feat(chaos): big update - optimize, fix bugs, add features, enhance UX (#6728)

* feat(chaos): add Chaos Mode — multi-model parallel/collaborative execution

- New DB column chaos_mode_enabled on api_keys table
- API key create/PATCH routes support chaosModeEnabled toggle
- Core library src/lib/chaos/chaosConfig.ts for persistent config
- API routes: GET/PUT/DELETE /api/chaos/config
- Chaos execution POST /api/skills/collect/chaos with key auth
- Dashboard page at /dashboard/chaos with full config UI
- Sidebar entry in Agentic Features section
- Chaos mode toggle in API Key editor permissions panel
- i18n keys for chaos config (en.json)

* feat(chaos): big update — optimize, fix bugs, add features

=== Changes ===

1. NEW: src/lib/chaos/chaosExecutor.ts — shared execution engine
   - Removed ~150 lines of duplicate dispatch logic between two API routes
   - Single executeChaosRun() function used by both endpoints
   - Added concurrency limit (max 10 parallel requests)
   - Added proper TypeScript interfaces (ChaosRunInput, ChaosRunResult)
   - Added error logging throughout

2. FIX: src/app/api/skills/collect/chaos/route.ts
   - Was MISSING logger import (log.error was undefined at runtime)
   - Reduced from 388 lines → 142 lines by delegating to shared executor
   - Added maxTokens support in schema validation

3. REFACTOR: src/app/api/chaos/run/route.ts
   - Simplified to thin wrapper: auth + validate + delegate to executor
   - Added maxTokens support

4. ENHANCE: src/lib/chaos/chaosConfig.ts
   - Added maxTokens config field (256-128k, default 4096)
   - Persisted per-instance via settings table

5. ENHANCE: UI — ChaosConfigPageClient.tsx
   - Loads available providers from /api/models for dropdown autocomplete
   - Added datalist-based provider selector in overrides section
   - Added Max Tokens configuration input
   - Added expandable provider list showing all detected providers
   - Fixed duplicate override detection

* fix(chaos): fetch providers from /api/providers instead of /api/keys

* fix(chaos): remove dead code isOverrideDuplicate, fix maxTokens fallback to include global config

* fix(chaos): resetConfig now shows error on HTTP failure (was silent)

* feat(dashboard): Chaos Mode — multi-model parallel/collaborative execution

Splits the PR down to only the genuinely new Chaos Mode feature (drops the
duplicate Skill Collector/GitHub-discovery portion already shipped via
#6186). Replaces the loopback fetch() dispatch (hardcoded to the wrong port)
with the established in-process synthetic-Request/route-handler pattern used
by src/lib/batches/dispatch.ts, moves settings persistence off raw SQL, and
adds unit test coverage for chaosConfig, chaosExecutor and the 3 chaos API
routes.

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

* fix(chaos): fix external Bearer-auth bypass and stale config cache in tests

validateApiKey() returns a plain boolean for both the deployment-time env key
and a DB-backed key, so branching on `keyInfo === true` in
verifyChaosKey() (src/app/api/skills/collect/chaos/route.ts) treated every
valid API key as having full env-key access, silently skipping the
chaosModeEnabled permission check entirely. Now always resolves through
getApiKeyMetadata() and only bypasses the per-key check for the synthesized
env-key record (id: "env-key").

Also exports invalidateChaosConfigCache() from chaosConfig.ts and wires it
into the route tests' resetStorage() — the in-process config cache was
surviving DB resets between tests, causing state to leak across cases.

Fixes CHANGELOG-eat from the release merge (re-inserted the Chaos Mode
bullet against the base CHANGELOG.md, verified additive via
check-changelog-integrity.mjs) and re-syncs against release/v3.8.47 tip.

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

* docs(changelog): Chaos Mode overhaul bullet referencing #6728 after release sync

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

* fix(merge): restore #6126 clinepass files reverted by release auto-resolve + baseline re-merge

The release sync's auto-resolve reverted sibling PR #6126's clinepass work
(registry, catalog, oauth constants, clineAuth.ts, token-refresh case, tests)
and the file-size baseline — all outside this PR's scope. Restored to the
release versions, re-applied only this PR's own baseline entries, restored the
#6126 CHANGELOG bullet (re-inserting only this PR's own).

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

* fix(dashboard): chaos client hook must not import the server Pino logger

useChaosConfigData ("use client") pulled @/sse/utils/logger → shared Pino →
logRotation/dataPaths → node:fs into the browser bundle, breaking next build
(Turbopack: Can't resolve 'fs') — caught by the DAST smoke's isolated build.
console.error matches every other dashboard client component.

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

* test(api-manager): align switch-count invariant with the extracted toggle components

The Self-service block now renders 4 inline switches; the #5731 quota-bypass
and #6728 chaos-access toggles were extracted into dedicated components. The
type="button" invariant is preserved AND extended: the test now also asserts
each extracted component's switches declare type="button".

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

* chore(sync): merge release tip + restore own CHANGELOG bullet

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

---------

Co-authored-by: Moseyuh333 <Moseyuh333@users.noreply.github.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>

src/app/api/chaos/config/route.ts

@@ -0,0 +1,84 @@
+/**
+ * GET /api/chaos/config — Get chaos mode configuration
+ * PUT /api/chaos/config — Update chaos mode configuration
+ * DELETE /api/chaos/config — Reset to defaults
+ *
+ * Chaos Mode global settings: which providers/models participate,
+ * default mode (parallel/collaborative), system prompt, timeout.
+ */
+
+import { NextResponse } from "next/server";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { buildErrorBody, sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
+import {
+  getChaosConfig,
+  setChaosConfig,
+  resetChaosConfig,
+  chaosConfigSchema,
+} from "@/lib/chaos/chaosConfig";
+import { validateBody, isValidationFailure } from "@/shared/validation/helpers";
+import * as log from "@/sse/utils/logger";
+
+export const dynamic = "force-dynamic";
+
+/**
+ * GET /api/chaos/config
+ * Returns the current chaos mode configuration.
+ */
+export async function GET(request: Request) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  try {
+    const config = await getChaosConfig();
+    return NextResponse.json({ config });
+  } catch (err) {
+    const msg = sanitizeErrorMessage(err);
+    log.error("chaos", "Error fetching chaos config", err);
+    return NextResponse.json(buildErrorBody(500, msg), { status: 500 });
+  }
+}
+
+/**
+ * PUT /api/chaos/config
+ * Update chaos mode configuration.
+ */
+export async function PUT(request: Request) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  try {
+    const rawBody = await request.json();
+    const validation = validateBody(chaosConfigSchema, rawBody);
+    if (isValidationFailure(validation)) {
+      return NextResponse.json(buildErrorBody(400, validation.error.message), {
+        status: 400,
+      });
+    }
+
+    const config = await setChaosConfig(validation.data);
+    return NextResponse.json({ config, message: "Chaos config updated" });
+  } catch (err) {
+    const msg = sanitizeErrorMessage(err);
+    log.error("chaos", "Error updating chaos config", err);
+    return NextResponse.json(buildErrorBody(500, msg), { status: 500 });
+  }
+}
+
+/**
+ * DELETE /api/chaos/config
+ * Reset chaos config to defaults.
+ */
+export async function DELETE(request: Request) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  try {
+    const config = await resetChaosConfig();
+    return NextResponse.json({ config, message: "Chaos config reset to defaults" });
+  } catch (err) {
+    const msg = sanitizeErrorMessage(err);
+    log.error("chaos", "Error resetting chaos config", err);
+    return NextResponse.json(buildErrorBody(500, msg), { status: 500 });
+  }
+}

src/app/api/chaos/run/route.ts

@@ -0,0 +1,73 @@
+/**
+ * POST /api/chaos/run — Unified Chaos Mode execution endpoint.
+ *
+ * Dashboard-friendly: uses the current management session (cookie) for auth.
+ * Delegates all execution logic to the shared chaosExecutor library.
+ *
+ * Body (JSON):
+ *   task: string          // REQUIRED — the task/goal
+ *   providers?: string[]  // Optional — filter specific providers
+ *   mode?: "parallel" | "collaborative"  // Optional — override global default
+ *   systemPrompt?: string // Optional — override global system prompt
+ *   maxTokens?: number    // Optional — override max_tokens per model call
+ *
+ * Returns the same shape as POST /api/skills/collect/chaos.
+ */
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { validateBody, isValidationFailure } from "@/shared/validation/helpers";
+import { buildErrorBody, sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
+import { getChaosConfig } from "@/lib/chaos/chaosConfig";
+import { executeChaosRun, type ChaosRunResult } from "@/lib/chaos/chaosExecutor";
+import * as log from "@/sse/utils/logger";
+
+export const dynamic = "force-dynamic";
+
+const runSchema = z.object({
+  task: z.string().min(1, "Task is required").max(100_000, "task too long"),
+  providers: z.array(z.string().min(1)).max(50).optional(),
+  mode: z.enum(["parallel", "collaborative"]).optional(),
+  systemPrompt: z.string().max(10_000).optional(),
+  maxTokens: z.number().int().min(256).max(128_000).optional(),
+});
+
+export async function POST(request: Request) {
+  // Require dashboard management auth (cookie-based)
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  try {
+    // Load global chaos config
+    const globalConfig = await getChaosConfig();
+    if (!globalConfig.enabled) {
+      return NextResponse.json(
+        buildErrorBody(400, "Chaos Mode is not enabled. Enable it in Dashboard → Chaos Mode."),
+        { status: 400 }
+      );
+    }
+
+    const rawBody = await request.json();
+    const validation = validateBody(runSchema, rawBody);
+    if (isValidationFailure(validation)) {
+      return NextResponse.json(buildErrorBody(400, validation.error.message), { status: 400 });
+    }
+
+    const { task, providers, mode, systemPrompt, maxTokens } = validation.data;
+
+    const result: ChaosRunResult = await executeChaosRun({
+      task,
+      providers,
+      mode,
+      systemPrompt,
+      timeoutMs: globalConfig.timeoutMs,
+      maxTokens: maxTokens || globalConfig.maxTokens,
+    });
+
+    return NextResponse.json(result);
+  } catch (err) {
+    const msg = sanitizeErrorMessage(err);
+    log.error("chaos", "Chaos run error", err);
+    return NextResponse.json(buildErrorBody(500, msg), { status: 500 });
+  }
+}

src/app/api/keys/[id]/route.ts

@@ -86,6 +86,7 @@ export async function PATCH(request, { params }) {
       usageLimitEnabled,
       dailyUsageLimitUsd,
       weeklyUsageLimitUsd,
+      chaosModeEnabled,
     } = validation.data;
 
     const payload: Parameters<typeof updateApiKeyPermissions>[1] = {};
@@ -112,6 +113,7 @@ export async function PATCH(request, { params }) {
     if (usageLimitEnabled !== undefined) payload.usageLimitEnabled = usageLimitEnabled;
     if (dailyUsageLimitUsd !== undefined) payload.dailyUsageLimitUsd = dailyUsageLimitUsd;
     if (weeklyUsageLimitUsd !== undefined) payload.weeklyUsageLimitUsd = weeklyUsageLimitUsd;
+    if (chaosModeEnabled !== undefined) payload.chaosModeEnabled = chaosModeEnabled;
 
     const updated = await updateApiKeyPermissions(id, payload);
     if (!updated) {
@@ -145,6 +147,7 @@ export async function PATCH(request, { params }) {
       ...(usageLimitEnabled !== undefined && { usageLimitEnabled }),
       ...(dailyUsageLimitUsd !== undefined && { dailyUsageLimitUsd }),
       ...(weeklyUsageLimitUsd !== undefined && { weeklyUsageLimitUsd }),
+      ...(chaosModeEnabled !== undefined && { chaosModeEnabled }),
     });
   } catch (error) {
     log.error("keys", "Error updating key permissions", error);

src/app/api/keys/route.ts

@@ -71,6 +71,7 @@ export async function POST(request) {
       usageLimitEnabled,
       dailyUsageLimitUsd,
       weeklyUsageLimitUsd,
+      chaosModeEnabled,
     } = validation.data;
 
     // Always get machineId from server
@@ -82,7 +83,8 @@ export async function POST(request) {
       allowUsageCommand === true ||
       usageLimitEnabled === true ||
       dailyUsageLimitUsd !== undefined ||
-      weeklyUsageLimitUsd !== undefined
+      weeklyUsageLimitUsd !== undefined ||
+      chaosModeEnabled === true
     ) {
       await updateApiKeyPermissions(apiKey.id, {
         ...(noLog === true && { noLog: true }),
@@ -90,6 +92,7 @@ export async function POST(request) {
         ...(usageLimitEnabled === true && { usageLimitEnabled: true }),
         ...(dailyUsageLimitUsd !== undefined && { dailyUsageLimitUsd }),
         ...(weeklyUsageLimitUsd !== undefined && { weeklyUsageLimitUsd }),
+        ...(chaosModeEnabled === true && { chaosModeEnabled: true }),
       });
     }
 
@@ -114,6 +117,7 @@ export async function POST(request) {
         usageLimitEnabled: usageLimitEnabled === true,
         dailyUsageLimitUsd: dailyUsageLimitUsd ?? null,
         weeklyUsageLimitUsd: weeklyUsageLimitUsd ?? null,
+        chaosModeEnabled: chaosModeEnabled === true,
         streamDefaultMode: "legacy",
       },
       { status: 201 }

src/app/api/skills/collect/chaos/route.ts

@@ -0,0 +1,147 @@
+/**
+ * POST /api/skills/collect/chaos
+ *
+ * Chaos Mode — spawn multiple models across providers for parallel or collaborative
+ * task execution. Each active provider contributes one model instance; all models
+ * work on the same task simultaneously (parallel) or in a chain where each sees
+ * the previous model's output (collaborative).
+ *
+ * External API: uses Bearer token auth (API key with chaos_mode_enabled).
+ *
+ * Body (JSON):
+ *   task: string                   // REQUIRED — the task/goal for all models
+ *   providers?: string[]           // Optional filter — only these provider IDs
+ *   mode?: "parallel" | "collaborative"  // Default: from global config
+ *   systemPrompt?: string          // Optional custom system prompt override
+ *   maxTokens?: number             // Optional — max_tokens per model call
+ *
+ * Returns:
+ *   {
+ *     task, mode, startedAt,
+ *     totalProviders, totalResults,
+ *     models: [{ providerId, providerName, modelId, status, content, error?, durationMs }],
+ *     summary?: string
+ *   }
+ */
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { validateBody, isValidationFailure } from "@/shared/validation/helpers";
+import { buildErrorBody, sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
+import { validateApiKey, getApiKeyMetadata } from "@/lib/localDb";
+import { getChaosConfig } from "@/lib/chaos/chaosConfig";
+import { executeChaosRun, type ChaosRunResult } from "@/lib/chaos/chaosExecutor";
+import * as log from "@/sse/utils/logger";
+
+export const dynamic = "force-dynamic";
+
+// ── Schema ───────────────────────────────────────────────────────────────────
+
+const chaosSchema = z.object({
+  task: z.string().min(1, "task is required").max(100_000, "task too long"),
+  providers: z.array(z.string().min(1)).max(50).optional(),
+  mode: z.enum(["parallel", "collaborative"]).optional(),
+  systemPrompt: z.string().max(10_000).optional(),
+  maxTokens: z.number().int().min(256).max(128_000).optional(),
+});
+
+// ── Auth helpers ─────────────────────────────────────────────────────────────
+
+/**
+ * Extract Bearer token from Authorization header.
+ */
+function extractBearerToken(request: Request): string | null {
+  const auth = request.headers.get("Authorization");
+  if (!auth || !auth.startsWith("Bearer ")) return null;
+  return auth.slice(7).trim();
+}
+
+/**
+ * Verify API key has chaos mode enabled.
+ * validateApiKey returns a plain boolean for BOTH the deployment-time env key and a
+ * DB-backed key (see src/lib/db/apiKeys.ts::validateApiKey) — it never returns the
+ * key record, so the env-key/DB-key distinction has to be made via getApiKeyMetadata,
+ * whose synthesized env-key record is tagged `id: "env-key"` (src/lib/db/apiKeys.ts::
+ * getApiKeyMetadata) and always carries "manage" scope.
+ */
+async function verifyChaosKey(bearerToken: string): Promise<{ ok: boolean; error?: string }> {
+  const isValid = await validateApiKey(bearerToken);
+  if (!isValid) {
+    return { ok: false, error: "Invalid API key" };
+  }
+
+  const metadata = await getApiKeyMetadata(bearerToken);
+  if (!metadata) {
+    return { ok: false, error: "Invalid API key" };
+  }
+
+  // Env key has full access (see getApiKeyMetadata's synthesized "env-key" record).
+  if (metadata.id === "env-key") {
+    return { ok: true };
+  }
+
+  if (!metadata.chaosModeEnabled) {
+    return {
+      ok: false,
+      error: "Chaos Mode is not enabled for this API key. Enable it in API Key settings.",
+    };
+  }
+
+  return { ok: true };
+}
+
+// ── Main handler ─────────────────────────────────────────────────────────────
+
+export async function POST(request: Request) {
+  try {
+    // ── API Key auth check ─────────────────────────────────────────────
+    const bearerToken = extractBearerToken(request);
+    if (!bearerToken) {
+      return NextResponse.json(
+        buildErrorBody(401, "Missing or invalid Authorization header — Bearer token required"),
+        { status: 401 }
+      );
+    }
+
+    const auth = await verifyChaosKey(bearerToken);
+    if (!auth.ok) {
+      return NextResponse.json(buildErrorBody(403, auth.error!), { status: 403 });
+    }
+
+    // ── Parse request body ─────────────────────────────────────────────
+    const rawBody = await request.json();
+    const validation = validateBody(chaosSchema, rawBody);
+    if (isValidationFailure(validation)) {
+      return NextResponse.json(buildErrorBody(400, validation.error.message), {
+        status: 400,
+      });
+    }
+
+    const { task, providers, mode, systemPrompt, maxTokens } = validation.data;
+
+    // ── Load global chaos config ───────────────────────────────────────
+    const globalConfig = await getChaosConfig();
+    if (!globalConfig.enabled) {
+      return NextResponse.json(
+        buildErrorBody(400, "Chaos Mode is not enabled globally. Enable it in Dashboard → Chaos Mode."),
+        { status: 400 }
+      );
+    }
+
+    // ── Execute via the shared executor ────────────────────────────────
+    const result: ChaosRunResult = await executeChaosRun({
+      task,
+      providers,
+      mode,
+      systemPrompt,
+      timeoutMs: globalConfig.timeoutMs,
+      maxTokens: maxTokens || globalConfig.maxTokens,
+      apiKey: bearerToken,
+    });
+
+    return NextResponse.json(result);
+  } catch (err) {
+    const msg = sanitizeErrorMessage(err);
+    log.error("chaos", "Chaos external API error", err);
+    return NextResponse.json(buildErrorBody(500, msg), { status: 500 });
+  }
+}