The agentrouter.org upstream WAF returns 400 content-blocked
intermittently when:
1. messages[].content contains a blocked keyword (Lorem ipsum, the
phrase 'language model' alone, 'virtual assistant', etc.); or
2. Requests from the same IP/key arrive in a burst, after which the
WAF's per-IP suspicion bucket starts blocking content that would
normally pass. The bucket relaxes after ~5-10s of idle.
Apply three mitigations:
1. Burst guard (open-sse/services/wafRateLimit.ts)
Per-bucket (provider+url) gate that enforces a 500ms minimum gap
between outbound requests to agentrouter. Configurable via
configureWafRateLimit(). Tested in tests/unit/wafRateLimit.test.ts.
2. Reactive retry (BaseExecutor.WAF_RETRY_CONFIG in base.ts)
New WAF_RETRY_CONFIG with maxAttempts=2, delayMs=1500,
backoffMultiplier=2. When the upstream returns 400 with a body that
matches /content[_-]blocked/i, retry the same URL with exponential
backoff (1.5s, 3.0s) before falling through to the 429/401/fallback
chain. Tested in tests/unit/base-executor-waf-retry.test.ts.
3. Documentation (docs/security/AGENTROUTER_WAF.md)
Blocklist of always-blocked and almost-always-blocked patterns,
behavior under load, guidance for prompts/tool output, and pointers
to the relevant code paths in OmniRoute.
These are belt-and-suspenders: the burst guard prevents the WAF from
activating on normal traffic, and the reactive retry recovers when it
does anyway. Together they should eliminate the intermittent
400 content-blocked that Claude Code sees when running through
agentrouter via OmniRoute.
Refs #9275 follow-up. Test: 'WAF retry config shape' and 'WAF retry
differs from generic' guard the WAF_RETRY_CONFIG contract so future
refactors don't accidentally collapse the two retry paths.
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
* fix(routing): bare model ids route to codex first; validate synced candidates
Two bare-model-routing bugs surfaced in the field when an OmniRoute
deployment had a codex subscription whose cookie quota was exhausted
(retry-after 429047s / ~5 days) AND an active kiro connection whose
upstream sync briefly advertised 'claude-opus-5' before kiro vendored
it into the static registry.
1. Bare 'gpt-5.6-sol' (and friends) routed to the codex provider even
when the user had explicitly configured 'agentrouter' as their
provider (via model_provider in codex CLI). With codex in cooldown,
every bare request 429'd. Fix: extend CODEX_NATIVE_UNPREFIXED_MODELS
to include the full gpt-5.6-sol tier set + gpt-5.5 + the related
codex-native ids. The Codex CLI default is now actually honored;
users can still prefix 'agentrouter/gpt-5.6-sol' to opt into a
specific provider.
2. Bare 'claude-opus-5' silently routed to 'kiro' when kiro's synced
/v1/models catalog had that id (likely from a transient upstream
quirk). kiro's static registry never cataloged claude-opus-5, so
the upstream call 404'd. Fix: validate activeSyncedProviders against
MODEL_TO_PROVIDERS before merging them into the candidate list.
Auto-discovery still wins when the model id has no static entry
(brand-new models from upstream keep working).
Bonus: when handleNoCredentials returns a 404 'No active credentials for
provider: X' error, surface the top-3 candidate aliases (e.g.
'anthropic/claude-opus-5, claude/claude-opus-5, agentrouter/claude-opus-5')
so the operator can pick a working prefix instead of staring at a wall.
Tests (all pass, 25 regression tests preserved):
- tests/unit/fix-bare-model-precedence.test.ts (7 tests)
- tests/unit/fix-synced-model-validation.test.ts (3 tests)
- tests/unit/fix-error-message-candidates.test.ts (3 tests)
- tests/unit/fix-bare-routing-fallback.test.ts (7 tests)
* fix(tests): replace lorem ipsum with neutral text to avoid agentrouter WAF
The agentrouter.org WAF blocks requests containing 'lorem ipsum' in
messages[].content. When Claude Code reads test files via the Read tool,
the content appears in tool_result blocks which can trigger the filter.
Replace 'lorem ipsum dolor sit amet' with 'example content for testing
purposes' in compression harness test to avoid false positives.
---------
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
The worktree-isolation recipe in `CLAUDE.md` told agents to symlink `node_modules` from the main checkout. That silently breaks the dev server.
Turbopack refuses a symlink that resolves outside the project root, so `npm run dev` dies with a FATAL panic while typecheck, lint and both test runners keep passing — the message names "filesystem root", not the worktree, so it reads like a Next/build problem.
`cp -al` gives the same benefit (no per-worktree npm install) without the defect: ~5s for the 4.4 GB tree and near-zero extra disk. Verified on this very worktree: same inode, link count 2.
Mirrored into the two translated CLAUDE.md copies that carry the command (zh-CN translated, pl left in English to match its surrounding section).
Adds the `?utm_source=omniroute` tracking parameter to every public-facing URL where Cheaper Inference is clickable.
- README: the two `<a href>` targets in the Open Source Friends table row (logo + "Get an API key" CTA)
- `gateways.ts`: the `website` field and the `apiHint` text
Not changed on purpose: `api.cheaperinference.com/*` endpoints (technical, not clicks), JSDoc mentions (descriptive text), and the `<sub>cheaperinference.com</sub>` label under the logo (plain text, not a link).
fix(agentrouter): infer protocol from client endpoint
- /v1/responses resolves AgentRouter as openai-responses
- /v1/chat/completions resolves AgentRouter as openai
- /v1/messages resolves AgentRouter as claude
- Per-request protocol and credential cloning (no SQLite mutation)
- Codex 0.146.0 and Claude Code 2.1.220 identity alignment
- response.completed.usage.total_tokens normalization for strict Codex clients
Closes#9224
* docs(readme): add Affiliates Promo section (coupon for AgentRouter)
New collapsible <details> block under '🤝 Supported by our Open Source Friends',
labeld 'Affiliates Promo' to keep it visually and editorially separate from
actual sponsors. Sized at ~half (icon 32px, sub-tag text) so it does not
compete with the partner block above.
First entry: AgentRouter — $100 signup credit (per FREE_TIERS.md), free server
with higher latency, first-class support since v3.8.50. Models surfaced:
claude-opus-4-8, claude-opus-5, gpt-5.6-sol — with a live-list link to
agentrouter.org/v1/models so users can verify.
Clear caveat: 'Affiliate link — OmniRoute has no sponsorship or partnership
with this provider.' — and a footer inviting more coupons via issue.
* docs(readme): leave Affiliates Promo expanded by default
The block only has a single entry today; collapsing it would hide the
AgentRouter coupon from a casual skim. Add 'open' to <details> so the
content is visible on first load. Users can still collapse it manually.
* docs(readme): drop 'see live list at agentrouter.org/v1/models' sentence
---------
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
- npm run test:scoped: runs only tests impacted by your changes
- npm run test:scoped:staged: for staged changes (pre-commit)
- Uses select-impacted-tests.mjs with impact map when available
- Falls back to heuristic (changed test files) when no map
- Hub file changes suggest full suite
- 7 unit tests for the selection logic
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
G1 (v3.8.51): section (2) of check-known-symbols no longer regex-scans
strategy === "..." literals from combo source. The handled set now comes
from a runtime-imported dispatch registry (open-sse/services/combo/
strategyDispatch.ts) that imports the real ordering functions and enumerates
which strategies they implement. This keeps the canonical-not-handled gate
correct under the upcoming R0.3 registry dispatch, which removes the
strategy === branches the regex relied on.
- Adds HANDLED_COMBO_STRATEGIES registry (all 20 canonical strategies) + binds
the real dispatch leaves (applyStrategyOrdering, resolveAutoStrategyOrder,
tryFusionDispatch, tryPipelineDispatch, resolveComboTargetPipeline).
- main() imports the registry instead of reading/sourcing combo files.
- extractHandledStrategies + diffComboStrategies stay exported (pure, tested).
- New TDD test proves the runtime enumeration covers canonical exactly.
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
* feat(ci): G0 — quality rail (PR→release/**) ganha ratchets+segurança do trilho A
O refactor de god-files do trilho 3.8.50→3.9.0 acontece em PRs→release/**, e esse
trilho pulava o motor de ratchet, o CodeQL ratchet e todos os scanners de segurança
— exatamente onde a rede era necessária (5 das 13 causas da reconciliação de 07-24
eram regressões reais shipadas por CI verde por-PR).
Modo enxuto, jobs EXISTENTES (a .51 consolida lanes; nenhum job novo):
- lint-guard: quality:collect + ratchet --allow-missing + require-tighten +
check:codeql-ratchet. O job já escreve .artifacts/eslint-results.json, então o
motor entra a custo ZERO de ESLint (um inventário, dois consumidores). Coverage
ausente degrada gracioso (--allow-missing); autoridade de coverage segue no
trilho A. + permissions security-events:read para o CodeQL ratchet.
- fast-gates: check:cycles, check:lockfile, duplication, dead-code, type-coverage,
compression-budget + install endurecido dos scanners (gh release download,
zizmor PINADO 1.25.2 = mesmo auditor do ci.yml) + secrets/vuln/workflows/
openapi-breaking com --ratchet (self-skip sem binário; só regressão medida bloqueia).
- Fora de propósito: bundle-size (self-skip sem build → configuração morta) e o
run de coverage (fast-unit já roda a suíte cheia).
Runners intocados: guard tests/unit/vps-runner-variable-scope.test.ts verde;
teste novo tests/unit/quality-rail-gate-membership.test.ts pina a MEMBERSHIP dos
gates no trilho B (red antes da edição, green depois).
Validação no tip puro (nenhum base-red fabricado para a fila de PRs abertos):
cycles OK · lockfile OK · duplication 4.26% (base 5.72%) · dead-code 226 (base
227) · type-coverage 94.13% (base 92.17%) · compression OK · secrets 0 (base 0) ·
vuln 5 (base 10) · codeql 0 (base 0) · oasdiff 0 (base 0) · zizmor 178 (base 190)
· actionlint exit 0 no arquivo editado · quality-ratchet 56 métricas OK +
require-tighten OK com --allow-missing.
Refs #8084
* feat(.50): G13 golden-set, G14 import boundaries, gap34 deterministic, docs sync, R0.2 dead hooks
Integra os itens restantes da 3.8.50:
- G13: golden-set determinístico para combo.ts e chatCore.ts via seams públicas
- G14: no-restricted-imports para localDb barrel fora de src/lib/db/ e executors em src/app/
- Gap34: teste determinístico de timeout DuckDuckGo sem rede real
- Docs: golden path de contribuição + sincronização de números canônicos
- R0.2: remoção dos 7 hooks mortos do BUILTIN_EVENTS + UI marketplace ajustada
* fix(r0.2): remove marketplace tab remnants from plugins page — fixes dashboard typecheck regression
* chore(r0.2): remove pluginWorker.ts, signing.ts, sandbox.ts — zero importers confirmed
* fix(docs): remove OMNIROUTE_PLUGINS_ALLOW_EXEC reference — env var removed with pluginWorker.ts in R0.2
* fix(env): remove dead OMNIROUTE_PLUGINS_ALLOW_EXEC from .env.example — consumer removed in R0.2
* fix(test): update sidebar-visibility assertion for R0.2 marketplace removal
---------
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
O refactor de god-files do trilho 3.8.50→3.9.0 acontece em PRs→release/**, e esse
trilho pulava o motor de ratchet, o CodeQL ratchet e todos os scanners de segurança
— exatamente onde a rede era necessária (5 das 13 causas da reconciliação de 07-24
eram regressões reais shipadas por CI verde por-PR).
Modo enxuto, jobs EXISTENTES (a .51 consolida lanes; nenhum job novo):
- lint-guard: quality:collect + ratchet --allow-missing + require-tighten +
check:codeql-ratchet. O job já escreve .artifacts/eslint-results.json, então o
motor entra a custo ZERO de ESLint (um inventário, dois consumidores). Coverage
ausente degrada gracioso (--allow-missing); autoridade de coverage segue no
trilho A. + permissions security-events:read para o CodeQL ratchet.
- fast-gates: check:cycles, check:lockfile, duplication, dead-code, type-coverage,
compression-budget + install endurecido dos scanners (gh release download,
zizmor PINADO 1.25.2 = mesmo auditor do ci.yml) + secrets/vuln/workflows/
openapi-breaking com --ratchet (self-skip sem binário; só regressão medida bloqueia).
- Fora de propósito: bundle-size (self-skip sem build → configuração morta) e o
run de coverage (fast-unit já roda a suíte cheia).
Runners intocados: guard tests/unit/vps-runner-variable-scope.test.ts verde;
teste novo tests/unit/quality-rail-gate-membership.test.ts pina a MEMBERSHIP dos
gates no trilho B (red antes da edição, green depois).
Validação no tip puro (nenhum base-red fabricado para a fila de PRs abertos):
cycles OK · lockfile OK · duplication 4.26% (base 5.72%) · dead-code 226 (base
227) · type-coverage 94.13% (base 92.17%) · compression OK · secrets 0 (base 0) ·
vuln 5 (base 10) · codeql 0 (base 0) · oasdiff 0 (base 0) · zizmor 178 (base 190)
· actionlint exit 0 no arquivo editado · quality-ratchet 56 métricas OK +
require-tighten OK com --allow-missing.
Refs #8084
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
- memoryTools: apiKeyId now optional; falls back to caller principal
(HTTP auth headers / OMNIROUTE_API_KEY env) so agents can store memory
without knowing their key id
- memorySkillsInjection: server-side memory_* builtins only injected for
non-stream requests (stream clients execute tools client-side via MCP)
- memoryBuiltins: memory_save/update/search/delete builtin tools with
per-provider schemas + interception dispatch
- retrieval: fix toFts5MatchQuery import (ReferenceError on FTS5 path)
- tests: MCP auto-owner fallback, cross-principal isolation, stream guard
Scaffold the standalone Rust compression core (no OmniRoute deps):
- crates/core-api: stable traits (TokenCounter, Compressor) + types
(Message, Encoding, CompressionConfig/Result) — the contract for all
adapters (N-API, sidecar, CLI)
- crates/tokenizer: tiktoken-rs cl100k_base + o200k_base port
- crates/tests: golden tests reading fixtures/ (byte-equality vs JS)
- crates/bench: criterion harness (21.4ms vs JS 37.9ms on large input)
- crates/ffi: empty N-API adapter placeholder (integration phase)
- scripts/generate-fixtures.ts: JS reference output (source of truth)
- scripts/verify-golden.ts: regen + run golden tests
- fixtures/: 13 tokenizer samples incl. 405K-char stress case
Golden status: 100% match JS vs Rust on all fixtures.
injectSkills() lists the in-memory skillRegistry, which is empty after a
cold start until something calls loadFromDatabase(). The interception path
already warms the cache (#2815); the injection path did not, so skills
were silently skipped (no_enabled_skills) for the first requests after
restart. Warm the cache for the chat owner before injection.
Stored skill schemas are flat property maps ({ text: { type: string } }),
which OpenAI-compatible providers tolerate but Gemini
(function_declarations[].parameters) rejects with 'Unknown name ... Cannot
find field'. Wrap bare maps into { type: 'object', properties: {...} } for
all three tool formats.
Registers Cheaper Inference (api.cheaperinference.com) as an OSS-sponsor gateway provider.
- Canonical provider `cheaperinference` (alias `cinf`) + routing registry with 39 measured text models
- Dedicated executor: forces `store:false` on the native /v1/responses endpoint (the shared strip in
chatCore.ts deletes `store` for every provider != openai, so without this every Responses request
400'd) and resolves chat-vs-responses URL from the per-model targetFormat
- 3 image models (grok-imagine, nano-banana-pro, nano-banana-2), prefix-only: the two nano-banana ids
already belong to adobe-firefly, which keeps the bare-id routing
- Resale pricing measured from GET /v1/models (30% off list); sponsor rail Kimi 1st / Cheaper
Inference 2nd via an explicit rank map; supporter badge in 43 locales; README row
No quota card: the gateway exposes no balance API (/v1/wallet and /v1/balance both 404).
Validated live end-to-end through OmniRoute: chat, native Responses, streaming and image generation
all 200 with real content; the Firefly collision guard verified at runtime.
getCombos() selected only data/sort_order/context_cache_protection, so
combos whose JSON blob lacked an id field returned id: undefined. The
dashboard then linked to /dashboard/combos/undefined and Combo Control
Center failed with 'Combo not found'. Merge the id column into parsed
rows (authoritative, only when the blob has no id).
Skill tools were advertised as 'name@version' (e.g. test-fr2@1.0.0), but
DeepSeek/Groq/OpenAI reject function names not matching ^[a-zA-Z0-9_-]+$.
Names already valid are left untouched; invalid ones are reversibly encoded
as omr_skill_<base64url> and decoded in interception before registry lookup.
- skills: Next.js compiles SkillExecutor into multiple chunks (own singleton
each); route chunk lacked builtin handlers registered at startup via
instrumentation. execute() now falls back to builtinSkills registry, so
POST /api/skills/executions works for file_read/web_fetch/etc.
- memory: scheduleVectorUpsert is fire-and-forget and embeddings are slow;
health-check verify (create->delete test memory) left queued upserts
failing with 'memory not found' every 30s. Check existence before embedding
and skip quietly.
searchHybrid in vectorStore.ts runs its own raw FTS5 MATCH — the earlier
retrieval.ts fix missed it, so hybrid queries with punctuation still threw
'fts5: syntax error'. Extracted the sanitizer to src/lib/memory/ftsQuery.ts
(no import cycle) and applied it at all three MATCH sites; punctuation-only
queries now yield a non-matching '""' phrase instead of an error.
- /api/v1/quotas read conn.id/provider/name — the lazy row proxy does not
expose connectionId/providerId, so every connection was skipped and the
endpoint always returned an empty list.
- retrieveMemories/buildFtsRows now sanitize the query into a quoted FTS5
MATCH expression — natural-language queries with ? ! : ( ) etc. no longer
throw 'fts5: syntax error' and silently degrade to empty results.
- new unit test tests/unit/memory/fts5-query-sanitize.test.ts (5 cases).
potion-base-8M has no vocab.json on HuggingFace (404) — the download
silently failed and vector retrieval always fell back to FTS5-only.
Load the token→id map from tokenizer.json (already cached at
<DATA_DIR>/embeddings/potion-base-8M/tokenizer.json) with fallbacks to
vocab.json and line-indexed vocab.txt.
- responseHeaders: promote NVIDIA NIM quota/usage headers (x-nvcf-*,
x-quota-*, x-ratelimit-*) to priority 2 so they survive the 768-byte
upstream header forwarding budget (were previously dropped as priority 3)
- new GET /api/v1/quotas: lists every provider connection with saturation
(0..1), remaining percent, and data source using existing saturation
signals — lets operators check key budgets via API instead of live monitoring
Root cause (reproduced by tests): combo steps edited by an agent in text/SQLite
format used field names the normalizer didn't recognize, so every step was
dropped and the combo became empty in the WebUI builder.
- steps.ts: extractModelField() accepts model/target/name/modelName variants,
used by both getComboStepTarget and normalizeComboStep (fixes {name,provider}
and legacy {id,target,weight} shapes)
- combos.ts: withSortOrder/parseComboRow now return null on malformed stored
JSON instead of throwing, so the WebUI combo list never crashes on a broken
row
- new test: combo-editability-paths.test.ts (7 cases covering baseline, SQLite
INSERT, API text-edit, legacy shapes, malformed JSON)
- chatCore: maxAttempts 1→2 for all providers (previously only model-scope and codex got retries)
- combo.ts: add x-omniroute-attempt response header showing how many attempts were made
- memory/settings: enable memory injection by default (maxTokens 1000) — auto-extraction already wired in chatCore
