mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-17 20:32:25 +03:00
fix/release-electron-dispatch-builds-github-ref
346 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Diego Rodrigues de Sa e Souza
|
5f3b1e8cde |
fix(db): dedup duplicate API keys per provider on connection create (#3023) (#3100)
createProviderConnection deduped apikey connections only by (provider, name). Adding the same key under a different/blank name created a duplicate row. It now also matches by the decrypted key value (AES-GCM ciphertext is non-deterministic, so we decrypt+compare plaintext, trimmed) and updates the existing connection instead. Tests cover same-key dedup, whitespace-variant dedup, and distinct-key separation. |
||
|
diegosouzapw
|
51d2ca8151 |
feat(db): add apiKeyContextSources module + migration 092
Implements per-API-key context source configuration table and CRUD functions required by the Obsidian PR. Restores getApiKeyContextSource in obsidian.ts (was stubbed to null during conflict resolution). 11/11 tests pass in obsidian-config.test.ts. |
||
|
Brandon Bennett
|
9db306e2f8 |
feat(observability): add Obsidian context source with 24 MCP tools (#3077)
Integrated into release/v3.8.9. Fixes applied: removed .serena/ from repo (gitignored), resolved import conflicts preserving agentSkillTools, fixed TS errors. |
||
|
Diego Rodrigues de Sa e Souza
|
20c31493af |
feat(plugins): plugins framework + per-API-key disable-non-public-models (#3041)
Integrates two community contributions into release/v3.8.8 with security hardening and conflict resolution. - **Plugins framework** (#2913 — thanks @oyi77): hooks + registry unification, plugin SDK (`definePlugin`), worker-thread sandbox, per-plugin hook rate limiting, SHA-256 integrity verification, semver-gated upgrade, and execution analytics. Plugin routes are loopback-only (`isLocalOnlyPath`); `child_process` exec is opt-in via `OMNIROUTE_PLUGINS_ALLOW_EXEC` (default off). - **API key option: disable non-published models** (#3017 — thanks @androw): a per-key flag restricting the key to discovered public models (combos / `auto/*` / `qtSd/*` routing still allowed). Hardening applied during integration: migration renumber (089/090/091), `/api/plugins` LOCAL_ONLY route-guard classification (closes the plugin-RCE vector), atomic install/upgrade with path containment, `O_EXCL` tmp-file creation (TOCTOU), rate-limit-map eviction, `validatePluginConfig` on configure, `buildErrorBody` on all plugin error paths. 246/246 tests; typecheck / cycles / docs-sync clean. Co-authored-by: oyi77 <14921983+oyi77@users.noreply.github.com> Co-authored-by: Nicolas Lorin <androw95220@gmail.com> |
||
|
Hernan Javier Ardila Sanchez
|
482e4690eb |
fix(dashboard): use lightweight ping endpoint for MaintenanceBanner (fixes #3040) (#3043)
Integrated into release/v3.8.8. Applied review fixes: moved the SELECT 1 into a pingDb() db helper (no raw SQL in route, Hard Rule #5) + the 503 catch no longer leaks err.message (Hard Rule #12). Thanks @herjarsa! |
||
|
diegosouzapw
|
58a7d97b3f |
Merge branch 'release/v3.8.8' into feat/quota-share-redesign
# Conflicts: # src/lib/db/apiKeys.ts # src/lib/db/migrationRunner.ts # src/server/authz/policies/management.ts # src/server/authz/routeGuard.ts # tests/unit/route-guard-private-lan.test.ts |
||
|
diegosouzapw
|
eac24ca458 |
feat(quota): group-level allocations + group access enforcement
upsertAllocations now propagates allocation rows to every pool in the same group. A key allocated to pool A in group G automatically gets an allocation row in pool B (same group), so enforceQuotaShare finds the row when the key calls pool B's model and applies fair-share. No change to apiKeyPolicy Check 3 (already group-correct via B5 groupSlug logic) or enforce.ts pool-match (works once propagation supplies the row). |
||
|
diegosouzapw
|
e9cc53b17f |
feat(quota): key scope + /v1/models expand to the whole group (real group)
- `getPoolsByGroup(groupId)` in quotaPools.ts: SELECT all pools for a group,
exposed as public API and re-exported from localDb.ts.
- `resolveQuotaKeyScope`: pool → group → all pools in group expansion.
The returned `poolSlugs` field now holds GROUP slugs (quotaGroupSlug of the
group name) instead of individual pool-name slugs, one per distinct group.
Group slug included only when the group has ≥1 valid connection (group-level
anyValidConnection gate). Deduplication: a key in 2 pools of the same group
expands once.
- `filterModelsToQuotaPools` (quotaCombos.ts): already matches by
`parsed.groupSlug` ∈ poolSlugs — no logic change needed, just test alignment.
- quota-key-resolve.test.ts: updated 4 tests that asserted pool-name slugs
(testpoola2, poolmix, etc.) to assert the group slug ("groupdemo") — this is
alignment to the B5 group semantics, not masking; the assertions were correct
for the old pool-slug behavior and are now correct for the new group-slug
behavior.
- quota-catalog-filter.test.ts: updated fixtures from old quotaShared-* format
to qtSd/<groupSlug>/... (naming changed in B3, test was already broken before B5).
|
||
|
diegosouzapw
|
1eff658678 |
feat(quota): quotaGroups DB module (CRUD)
Add src/lib/db/quotaGroups.ts with createGroup/getGroup/getGroupName/ listGroups/renameGroup/deleteGroup; deleteGroup guards against non-empty groups (throws /pools/i) and protects the 'group-demo' seed. Re-export all functions + QuotaGroup type from localDb.ts. 15 unit tests in tests/unit/quota-groups-crud.test.ts all passing. |
||
|
diegosouzapw
|
727616b2c0 |
feat(quota): quota_groups table + pools.group_id (migration 087)
Introduces first-class quota Group entity: new quota_groups table, quota_pools.group_id column, GroupDemo seed, backfill of existing pools, and groupId in QuotaPool/PoolCreate/PoolUpdate with a group-demo default. Migration runner gains an isSchemaAlreadyApplied guard for version 087. |
||
|
diegosouzapw
|
abb77879db |
feat(quota): QuotaStore.poolConsumedTotal — pool aggregate per dimension
Add poolConsumedTotal(poolId, dim) to the QuotaStore interface and implement it in both SqliteQuotaStore and RedisQuotaStore so the enforce path can read the real pool-wide consumption (sum across all keys) rather than the per-key saturation signal, which is 0 for countable units and therefore never blocks. - db/quotaConsumption.ts: add sumPoolDimension() — single SQL COALESCE(SUM) for curr and prev buckets across all api_key_id rows for a dimensionKey. - localDb.ts: re-export sumPoolDimension. - quota/types.ts: add poolConsumedTotal to QuotaStore interface (with JSDoc). - sqliteQuotaStore.ts: implement using sumPoolDimension + existing slidingWindowEffective helper — one consistent sliding-window read. - redisQuotaStore.ts: implement by fetching pool allocations from SQLite (F2), then issuing a single MGET for all (key, curr-bucket) and (key, prev-bucket) Redis keys, summing raw values, and applying the sliding-window formula once. - tests/unit/quota-store-pool-total.test.ts: 4 tests (sum, pool isolation, unit isolation, peek-no-regression) all passing. |
||
|
diegosouzapw
|
cb45d9dfe9 |
fix(quota): prune deleted pool id from api_keys.allowed_quotas
deletePool now runs a SQLite json_each UPDATE inside the existing transaction to remove the pool's id from every api_key's allowed_quotas JSON array, preventing stale pool references after deletion. Tests: tests/unit/quota-pool-delete-prune.test.ts (7 scenarios). |
||
|
diegosouzapw
|
8c11acaa33 | feat(quota): per-pool usage-log endpoint + card | ||
|
diegosouzapw
|
d4045e74b5 |
fix(models): honor per-model targetFormat for custom models (#2905)
Custom models (added via the UI) on opencode-go / openai-compatible nodes always routed as OpenAI-compatible because there was no per-model targetFormat: addCustomModel didn't accept it, the API schema stripped it, and getModelTargetFormat (static-registry only) never saw it — so a custom model needing the Anthropic Messages shape fell back to the provider default 'openai'. Thread an optional targetFormat through addCustomModel / replaceCustomModels / updateCustomModel + the providerModelMutationSchema + the POST/PUT route, surface it from getModelInfo (one combined custom-model metadata lookup alongside apiFormat), and use it in chatCore's targetFormat resolution before the provider default. Closes #2905 |
||
|
diegosouzapw
|
2521c09119 |
feat(quota): one provider per pool (block mixed-type) — server guard + wizard filter
- Add assertSingleProvider() helper in quotaPools.ts: queries provider_connections with DISTINCT provider WHERE id IN (...), throws if >1 provider detected. - Call guard early in createPool (when connectionIds.length > 1) and updatePool (when input.connectionIds.length > 1), before any DB writes. - Add lockedProvider useMemo in PoolWizard.tsx: derived from first selected connection; availableConnections filtered to same provider once locked. - Show wizardSingleProviderNote i18n hint in step 1 when lockedProvider is set. - Add wizardSingleProviderNote to en.json + pt-BR.json (parity). - New test: tests/unit/quota-pool-single-provider.test.ts (4 cases). - Update tests/unit/quota-multiprovider.test.ts: all D2 tests now use two same-provider connections (both PROVIDER_A/openrouter) — the tests were exercising connection-plumbing (scope, enforce membership, combo fan-out), not mixed-provider behavior per se; updated to remain valid under Task 3 rule. |
||
|
diegosouzapw
|
d5b163558d |
fix(db): resolve 077 migration version collision blocking getDbInstance
077_api_key_stream_default_mode.sql and 077_quota_pools.sql both claimed prefix 077, so getMigrationFiles() threw a version-collision error and getDbInstance() failed at every startup (app would not boot; all DB-touching unit tests were red on release/v3.8.8). Renumber the dependency-free, idempotent quota_pools migration 077 -> 085 (no other migration references quota_pools/quota_allocations), keep the non-idempotent api_key_stream_default_mode ALTER at 077, add a retroactive isSchemaAlreadyApplied guard (case 085) for DBs that already applied it under 077, and add a regression test enforcing unique migration prefixes. |
||
|
diegosouzapw
|
69acd664d7 |
feat(quota): pool can span N connections — quota_pool_connections join table (Phase D1)
Adds migration 086 to create the `quota_pool_connections` join table with a backfill that seeds every existing pool's single connection_id as its first member. Updates QuotaPool type with `connectionIds: string[]`, wires createPool/updatePool/deletePool to maintain the join table transactionally, and keeps `connection_id` as the primary back-compat column synced to `connectionIds[0]`. |
||
|
diegosouzapw
|
4536aabe23 | Merge PR 2959 into release/v3.8.8 | ||
|
diegosouzapw
|
49f6092099 |
feat(quota): auto-sync quotaShared-* combos on pool allocation changes (Phase B2)
Mints one combo per model of the pool's provider when a quota pool is created/updated/reallocated, and prunes stale quota combos on deletion. |
||
|
diegosouzapw
|
e7870132db | Merge release/v3.8.8 | ||
|
Brandon Bennett
|
8cd77b0f49 | feat(notion): add Notion MCP context source with 6 tools, dashboard tab, and 20 tests | ||
|
diegosouzapw
|
51b586c2af | feat(quota): add allowed_quotas allow-list field to api_keys (Phase A1) | ||
|
Jan Leon
|
99d673fe5b | feat(stream): add per-key JSON stream default mode | ||
|
diegosouzapw
|
ac0e9d5272 |
Merge release/v3.8.8 into refactor/pages-v3-C (Playground + Search Tools Studio — plans 17+18)
Conflicts: migration 076_playground_presets->084; localDb/.env union; REPOSITORY_MAP dedup; package.json keep base (version 3.8.7, coverage --functions 40); .source regenerated (+3 docs); deps cli-table3/wtfnode/@types/bun/uuid (npm install). i18n pt-BR: 19 collisions — 18 playground keys -> HEAD pt-BR translations (base had untranslated EN: Send->Enviar, Cancel->Cancelar etc), costsSection -> base Custos. Rule: prefer side != en.json (translated). openapi: --theirs base + 3 playground/search paths + 2 schemas + 1 tag (js-yaml surgical insert; union-blind breaks YAML). No open-sse, typecheck:core 0 errors. |
||
|
diegosouzapw
|
dd8f7aa6a1 |
Merge release/v3.8.8 into refactor/pages-v3-21 (Memory engine redesign — sqlite-vec + RRF + Studio)
Conflicts: migration 073_memory_vec->083; localDb/.env/REPOSITORY_MAP union; request.ts->base; i18n auto-merged; .source regenerated (+3 docs). openapi: --theirs base + surgically inserted 14 memory paths + 4 schemas + Memory tag via js-yaml extract (union-blind broke YAML structure). +938 lines, base formatting preserved, gen-openapi validates. deps: @huggingface/transformers + sqlite-vec added (package.json); npm install ran, lock regenerated. chatCore auto-merged (memory + quota hooks coexist, transform OK). typecheck:core 0 errors. |
||
|
diegosouzapw
|
ef6e6c74a5 |
Merge release/v3.8.8 into refactor/pages-v3-A (AgentBridge+Inspector) + fix test gaps
Conflicts: migrations 073/074/075->080/081/082; localDb/.env.example/openapi union; i18n deep-merge; request.ts+i18n-fallback->base (deepMergeFallback, drop old getNestedValue); REPOSITORY_MAP dedup; .source regenerated via fumadocs-mdx (+AGENTBRIDGE/TRAFFIC_INSPECTOR docs). Pre-existing #2858 gaps fixed: sidebar-visibility.test.ts expected list missing agent-bridge/traffic-inspector (code already had them); documented 10 INSPECTOR/AGENTBRIDGE env vars in ENVIRONMENT.md; NODE_TLS_REJECT_UNAUTHORIZED added to env-doc-sync IGNORE_FROM_CODE (instruction snippet, not OmniRoute config). |
||
|
diegosouzapw
|
1b0d3c75e9 |
Merge release/v3.8.8 into refactor/pages-v3-B (Monitoring+Costs+Quota) + fix transform bug
Conflicts: migrations 073/074/075->077/078/079 (collision w/ base 073-076); localDb union (quota + tokenLimits/plugins re-exports); i18n en/pt-BR deep-merge (base translations win over __MISSING__ placeholders; sidebar.costsSection=Custos); CLAUDE.md keeps base coverage rule (>=40%). Pre-existing #2859 bugs surfaced by validation & fixed: chatCore onStreamComplete 'await import'->'import().then()' (await was outside async fn, broke tsx transform of 17 chat-* test files); documented 5 QUOTA_* env vars in ENVIRONMENT.md to fix env-doc-sync drift. |
||
|
Diego Rodrigues de Sa e Souza
|
191009dd23 |
Release v3.8.7 (#2919)
* feat(plugins): WordPress-style plugin system backend * fix(plugins): address code review feedback - Path traversal guard: validate entryPoint stays within plugin dir - install() now handles direct plugin directories (not just parent dirs) - Non-null assertion replaced with explicit null check - require efficiency: allowedModules map moved outside function - Source wrapper: add newlines to prevent trailing comment issues - Config validation: validate values against configSchema on save - Dynamic import comment: clarify Node.js caching behavior Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com> * fix(plugins): replace vm with child_process, add auth to all routes Addresses all remaining code review feedback: 1. **Loader rewrite**: Replaced Node.js vm module with child_process.fork() for proper process-level isolation. Complies with Rule 3 (no eval). Each plugin runs in a separate Node.js process with IPC communication. 2. **Auth on all routes**: Added requireManagementAuth to all 6 plugin API route files (list, install, scan, details, activate, deactivate, config). 3. **Env filtering**: Only safe env vars passed to plugin processes unless "env" permission is granted. Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com> * fix(plugins): security + ESM fixes for loader and manager loader.ts: - Fix IPC: use process.send()/process.on("message") instead of worker_threads.parentPort - Fix ESM: write host script as .mjs (not .js) to force ESM execution - Add timeout: 10s default on callHook() with Promise.race - Add SIGKILL escalation: SIGTERM first, then SIGKILL after 3s grace - Fix env filtering: use allowlist (safeKeys) instead of passing all env vars - Clear timeout on successful IPC response (no timer leak) manager.ts: - Fix path traversal: use fs.realpath() instead of startsWith() - Fix imports: use registerHook/unregisterHooks from hooks.ts - Register hooks individually via registerHook(event, name, handler) hooks.ts: - Copied from feat/plugin-custom-hooks (canonical registry) * feat(discovery): add discovery tool stub service Phase 1 scaffold for automated provider discovery: - DiscoveryConfig, DiscoveryResult types - probeEndpoint() for URL availability checking - scanProvider() stub (Phase 2 will implement real scanning) - getDiscoveryResults() stub - Default config: disabled (opt-in) * chore(plugins): slop cleanup — pino logger, remove redundant sorts - index.ts: replace console.log/error with pino structured logging - hooks.ts: remove redundant .sort() in emitHookBlocking/runOnResponse (already sorted on registration) - manager.ts: add readFile import * test(plugins): add scanner, loader, manager unit tests - scanner: 9 tests (discovery, hidden dirs, validation, entry point, multiple) - loader: 5 tests (type contracts, Plugin/PluginContext/PluginResult interfaces) - manager: 6 tests (singleton, lifecycle methods, error on unknown) - Total: 20 tests, all passing * fix(settings): add missing home page pin keys to updateSettingsSchema * feat(plugins): add i18n keys to all 42 locales * fix(settings): add missing security keys to updateSettingsSchema and add tests * fix(usage): analytics route reads combo_name/requested_model from call_logs only The 3.8.6 variant of #2904 added SELECTs of combo_name/requested_model against usage_history, but those columns only exist in call_logs (no migration adds them to usage_history). This returned HTTP 500 on /api/usage/analytics. Restore the working query shape from the 3.8.7 variant. Fixes 18 failing usage-analytics-route tests. * fix(types,test): resolve noImplicitAny in progressiveAging + align semaphore test to #2903 gate pruning - progressiveAging: type compression results so messages[0].content is indexable (was TS7053 against {}); restores typecheck:noimplicit:core gate. - services-branch-hardening: #2903 (perf-ram) prunes idle rate-limit gates on zero; assert no-running/empty-queue without assuming the entry persists. * fix(analytics): address merged review regressions * fix(executor): normalize max effort for openai shape providers * Make zero-latency combo optimizations opt-in * Address zero-latency combo review feedback * chore(release): sync v3.8.7 touchpoints + credit contributors - llm.txt → 3.8.7 (Current version + Key Features header) - CHANGELOG: add Dmitry Kuznetsov & Nikolay Alafuzov to 3.8.6 Hall of Contributors - version already 3.8.7 across package.json/open-sse/electron/openapi (from #2909) * fix(cleanup): restore usage history cutoff boundary * docs(changelog): rank 3.8.6 contributors in a commits table with their PRs * fix(dashboard): theme ReactFlow Controls +/- buttons for dark mode * fix(settings): add missing home page pin keys to updateSettingsSchema * fix(settings): add missing security keys to updateSettingsSchema and add tests * fix(executor): normalize max effort for openai shape providers * Make zero-latency combo optimizations opt-in * Address zero-latency combo review feedback * fix(analytics): address merged review regressions * fix(cleanup): restore usage history cutoff boundary * feat(plugins): WordPress-style plugin system backend * fix(plugins): address code review feedback - Path traversal guard: validate entryPoint stays within plugin dir - install() now handles direct plugin directories (not just parent dirs) - Non-null assertion replaced with explicit null check - require efficiency: allowedModules map moved outside function - Source wrapper: add newlines to prevent trailing comment issues - Config validation: validate values against configSchema on save - Dynamic import comment: clarify Node.js caching behavior Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com> * fix(plugins): replace vm with child_process, add auth to all routes Addresses all remaining code review feedback: 1. **Loader rewrite**: Replaced Node.js vm module with child_process.fork() for proper process-level isolation. Complies with Rule 3 (no eval). Each plugin runs in a separate Node.js process with IPC communication. 2. **Auth on all routes**: Added requireManagementAuth to all 6 plugin API route files (list, install, scan, details, activate, deactivate, config). 3. **Env filtering**: Only safe env vars passed to plugin processes unless "env" permission is granted. Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com> * fix(plugins): security + ESM fixes for loader and manager loader.ts: - Fix IPC: use process.send()/process.on("message") instead of worker_threads.parentPort - Fix ESM: write host script as .mjs (not .js) to force ESM execution - Add timeout: 10s default on callHook() with Promise.race - Add SIGKILL escalation: SIGTERM first, then SIGKILL after 3s grace - Fix env filtering: use allowlist (safeKeys) instead of passing all env vars - Clear timeout on successful IPC response (no timer leak) manager.ts: - Fix path traversal: use fs.realpath() instead of startsWith() - Fix imports: use registerHook/unregisterHooks from hooks.ts - Register hooks individually via registerHook(event, name, handler) hooks.ts: - Copied from feat/plugin-custom-hooks (canonical registry) * feat(discovery): add discovery tool stub service Phase 1 scaffold for automated provider discovery: - DiscoveryConfig, DiscoveryResult types - probeEndpoint() for URL availability checking - scanProvider() stub (Phase 2 will implement real scanning) - getDiscoveryResults() stub - Default config: disabled (opt-in) * chore(plugins): slop cleanup — pino logger, remove redundant sorts - index.ts: replace console.log/error with pino structured logging - hooks.ts: remove redundant .sort() in emitHookBlocking/runOnResponse (already sorted on registration) - manager.ts: add readFile import * test(plugins): add scanner, loader, manager unit tests - scanner: 9 tests (discovery, hidden dirs, validation, entry point, multiple) - loader: 5 tests (type contracts, Plugin/PluginContext/PluginResult interfaces) - manager: 6 tests (singleton, lifecycle methods, error on unknown) - Total: 20 tests, all passing * feat(plugins): add i18n keys to all 42 locales * chore(plugins): remove duplicate migration 059_create_plugins.sql * chore(plugins): remove duplicate migration 059_create_plugins.sql (post-merge) * fix(sse): guard non-string error.code in proxyFetch + harden model parsing (#2463) (#2923) Integrated into release/v3.8.7 * fix(docker): add runner-web stage with Playwright Chromium (#2832) (#2846) Integrated into release/v3.8.7 * docs(changelog): document NVIDIA NIM and error code type-crash fix (#2463) * test: ignore NVIDIA_BASE_URL and NVIDIA_MODEL in env contract check --------- Co-authored-by: oyi77 <oyi77@users.noreply.github.com> Co-authored-by: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com> Co-authored-by: Apostol Apostolov <theapoapostolov@gmail.com> Co-authored-by: Halil Tezcan KARABULUT <info@hlltzcnkb.com> Co-authored-by: R.D. <rogerproself@gmail.com> |
||
|
mi
|
94682d2a76 |
perf(ram): reduce server memory footprint (#2903)
Integrated into release/v3.8.7 |
||
|
Halil Tezcan KARABULUT
|
a1a225209c |
Fix analytics history and log token accounting (#2904)
Integrated into release/v3.8.6 |
||
|
guanbear
|
fbe140c231 |
Add self-service API key usage status (#2908)
Integrated into release/v3.8.6 |
||
|
Diego Rodrigues de Sa e Souza
|
f59f8daa94 |
Release v3.8.6 (#2804)
* fix(gemini): preserve structured tool calls for antigravity * fix(gemini): parse prefixed textual tool calls * fix(antigravity): preserve textual SSE tool calls * fix(stream): normalize textual passthrough tool calls * fix(stream): normalize split textual tool calls * fix(stream): suppress malformed textual tool calls * fix(stream): suppress compact malformed tool calls * fix(stream): emit structured textual tool calls * fix(stream): suppress unknown textual tool calls * fix(stream): normalize responses textual tool calls * chore: ignore .claude/settings.local.json (per-user Claude Code permissions) * fix(opencode-go): route qwen3.x via claude messages + repair fixMissingToolResponses for Claude-shape upstreams (#2791) Integrated into release/v3.8.6 * fix: resolve npm install warnings — remove dead deps, relax engine constraint (#2792) Integrated into release/v3.8.6 * fix: register missing web-cookie validators (claude-web, gemini-web, copilot-web, t3-web) (#2793) Integrated into release/v3.8.6 * fix: Error: Unable to inspect existing database #2771 (#2795) Integrated into release/v3.8.6 * fix(oauth): repair Google loopback callback flow (#2796) Integrated into release/v3.8.6 * feat(logs): add clean history button (#2799) Integrated into release/v3.8.6 * [codex] home: restore settings-driven home layout and quota auto-refresh (#2800) Integrated into release/v3.8.6 * fix(gemini): emit signaturelessToolCallMode:text for GEMINI format models (#2801) Integrated into release/v3.8.6 * feat(modelSpecs): align opencode-go family with upstream provider limits (#2802) Integrated into release/v3.8.6 * chore: apply unit test fixes, polyfills, and environment precedence fixes * docs(agents): atualiza fluxos de release e triagem Expande os workflows de release para incluir auditoria de segurança, CHANGELOG completo por commits, quality gate obrigatório, homologação em VPS local, publicação oficial, deploy em Akamai e validação de artefatos. Reorganiza a triagem de features com arquivos permanentes por bucket, suporte a itens em andamento, regra de reclaim após 15 dias e novo tratamento para ideias viáveis catalogadas. Corrige a orientação de revisão de discussões para usar a ordem cronológica real dos comentários e respostas ao identificar a última atividade. * fix(lockout): classify Gemini Antigravity resource exhaustion as quota_exhausted * fix(reasoning): gate replay by interleaved field * docs(rule-16): permit human Co-authored-by, restrict only AI/bot trailers Rule #16 previously banned all `Co-Authored-By` trailers absolutely. That blocked the upstream-port workflows (`/port-upstream-features` and `/port-upstream-issues`), which must credit human upstream PR authors and issue reporters in OmniRoute commits. Refine the rule to ban only AI/bot-attributed trailers (Claude, GPT, Copilot, Bot; anthropic.com / openai.com / bot-owned noreply.github.com emails) while allowing standard human `Co-authored-by: Name <email>` attribution. Sync the rule across the source CLAUDE.md, the E2E shakedown doc note, and 41 i18n translations. * fix(gitlawb): add specialty validators for connection test — bypass /models probe GitLawB OpenGateway API (xiaomi-mimo compatible) does not expose a /models endpoint, causing validateOpenAILikeProvider to 404 on the initial probe and report 'Provider validation endpoint not supported'. Add specialty validators for both gitlawb and gitlawb-gmi that follow the same pattern as the existing xiaomi-mimo validator: skip GET /models, validate directly via POST /chat/completions with a minimal test message. Any 401/403 response means an invalid key; all other responses mean auth is OK. Fixes test-connection returning 404 for GitLawB providers. * test(gitlawb): add 12 unit tests for gitlawb and gitlawb-gmi specialty validators Covers success, auth failure (401/403), non-auth acceptance (400/422/429), network errors, and custom baseUrl overrides for both providers. * feat(gitlawb): serve models from static registry without API-unavailable warning GitLawB's OpenGateway API does not expose a /models endpoint per provider-path. Previously the models route fell through to the generic fallback which returned static catalog models with the misleading 'API unavailable — using local catalog' warning. Now gitlawb and gitlawb-gmi are handled as static model providers (same pattern as reka and qwen OAuth) — models are served from the provider registry without any warning, since all registered models are functional via POST /chat/completions. * refactor(gitlawb): extract shared opengateway validator factory, fix docs path in test - Extract gitlawb/gitlawb-gmi validators into buildOpengatewayValidator factory - Fix dockerignore-docs-coverage test: update stale docs/AUTO-COMBO.md -> docs/routing/AUTO-COMBO.md * fix(reasoning): guard interleaved capability lookup * feat(gitlawb): dynamic model fetch with gmi-cloud fallback Hybrid approach: - gitlawb (xiaomi-mimo): dynamic /models endpoint → 356 models - gitlawb-gmi (gmi-cloud): 404 fallback → local catalog gracefully Mimics Gitlawb/openclaude's model-routing pattern * i18n(pt-BR): complete missing translations and sync with en.json * feat(build): nix multi-OS package manager install (#2806) Integrated into release/v3.8.6 * fix(i18n): translate 144 new __MISSING__ pt-BR strings (#2816) Integrated into release/v3.8.6 * chore(docs): set coverage gate to 40/40/40/40 in CLAUDE.md Aligns the documented coverage gate with the v3.8.6 release decision (lowered from 75/75/75/70). Matches the threshold already set in package.json by the large feature PRs (planos 11-22). * fix(cli): respect PORT env var in serve command (#2845) Integrated into release/v3.8.6. * fix(deepseek-web): return 400 when client sends tools[] - chat.deepseek.com has no tool support (#2854) Integrated into release/v3.8.6. * fix(qoder): reject invalid/expired PATs returning Cosy 500 error (#2860) Integrated into release/v3.8.6. * fix(cli): register openclaw in tool-detector (#2833) (#2850) Integrated into release/v3.8.6. * fix(api): include noAuth providers in /v1/models catalog (#2798) (#2814) Integrated into release/v3.8.6. * fix(combo): resolve custom provider targets via combo name (#2778) (#2812) Integrated into release/v3.8.6. * fix(translator): strip safety_identifier in openai-responses cleanup (#2770) (#2809) Integrated into release/v3.8.6. * fix(quota): honor explicit per-connection preflight opt-out (#2831) (#2844) Integrated into release/v3.8.6. * fix(usage): un-invert GitHub Copilot Free/limited quota — limited_user_quotas is remaining (#2876) (#2881) Integrated into release/v3.8.6. * fix(nous-research): correct baseUrl to include /chat/completions (#2826) (#2835) Integrated into release/v3.8.6. * fix(opencode): qwen3.x max/plus models lack vision support (#2822) (#2836) Integrated into release/v3.8.6. * fix(translator): pass-through tool_search built-in tool type (#2766) (#2811) Integrated into release/v3.8.6. * fix(github): route claude-opus-4.6 via chat completions (#2821) Integrated into release/v3.8.6. * docs(oauth): add Windsurf login fix design (Phase 1 hotfix + Phase 2 Firebase OAuth) Two-phase plan to fix the broken Windsurf OAuth flow: - Phase 1: drop the dead app.devin.ai/editor/signin PKCE path, promote import-token from windsurf.com/show-auth-token as the primary path - Phase 2: port Firebase OAuth + RegisterUser flow from fendoushaonian/WindSurf-gRPC-API for full browser-based automation Spec only - no code changes yet. * docs(plan): Phase 1 windsurf login hotfix implementation plan 10 tasks covering: - TDD assertions for flowType + 410 Gone responses - Provider switch to import_token - Route handler retiring authorize/start-callback-server/poll-callback - OAuthModal UI override - i18n sync - Verification + PR steps * fix(cli): replace cli-table3 with hand-rolled formatter (#2752) (#2813) Integrated into release/v3.8.6. * fix(skills): skip interception for unregistered client-native tools (#2815) (#2817) Integrated into release/v3.8.6. * feat(sse): add RTK filters for kubectl, docker-build, composer, gh (#2824) Integrated into release/v3.8.6. * fix(geminiHelper): support rec.image content shape + warn on dropped remote URLs (refs #2807) (#2855) Integrated into release/v3.8.6. * fix(cli): allow nullable/optional apiKey in cliMitmStartSchema (#2857) Integrated into release/v3.8.6. * fix(combo): preserve system messages during context handoff summary generation (#2865) Integrated into release/v3.8.6. * fix: wire CLIProxyAPI fallback settings into chatCore routing engine (#2866) Integrated into release/v3.8.6. * fix(usage): add opencode quota fetcher (#2852) (#2867) Integrated into release/v3.8.6. * feat(claude): default xhigh support for newer Opus models (#2874) Integrated into release/v3.8.6. * fix(cli): restore omniroute logs command stream (#2756) (#2810) Integrated into release/v3.8.6. * fix(combo): normalize upstream Headers for Node 24 undici interop (#2751) (#2823) Integrated into release/v3.8.6. * Rename proxy log Public IP to Client IP (#2880) Integrated into release/v3.8.6. * fix(claude): preserve max effort for supported models (#2875) Integrated into release/v3.8.6. * fix(oauth): switch windsurf provider to import_token flow The PKCE auth URL targeting app.devin.ai/editor/signin returns 404 post-rebrand. Until Phase 2 ports Firebase OAuth + RegisterUser, the only supported path is import-token via windsurf.com/show-auth-token. - windsurf.ts: drop buildAuthUrl, set flowType=import_token - generateAuthData returns supported:false + helpful error for windsurf/devin-cli - tests: assert flowType + disabled stub * fix(oauth): return 410 Gone for retired windsurf/devin-cli PKCE actions start-callback-server, authorize, and poll-callback (GET + POST) now return 410 Gone with a pointer to /import-token. The 410 short-circuit runs before auth so the response is honest about the action being permanently gone, not gated. Codex PKCE flow unchanged. Tests: 5 new assertions cover GET + POST 410 paths and a Codex regression check. * refactor(oauth): annotate retired PKCE fields in WINDSURF_CONFIG No behaviour change - comment-only update documenting that authorizeUrl, codeChallengeMethod, callbackPort, callbackPath, apiServerUrl, and exchangePath are no longer consumed. Active fields (inferenceUrl, showAuthTokenUrl, firebaseApiKey, ideName) called out separately. * fix(cli,docs): use requireCliToolsAuth in logs route + document OPENCODE quota env Post-merge contract fixes for v3.8.6: - src/app/api/cli-tools/logs/route.ts (#2810) now uses the shared requireCliToolsAuth guard (param renamed req->request) to satisfy the cli-tools-auth-hardening contract test. - Document OMNIROUTE_OPENCODE_QUOTA_URL (#2867) in docs/reference/ENVIRONMENT.md to satisfy the env/docs sync contract. * fix(dashboard): force import-token panel for windsurf/devin-cli Phase 1 hotfix: hide the 'Browser Login' tab and start in Paste API Key mode. Removes windsurf/devin-cli from PKCE_CALLBACK_SERVER_PROVIDERS so no callback server is started for them. Codex still uses the PKCE flow. The 'Get token' link continues to point at windsurf.com/show-auth-token via the existing supportsTokenPaste form copy. * fix(oauth): windsurf import-token mapTokens signature mismatch The route at `src/app/api/oauth/[provider]/[action]/route.ts` invokes `providerData.mapTokens({ accessToken: token })` (object), matching the cursor/kiro signature. The windsurf provider was declared with `mapTokens(token: string)` instead, so the entire object was stored as `accessToken`. When the connection record reached the SQLite layer it crashed with: SQLite3 can only bind numbers, strings, bigints, buffers, and null Fix by aligning windsurf's `mapTokens` signature with the route caller and the cursor/kiro convention. Also dedupe a copy-pasted second `if (action === "import-token")` block in the route handler — the second block was unreachable but identical to the first. Adds two regression tests asserting that `provider.mapTokens({ accessToken })` returns a string `accessToken` for both windsurf and devin-cli, so a future signature drift trips the gate instead of the SQLite bind error in production. * feat(compression): expand pt-BR pack with troglodita rules (15 → 49) (#2818) Integrated into release/v3.8.6 * fix(sse): repair RTK engine defaults so dedup and direct calls work (#2825) Integrated into release/v3.8.6 * fix(mcp): redirect console.log/warn to stderr in --mcp stdio mode (#2840) Integrated into release/v3.8.6 * fix(gemini-cli): prefer real project IDs over default-project (#2841) Integrated into release/v3.8.6 * fix(opencode-go): add provider limits quota fetcher (#2861) Integrated into release/v3.8.6 * Audit & add web cookie providers: fix 4 missing registry entries + DuckDuckGo (#2862) Integrated into release/v3.8.6 * fix(antigravity): harden signatureless tool history (#2878) Integrated into release/v3.8.6 * fix: provider model sync pruning and dynamic antigravity MITM proxy mappings (#2886) Integrated into release/v3.8.6 * feat(usage): per-API-key token limits scoped to model/provider/global (#2888) Integrated into release/v3.8.6 * fix(audio): build multipart body manually to preserve Content-Type (#2842) Integrated into release/v3.8.6 * refactor: remove agent skill documentation files and streamline maintenance workflows * test(stabilization): resolve unit test failures in blackbox-web, schema-coercion, translator-helper-branches, usage-service-hardening, and audio-transcription * fix(security): mitigate Socket.dev supply-chain findings + secrets opt-in + minimal build profile (#2863) (#2871) Two real security gaps closed and four cosmetic Socket.dev fingerprints removed. See docs/security/SOCKET_DEV_FINDINGS.md for the per-finding maintainer attestation. Real bugs fixed: - cloudSync: HMAC verification of `X-Cloud-Sig` + opt-in `OMNIROUTE_CLOUD_SYNC_SECRETS=true` before overwriting `accessToken` / `refreshToken` / `providerSpecificData` from a remote response. Closes the silent-credential-swap surface (a misconfigured or hostile CLOUD_URL could previously replace local tokens unverified). - Zed import: split into 2-step `/discover` + `/import` flow. `/import` now requires `confirmedAccounts: [{ service, account, fingerprint }]` and re-reads the keychain server-side to filter by fingerprint, so a tampered discover response cannot trick the endpoint into saving an unrelated token. Cosmetic Socket.dev mitigations: - runElevatedPowerShell writes the elevated payload to a per-call temp `.ps1` file (mode 0o600) and references it via `-File`. Removes the textbook `-EncodedCommand <base64utf16le>` pattern flagged as malware by Socket's AI classifier. - Maintainer attestation `SECURITY-AUDITOR-NOTE:` blocks added at every flagged call site pointing to `docs/security/SOCKET_DEV_FINDINGS.md`. Build-time hardening: - `OMNIROUTE_BUILD_PROFILE=minimal` (`npm run build:secure`) physically removes the four sensitive modules from the standalone bundle via webpack `NormalModuleReplacementPlugin`. Stubs throw `FeatureDisabledError` at runtime. Intended for the `omniroute-secure` artifact. Tests: - 24 new unit tests in `tests/unit/security/` covering the wrapper builder, HMAC verification (4 cases), credential fingerprint determinism (5 cases), confirmedAccounts validation + fingerprint filtering (6 cases), and the minimal-build stubs (5 cases). Docs: - New `docs/security/SOCKET_DEV_FINDINGS.md` — per-finding attestation. - New `socket.yml` — Socket.dev v2 config pointing at the attestation. - Updated `SECURITY.md` — supply-chain scanner section. - Updated `.env.example` — three new env vars documented. Backwards compatibility: - Cloud sync token overwrite is OFF by default. Users who relied on it must set `OMNIROUTE_CLOUD_SYNC_SECRETS=true`. Breaking change documented in CHANGELOG. - Zed import 2-step is the new default; legacy 1-step preserved behind `OMNIROUTE_ZED_IMPORT_LEGACY_ONE_STEP=true` and will be removed in v3.9. Closes #2863 * fix(security): redact public Firebase Web key from windsurf spec; doc SHA-256 cache-key rationale (#2894) Two security-scanning findings on release/v3.8.6: - Secret-scanning alert 7 (google_api_key): the windsurf login-fix design spec embedded the literal public Firebase Web API key on two lines. Firebase Web API keys are non-sensitive by design (they identify the project; access is gated by Firebase Security Rules + key restrictions), but the literal trips secret scanning. Redacted to a placeholder; the embedded default still goes through resolvePublicCred per rule #11. - Code-scanning alert 261 (js/insufficient-password-hash): tokenCacheKey() uses SHA-256 to derive an in-memory cache key from the session token, not for password-at-rest storage. Added a comment documenting why CWE-916 KDFs do not apply (false positive). * fix(ci): resolve release/v3.8.6 gate failures (docs-sync, any-budget, pack-artifact) (#2895) * fix(ci): resolve release/v3.8.6 gate failures (docs-sync, any-budget, pack-artifact) Three CI gates failed on release/v3.8.6 (run 26630300877): - docs-sync: CHANGELOG had a spurious "## [3.8.6-patch]" section above "## [3.8.6]", so the latest release no longer matched package.json (3.8.6) and the 41 i18n CHANGELOG mirrors were flagged as missing that section. Fold the lone #2752 entry into [3.8.6] and drop the patch heading. - any-budget:t11: open-sse/handlers/chatCore.ts regressed to 1 explicit `any` (budget 0). Type the persist callback arg as Record<string, unknown>, which matches runWithOnPersist's RefreshPersistFn contract exactly. - pack-artifact: open-sse/utils/setupPolyfill.ts ships via package.json "files" (bin/omniroute.mjs imports it at startup) but was missing from the pack policy allowlist. Allow it and add a regression test. * fix(security): redact public Firebase Web key from windsurf spec Redact the literal public Firebase Web API key (secret-scanning #7) to a placeholder, mirroring the redaction on release/v3.8.6 (PR #2894) and the windsurf fix branch. Non-sensitive public Web key; trips secret scanning. * feat(combo): Zero-Latency Combos (Hedging, Proactive Compression, Predictive TTFT) (#2868) * feat(combo): implement zero-latency combo optimizations (hedging, proactive compression, predictive TTFT) * fix(combo): fix predictive TTFT skip logic and unhandled promise rejections --------- Co-authored-by: Automation <automation@omniroute> * feat: implement automated skill workflows and update system configuration and validation schemas * test: eliminate dynamic cast warnings in cloud-sync unit test * test: isolate services-branch-hardening database directory to avoid concurrency issues * feat(providers): add 7 new web-cookie providers + research catalog + discovery tool New providers: - huggingchat: free LLM chat via huggingface.co/chat (no subscription) - phind: free dev-focused AI chat via phind.com/api/agent - poe-web: multi-model chat via poe.com GraphQL (p-b cookie) - venice-web: privacy-focused AI chat via venice.ai (session cookie) - v0-vercel-web: Vercel v0 code gen via v0.dev (session cookie) - kimi-web: Moonshot Kimi chat via kimi.moonshot.cn (session cookie) - doubao-web: ByteDance Doubao chat via doubao.com (session cookie) Additional: - Research catalog: docs/research/UNLIMITED_LLM_ACCESS.md - Discovery tool design + stub: src/lib/discovery/ + migration 073 - Unit tests: 33 tests for all 7 providers - Shared helpers consolidated in error.ts (slop cleanup) - All registered in WEB_COOKIE_PROVIDERS + providerRegistry + webSessionCredentials Closes #2885 * fix(typecheck): resolve typecheck errors in combo spec and compression modules * feat(api,oauth): add `agy` (Antigravity CLI) standalone provider with CLI token import (#2899) Add a standalone OAuth provider `agy` (Antigravity CLI) next to gemini-cli/antigravity. It reuses the antigravity inference backend (identical Google client_id + daily-cloudcode-pa.googleapis.com endpoint, executor and token-refresh) but ships its own model catalog — including the Claude models the backend exposes (claude-opus-4-6-thinking, claude-sonnet-4-6) — its own account pool, and four ways to connect: - token-file import (paste/upload the agy oauth token JSON) - auto-detect a local CLI login (~/.gemini/antigravity-cli/antigravity-oauth-token) - browser OAuth (via the shared OAuthModal Google loopback flow) - bulk / ZIP import New routes: POST /api/providers/agy-auth/{import,import-bulk,zip-extract,apply-local}. Catalog pinned from the live :fetchAvailableModels endpoint. Docs (openapi.yaml, ENVIRONMENT.md, .env.example, CHANGELOG) updated; new unit tests for registration, the token parser, and route auth-hardening. * fix(security): redact public Firebase Web key from windsurf spec (#2896) Redact the literal public Firebase Web API key (secret-scanning #7) to a placeholder. Firebase Web API keys are non-sensitive by design but the literal trips GitHub secret scanning. Mirrors the redaction landed on release/v3.8.6 (PR #2894). Embedded default still flows through resolvePublicCred (rule #11). * Pr 2871 (#2897) * fix(security): mitigate Socket.dev supply-chain findings + secrets opt-in + minimal build profile (#2863) Two real security gaps closed and four cosmetic Socket.dev fingerprints removed. See docs/security/SOCKET_DEV_FINDINGS.md for the per-finding maintainer attestation. Real bugs fixed: - cloudSync: HMAC verification of `X-Cloud-Sig` + opt-in `OMNIROUTE_CLOUD_SYNC_SECRETS=true` before overwriting `accessToken` / `refreshToken` / `providerSpecificData` from a remote response. Closes the silent-credential-swap surface (a misconfigured or hostile CLOUD_URL could previously replace local tokens unverified). - Zed import: split into 2-step `/discover` + `/import` flow. `/import` now requires `confirmedAccounts: [{ service, account, fingerprint }]` and re-reads the keychain server-side to filter by fingerprint, so a tampered discover response cannot trick the endpoint into saving an unrelated token. Cosmetic Socket.dev mitigations: - runElevatedPowerShell writes the elevated payload to a per-call temp `.ps1` file (mode 0o600) and references it via `-File`. Removes the textbook `-EncodedCommand <base64utf16le>` pattern flagged as malware by Socket's AI classifier. - Maintainer attestation `SECURITY-AUDITOR-NOTE:` blocks added at every flagged call site pointing to `docs/security/SOCKET_DEV_FINDINGS.md`. Build-time hardening: - `OMNIROUTE_BUILD_PROFILE=minimal` (`npm run build:secure`) physically removes the four sensitive modules from the standalone bundle via webpack `NormalModuleReplacementPlugin`. Stubs throw `FeatureDisabledError` at runtime. Intended for the `omniroute-secure` artifact. Tests: - 24 new unit tests in `tests/unit/security/` covering the wrapper builder, HMAC verification (4 cases), credential fingerprint determinism (5 cases), confirmedAccounts validation + fingerprint filtering (6 cases), and the minimal-build stubs (5 cases). Docs: - New `docs/security/SOCKET_DEV_FINDINGS.md` — per-finding attestation. - New `socket.yml` — Socket.dev v2 config pointing at the attestation. - Updated `SECURITY.md` — supply-chain scanner section. - Updated `.env.example` — three new env vars documented. Backwards compatibility: - Cloud sync token overwrite is OFF by default. Users who relied on it must set `OMNIROUTE_CLOUD_SYNC_SECRETS=true`. Breaking change documented in CHANGELOG. - Zed import 2-step is the new default; legacy 1-step preserved behind `OMNIROUTE_ZED_IMPORT_LEGACY_ONE_STEP=true` and will be removed in v3.9. Closes #2863 * feat: implement automated skill workflows and update system configuration and validation schemas * test: eliminate dynamic cast warnings in cloud-sync unit test * test: isolate services-branch-hardening database directory to avoid concurrency issues * chore(docs): refresh generated docs collection index Update the generated Fumadocs browser collection mapping to keep documentation imports in sync with the current docs structure. * docs: update generated browser docs collection manifest Refresh the generated Fumadocs browser collection mapping so the docs site can resolve the current documentation files correctly. --------- Co-authored-by: OpenClaw <openclaw@kuzhomesrv.local> Co-authored-by: Dmitry Kuznetsov <139351986+dmitry@users.noreply.local> Co-authored-by: KuzyaBot <kuzya@local> Co-authored-by: JeferssonLemes <jeferssondev@gmail.com> Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com> Co-authored-by: Markus Hartung <mail@hartmark.se> Co-authored-by: akarray <akarray@users.noreply.github.com> Co-authored-by: Apostol Apostolov <theapoapostolov@gmail.com> Co-authored-by: Hernan Javier Ardila Sanchez <hjasgr@gmail.com> Co-authored-by: Dmitry Kuznetsov <dmitry@kuznetsov.me> Co-authored-by: Nikolay Alafuzov <alafuzov_nn@rusklimat.ru> Co-authored-by: oyi77 <oyi77@users.noreply.github.com> Co-authored-by: Ronaldo Davi <alltomatos@users.noreply.github.com> Co-authored-by: levonk <277861+levonk@users.noreply.github.com> Co-authored-by: Lenine Júnior <lenine@engrene.com.br> Co-authored-by: Annas Alghoffar <aag.annas@gmail.com> Co-authored-by: Tushar Agarwal <76201310+Tushar49@users.noreply.github.com> Co-authored-by: GreatLiu <eurasiaxz@qq.com> Co-authored-by: yuna amelia <230527278+yunaamelia@users.noreply.github.com> Co-authored-by: Randi <55005611+rdself@users.noreply.github.com> Co-authored-by: Container <78986709+disonjer@users.noreply.github.com> Co-authored-by: nickwizard <35692452+nickwizard@users.noreply.github.com> Co-authored-by: Rajvardhan Patil <rajvardhanpatil7890@gmail.com> Co-authored-by: Raxxoor <manker_lol@hotmail.com> Co-authored-by: Muhammad Mugni Hadi <mugnimaestra3@gmail.com> Co-authored-by: mi <123757457+soyelmismo@users.noreply.github.com> Co-authored-by: Automation <automation@omniroute> |
||
|
diegosouzapw
|
516a7e5520 |
fix(memory): code-review hardening — guards, asserts, useEffect
Smaller fixes from the 2nd code-review pass on plan 21. Backend / CLI / DB: - memoryTools.ts: error-path fallback no longer hardcodes retrievalStrategy:"exact"; uses DEFAULT_MEMORY_SETTINGS via toMemoryRetrievalConfig (D16 / Bug #7). - memory.mjs: applyLegacyTypeMap also runs on search / list / clear (was only on add); legacy user/feedback/project/reference remap to canonical types with a stderr warning (D17 / Bug #4). - migrationRunner.ts: case "073" guards via hasColumn(memories, needs_reindex) so an unmarked re-run of 073_memory_vec.sql is skipped cleanly (D27). UI: - MemoryEngineStatus: optional onConfigure callback; "Configurar →" CTAs on the Embedding / Qdrant / Rerank rows when those components are off or missing (matches §4.3 wireframe). - EngineTab: scroll IDs on config cards + handleConfigure wired to the status panel. Providers fetch moved from render body (setState-during-render anti-pattern) into useEffect. - RerankConfigCard: toggle is disabled when no provider has a key — blocks turning rerank ON without a provider, still allows turning it OFF (D13). - MemoriesTab: Import validates each entry against the canonical type enum before POST so invalid types are caught locally with a clear skipped count. Tooling: - package.json: test:all includes test:vitest:ui so the UI suite is no longer orphaned in CI. Tests: - cli-memory-commands: asserts updated for the new legacy->canonical remap on search/clear. - memory-embedding-resolve: drop always-true `|| reason.length > 0` clauses that neutralized two assertions. - memory-embedding-static-potion: model_load_failed test forces a real load failure via MEMORY_STATIC_CACHE_DIR=/dev/null/<subdir> and asserts EmbeddingError shape + reason + sanitized message (replaces the previous `assert.ok(true)`). - rerank-config-card.test.tsx: happy-path now uses a provider with hasKey; new test covers the disabled-toggle guard. Full memory suite green: 331/331 unit tests, 46/46 UI tests. typecheck:core, typecheck:noimplicit:core, check:cycles clean. |
||
|
diegosouzapw
|
e06d72e270 |
fix(inspector): set source="custom-host" in agentBridgeHook for custom-host requests (R5-8)
recordRequestStart() now performs a cheap DB lookup (isCustomHost) before building the InterceptedRequest. Hosts registered in inspector_custom_hosts with enabled=1 receive source="custom-host" and agent=undefined, so they appear correctly under the "Custom" profile filter instead of being silently routed to "agent-bridge" entries. Added isCustomHost() helper to inspectorCustomHosts.ts and a unit test covering enabled custom-host, non-custom host, and disabled custom-host cases. |
||
|
diegosouzapw
|
59c983e201 |
feat(inspector): add POST /sessions/[id]/requests to persist live snapshots (R5-5 backend half)
Wires the previously-dead appendSessionRequest() DB function to a new POST /api/tools/traffic-inspector/sessions/[id]/requests route. appendSessionRequest now returns the inserted seq so callers can confirm order. InspectorSessionRequestAppendSchema (1 MB cap) guards the endpoint. Integration test covers seq increments 1-2-3, requestCount sync, 400/404 paths, and stack-trace-free error responses. |
||
|
diegosouzapw
|
907075f704 |
feat(db,inspector): add snapshotSession + restore hookBufferUpdate spec contract (M1+M2)
- Add `snapshotSession(sessionId)` to inspectorSessions.ts per master-plan §3.8: returns parsed InterceptedRequest[] in seq order, or null for non-existent sessions. Silently skips rows that fail InterceptedRequestSchema validation (defensive). - Restore canonical no-arg form of `MitmHandlerBase.hookBufferUpdate(intercepted)` per master-plan §3.5: when opts is omitted, derive completion fields from the intercepted object itself (status/responseHeaders/responseBody/responseSize/ *LatencyMs) rather than no-op'ing. Extended opts form preserved for legacy callers. - Update Zod record() calls in InterceptedRequestSchema to current (key,value) signature. - Add 3 unit tests for snapshotSession (happy path / non-existent / silent skip). - Add 2 unit tests for hookBufferUpdate (no-arg form + extended opts form). |
||
|
diegosouzapw
|
b9f93a5c07 |
feat(memory): add migration 073, memoryVec CRUD module, and localDb re-export (plan 21 F2)
- 073_memory_vec.sql: creates memory_vec_meta singleton table (active_dim, embedding_signature, last_reset_at, vec_loaded) and adds needs_reindex column to memories table with a partial index; idempotent via CREATE IF NOT EXISTS + INSERT OR IGNORE + migration runner's duplicate-column-name guard - src/lib/db/memoryVec.ts: implements 6 CRUD functions per §3.8 contract (getMemoryVecMeta, setMemoryVecMeta, markMemoryNeedsReindex, markAllMemoriesNeedReindex, getMemoryReindexQueue, countMemoryReindexPending) - src/lib/localDb.ts: adds re-export block for the 6 functions (Hard Rule #2) - .env.example: documents 7 new MEMORY_* env vars per §3.9 - tests/unit/memory-vec-meta.test.ts: 7 tests (meta get/set, migration idempotency) - tests/unit/memory-needs-reindex.test.ts: 12 tests (mark/unmark, markAll, queue) |
||
|
diegosouzapw
|
9fcfc2bd0b | feat(db): add inspector custom hosts + sessions CRUD modules (F2) | ||
|
diegosouzapw
|
45f602606b | feat(db): add agentBridge state/mappings/bypass CRUD modules (F2) | ||
|
diegosouzapw
|
89d3304a93 | feat(db): add migrations 073/074/075 agent_bridge + inspector (F2) | ||
|
diegosouzapw
|
1721cf7b32 |
feat(db): add providerPlans module with CRUD for per-connection quota plans (B/F2)
Implements getPlan, listPlans, upsertPlan (idempotent ON CONFLICT DO UPDATE), and deletePlan. Serializes QuotaDimension[] as JSON into dimensions_json column and parses back on read. Malformed JSON returns empty dimensions rather than throwing. |
||
|
diegosouzapw
|
83790b6c6a |
feat(db): add quotaConsumption sliding-window counter storage (B/F2)
Implements getBucket, incrementBucket (atomic UPSERT), getPair (curr+prev for sliding window formula), and gcOlderThan (stale bucket cleanup). Atomic increment uses INSERT ... ON CONFLICT DO UPDATE — no separate read-modify-write cycle needed. |
||
|
diegosouzapw
|
07d6a17643 |
feat(db): add quotaPools module with CRUD and allocation management (B/F2)
Implements listPools, getPool, createPool, updatePool, deletePool, upsertAllocations (replace strategy via transaction), and listAllocationsForApiKey. All SQL uses prepared statements. Local type shapes aligned with src/lib/quota/dimensions.ts contract (B13). |
||
|
diegosouzapw
|
4f149fb5a3 |
feat(db): add quota_pools and quota_consumption migrations (B/F2)
Creates migrations 073 (quota_pools + quota_allocations) and 074 (quota_consumption sliding-window counter). Both are idempotent via CREATE TABLE IF NOT EXISTS and CREATE INDEX IF NOT EXISTS. FK ON DELETE CASCADE from quota_allocations to quota_pools. Fixes B2 IDs. |
||
|
diegosouzapw
|
617d761948 |
feat(db): add playgroundPresets CRUD module
Implements listPlaygroundPresets, getPlaygroundPreset, createPlaygroundPreset,
updatePlaygroundPreset, and deletePlaygroundPreset using db.prepare() (never
raw db.exec or string interpolation). randomUUID() from node:crypto for IDs;
params serialized via JSON.stringify/JSON.parse with fallback to {}.
|
||
|
diegosouzapw
|
088ad53d79 |
feat(db): add playground_presets migration 076
Creates playground_presets table with indexes on name and endpoint. Idempotent via IF NOT EXISTS (migration 076 per group-C D2 decision). |
||
|
Apostol Apostolov
|
87fad5d171 |
[codex] home: restore settings-driven home layout and quota auto-refresh (#2800)
Integrated into release/v3.8.6 |
||
|
Jan Leon
|
e6ea8f13d9 | fix: keep database log settings in sync with the pipeline toggle | ||
|
Jack
|
af5635e422 |
feat(api): add endpoint restrictions for client API keys (#2777)
Merge PR #2777 — feat(api): add endpoint restrictions for client API keys |
||
|
Diego Rodrigues de Sa e Souza
|
b91ffa7f72 |
Release v3.8.4 (#2678)
* chore: bump version to 3.8.4 * feat(providers): enhance Google Gemini, CLI, and Antigravity resilience and features (#2676) Integrated into release/v3.8.4 * docs: add PR #2676 to changelog * fix(vision-bridge): process images when vision-capable model has combo mapping When a model-combo mapping routes a vision-capable model through a combo where some targets may NOT support vision, the vision bridge must process images so combo targets can describe them. Before: if body.model supports vision, the vision bridge skipped image processing entirely. Non-vision combo targets would receive raw images they can't handle. After: before skipping, check if the model has a model-combo mapping. If it does, process images through the vision bridge regardless of body.model's native vision support. - Add checkModelHasComboMapping() helper (dynamic import, failsafe) - Add checkModelHasComboMapping dep to VisionBridgeDependencies (testable) - Guardrail preCall: check combo mapping before early-return on vision support - Add VB-S11 / VB-S11b tests * fix(vision-bridge): only process images when some combo targets lack native vision Optimization per code review: instead of always processing images when a combo mapping exists, resolve the combo targets and check each target model's native vision support. Only invoke the vision bridge when at least one target model does not support vision. - Replace checkModelHasComboMapping() with shouldProcessImagesForComboModel() - When combo has ComboRefStep targets, conservatively process images - When all targets are model steps with native vision, skip processing - On errors, process images (conservative fail-safe) * fix(combos): repair context handoff ordering and add per-model timeout Root cause: recordSessionModelUsage was called BEFORE getLastSessionModel, so prevModel always matched the current modelStr — handoff summaries were never generated when auto-routing switched models. Fix: call getLastSessionModel first (captures actual previous model), generate handoff on mismatch, then record the new model for next time. Also: - ORDER BY id DESC in session_model_history query (deterministic vs used_at which has second-precision ties) - 30s per-model timeout for combo routing (default FETCH_TIMEOUT_MS is 600s, too long for combo fallback scenarios) * Revert "fix(combos): repair context handoff ordering and add per-model timeout" This reverts commit |