Cumulative warnings drift across this cycle's parallel-session merges, surfaced
only by the release PR's full CI (the Quality Ratchet doesn't run on PR→release
fast-gates). My release-finalize changes contribute 0 warnings (verified). No
coverage/openapi/i18n regressions.
#4576 added src/lib/db/providerNodeSelect.ts (pure node-resolution helper, not
re-exported from localDb) which the audit gate correctly classifies as internal,
but the regression guard's expected-set count wasn't updated → deterministic red
across the unit-test shards. Aligns the expected list + count to the real module set.
src/models/index.ts was added to package.json "files" so the published --mcp
import closure ships it (#3578 gate); the bidirectional pack-artifact validator
also needs the matching src/models/ prefix in PACK_ARTIFACT_ALLOWED_PATH_PREFIXES,
otherwise it flags the newly-shipped file as an unexpected artifact. Mirrors the
src/lib/ / src/sse/ entries. Covered by tests/unit/pack-artifact-policy.test.ts.
- Reconcile [3.8.33] CHANGELOG to 1:1 commit coverage (51 bullets) + env contract
(QUOTA_PREFLIGHT_CUTOFF_ENABLED, KIRO_VERIFY_FULL_CRC) + README What's New range.
- fix(translator): dedupe the duplicate input_audio handler in geminiHelper; mp3
normalizes to canonical audio/mpeg and the data: prefix is stripped (#912/#913).
- fix(auth): wire admin-configured maxCooldownMs to all 4 markAccountUnavailable
model-lockout sites (#4530 follow-up — combo.ts sites were already covered).
- fix(api): add src/models/ to package.json files so the published --mcp closure
ships it (#3578 gate).
- test: align stale expectations to intentional code (10 essential MCP tools incl.
web_fetch; busy_timeout 2s cap from v3.8.32).
- chore(quality): rebaseline file-size for auth.ts 2279->2289 + db-core-init.test.ts.
* fix(api): resolve compatible provider node by base type, not only exact id (#4421)
* chore(quality): rebaseline db/providers.ts file-size 1050->1063 (#4421)
* chore(quality): mark providerNodeSelect db-internal in db-rules allowlist (#4421)
---------
Co-authored-by: Diego Rodrigues de Sa e Souza <diego.souza@cdwasolutions.com.br>
Integrated into release/v3.8.33 (resolved overlap with #4547: requestFormat/claudeEffort leaves already restored, this adds keyHealth/targetFormat + wires all 4)
Closes#4438. Dedupes quota_snapshots writes for idle connections via pure quotaSnapshotChanged() gate. TDD 5/5. Admin-merged over a pre-existing, unrelated base red (model-lockout-max-cooldown.test.ts 'markAccountUnavailable local 404 ... maxCooldownMs', from #4530 incomplete wiring) proven to fail on release/v3.8.33 HEAD without this change.
Re-applies the endpoint/format (requestFormat.ts, #4507) and Claude effort-variant (claudeEffortVariant.ts, #4511) extractions that were orphaned from release/v3.8.33 by a parallel force-push. 19/19 chatCore tests pass.
Integrated into release/v3.8.33.
Adds enginesExplicit to the strict compression PUT schema so the panel can save without a 400. Kept only this commit; the Hub-render commit was superseded by Phase 2 (#4521) which rewrote CompressionHub.tsx. Does not reopen the Phase 1 gate (enginesExplicit is recomputed from stored engines, the persisted row is ignored). Tested.
Integrated into release/v3.8.33.
The omniroute_web_fetch input schema (#4510) used z.string().min(1, "URL is
required") for the url field, but .min() only fires for an empty string. A
MISSING url (webFetchInput.parse({})) fails the z.string() type check first and
emitted the default Zod v4 message ("expected string, received undefined"), so
the existing test 'webFetchInput rejects missing URL' (expecting /URL is
required/) failed on the full unit suite — a latent base red on release/v3.8.33.
Add the custom message to the type check: z.string({ error: "URL is required" }).
Now both the missing-field and empty-string cases emit 'URL is required'; a valid
url still passes. No other web_fetch behavior changes.
Co-authored-by: Diego Rodrigues de Sa e Souza <diego.souza@cdwasolutions.com.br>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds account/combo/latency/fallbackCount to telegram request.completed notifications; account UUID rendered via truncated display name (no sensitive data leak). Tested. Rebuilt onto release/v3.8.33.
Integrated into release/v3.8.33.
Adds authHint + enriched freeNote/apiHint on the existing bazaarlink entry (distinct from the closed-redundant #4497). Integrity test included.
Integrated into release/v3.8.33.
The combo.ts lockout call sites never forwarded mlSettings.maxCooldownMs to recordModelLockoutFailure, so the admin-configured cap fell back to BACKOFF_CONFIG.max. Passes it at all 3 sites. TDD included.
Integrated into release/v3.8.33.
Rebuilt onto release/v3.8.33; reconciled with the already-merged keepOpenOnSelect (#4496) — deselection now rides the existing keepOpenOnSelect + onDeselect wiring instead of a redundant closeOnSelect prop. Integrated into release/v3.8.33.
