* chore(release): open v3.8.10 development cycle
Bump 3.8.9 → 3.8.10 across package.json, lockfile, electron, open-sse, and
docs/reference/openapi.yaml; add the [3.8.10] CHANGELOG section (root + 41 i18n
mirrors) as the integration target for the cycle. Entries land here as work
merges into release/v3.8.10; finalized by the release flow.
* fix(providers): resolve web provider alias collisions
Assign unique aliases to HuggingChat, Kimi Web, and Qwen Web so they no longer shadow primary providers or trigger startup warnings.
Add a unit test to enforce provider alias uniqueness and prevent future collisions. Also expand local ignore and VS Code exclude rules for agent, build, and worktree artifacts.
* fix(responses): normalize image_url parts across input paths (#3150)
Normalize image_url parts across all Responses input paths. Integrated into release/v3.8.10.
* fix(api-manager): preserve API key expiration local time (#3146)
Preserve API key expiration local time + clear button. Integrated into release/v3.8.10.
* Strip previous_response_id for stateless Responses upstreams (#3143)
Strip previous_response_id for stateless Responses upstreams (auto/strip/preserve). Integrated into release/v3.8.10.
* fix(opencode-plugin): map thinking cap to interleaved in model+combo (#3138)
Map caps.thinking to ModelV2.capabilities.interleaved for opencode-plugin. Integrated into release/v3.8.10.
* fix(providers): use synced models as fallback for all providers (#3148)
Use synced models as authoritative local catalog for all providers (+regression test). Integrated into release/v3.8.10.
* fix(qoder): bifurcate validation by token type — PAT→Cosy, regular API key→dashscope (#3149)
Bifurcate Qoder validation by token type (PAT→Cosy, regular→dashscope) +regression test. Integrated into release/v3.8.10.
* fix(antigravity): dynamic model resolution via MITM alias table (#3144)
Dynamic antigravity MITM model resolution in the executor (+bug fix +regression test; DB import dropped from client-reachable config). Integrated into release/v3.8.10.
* Feature/batch allow big (#3128)
Podman deployment options + larger upload body-size limits (+CONTAINER_HOST docs). Integrated into release/v3.8.10.
* fix(fireworks): preserve fully-qualified router/model IDs (#3133) (#3160)
Fireworks router IDs (accounts/fireworks/routers/...) were double-prefixed
with accounts/fireworks/models/ → upstream 404. Add optional
acceptedModelIdPrefixes to the registry entry and skip the prepend when the
model already starts with an accepted prefix.
Co-authored-by: KooshaPari <KooshaPari@users.noreply.github.com>
* fix(llama-cpp): route to configured local baseUrl instead of OpenAI (#3136) (#3161)
llama-cpp was missing from the local-provider group in buildUrl(), so it
fell through to the OpenAI baseUrl and returned an OpenAI 401. Add the
case to resolve the connection's providerSpecificData.baseUrl.
Co-authored-by: tjengbudi <tjengbudi@users.noreply.github.com>
* fix(t3-chat-web): parse cookies + convexSessionId from stored credential (#3007) (#3162)
The executor read credentials.cookies/convexSessionId, but the pipeline
only stores the pasted string under apiKey → t3.chat always 400'd. Parse
both values from apiKey (fallback accessToken), mirroring validation.ts.
Co-authored-by: minhtran162 <minhtran162@users.noreply.github.com>
* fix(minimax): stop capping MiniMax-M3 / M2.7 max_tokens at 8192 (#3141) (#3163)
MiniMax-M3 had no MODEL_SPECS entry and capitalized MiniMax-M2.7 missed
its lowercase spec (case-sensitive lookup) → both fell to the 8192 default
cap. Add the M3 spec (512K output), alias the capitalized ids, and make
getModelSpec lookups case-insensitive.
Co-authored-by: totaltube <totaltube@users.noreply.github.com>
* fix(github-copilot): discover model catalog live from api.githubcopilot.com (#3120, #3121) (#3164)
The github (Copilot) provider had a static hardcoded catalog with no
discovery source, so Import Models never refreshed (#3120) and advertised
non-entitled models that 400 on use (#3121). Add a live /models fetch with
fallback to the static list.
Co-authored-by: gabrielmoreira <gabrielmoreira@users.noreply.github.com>
* fix(combo): invalidate nested-combo cache on edits + log DATA_DIR (#3147) (#3165)
Editing a combo did not invalidate the 10s nested-combo expansion caches
(chat.ts getCombosCachedForChat + chatCore.ts getCombosCached; the exported
clearCombosCache was dead code), so a removed nested target/model could be
served as a phantom for up to 10s. Wire a shared monotonic combos-cache
version in readCache (bumped by invalidateDbCache("combos") on every combo
write); both cache layers treat a version mismatch as a miss.
Also log the resolved DATA_DIR/SQLITE_FILE absolute path at DB init so the
reporter's 'persists across restart + volume wipe' symptom (a multi-replica
Docker volume/DATA_DIR mismatch, not a routing bug) is diagnosable from logs.
Includes consolidated CHANGELOG entries for #3133/#3136/#3007/#3141/#3120/#3121.
Co-authored-by: ViFigueiredo <ViFigueiredo@users.noreply.github.com>
* fix(web-tools): parse bare JSON tool calls (#3157)
Parse bare JSON tool calls for deepseek-web (#2820) + fuzzy tool-name matching. Integrated into release/v3.8.10.
* fix(misc): minor fixes across reasoning cache, account fallback, binary manager (#3177)
Misc: ProviderProfile export, DeepSeek reasoning regex, binary guard. Integrated into release/v3.8.10.
* fix(kiro): minor OAuth social exchange tweaks (#3176)
Kiro social OAuth: optional targetProvider passthrough. Integrated into release/v3.8.10.
* deps: bump hono from 4.12.18 to 4.12.23 (#3179)
Bump hono to 4.12.23. Integrated into release/v3.8.10.
* fix(providerRegistry): update kilocode format and executor (#3166)
kilocode: openai format + default executor (matches kilo-gateway) + registry test. Integrated into release/v3.8.10.
* feat(metrics): cross-request TTFT and gap latency after tool calls (#3173)
Cross-request TTFT + gap-after-tool latency metrics (+test). Integrated into release/v3.8.10.
* feat(dashboard): provider stats API endpoint and dashboard page (#3175)
Provider stats dashboard + API (SQL moved to db module per Hard Rule #5, +test). Integrated into release/v3.8.10.
* fix(usage): sequential+spaced OAuth quota sync, reactive force-refresh, actionable 401 (#3156)
Sequential+spaced OAuth quota sync, reactive force-refresh on 401, actionable 401 in UI. Integrated into release/v3.8.10.
* fix(healthcheck): per-provider proactive-refresh skip list (rescue short-TTL OAuth) (#3159)
Per-provider proactive-refresh skip list (OMNIROUTE_HEALTHCHECK_SKIP_PROVIDERS) to rescue short-TTL OAuth. Integrated into release/v3.8.10.
* feat(quota): show OAuth token expiry on provider cards (small, blue, informative) (#3178)
Show OAuth token expiry on provider cards (small, blue, informative). Integrated into release/v3.8.10.
* fix(providers): empty refresh must not resurface just-cleared synced models (#3181)
Empty refresh must not resurface just-cleared synced models (fixes the release-blocking provider-models-route test). Integrated into release/v3.8.10.
* chore(release): v3.8.10 — 2026-06-04 (finalize CHANGELOG)
---------
Co-authored-by: Wilson <pedbookmed@gmail.com>
Co-authored-by: Xiangzhe <32761048+xz-dev@users.noreply.github.com>
Co-authored-by: Jan Leon <Jan.gaschler@gmail.com>
Co-authored-by: M.M <mr.maatoug@gmail.com>
Co-authored-by: Hernan Javier Ardila Sanchez <hjasgr@gmail.com>
Co-authored-by: Markus Hartung <mail@hartmark.se>
Co-authored-by: KooshaPari <KooshaPari@users.noreply.github.com>
Co-authored-by: tjengbudi <tjengbudi@users.noreply.github.com>
Co-authored-by: minhtran162 <minhtran162@users.noreply.github.com>
Co-authored-by: totaltube <totaltube@users.noreply.github.com>
Co-authored-by: gabrielmoreira <gabrielmoreira@users.noreply.github.com>
Co-authored-by: ViFigueiredo <ViFigueiredo@users.noreply.github.com>
Co-authored-by: PizzaV <103120356+pizzav-xyz@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Nicolas Lorin <androw95220@gmail.com>
createProviderConnection deduped apikey connections only by (provider, name). Adding the same key under a different/blank name created a duplicate row. It now also matches by the decrypted key value (AES-GCM ciphertext is non-deterministic, so we decrypt+compare plaintext, trimmed) and updates the existing connection instead. Tests cover same-key dedup, whitespace-variant dedup, and distinct-key separation.
Implements per-API-key context source configuration table and CRUD
functions required by the Obsidian PR. Restores getApiKeyContextSource
in obsidian.ts (was stubbed to null during conflict resolution).
11/11 tests pass in obsidian-config.test.ts.
Integrated into release/v3.8.8. Applied review fixes: moved the SELECT 1 into a pingDb() db helper (no raw SQL in route, Hard Rule #5) + the 503 catch no longer leaks err.message (Hard Rule #12). Thanks @herjarsa!
upsertAllocations now propagates allocation rows to every pool in the
same group. A key allocated to pool A in group G automatically gets
an allocation row in pool B (same group), so enforceQuotaShare finds
the row when the key calls pool B's model and applies fair-share.
No change to apiKeyPolicy Check 3 (already group-correct via B5
groupSlug logic) or enforce.ts pool-match (works once propagation
supplies the row).
- `getPoolsByGroup(groupId)` in quotaPools.ts: SELECT all pools for a group,
exposed as public API and re-exported from localDb.ts.
- `resolveQuotaKeyScope`: pool → group → all pools in group expansion.
The returned `poolSlugs` field now holds GROUP slugs (quotaGroupSlug of the
group name) instead of individual pool-name slugs, one per distinct group.
Group slug included only when the group has ≥1 valid connection (group-level
anyValidConnection gate). Deduplication: a key in 2 pools of the same group
expands once.
- `filterModelsToQuotaPools` (quotaCombos.ts): already matches by
`parsed.groupSlug` ∈ poolSlugs — no logic change needed, just test alignment.
- quota-key-resolve.test.ts: updated 4 tests that asserted pool-name slugs
(testpoola2, poolmix, etc.) to assert the group slug ("groupdemo") — this is
alignment to the B5 group semantics, not masking; the assertions were correct
for the old pool-slug behavior and are now correct for the new group-slug
behavior.
- quota-catalog-filter.test.ts: updated fixtures from old quotaShared-* format
to qtSd/<groupSlug>/... (naming changed in B3, test was already broken before B5).
Add src/lib/db/quotaGroups.ts with createGroup/getGroup/getGroupName/
listGroups/renameGroup/deleteGroup; deleteGroup guards against non-empty
groups (throws /pools/i) and protects the 'group-demo' seed. Re-export
all functions + QuotaGroup type from localDb.ts. 15 unit tests in
tests/unit/quota-groups-crud.test.ts all passing.
Introduces first-class quota Group entity: new quota_groups table,
quota_pools.group_id column, GroupDemo seed, backfill of existing
pools, and groupId in QuotaPool/PoolCreate/PoolUpdate with a
group-demo default. Migration runner gains an isSchemaAlreadyApplied
guard for version 087.
Add poolConsumedTotal(poolId, dim) to the QuotaStore interface and implement
it in both SqliteQuotaStore and RedisQuotaStore so the enforce path can read
the real pool-wide consumption (sum across all keys) rather than the per-key
saturation signal, which is 0 for countable units and therefore never blocks.
- db/quotaConsumption.ts: add sumPoolDimension() — single SQL COALESCE(SUM)
for curr and prev buckets across all api_key_id rows for a dimensionKey.
- localDb.ts: re-export sumPoolDimension.
- quota/types.ts: add poolConsumedTotal to QuotaStore interface (with JSDoc).
- sqliteQuotaStore.ts: implement using sumPoolDimension + existing
slidingWindowEffective helper — one consistent sliding-window read.
- redisQuotaStore.ts: implement by fetching pool allocations from SQLite (F2),
then issuing a single MGET for all (key, curr-bucket) and (key, prev-bucket)
Redis keys, summing raw values, and applying the sliding-window formula once.
- tests/unit/quota-store-pool-total.test.ts: 4 tests (sum, pool isolation,
unit isolation, peek-no-regression) all passing.
deletePool now runs a SQLite json_each UPDATE inside the existing
transaction to remove the pool's id from every api_key's allowed_quotas
JSON array, preventing stale pool references after deletion.
Tests: tests/unit/quota-pool-delete-prune.test.ts (7 scenarios).
Custom models (added via the UI) on opencode-go / openai-compatible nodes always
routed as OpenAI-compatible because there was no per-model targetFormat: addCustomModel
didn't accept it, the API schema stripped it, and getModelTargetFormat (static-registry
only) never saw it — so a custom model needing the Anthropic Messages shape fell back to
the provider default 'openai'.
Thread an optional targetFormat through addCustomModel / replaceCustomModels /
updateCustomModel + the providerModelMutationSchema + the POST/PUT route, surface it from
getModelInfo (one combined custom-model metadata lookup alongside apiFormat), and use it
in chatCore's targetFormat resolution before the provider default.
Closes#2905
- Add assertSingleProvider() helper in quotaPools.ts: queries provider_connections
with DISTINCT provider WHERE id IN (...), throws if >1 provider detected.
- Call guard early in createPool (when connectionIds.length > 1) and updatePool
(when input.connectionIds.length > 1), before any DB writes.
- Add lockedProvider useMemo in PoolWizard.tsx: derived from first selected
connection; availableConnections filtered to same provider once locked.
- Show wizardSingleProviderNote i18n hint in step 1 when lockedProvider is set.
- Add wizardSingleProviderNote to en.json + pt-BR.json (parity).
- New test: tests/unit/quota-pool-single-provider.test.ts (4 cases).
- Update tests/unit/quota-multiprovider.test.ts: all D2 tests now use two
same-provider connections (both PROVIDER_A/openrouter) — the tests were
exercising connection-plumbing (scope, enforce membership, combo fan-out),
not mixed-provider behavior per se; updated to remain valid under Task 3 rule.
077_api_key_stream_default_mode.sql and 077_quota_pools.sql both claimed
prefix 077, so getMigrationFiles() threw a version-collision error and
getDbInstance() failed at every startup (app would not boot; all DB-touching
unit tests were red on release/v3.8.8).
Renumber the dependency-free, idempotent quota_pools migration 077 -> 085
(no other migration references quota_pools/quota_allocations), keep the
non-idempotent api_key_stream_default_mode ALTER at 077, add a retroactive
isSchemaAlreadyApplied guard (case 085) for DBs that already applied it under
077, and add a regression test enforcing unique migration prefixes.
Adds migration 086 to create the `quota_pool_connections` join table with a backfill
that seeds every existing pool's single connection_id as its first member. Updates
QuotaPool type with `connectionIds: string[]`, wires createPool/updatePool/deletePool
to maintain the join table transactionally, and keeps `connection_id` as the primary
back-compat column synced to `connectionIds[0]`.
* fix(gemini): preserve structured tool calls for antigravity
* fix(gemini): parse prefixed textual tool calls
* fix(antigravity): preserve textual SSE tool calls
* fix(stream): normalize textual passthrough tool calls
* fix(stream): normalize split textual tool calls
* fix(stream): suppress malformed textual tool calls
* fix(stream): suppress compact malformed tool calls
* fix(stream): emit structured textual tool calls
* fix(stream): suppress unknown textual tool calls
* fix(stream): normalize responses textual tool calls
* chore: ignore .claude/settings.local.json (per-user Claude Code permissions)
* fix(opencode-go): route qwen3.x via claude messages + repair fixMissingToolResponses for Claude-shape upstreams (#2791)
Integrated into release/v3.8.6
* fix: resolve npm install warnings — remove dead deps, relax engine constraint (#2792)
Integrated into release/v3.8.6
* fix: register missing web-cookie validators (claude-web, gemini-web, copilot-web, t3-web) (#2793)
Integrated into release/v3.8.6
* fix: Error: Unable to inspect existing database #2771 (#2795)
Integrated into release/v3.8.6
* fix(oauth): repair Google loopback callback flow (#2796)
Integrated into release/v3.8.6
* feat(logs): add clean history button (#2799)
Integrated into release/v3.8.6
* [codex] home: restore settings-driven home layout and quota auto-refresh (#2800)
Integrated into release/v3.8.6
* fix(gemini): emit signaturelessToolCallMode:text for GEMINI format models (#2801)
Integrated into release/v3.8.6
* feat(modelSpecs): align opencode-go family with upstream provider limits (#2802)
Integrated into release/v3.8.6
* chore: apply unit test fixes, polyfills, and environment precedence fixes
* docs(agents): atualiza fluxos de release e triagem
Expande os workflows de release para incluir auditoria de segurança,
CHANGELOG completo por commits, quality gate obrigatório, homologação em
VPS local, publicação oficial, deploy em Akamai e validação de artefatos.
Reorganiza a triagem de features com arquivos permanentes por bucket,
suporte a itens em andamento, regra de reclaim após 15 dias e novo
tratamento para ideias viáveis catalogadas.
Corrige a orientação de revisão de discussões para usar a ordem
cronológica real dos comentários e respostas ao identificar a última
atividade.
* fix(lockout): classify Gemini Antigravity resource exhaustion as quota_exhausted
* fix(reasoning): gate replay by interleaved field
* docs(rule-16): permit human Co-authored-by, restrict only AI/bot trailers
Rule #16 previously banned all `Co-Authored-By` trailers absolutely.
That blocked the upstream-port workflows (`/port-upstream-features` and
`/port-upstream-issues`), which must credit human upstream PR authors
and issue reporters in OmniRoute commits.
Refine the rule to ban only AI/bot-attributed trailers (Claude, GPT,
Copilot, Bot; anthropic.com / openai.com / bot-owned noreply.github.com
emails) while allowing standard human `Co-authored-by: Name <email>`
attribution.
Sync the rule across the source CLAUDE.md, the E2E shakedown doc note,
and 41 i18n translations.
* fix(gitlawb): add specialty validators for connection test — bypass /models probe
GitLawB OpenGateway API (xiaomi-mimo compatible) does not expose a /models
endpoint, causing validateOpenAILikeProvider to 404 on the initial probe
and report 'Provider validation endpoint not supported'.
Add specialty validators for both gitlawb and gitlawb-gmi that follow the
same pattern as the existing xiaomi-mimo validator: skip GET /models,
validate directly via POST /chat/completions with a minimal test message.
Any 401/403 response means an invalid key; all other responses mean auth
is OK.
Fixes test-connection returning 404 for GitLawB providers.
* test(gitlawb): add 12 unit tests for gitlawb and gitlawb-gmi specialty validators
Covers success, auth failure (401/403), non-auth acceptance (400/422/429),
network errors, and custom baseUrl overrides for both providers.
* feat(gitlawb): serve models from static registry without API-unavailable warning
GitLawB's OpenGateway API does not expose a /models endpoint per
provider-path. Previously the models route fell through to the generic
fallback which returned static catalog models with the misleading
'API unavailable — using local catalog' warning.
Now gitlawb and gitlawb-gmi are handled as static model providers
(same pattern as reka and qwen OAuth) — models are served from the
provider registry without any warning, since all registered models
are functional via POST /chat/completions.
* refactor(gitlawb): extract shared opengateway validator factory, fix docs path in test
- Extract gitlawb/gitlawb-gmi validators into buildOpengatewayValidator factory
- Fix dockerignore-docs-coverage test: update stale docs/AUTO-COMBO.md -> docs/routing/AUTO-COMBO.md
* fix(reasoning): guard interleaved capability lookup
* feat(gitlawb): dynamic model fetch with gmi-cloud fallback
Hybrid approach:
- gitlawb (xiaomi-mimo): dynamic /models endpoint → 356 models
- gitlawb-gmi (gmi-cloud): 404 fallback → local catalog gracefully
Mimics Gitlawb/openclaude's model-routing pattern
* i18n(pt-BR): complete missing translations and sync with en.json
* feat(build): nix multi-OS package manager install (#2806)
Integrated into release/v3.8.6
* fix(i18n): translate 144 new __MISSING__ pt-BR strings (#2816)
Integrated into release/v3.8.6
* chore(docs): set coverage gate to 40/40/40/40 in CLAUDE.md
Aligns the documented coverage gate with the v3.8.6 release decision
(lowered from 75/75/75/70). Matches the threshold already set in
package.json by the large feature PRs (planos 11-22).
* fix(cli): respect PORT env var in serve command (#2845)
Integrated into release/v3.8.6.
* fix(deepseek-web): return 400 when client sends tools[] - chat.deepseek.com has no tool support (#2854)
Integrated into release/v3.8.6.
* fix(qoder): reject invalid/expired PATs returning Cosy 500 error (#2860)
Integrated into release/v3.8.6.
* fix(cli): register openclaw in tool-detector (#2833) (#2850)
Integrated into release/v3.8.6.
* fix(api): include noAuth providers in /v1/models catalog (#2798) (#2814)
Integrated into release/v3.8.6.
* fix(combo): resolve custom provider targets via combo name (#2778) (#2812)
Integrated into release/v3.8.6.
* fix(translator): strip safety_identifier in openai-responses cleanup (#2770) (#2809)
Integrated into release/v3.8.6.
* fix(quota): honor explicit per-connection preflight opt-out (#2831) (#2844)
Integrated into release/v3.8.6.
* fix(usage): un-invert GitHub Copilot Free/limited quota — limited_user_quotas is remaining (#2876) (#2881)
Integrated into release/v3.8.6.
* fix(nous-research): correct baseUrl to include /chat/completions (#2826) (#2835)
Integrated into release/v3.8.6.
* fix(opencode): qwen3.x max/plus models lack vision support (#2822) (#2836)
Integrated into release/v3.8.6.
* fix(translator): pass-through tool_search built-in tool type (#2766) (#2811)
Integrated into release/v3.8.6.
* fix(github): route claude-opus-4.6 via chat completions (#2821)
Integrated into release/v3.8.6.
* docs(oauth): add Windsurf login fix design (Phase 1 hotfix + Phase 2 Firebase OAuth)
Two-phase plan to fix the broken Windsurf OAuth flow:
- Phase 1: drop the dead app.devin.ai/editor/signin PKCE path, promote
import-token from windsurf.com/show-auth-token as the primary path
- Phase 2: port Firebase OAuth + RegisterUser flow from
fendoushaonian/WindSurf-gRPC-API for full browser-based automation
Spec only - no code changes yet.
* docs(plan): Phase 1 windsurf login hotfix implementation plan
10 tasks covering:
- TDD assertions for flowType + 410 Gone responses
- Provider switch to import_token
- Route handler retiring authorize/start-callback-server/poll-callback
- OAuthModal UI override
- i18n sync
- Verification + PR steps
* fix(cli): replace cli-table3 with hand-rolled formatter (#2752) (#2813)
Integrated into release/v3.8.6.
* fix(skills): skip interception for unregistered client-native tools (#2815) (#2817)
Integrated into release/v3.8.6.
* feat(sse): add RTK filters for kubectl, docker-build, composer, gh (#2824)
Integrated into release/v3.8.6.
* fix(geminiHelper): support rec.image content shape + warn on dropped remote URLs (refs #2807) (#2855)
Integrated into release/v3.8.6.
* fix(cli): allow nullable/optional apiKey in cliMitmStartSchema (#2857)
Integrated into release/v3.8.6.
* fix(combo): preserve system messages during context handoff summary generation (#2865)
Integrated into release/v3.8.6.
* fix: wire CLIProxyAPI fallback settings into chatCore routing engine (#2866)
Integrated into release/v3.8.6.
* fix(usage): add opencode quota fetcher (#2852) (#2867)
Integrated into release/v3.8.6.
* feat(claude): default xhigh support for newer Opus models (#2874)
Integrated into release/v3.8.6.
* fix(cli): restore omniroute logs command stream (#2756) (#2810)
Integrated into release/v3.8.6.
* fix(combo): normalize upstream Headers for Node 24 undici interop (#2751) (#2823)
Integrated into release/v3.8.6.
* Rename proxy log Public IP to Client IP (#2880)
Integrated into release/v3.8.6.
* fix(claude): preserve max effort for supported models (#2875)
Integrated into release/v3.8.6.
* fix(oauth): switch windsurf provider to import_token flow
The PKCE auth URL targeting app.devin.ai/editor/signin returns 404
post-rebrand. Until Phase 2 ports Firebase OAuth + RegisterUser, the
only supported path is import-token via windsurf.com/show-auth-token.
- windsurf.ts: drop buildAuthUrl, set flowType=import_token
- generateAuthData returns supported:false + helpful error for windsurf/devin-cli
- tests: assert flowType + disabled stub
* fix(oauth): return 410 Gone for retired windsurf/devin-cli PKCE actions
start-callback-server, authorize, and poll-callback (GET + POST) now
return 410 Gone with a pointer to /import-token. The 410 short-circuit
runs before auth so the response is honest about the action being
permanently gone, not gated. Codex PKCE flow unchanged.
Tests: 5 new assertions cover GET + POST 410 paths and a Codex
regression check.
* refactor(oauth): annotate retired PKCE fields in WINDSURF_CONFIG
No behaviour change - comment-only update documenting that authorizeUrl,
codeChallengeMethod, callbackPort, callbackPath, apiServerUrl, and
exchangePath are no longer consumed. Active fields (inferenceUrl,
showAuthTokenUrl, firebaseApiKey, ideName) called out separately.
* fix(cli,docs): use requireCliToolsAuth in logs route + document OPENCODE quota env
Post-merge contract fixes for v3.8.6:
- src/app/api/cli-tools/logs/route.ts (#2810) now uses the shared
requireCliToolsAuth guard (param renamed req->request) to satisfy the
cli-tools-auth-hardening contract test.
- Document OMNIROUTE_OPENCODE_QUOTA_URL (#2867) in docs/reference/ENVIRONMENT.md
to satisfy the env/docs sync contract.
* fix(dashboard): force import-token panel for windsurf/devin-cli
Phase 1 hotfix: hide the 'Browser Login' tab and start in Paste API Key
mode. Removes windsurf/devin-cli from PKCE_CALLBACK_SERVER_PROVIDERS so
no callback server is started for them. Codex still uses the PKCE flow.
The 'Get token' link continues to point at windsurf.com/show-auth-token
via the existing supportsTokenPaste form copy.
* fix(oauth): windsurf import-token mapTokens signature mismatch
The route at `src/app/api/oauth/[provider]/[action]/route.ts` invokes
`providerData.mapTokens({ accessToken: token })` (object), matching the
cursor/kiro signature. The windsurf provider was declared with
`mapTokens(token: string)` instead, so the entire object was stored as
`accessToken`. When the connection record reached the SQLite layer it
crashed with:
SQLite3 can only bind numbers, strings, bigints, buffers, and null
Fix by aligning windsurf's `mapTokens` signature with the route caller
and the cursor/kiro convention. Also dedupe a copy-pasted second
`if (action === "import-token")` block in the route handler — the
second block was unreachable but identical to the first.
Adds two regression tests asserting that
`provider.mapTokens({ accessToken })` returns a string `accessToken` for
both windsurf and devin-cli, so a future signature drift trips the gate
instead of the SQLite bind error in production.
* feat(compression): expand pt-BR pack with troglodita rules (15 → 49) (#2818)
Integrated into release/v3.8.6
* fix(sse): repair RTK engine defaults so dedup and direct calls work (#2825)
Integrated into release/v3.8.6
* fix(mcp): redirect console.log/warn to stderr in --mcp stdio mode (#2840)
Integrated into release/v3.8.6
* fix(gemini-cli): prefer real project IDs over default-project (#2841)
Integrated into release/v3.8.6
* fix(opencode-go): add provider limits quota fetcher (#2861)
Integrated into release/v3.8.6
* Audit & add web cookie providers: fix 4 missing registry entries + DuckDuckGo (#2862)
Integrated into release/v3.8.6
* fix(antigravity): harden signatureless tool history (#2878)
Integrated into release/v3.8.6
* fix: provider model sync pruning and dynamic antigravity MITM proxy mappings (#2886)
Integrated into release/v3.8.6
* feat(usage): per-API-key token limits scoped to model/provider/global (#2888)
Integrated into release/v3.8.6
* fix(audio): build multipart body manually to preserve Content-Type (#2842)
Integrated into release/v3.8.6
* refactor: remove agent skill documentation files and streamline maintenance workflows
* test(stabilization): resolve unit test failures in blackbox-web, schema-coercion, translator-helper-branches, usage-service-hardening, and audio-transcription
* fix(security): mitigate Socket.dev supply-chain findings + secrets opt-in + minimal build profile (#2863) (#2871)
Two real security gaps closed and four cosmetic Socket.dev fingerprints removed.
See docs/security/SOCKET_DEV_FINDINGS.md for the per-finding maintainer
attestation.
Real bugs fixed:
- cloudSync: HMAC verification of `X-Cloud-Sig` + opt-in
`OMNIROUTE_CLOUD_SYNC_SECRETS=true` before overwriting `accessToken` /
`refreshToken` / `providerSpecificData` from a remote response. Closes the
silent-credential-swap surface (a misconfigured or hostile CLOUD_URL could
previously replace local tokens unverified).
- Zed import: split into 2-step `/discover` + `/import` flow. `/import` now
requires `confirmedAccounts: [{ service, account, fingerprint }]` and
re-reads the keychain server-side to filter by fingerprint, so a tampered
discover response cannot trick the endpoint into saving an unrelated token.
Cosmetic Socket.dev mitigations:
- runElevatedPowerShell writes the elevated payload to a per-call temp `.ps1`
file (mode 0o600) and references it via `-File`. Removes the textbook
`-EncodedCommand <base64utf16le>` pattern flagged as malware by Socket's AI
classifier.
- Maintainer attestation `SECURITY-AUDITOR-NOTE:` blocks added at every
flagged call site pointing to `docs/security/SOCKET_DEV_FINDINGS.md`.
Build-time hardening:
- `OMNIROUTE_BUILD_PROFILE=minimal` (`npm run build:secure`) physically
removes the four sensitive modules from the standalone bundle via webpack
`NormalModuleReplacementPlugin`. Stubs throw `FeatureDisabledError` at
runtime. Intended for the `omniroute-secure` artifact.
Tests:
- 24 new unit tests in `tests/unit/security/` covering the wrapper builder,
HMAC verification (4 cases), credential fingerprint determinism (5 cases),
confirmedAccounts validation + fingerprint filtering (6 cases), and the
minimal-build stubs (5 cases).
Docs:
- New `docs/security/SOCKET_DEV_FINDINGS.md` — per-finding attestation.
- New `socket.yml` — Socket.dev v2 config pointing at the attestation.
- Updated `SECURITY.md` — supply-chain scanner section.
- Updated `.env.example` — three new env vars documented.
Backwards compatibility:
- Cloud sync token overwrite is OFF by default. Users who relied on
it must set `OMNIROUTE_CLOUD_SYNC_SECRETS=true`. Breaking change documented
in CHANGELOG.
- Zed import 2-step is the new default; legacy 1-step preserved behind
`OMNIROUTE_ZED_IMPORT_LEGACY_ONE_STEP=true` and will be removed in v3.9.
Closes#2863
* fix(security): redact public Firebase Web key from windsurf spec; doc SHA-256 cache-key rationale (#2894)
Two security-scanning findings on release/v3.8.6:
- Secret-scanning alert 7 (google_api_key): the windsurf login-fix design spec
embedded the literal public Firebase Web API key on two lines. Firebase Web
API keys are non-sensitive by design (they identify the project; access is
gated by Firebase Security Rules + key restrictions), but the literal trips
secret scanning. Redacted to a placeholder; the embedded default still goes
through resolvePublicCred per rule #11.
- Code-scanning alert 261 (js/insufficient-password-hash): tokenCacheKey() uses
SHA-256 to derive an in-memory cache key from the session token, not for
password-at-rest storage. Added a comment documenting why CWE-916 KDFs do not
apply (false positive).
* fix(ci): resolve release/v3.8.6 gate failures (docs-sync, any-budget, pack-artifact) (#2895)
* fix(ci): resolve release/v3.8.6 gate failures (docs-sync, any-budget, pack-artifact)
Three CI gates failed on release/v3.8.6 (run 26630300877):
- docs-sync: CHANGELOG had a spurious "## [3.8.6-patch]" section above
"## [3.8.6]", so the latest release no longer matched package.json (3.8.6)
and the 41 i18n CHANGELOG mirrors were flagged as missing that section.
Fold the lone #2752 entry into [3.8.6] and drop the patch heading.
- any-budget:t11: open-sse/handlers/chatCore.ts regressed to 1 explicit `any`
(budget 0). Type the persist callback arg as Record<string, unknown>, which
matches runWithOnPersist's RefreshPersistFn contract exactly.
- pack-artifact: open-sse/utils/setupPolyfill.ts ships via package.json "files"
(bin/omniroute.mjs imports it at startup) but was missing from the pack
policy allowlist. Allow it and add a regression test.
* fix(security): redact public Firebase Web key from windsurf spec
Redact the literal public Firebase Web API key (secret-scanning #7) to a
placeholder, mirroring the redaction on release/v3.8.6 (PR #2894) and the
windsurf fix branch. Non-sensitive public Web key; trips secret scanning.
* feat(combo): Zero-Latency Combos (Hedging, Proactive Compression, Predictive TTFT) (#2868)
* feat(combo): implement zero-latency combo optimizations (hedging, proactive compression, predictive TTFT)
* fix(combo): fix predictive TTFT skip logic and unhandled promise rejections
---------
Co-authored-by: Automation <automation@omniroute>
* feat: implement automated skill workflows and update system configuration and validation schemas
* test: eliminate dynamic cast warnings in cloud-sync unit test
* test: isolate services-branch-hardening database directory to avoid concurrency issues
* feat(providers): add 7 new web-cookie providers + research catalog + discovery tool
New providers:
- huggingchat: free LLM chat via huggingface.co/chat (no subscription)
- phind: free dev-focused AI chat via phind.com/api/agent
- poe-web: multi-model chat via poe.com GraphQL (p-b cookie)
- venice-web: privacy-focused AI chat via venice.ai (session cookie)
- v0-vercel-web: Vercel v0 code gen via v0.dev (session cookie)
- kimi-web: Moonshot Kimi chat via kimi.moonshot.cn (session cookie)
- doubao-web: ByteDance Doubao chat via doubao.com (session cookie)
Additional:
- Research catalog: docs/research/UNLIMITED_LLM_ACCESS.md
- Discovery tool design + stub: src/lib/discovery/ + migration 073
- Unit tests: 33 tests for all 7 providers
- Shared helpers consolidated in error.ts (slop cleanup)
- All registered in WEB_COOKIE_PROVIDERS + providerRegistry + webSessionCredentials
Closes#2885
* fix(typecheck): resolve typecheck errors in combo spec and compression modules
* feat(api,oauth): add `agy` (Antigravity CLI) standalone provider with CLI token import (#2899)
Add a standalone OAuth provider `agy` (Antigravity CLI) next to gemini-cli/antigravity.
It reuses the antigravity inference backend (identical Google client_id +
daily-cloudcode-pa.googleapis.com endpoint, executor and token-refresh) but ships its own
model catalog — including the Claude models the backend exposes (claude-opus-4-6-thinking,
claude-sonnet-4-6) — its own account pool, and four ways to connect:
- token-file import (paste/upload the agy oauth token JSON)
- auto-detect a local CLI login (~/.gemini/antigravity-cli/antigravity-oauth-token)
- browser OAuth (via the shared OAuthModal Google loopback flow)
- bulk / ZIP import
New routes: POST /api/providers/agy-auth/{import,import-bulk,zip-extract,apply-local}.
Catalog pinned from the live :fetchAvailableModels endpoint. Docs (openapi.yaml,
ENVIRONMENT.md, .env.example, CHANGELOG) updated; new unit tests for registration,
the token parser, and route auth-hardening.
* fix(security): redact public Firebase Web key from windsurf spec (#2896)
Redact the literal public Firebase Web API key (secret-scanning #7) to a
placeholder. Firebase Web API keys are non-sensitive by design but the literal
trips GitHub secret scanning. Mirrors the redaction landed on release/v3.8.6
(PR #2894). Embedded default still flows through resolvePublicCred (rule #11).
* Pr 2871 (#2897)
* fix(security): mitigate Socket.dev supply-chain findings + secrets opt-in + minimal build profile (#2863)
Two real security gaps closed and four cosmetic Socket.dev fingerprints removed.
See docs/security/SOCKET_DEV_FINDINGS.md for the per-finding maintainer
attestation.
Real bugs fixed:
- cloudSync: HMAC verification of `X-Cloud-Sig` + opt-in
`OMNIROUTE_CLOUD_SYNC_SECRETS=true` before overwriting `accessToken` /
`refreshToken` / `providerSpecificData` from a remote response. Closes the
silent-credential-swap surface (a misconfigured or hostile CLOUD_URL could
previously replace local tokens unverified).
- Zed import: split into 2-step `/discover` + `/import` flow. `/import` now
requires `confirmedAccounts: [{ service, account, fingerprint }]` and
re-reads the keychain server-side to filter by fingerprint, so a tampered
discover response cannot trick the endpoint into saving an unrelated token.
Cosmetic Socket.dev mitigations:
- runElevatedPowerShell writes the elevated payload to a per-call temp `.ps1`
file (mode 0o600) and references it via `-File`. Removes the textbook
`-EncodedCommand <base64utf16le>` pattern flagged as malware by Socket's AI
classifier.
- Maintainer attestation `SECURITY-AUDITOR-NOTE:` blocks added at every
flagged call site pointing to `docs/security/SOCKET_DEV_FINDINGS.md`.
Build-time hardening:
- `OMNIROUTE_BUILD_PROFILE=minimal` (`npm run build:secure`) physically
removes the four sensitive modules from the standalone bundle via webpack
`NormalModuleReplacementPlugin`. Stubs throw `FeatureDisabledError` at
runtime. Intended for the `omniroute-secure` artifact.
Tests:
- 24 new unit tests in `tests/unit/security/` covering the wrapper builder,
HMAC verification (4 cases), credential fingerprint determinism (5 cases),
confirmedAccounts validation + fingerprint filtering (6 cases), and the
minimal-build stubs (5 cases).
Docs:
- New `docs/security/SOCKET_DEV_FINDINGS.md` — per-finding attestation.
- New `socket.yml` — Socket.dev v2 config pointing at the attestation.
- Updated `SECURITY.md` — supply-chain scanner section.
- Updated `.env.example` — three new env vars documented.
Backwards compatibility:
- Cloud sync token overwrite is OFF by default. Users who relied on
it must set `OMNIROUTE_CLOUD_SYNC_SECRETS=true`. Breaking change documented
in CHANGELOG.
- Zed import 2-step is the new default; legacy 1-step preserved behind
`OMNIROUTE_ZED_IMPORT_LEGACY_ONE_STEP=true` and will be removed in v3.9.
Closes#2863
* feat: implement automated skill workflows and update system configuration and validation schemas
* test: eliminate dynamic cast warnings in cloud-sync unit test
* test: isolate services-branch-hardening database directory to avoid concurrency issues
* chore(docs): refresh generated docs collection index
Update the generated Fumadocs browser collection mapping to keep
documentation imports in sync with the current docs structure.
* docs: update generated browser docs collection manifest
Refresh the generated Fumadocs browser collection mapping so the docs site can resolve the current documentation files correctly.
---------
Co-authored-by: OpenClaw <openclaw@kuzhomesrv.local>
Co-authored-by: Dmitry Kuznetsov <139351986+dmitry@users.noreply.local>
Co-authored-by: KuzyaBot <kuzya@local>
Co-authored-by: JeferssonLemes <jeferssondev@gmail.com>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: Markus Hartung <mail@hartmark.se>
Co-authored-by: akarray <akarray@users.noreply.github.com>
Co-authored-by: Apostol Apostolov <theapoapostolov@gmail.com>
Co-authored-by: Hernan Javier Ardila Sanchez <hjasgr@gmail.com>
Co-authored-by: Dmitry Kuznetsov <dmitry@kuznetsov.me>
Co-authored-by: Nikolay Alafuzov <alafuzov_nn@rusklimat.ru>
Co-authored-by: oyi77 <oyi77@users.noreply.github.com>
Co-authored-by: Ronaldo Davi <alltomatos@users.noreply.github.com>
Co-authored-by: levonk <277861+levonk@users.noreply.github.com>
Co-authored-by: Lenine Júnior <lenine@engrene.com.br>
Co-authored-by: Annas Alghoffar <aag.annas@gmail.com>
Co-authored-by: Tushar Agarwal <76201310+Tushar49@users.noreply.github.com>
Co-authored-by: GreatLiu <eurasiaxz@qq.com>
Co-authored-by: yuna amelia <230527278+yunaamelia@users.noreply.github.com>
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Container <78986709+disonjer@users.noreply.github.com>
Co-authored-by: nickwizard <35692452+nickwizard@users.noreply.github.com>
Co-authored-by: Rajvardhan Patil <rajvardhanpatil7890@gmail.com>
Co-authored-by: Raxxoor <manker_lol@hotmail.com>
Co-authored-by: Muhammad Mugni Hadi <mugnimaestra3@gmail.com>
Co-authored-by: mi <123757457+soyelmismo@users.noreply.github.com>
Co-authored-by: Automation <automation@omniroute>
Smaller fixes from the 2nd code-review pass on plan 21.
Backend / CLI / DB:
- memoryTools.ts: error-path fallback no longer hardcodes
retrievalStrategy:"exact"; uses DEFAULT_MEMORY_SETTINGS via
toMemoryRetrievalConfig (D16 / Bug #7).
- memory.mjs: applyLegacyTypeMap also runs on search / list / clear
(was only on add); legacy user/feedback/project/reference remap to
canonical types with a stderr warning (D17 / Bug #4).
- migrationRunner.ts: case "073" guards via
hasColumn(memories, needs_reindex) so an unmarked re-run of
073_memory_vec.sql is skipped cleanly (D27).
UI:
- MemoryEngineStatus: optional onConfigure callback; "Configurar →"
CTAs on the Embedding / Qdrant / Rerank rows when those components
are off or missing (matches §4.3 wireframe).
- EngineTab: scroll IDs on config cards + handleConfigure wired to
the status panel. Providers fetch moved from render body
(setState-during-render anti-pattern) into useEffect.
- RerankConfigCard: toggle is disabled when no provider has a key —
blocks turning rerank ON without a provider, still allows turning
it OFF (D13).
- MemoriesTab: Import validates each entry against the canonical
type enum before POST so invalid types are caught locally with a
clear skipped count.
Tooling:
- package.json: test:all includes test:vitest:ui so the UI suite
is no longer orphaned in CI.
Tests:
- cli-memory-commands: asserts updated for the new legacy->canonical
remap on search/clear.
- memory-embedding-resolve: drop always-true `|| reason.length > 0`
clauses that neutralized two assertions.
- memory-embedding-static-potion: model_load_failed test forces a
real load failure via MEMORY_STATIC_CACHE_DIR=/dev/null/<subdir>
and asserts EmbeddingError shape + reason + sanitized message
(replaces the previous `assert.ok(true)`).
- rerank-config-card.test.tsx: happy-path now uses a provider with
hasKey; new test covers the disabled-toggle guard.
Full memory suite green: 331/331 unit tests, 46/46 UI tests.
typecheck:core, typecheck:noimplicit:core, check:cycles clean.
recordRequestStart() now performs a cheap DB lookup (isCustomHost) before
building the InterceptedRequest. Hosts registered in inspector_custom_hosts
with enabled=1 receive source="custom-host" and agent=undefined, so they
appear correctly under the "Custom" profile filter instead of being
silently routed to "agent-bridge" entries.
Added isCustomHost() helper to inspectorCustomHosts.ts and a unit test
covering enabled custom-host, non-custom host, and disabled custom-host cases.
Wires the previously-dead appendSessionRequest() DB function to a new
POST /api/tools/traffic-inspector/sessions/[id]/requests route.
appendSessionRequest now returns the inserted seq so callers can confirm order.
InspectorSessionRequestAppendSchema (1 MB cap) guards the endpoint.
Integration test covers seq increments 1-2-3, requestCount sync, 400/404 paths,
and stack-trace-free error responses.
- Add `snapshotSession(sessionId)` to inspectorSessions.ts per master-plan §3.8:
returns parsed InterceptedRequest[] in seq order, or null for non-existent sessions.
Silently skips rows that fail InterceptedRequestSchema validation (defensive).
- Restore canonical no-arg form of `MitmHandlerBase.hookBufferUpdate(intercepted)`
per master-plan §3.5: when opts is omitted, derive completion fields from
the intercepted object itself (status/responseHeaders/responseBody/responseSize/
*LatencyMs) rather than no-op'ing. Extended opts form preserved for legacy callers.
- Update Zod record() calls in InterceptedRequestSchema to current (key,value) signature.
- Add 3 unit tests for snapshotSession (happy path / non-existent / silent skip).
- Add 2 unit tests for hookBufferUpdate (no-arg form + extended opts form).
Implements getPlan, listPlans, upsertPlan (idempotent ON CONFLICT DO
UPDATE), and deletePlan. Serializes QuotaDimension[] as JSON into
dimensions_json column and parses back on read. Malformed JSON returns
empty dimensions rather than throwing.
Implements listPools, getPool, createPool, updatePool, deletePool,
upsertAllocations (replace strategy via transaction), and
listAllocationsForApiKey. All SQL uses prepared statements. Local type
shapes aligned with src/lib/quota/dimensions.ts contract (B13).
Creates migrations 073 (quota_pools + quota_allocations) and 074
(quota_consumption sliding-window counter). Both are idempotent via
CREATE TABLE IF NOT EXISTS and CREATE INDEX IF NOT EXISTS. FK ON DELETE
CASCADE from quota_allocations to quota_pools. Fixes B2 IDs.
Implements listPlaygroundPresets, getPlaygroundPreset, createPlaygroundPreset,
updatePlaygroundPreset, and deletePlaygroundPreset using db.prepare() (never
raw db.exec or string interpolation). randomUUID() from node:crypto for IDs;
params serialized via JSON.stringify/JSON.parse with fallback to {}.
