Add poolConsumedTotal(poolId, dim) to the QuotaStore interface and implement
it in both SqliteQuotaStore and RedisQuotaStore so the enforce path can read
the real pool-wide consumption (sum across all keys) rather than the per-key
saturation signal, which is 0 for countable units and therefore never blocks.
- db/quotaConsumption.ts: add sumPoolDimension() — single SQL COALESCE(SUM)
for curr and prev buckets across all api_key_id rows for a dimensionKey.
- localDb.ts: re-export sumPoolDimension.
- quota/types.ts: add poolConsumedTotal to QuotaStore interface (with JSDoc).
- sqliteQuotaStore.ts: implement using sumPoolDimension + existing
slidingWindowEffective helper — one consistent sliding-window read.
- redisQuotaStore.ts: implement by fetching pool allocations from SQLite (F2),
then issuing a single MGET for all (key, curr-bucket) and (key, prev-bucket)
Redis keys, summing raw values, and applying the sliding-window formula once.
- tests/unit/quota-store-pool-total.test.ts: 4 tests (sum, pool isolation,
unit isolation, peek-no-regression) all passing.
getQuotaStore() is async; enforce.ts used it without await, so store was a Promise
and store.peek/store.consume threw 'not a function' → enforceQuotaShare failed open
on every request and recordConsumption never wrote. Production quota was a silent
no-op (unit tests passed because they inject a sync mock store). Await it + guard.
Adds 17 missing exports to the __testing object in usage.ts so
usage-utils.test.ts can import and test them. Also adds the
test file itself.
- toDisplayLabel, getClaudePlanLabel, createQuotaFromUsage
- getMiniMaxQuotaResetAt, isMiniMaxTextQuotaModel
- getMiniMaxSessionTotal, getMiniMaxWeeklyTotal
- createMiniMaxQuotaFromCount, getMiniMaxAuthErrorMessage
- getMiniMaxErrorSummary
- mapCodeAssistSubscriptionToPlanLabel
- mapCodeAssistTierIdToLabel
- mapSubscriptionTierStringToPlanLabel
Guard PUT and DELETE on /api/combos/[id] to return 409 when the target combo name
starts with QUOTA_MODEL_PREFIX; filter isHidden combos from the Combos page state
so quota-managed combos never appear as editable rows there.
deletePool now runs a SQLite json_each UPDATE inside the existing
transaction to remove the pool's id from every api_key's allowed_quotas
JSON array, preventing stale pool references after deletion.
Tests: tests/unit/quota-pool-delete-prune.test.ts (7 scenarios).
Runtime (enforce.ts): compute effectiveWeight = 100/N for each key when the
pool's total weight is 0, so pools with all-zero weights (newly created via
UI) are usable immediately without a re-save. Original non-zero weights are
unchanged.
UI (PoolWizard, EditAllocationsModal): addKey now recomputes all weights to
an equal split after adding a key, so saved pools store equal weights and
never persist all-zero allocations.
Tests: tests/unit/quota-equal-split.test.ts (7 scenarios).
getProviderModelIds read PROVIDER_MODELS, which is empty for CLI/OAuth providers
(codex, kimi, claude, …) — so pools built from those providers produced ZERO
quotaShared-* combos and their quota keys saw no models. Read the provider REGISTRY
instead (the same source /v1/models uses), which covers all providers.
Payload rules are written to the DB (key_value settings.payloadRules) and
mirrored into an in-memory runtimeOverride. After a restart, if runtimeOverride
is null — the boot applyRuntimeSettings hook didn't run in this module instance,
or a separate bundle instance in the standalone Next.js build — getPayloadRulesConfig
fell back to the (usually empty) config/payloadRules.json file and returned no
rules, so saved rules appeared to vanish.
The persistence/apply path is correct on inspection (DB write+read both use the
'settings' namespace; the boot hook sets the override with force:true); the null
override is an environment/bundling effect. Make getPayloadRulesConfig read the
DB-persisted rules (via getCachedSettings, the source of truth) before the file
when no override is set, so saved rules deterministically survive a restart.
Closes#2986
Adds a read-only AccountQuotaRow component that fetches cached quota data
from GET /api/usage/provider-limits (same endpoint as ProviderLimits.tsx)
and renders a compact per-connection quota summary (% remaining + reset
countdown) inside each PoolCard, below the dimensions section and before
the BurnRateChart. Fail-softs to "—" on error / empty / loading state.
Custom models (added via the UI) on opencode-go / openai-compatible nodes always
routed as OpenAI-compatible because there was no per-model targetFormat: addCustomModel
didn't accept it, the API schema stripped it, and getModelTargetFormat (static-registry
only) never saw it — so a custom model needing the Anthropic Messages shape fell back to
the provider default 'openai'.
Thread an optional targetFormat through addCustomModel / replaceCustomModels /
updateCustomModel + the providerModelMutationSchema + the POST/PUT route, surface it from
getModelInfo (one combined custom-model metadata lookup alongside apiFormat), and use it
in chatCore's targetFormat resolution before the provider default.
Closes#2905
A pool with N same-type connections now has an effective budget of
perAccountLimit × N per dimension. Only the limit fed to fair-share
scales — consumption (pool-keyed shared bucket) is unchanged.
Replace the (connId × modelId) upsert loop in syncQuotaCombos with a
model-grouped build: one combo per model with ALL connections as steps
and strategy "fill-first", fixing the collision where a second same-provider
connection overwrote the first (last upsert won, only one account ever used).
Pollinations retired the legacy text.pollinations.ai host, which now returns
404 'This is our legacy API' for all models. The registry primary baseUrl (and
the executor's hardcoded fallback) still pointed at it; gen.pollinations.ai/v1
is the current OpenAI-compatible gateway (it was already listed as the
secondary fallback). Make gen the sole/primary endpoint and align the executor
test.
Closes#2987
- Add assertSingleProvider() helper in quotaPools.ts: queries provider_connections
with DISTINCT provider WHERE id IN (...), throws if >1 provider detected.
- Call guard early in createPool (when connectionIds.length > 1) and updatePool
(when input.connectionIds.length > 1), before any DB writes.
- Add lockedProvider useMemo in PoolWizard.tsx: derived from first selected
connection; availableConnections filtered to same provider once locked.
- Show wizardSingleProviderNote i18n hint in step 1 when lockedProvider is set.
- Add wizardSingleProviderNote to en.json + pt-BR.json (parity).
- New test: tests/unit/quota-pool-single-provider.test.ts (4 cases).
- Update tests/unit/quota-multiprovider.test.ts: all D2 tests now use two
same-provider connections (both PROVIDER_A/openrouter) — the tests were
exercising connection-plumbing (scope, enforce membership, combo fan-out),
not mixed-provider behavior per se; updated to remain valid under Task 3 rule.
- Restrict the /authorize postMessage and the modal listener to the loopback
origin pair (localhost + 127.0.0.1) instead of "*"/single-origin. The dashboard
runs on localhost while Trae forces the callback onto 127.0.0.1, so a single
window.location.origin target silently dropped the success message (popup never
closed). Addresses CWE-359 without breaking the cross-loopback flow.
- TraeExecutor: cancel the SSE reader on completion, abort upfront when the caller
signal is already aborted, and accept string elements in array message content.
- Move ad-hoc dev scripts to scripts/ad-hoc/ per the repo style guide.
Free-plan Codex accounts (workspacePlanType === "free", from the OAuth id_token)
cannot run the server-side image_generation hosted tool, but the Codex CLI
injects it into every Responses request — causing an upstream 400. normalizeCodexTools
now drops image_generation when the connection is a free-plan account; paid plans
keep it. Mirrors CLIProxyAPI's isCodexFreePlanAuth guard.
Found during the #2980 (Codex OAuth compat) analysis against CLIProxyAPI.
Custom providers (openai-compatible-<uuid> / anthropic-compatible-<uuid>) showed
the raw UUID id instead of the user-given node name in the active-requests panel,
proxy logger, and home-page provider topology. Only RequestLoggerV2 resolved it
(via a local helper + /api/provider-nodes fetch).
Extract the resolver into a shared util (src/shared/utils/providerDisplayLabel.ts,
unit-tested), reuse it in RequestLoggerV2, and apply it (with a provider-nodes
fetch) in ActiveRequestsPanel, ProxyLogger, and the HomePageClient topology so all
surfaces show the user-defined provider name.
Closes#2968
The Docker image bakes NODE_OPTIONS=--max-old-space-size=256, and the standalone
launcher (scripts/dev/run-standalone.mjs, the Docker CMD) spawned 'node
server.js' without overriding it — so the server inherited the 256 MB cap and
OOMed randomly under load or with a large SQLite DB. `omniroute serve` already
honored OMNIROUTE_MEMORY_MB but the Docker path did not.
Add a shared resolveMaxOldSpaceMb() helper (OMNIROUTE_MEMORY_MB, default 512,
clamped [64,16384]) and have the launcher append --max-old-space-size to the
child NODE_OPTIONS (a trailing flag wins, overriding the baked 256 without
clobbering other flags). Update the .env.example doc to reflect the 512 default.
Web-cookie providers (gemini-web, claude-web, claude-turnstile) need
Playwright/Chromium, which only ships in the runner-web image. The default
docker-compose.yml had no profile targeting runner-web, so 'docker compose up'
ran the base image and those providers failed with
'Executable doesn't exist at .../ms-playwright/chromium...'.
Add an 'omniroute-web' service (target runner-web, image omniroute:web,
profile 'web') and document it in the header. Validated with
'docker compose --profile web config'.
(A) For a Codex-only account, a bare gpt-5.5 Responses request was rerouted to
codex with the model hardcoded to gpt-5.5-medium (chatHelpers.ts). The Codex
executor reads a model-name suffix as an explicit modelEffort that, per #2331,
overrides the client's reasoning.effort — so a genuine reasoning.effort=xhigh
was silently demoted to medium. Keep the bare gpt-5.5 id (the connection
fallback still supplies the default effort); the executor precedence is
untouched, so #2331 stays intact.
(B) gpt-5.5-xhigh/-high/-low misrouted to the openai provider (only bare gpt-5.5
was codex-preferred), so codex-only users got 'No credentials for provider:
openai'. Add the suffixed variants to CODEX_PREFERRED_UNPREFIXED_MODELS so they
infer codex before the /^gpt-/ → openai fallback.
Closes#2877
handleChatCore declared `const settings = cachedSettings ?? await
getCachedSettings()` twice in the same function scope — the consolidated
"fetch once, reuse" const near the top, plus a duplicate added alongside the
per-key stream-default-mode feature. esbuild/tsx rejected the same-scope
redeclaration ("The symbol 'settings' has already been declared"), which made
every unit test that imports chatCore fail to transform and broke the
production build.
Remove the duplicate; reuse the earlier consolidated `settings`. Add an
import-guard regression test.
GET /api/quota/pools/[id]/usage returns { usage: snapshot }, but usePoolUsage
stored the whole wrapper, leaving usage.dimensions undefined. StackedAllocationBar
then dereferenced usage.dimensions[dimensionIndex] (undefined[0]) and crashed the
entire quota-share page for any pool that has allocations. Unwrap data.usage in the
hook + defensively guard usage.dimensions?.[i] / dim.perKey ?? [] in the bar.
createSession() used rotator.random() despite its docstring saying 'next
available fingerprint'. Random draws collide in a small profile pool,
producing duplicate fingerprints (and duplicate sess-<fp>-<ms> ids) across
a warm pool — flaky tests and look-alike sessions. Switch to rotator.next()
so each pooled session gets a distinct fingerprint, as documented.
