- duckduckgo-web.ts: Add poolConfig (2-5 sessions, 1s cooldown)
- providerRegistry.ts: Add poolConfig field to RegistryEntry type, configure for llm7
- default.ts: Read poolConfig from registry in constructor
DuckDuckGo Web now uses pool for VQD token rotation.
LLM7.io now uses pool with 2s cooldown for its 1 req/s rate limit.
Move pool integration from Pollinations-specific code into BaseExecutor
so any executor can opt in via a protected poolConfig property.
Changes:
- base.ts: Add poolConfig, getPool(), buildPoolHeaders() to BaseExecutor
- pollinations.ts: Remove static pool, use base class pattern
- session-pool-modular.test.ts: 36 tests for provider-agnostic pool behavior
Closes#2953
server-ws.mjs imports ./peer-stamp.mjs but the npm-pack path didn't include it:
prepublish.ts didn't copy it and pack-artifact-policy pruned it (not in the
app/ allowlist). Without it the WS wrapper throws ERR_MODULE_NOT_FOUND on boot
and the peer-IP stamp (authz LOCAL_ONLY locality) never runs. Copy it in
prepublish + allowlist + mark required so a regression fails the pack.
Codex can emit a function_call with an empty/missing call_id; the matching
function_call_output then becomes a role:'tool' message with no preceding
tool_call, which the upstream rejects: "Messages with role 'tool' must be a
response to a preceding message with 'tool_calls'". The orphan filter let it
slip through because its guard (`&& rec.tool_call_id`) short-circuited on the
empty id.
Two changes in openaiResponsesToOpenAIRequest:
- Skip function_call items with an empty call_id (mirrors the empty-name skip),
so no dangling assistant tool_call with an unmatched id is emitted.
- Drop ANY role:'tool' message whose tool_call_id (including empty/missing) has
no matching tool_call, instead of only those with a truthy id.
Closes#2893
opencode-zen serves the public, signup-free OpenCode Zen endpoint
(https://opencode.ai/zen/v1). With no API-key connection configured,
getProviderCredentials returned null, so the Playground/combos surfaced
"No credentials for provider: opencode-zen" when selecting an OpenCode free
model.
Fall back to synthetic no-auth credentials for opencode-zen when no usable
connection exists (a configured active key is still selected first; a
rate-limited/terminal key returns its own signal before this point). Other
api-key providers are unaffected.
Closes#2962
Fireworks Fire Pass (fpk_*) keys return 403 "Fire Pass API keys are not
authorized for this route." on /models while still serving chat. Two paths
wrongly penalized the key:
- validateOpenAILikeProvider returned "Invalid API key" for any 403 on the
models endpoint without trying the chat probe.
- checkFallbackError classified the 403 as AUTH_ERROR (retryable cooldown), and
even a generic fall-through hit the transient-cooldown default — marking the
connection unavailable.
Fix: validateOpenAILikeProvider now inspects the 403 body and falls through to
the chat probe for "not authorized for this route" responses (401 and generic
403 still fail fast). checkFallbackError short-circuits such route-restriction
403s to { shouldFallback: false, cooldownMs: 0 } so the connection is not cooled
down. Per CLAUDE.md, a generic api-key 403 should be recoverable unless terminal.
Closes#2929
Satisfies the env/docs contract check (the per-process peer-stamp secret is
referenced in code; the auto-loader generates it, so it's documented as an
optional/auto var alongside OMNIROUTE_WS_BRIDGE_SECRET).
D2 moved poolSlug collection outside the connection loop, so a pool whose only
connection was deleted still leaked its slug into resolveQuotaKeyScope — that
slug has no quotaShared-* models behind it. Gate the slug on >=1 valid member
connection (restores Phase-A2 behavior for multi-connection pools).
Docker runs the Next standalone build (run-standalone.mjs), which now prefers
server-ws.mjs — but build-next-isolated.mjs only copied run-standalone.mjs, not
the WS wrapper or its deps, so Docker fell back to bare server.js with no peer
stamp (LOCAL_ONLY routes 403, CLI token broken — fail-closed but unusable).
Co-locate all three at the standalone root so the peer stamp runs in Docker too.
(The npm package path already ships them via prepublish.ts.)
The no-auth OpenCode provider has id "opencode" and alias "oc". The combo
builder built qualifiedModel from the provider id ("opencode/big-pickle"), but
parseModel("opencode/...") resolves to the opencode-zen api-key tier via a
manual ALIAS_TO_PROVIDER_ID override — not the no-auth "opencode" provider.
"oc/<model>" resolves correctly.
Rewrite qualifiedModel to the provider alias for no-auth providers (only when
the alias differs from the id), keeping providerId for getModelIsHidden. Aligned
the route test that previously asserted the buggy "opencode/" prefix.
Closes#2901
Adversarial review of the peer-IP fix surfaced: (1) CRITICAL — cliTokenAuth.ts
still derived loopback from new URL(request.url).hostname (the same spoofable
Host class), letting a remote caller with a stolen CLI token reach management
APIs via Host: 127.0.0.1; now it trusts the middleware-stamped locality verdict
(AUTHZ_HEADER_PEER_LOCALITY, a client-stripped trusted header). (2) HIGH —
isLoopbackHost mangled bare IPv6 (::1, ::ffff:127.0.0.1) via split(":")[0],
a fail-closed DoS on IPv6 deploys. (3) HIGH — the Docker entrypoint ran bare
server.js (no peer stamp); run-standalone.mjs now prefers server-ws.mjs.
Codex Desktop injects an image_generation hosted tool into every Responses API
request (even text-only ones). The tool-type validator threw
unsupportedFeature() (400) for it, breaking every Codex Desktop request.
Mirror the tool_search handling: add IMAGE_GENERATION_TOOL_TYPES, allow it past
the validator guard, and drop it from the tools array before forwarding to Chat
Completions.
Closes#2950
The github provider has format:"openai" (baseUrl .../chat/completions) plus a
separate responsesBaseUrl (.../responses); a model only uses the Responses API
when it sets targetFormat:"openai-responses". GitHub Copilot's Responses API
does not serve Claude/Gemini models, so claude-opus-4.7, claude-opus-4-5-20251101,
gemini-3.1-pro-preview and gemini-3-flash-preview failed with [400]. The working
claude-opus-4.6 carries no targetFormat and uses chat/completions.
Drop targetFormat:"openai-responses" from those four Claude/Gemini entries so
they use the provider default. Native OpenAI gpt-* models (and oswe-vscode-prime)
keep the Responses API.
Closes#2911
The middleware runtime exposes no socket, so a prior fix derived LOCAL_ONLY
locality from the Host header — letting a remote caller send Host: 127.0.0.1
and reach spawn-capable routes (RCE class). The custom Node servers now stamp
the real socket.remoteAddress into a token-signed internal header; the policy
trusts only a stamp whose token matches this process's secret, and fails closed
otherwise. Preserves the owner-authorized loopback + private-LAN access without
trusting any client-controlled header.
big-pickle's OpenCode/Zen upstream runs DeepSeek thinking mode, but the model
id reveals no DeepSeek signal, so requiresReasoningReplay (called with
allowLegacyFallback:false) never triggered. Follow-up/tool-use turns failed
with [400] 'The reasoning_content in the thinking mode must be passed back to
the API'. Note: requiresReasoningReplay does not consume supportsReasoning, so
the registry flag alone would not have fixed it.
Add RegistryModel.interleavedField (mirrors models.dev interleaved_field),
declare interleavedField:'reasoning_content' (+ supportsReasoning:true) on
big-pickle in both opencode and opencode-zen, and surface the registry value
in getResolvedModelCapabilities so requiresReasoningReplay returns true.
Closes#2900
077_api_key_stream_default_mode.sql and 077_quota_pools.sql both claimed
prefix 077, so getMigrationFiles() threw a version-collision error and
getDbInstance() failed at every startup (app would not boot; all DB-touching
unit tests were red on release/v3.8.8).
Renumber the dependency-free, idempotent quota_pools migration 077 -> 085
(no other migration references quota_pools/quota_allocations), keep the
non-idempotent api_key_stream_default_mode ALTER at 077, add a retroactive
isSchemaAlreadyApplied guard (case 085) for DBs that already applied it under
077, and add a regression test enforcing unique migration prefixes.
1. check-permissions.sh: swap NODE_OPTIONS flag order so runtime
OMNIROUTE_MEMORY_MB override wins (last flag takes precedence)
2. comboMetrics.ts: evictOldestMetric(targetMap) now accepts the
target map as parameter; cleanup timer iterates BOTH metrics
AND shadowMetrics; null lastUsedAt falls back to Date.now()
instead of epoch 0 (prevents premature eviction of intent-only
entries)
3. providerRegistry.ts: remove Proxy wrapper — adds CPU/complexity
overhead with zero memory savings since _REGISTRY_EAGER is
already fully allocated and generator functions iterate all
entries at startup. Simple re-export instead.
4. usage.ts: use per-cache TTL constants in cleanup timer
(ANTIGRAVITY_MODELS_CACHE_TTL_MS=1min, others=5min) instead of
single 10min SUB_CACHE_TTL_MS for all caches.
5. Add 18 unit tests for comboMetrics memory management covering:
basic CRUD, shadow metrics, intent tracking, eviction at capacity,
strategy tracking, and reset operations.
Dockerfile: OMNIROUTE_MEMORY_MB=1024 (was hardcoded 256MB).
NODE_OPTIONS now references OMNIROUTE_MEMORY_MB so users can
override via docker run -e OMNIROUTE_MEMORY_MB=2048.
check-permissions.sh: entrypoint reads OMNIROUTE_MEMORY_MB and
builds NODE_OPTIONS dynamically. This was documented in .env.example
but never actually implemented — the entrypoint just did exec
without processing the variable.
Combined with the first commit's cache eviction fixes, this should
prevent the OOM crashes that killed the process within 5 minutes
of intensive use.
- PoolCreateSchema: add optional connectionIds[] + .refine() that enforces primary membership
- PoolWizard: replace single-select dropdown with checkbox multi-select; first checked = primary (badge); step-2 adds helper note for additional connections; step-3 preview grouped by provider with +N more; POST body sends both connectionId and connectionIds
- PoolCard: optional providers[] prop renders a row of ProviderIcon (up to 3 + badge) instead of a single icon when pool has multiple connections
- i18n: 4 new keys added to both en.json and pt-BR.json (wizardConnectionsLabel, wizardPrimaryBadge, wizardAdditionalConnectionsNote, wizardPreviewMoreModels) — parity maintained (23 wizard keys each)
- Tests: quota-pool-wizard-multi.test.ts (21 tests) covering schema accept/reject, structural wizard assertions, and i18n parity
Root cause: Node.js process crashes with OOM (JavaScript heap out of memory)
within 5 minutes of intensive use. Heap exhausted at ~250MB.
Three fixes targeting the memory leak sources identified during investigation:
1. comboMetrics.ts — Add eviction + TTL for metrics/shadowMetrics Maps
- MAX_METRICS_ENTRIES = 500 (LRU eviction via lastUsedAt)
- METRICS_TTL_MS = 1 hour
- Cleanup interval every 5 minutes (unref'd)
- Size-cap checks in recordComboRequest, recordComboShadowRequest, recordComboIntent
2. usage.ts — Proactive TTL purging for 6 passive subscription caches
- SUB_CACHE_TTL_MS = 10 minutes
- Cleanup interval every 5 minutes (unref'd)
- Purges: geminiCliSubCache, antigravitySubCache, antigravityAvailableModelsCache,
antigravityCreditProbeCache
- Inflight Maps left alone (self-clean on Promise resolution)
3. providerRegistry.ts — Lazy Proxy for 212 provider entries
- REGISTRY renamed to _REGISTRY_EAGER, wrapped in lazy Proxy
- Individual entries materialized on first access only (_registryCache Map)
- _byAlias, _unsupportedParamsMap, _passthroughProviderIds all made lazy
- getRegisteredProviders() returns pre-computed _registryKeys (no eager iteration)
Also noted: Dockerfile hardcodes --max-old-space-size=256 (too low for production).
.env.example documents OMNIROUTE_MEMORY_MB but no script reads it — entrypoint
should be updated separately to respect this setting.
TypeScript: zero new errors introduced (pre-existing mcp-server/server.ts errors
confirmed on main branch)
- quotaKey.ts (resolveQuotaKeyScope): iterate pool.connectionIds (fall back to
[connectionId] for un-backfilled rows); each connection contributes its own
connId + provider to the scope. poolSlugs logic unchanged (one slug per pool).
- quotaCombos.ts (syncQuotaCombos): replace single-connection resolvePoolProvider
with resolvePoolForSync that returns all connectionIds; iterate each connId to
build the desiredNames union across all providers; upsert combos pinned to the
CORRECT per-connection connId; prune against the full union so only truly stale
combos (no longer produced by any current connection) are deleted.
- enforce.ts (enforceQuotaShare + recordConsumption): both pool-matching loops
changed from equality (p.connectionId === input.connectionId) to membership
(p.connectionIds.includes) with fallback for un-backfilled rows. Fail-open
(B16) and pool-level dimension key semantics are preserved unchanged.
- quotaPools.ts: no logic change needed — connectionIds already flows through
getPool (D1); syncQuotaCombosGuarded passes poolId and syncQuotaCombos
resolves the full QuotaPool internally.
- tests/unit/quota-multiprovider.test.ts: 6 new tests covering D2 (scope,
enforce primary/secondary membership, combos 2-provider create + prune).
All 22 tests pass (14 new + 8 existing enforce + pool-connections suites).
Full SOLO remote-agent integration against solo.trae.ai's reverse-engineered
API (upgrades the previous import_token stub).
- open-sse/executors/trae.ts: streaming executor for the solo_agent_remote API
(POST /chat_sessions + GET /events SSE -> OpenAI chat.completions), accumulating
plan_item thoughts and mapping token_usage. Headless Cloud-IDE-JWT refresh via
the ExchangeToken endpoint.
- Session mode via model id: `trae/work` runs the fast work-mode auto agent;
`trae/auto` and named models (gpt-5.4, kimi-k2.5, gemini-3.1-pro, ...) run in
code mode.
- Provider registry entry (models + 272k context) and executor wiring.
- Two credential paths: browser /authorize loopback callback (captures the JWT +
long-lived refresh token) and manual Cloud-IDE-JWT paste via
POST /api/oauth/trae/import (Zod-validated).
- TraeAuthModal dashboard UI wired into the provider detail page.
- mapTokens/providerSpecificData carry the SOLO common_params identity fields.
- Tests: executor (stream/non-stream/error/refresh/work-mode + callback parser)
and updated oauth-trae provider tests.
Adds migration 086 to create the `quota_pool_connections` join table with a backfill
that seeds every existing pool's single connection_id as its first member. Updates
QuotaPool type with `connectionIds: string[]`, wires createPool/updatePool/deletePool
to maintain the join table transactionally, and keeps `connection_id` as the primary
back-compat column synced to `connectionIds[0]`.
