Next.js does not support glob patterns in allowedDevOrigins, so the wildcard
was silently ignored — blocking HMR access from 192.168.0.250 and causing an
infinite loading spinner on the login page when accessed from the LAN.
- Use Input's built-in icon prop so the search icon renders inside the correct
positioned context (Input's internal div.relative) instead of misaligned outside
- Switch from className to inputClassName so padding applies to the actual <input>
element, not the outer wrapper div
- Remove flex-1 spacer; make search container flex-1 so it fills available width
- ProviderCard: add cloud-agent dot (violet) to DOT_COLORS
- page.tsx: web-cookie/search/audio/cloud-agent/local/upstream-proxy
sections now pass their actual type as authType instead of displayAuthType
(which was always "apikey" for all static catalog groups)
- page.tsx: split search bar row into 25% input + 75% dot-type legend
showing all 10 auth types with their colors and translated labels
Add passthroughModels: true to the opencode registry entry so that unknown
model IDs trigger model lockout instead of connection cooldown. Fix dot color
for FREE_PROVIDERS in the Free Tier section by using toggleAuthType === "free"
to select the green dot instead of the blue oauth dot.
Moves Compatible Providers to the top (before Expiration Banner) so users can
add custom OpenAI/Anthropic compatible providers without scrolling. Reduces
ProviderCard icon from 32px to 28px and increases grid density by one column at
each breakpoint (gap-4→gap-3). Adds a curated Free Tier Providers section with
27 providers (OAuth/noAuth group + API-key free-tier group), positioned between
Expiration Banner and OAuth Providers. Cards in the free section suppress the
hasFree badge since context makes it implicit.
Adds 'opencode' to FREE_PROVIDERS as a no-auth provider using the public
OpenCode endpoint (https://opencode.ai/zen/v1). The existing OpencodeExecutor
already skips the Authorization header when no API key is present. Registry
entry reuses the opencode executor and shares models from the zen/v1 endpoint.
opencode-zen returns Claude-format SSE bodies (type: 'message_start', no
choices array) for qwen3.6-plus and qwen3.6-plus-free even when the request
hits the OpenAI-compatible /chat/completions endpoint. Clients expecting
OpenAI format fail Zod validation with 'expected choices (array), received
undefined'.
Flagging these two models with targetFormat: 'claude' makes the opencode
executor route through /messages and the response is parsed by the Claude
translator. This matches the existing minimax-m2.7/m2.5 pattern in
opencode-zen and is the minimum-risk fix that ships in v3.8.0.
The broader runtime format-detection refactor proposed by @raccoonwannafly
(detect Claude payload on 200 response from OpenAI endpoint) is deferred
to a dedicated PR with end-to-end tests.
Custom embedding models on the DeepInfra provider (e.g.
Qwen/Qwen3-Embedding-8B) were rejected by createEmbeddingResponse with
'Unknown embedding provider: deepinfra. No matching hardcoded or local
provider found.' because the registry only included Nebius/OpenAI/Together/
Fireworks/NVIDIA/Mistral/Voyage/Jina/Gemini. The fallback to
provider_nodes only resolves localhost/172.x dev URLs, so remote DeepInfra
keys had no path to /v1/embeddings.
Adds DeepInfra with 8 popular embedding models (Qwen3-Embedding-8B/4B/0.6B,
BGE Large/Base/M3, E5 Large v2, GTE Large) routed through
https://api.deepinfra.com/v1/openai/embeddings.
Part 1 (incomplete model list import) still needs reproduction details
from the reporter and will be tracked separately.
The existing /api/combos GET requires a management token, which broke
read-only integrations (opencode-omniroute-auth plugin and similar) that
need to enrich combo capabilities from a normal Bearer API key. Those
clients got 403 AUTH_001 'Invalid management token' even though the same
API key could list models via /v1/models.
This adds GET /v1/combos with the same auth model as /v1/models:
- Accepts valid Bearer API key OR dashboard session cookie.
- Falls back to anonymous when REQUIRE_API_KEY=false (single-user local).
- Projects ONLY public metadata: name, strategy, description, model id,
providerId, comboName (for combo-refs). Internal routing details
(connectionId, weights, labels, sortOrder, config) are stripped.
/api/combos (management writes) is unchanged.
The OpenAI Responses API path emits 'developer' role messages. The previous
default preserved that role for any targetFormat=openai upstream, which broke
DeepSeek, MiniMax, Mimo, GLM, Fireworks, Together, and most other
OpenAI-compatible gateways with '[400]: unknown variant developer, expected
one of system/user/assistant/tool'.
New default: preserve developer only for the openai-family allowlist
(openai, azure-openai, azure, github, or any id containing 'openai').
Convert developer→system for everyone else when preserveDeveloperRole is
not explicitly set. The dashboard 'Compatibility → preserveOpenAIDeveloperRole
= true' toggle still forces preservation when needed.
- Add /dashboard/audit/a2a page with A2aAuditTab: lists tasks with skill/state
filters, colored state badges, duration, events and artifacts counts
- Add "A2A Audit" item to Audit sidebar group (Monitoring section)
- Remove duplicate "MCP Audit" from MCP Server sidebar group — it stays
only in the Audit group under Monitoring
- Improve McpAuditTab: fetch /api/mcp/audit/stats and show 4-card stat bar
(calls 24h, success rate, avg duration, top tool) above the filters
- Add audit-a2a to HIDEABLE_SIDEBAR_ITEM_IDS
- Add i18n keys: auditA2a in sidebar + header sections, a2a* in compliance namespace
- Rename sidebar/page titles: "mcp" → "MCP Server", "a2a" → "A2A Server" (en.json)
- Wrap top header section in <Card> on both MCP and A2A pages for consistent styling
- Remove redundant "hub MCP Server" / "group_work A2A Server" headings from page body
- Add MCP_GROUP collapsible sidebar group (MCP Server + MCP Audit) in Agentic Features
- Update AGENTIC_FEATURES_ITEMS type to SidebarSectionChild[] to support groups
- Remove Integration Surface card (tab switcher + Protocols tab card)
- API endpoints list always visible (no tab toggle needed)
- Cloud OmniRoute moved to first position inside Tunnels accordion section
- Tunnels header always visible (was conditional on tunnel flags)
- Cloudflare row: no longer collapsible — flat row with inline notice/error
- Remove leading comma from LAN IP and Tailscale IP inline displays
- Remove Cloudflare URL notice text (always-shown description removed)
- Remove double border between Tunnels header and Cloud OmniRoute row
- ngrok authtoken label: "not set in environment" (was "not set")
- MCP page: description + 3-step quick start merged into header area
- A2A page: description + 3-step quick start merged into header area
- Promote prevHeaders from per-batch local to module-level global with 60s TTL
- Share rate-limit throttle state across sequential batches
- Use 24h time-based retry limit (MAX_RETRY_DURATION_MS) instead of count-only
- Increase baseMs to 5s and maxMs to 1h for batch-appropriate backoff
- Add getCachedHeaders/resetCachedHeaders test helpers
- 7/7 unit tests pass
Authored-by: Markus Hartung <hartmark@users.noreply.github.com>
- Local Server: show LAN IPs inline (comma-separated) instead of chips below name
- Tailscale row: show Tailscale IP (100.x) inline with comma in row header
- Cloudflare expanded: remove readOnly URL input (URL visible in Active Endpoints bar)
- Tailscale expanded: remove both URL inputs; sudo field always visible (not conditional on running state)
- ngrok expanded: remove readOnly URL input; keep only authtoken field
- tailscaleTunnel: add 'serve status' fallback for older/permissioned CLI builds
- tailscaleTunnel: use settings.tailscaleEnabled as fallback when live funnel detection fails
- tailscaleTunnel: use path.format() to avoid CWE-22 false positive on sibling binary path
- api/network/info: new endpoint returning LAN IPs and Tailscale interface IP
- endpoint page: show machine LAN IP chips in Local Server row for network access
- endpoint page: show Tailscale 100.x IP URL in expanded Tailscale panel
- endpoint page: fix Tailscale Stop Funnel icon (vpn_lock_off -> vpn_key_off, valid glyph)
- Remove inline URL <code> blocks from all 5 connection rows (URLs now show only in the Active Endpoints bar)
- Show Active Endpoints bar when any URL is active (was: only when > 1)
- Fix Tailscale missing from Active bar by falling back to tunnelUrl when apiUrl is null
- Persist ngrok authtoken to /api/settings after first successful enable; restore on startup so it never needs re-entering
- /dashboard/mcp: adiciona ServiceToggle (ON/OFF), TransportSelector (stdio/SSE/streamable-http) e DisabledPanel
- /dashboard/a2a: adiciona ServiceToggle (ON/OFF) e DisabledPanel
- /dashboard/endpoint: remove abas MCP, A2A e API Endpoints (agora têm páginas próprias), renderiza só EndpointPageClient
- ApiEndpointsTab: remove sub-aba Webhooks (migrada para /dashboard/webhooks)
- DeepSeekWebExecutor with ds_session_id cookie auth
- DeepSeekWebWithAutoRefreshExecutor for session management
- Keccak-based PoW solver (DeepSeekHashV1)
- SSE stream transformation to OpenAI format
- Provider constant and alias (ds-web)
- 23 unit tests + live integration test
Authored-by: Paijo <oyi77@users.noreply.github.com>
Removes default daily/weekly/monthly request caps (1K/5K/20K) that were
silently applied to API keys without explicit rate limits, causing
surprise 429s in production aggregator deployments.
Authored-by: josephvoxone <josephvoxone@users.noreply.github.com>
Adds a complete executor for DeepSeek's native web API with:
- Authentication via ds_session_id cookie → Bearer token from /users/current
- Proof-of-Work (DeepSeekHashV1) solver using custom Keccak sponge
- SSE stream response parsing with OpenAI-compatible output
- Web search toggle (search_enabled)
- Deep thinking toggle (thinking_enabled + x-thinking-enabled header)
- File attachment support (ref_file_ids)
- Auto-refresh executor for session management
- 23 unit tests covering all features + live integration test
API flow: /users/current → /chat_session/create → /create_pow_challenge
→ PoW solve → /chat/completion with native DeepSeek body format
Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
- Add missing column to provider_connections CREATE TABLE baseline so
fresh/in-memory databases include it from the start
- Call ensureProviderConnectionsColumns for in-memory instances to match
the file-backed path
Compresses the explanatory NOTE in claudeCodeToolRemapper.ts from 6 lines
to 4 while keeping the actionable why: the flag has no readers, would
leak into the Anthropic request body causing HTTP 400 (Extra inputs are
not permitted), and the response-side remap is unconditional.
Addresses gemini-code-assist review feedback on PR #2290.
- Rename first section from "Routing" to "OmniProxy" with collapsible header
- Accordion behavior: opening a section closes all non-pinned sections
- Pin button (push_pin) on section headers — visible on hover, always visible when pinned
- Pinned sections stay open regardless of accordion toggle
- Both expanded + pinned state persisted to localStorage
- i18n: add omniProxySection key to all 41 locales
