CodeQL re-flagged the HMAC variant from #2394 at high severity (#247) —
its data-flow analysis still sees an OAuth bearer reaching .update(token)
and applies js/insufficient-password-hash, regardless of whether the hash
primitive is createHash or createHmac.
Stop hashing the token at all. The session-pool Map is keyed by the
token verbatim, falling back to "anonymous" when the input is missing
or empty. This is safe because:
- The token is already held in CopilotSession.cookies for every pool
entry, so the Map key adds no new in-memory exposure.
- The pool is bounded by MAX_POOL_SIZE with LRU eviction, so memory
stays bounded regardless of how many distinct tokens appear.
- bcrypt/scrypt/argon2 — the only forms CodeQL accepts here — are the
wrong tool, since their slowness exists to thwart brute-force of
low-entropy human passwords we do not have.
Tests
- Replace the "16-char hex" shape assertion with verbatim-equality
assertions and an explicit "empty string → anonymous" case.
- Keep the regression guard that fails if anyone ever re-introduces
createHash/createHmac on the token (catches the alert reappearing
before CodeQL does).
- 16/16 copilot-web tests pass.
CodeQL re-flagged the SHA-256 inside sessionPoolKey at high severity even
after the rename/dedup in #2391 — its data-flow analysis still tracks the
OAuth bearer (accessToken → token) into createHash and applies the
js/insufficient-password-hash rule. Bcrypt/scrypt/argon2 would be wrong
here (the input is a high-entropy bearer, not a low-entropy human password
that needs brute-force protection).
Switch to HMAC-SHA-256 with a process-scope key generated at startup
(randomBytes(32)). HMAC is a MAC primitive, not a password hash, so the
CodeQL rule no longer applies; uniqueness, determinism-within-process,
and the 16-char hex shape all still hold, and as a small bonus an
off-process attacker can no longer precompute pool keys from a token
alone.
Tests
- Replace the "exact SHA-256 prefix" assertion with shape/uniqueness
checks and a regression guard that fails if the implementation ever
reverts to plain createHash.
- All 15 copilot-web tests pass.
Re-adds the "Special thanks to 9router by decolua" line at the top of the
Acknowledgments section. The reference was present through v3.7.x and was
inadvertently dropped during a docs cleanup; OmniRoute is a TypeScript
rewrite that originally built on 9router's design, so this credit belongs
alongside the other "inspired-by" entries (CLIProxyAPI, Caveman, RTK).
#243 (js/request-forgery, high) — providers/bulk/route.ts
- Replace `fetch(\${origin}/api/providers/validate)` (where origin came from
spoofable `new URL(request.url).origin`) with a direct in-process call to
validateProviderApiKey. Eliminates the SSRF vector and the HTTP round-trip
through the same app.
- Resolve proxy once outside the loop and reuse via runWithProxyContext.
- Drop now-unused passthroughAuthHeaders helper.
#244 (js/resource-exhaustion, warn) — copilot-web.ts::solveHashcash
- Clamp upstream-supplied `difficulty` to [1, 8] before `"0".repeat(difficulty)`
so a malicious/buggy server can't force a huge prefix allocation or push the
10M-iteration loop into effectively unbounded work.
#245 (js/insufficient-password-hash, warn) — copilot-web.ts::getSession
- Dedupe the inline `createHash("sha256").update(accessToken)` call by reusing
the existing sessionPoolKey helper.
- Rename its parameter from `accessToken` to `token` and document that the
input is a high-entropy OAuth bearer used only as an in-memory Map key —
bcrypt/scrypt/argon2 would be incorrect here, and SHA-256:16 is an
appropriate fingerprint per docs/security/PUBLIC_CREDS.md.
Tests
- Export solveHashcash and add unit tests asserting it returns null for
out-of-range / non-integer difficulty and produces a numeric nonce for the
common difficulty=1 case.
- All 26 tests in copilot-web-executor.test.ts and providers-bulk-route.test.ts
continue to pass; sessionPoolKey contract (SHA-256:16) preserved.
- BudgetTab: compute projectionOverBudget per key (HIGH)
- ProviderLimits: convert outer button to div role=button to fix invalid HTML nesting
- Runtime: externalize all strings via next-intl (runtime namespace)
- QuotaShare: externalize all strings via next-intl (quotaShare namespace)
- Add /api/usage/budget/bulk endpoint and switch BudgetTab to single fetch (avoid N+1)
Co-authored-by: diegosouzapw <diego.souza.pw@gmail.com>
New files added via package.json files[] field in the cli-tools feature:
- src/lib/cli-helper/ (config generators, doctor checks, log-streamer, tool-detector)
- @omniroute/opencode-provider/ (workspace package published alongside)
- scripts/postinstall.mjs and scripts/build/sync-env.mjs (new install scripts)
Replace import("monaco-editor") with import("monaco-editor/esm/vs/editor/editor.api")
in MonacoEditor.tsx. The root package entry resolves to the minified bundle
(min/vs/editor/editor.main.js) which requires the monaco-editor-webpack-plugin
loader "vs/nls.messages-loader". The ESM API module has no such dependency and
satisfies loader.config({ monaco }) identically.
noImplicitAny check rejects FREE_PROVIDERS[resolvedId] because resolveProviderId
returns string but FREE_PROVIDERS has literal key types. Cast to
Record<string, {noAuth?: boolean} | undefined> to express the intent clearly.
Adds `.safeParse()` to cli-tools/apply and cli-tools/config POST handlers to
satisfy the check:route-validation:t06 CI gate. Regenerates all 41 locale
translations of CLAUDE.md to clear the i18n strict-drift check failure.
Claude requires tool_result in the IMMEDIATELY next message after tool_use.
Existing fixToolPairs() checks global ID presence but not adjacency —
keeping tool_use blocks whose tool_result exists later in the array but
not in the next message, causing 400 errors.
Add fixToolAdjacency() that runs after fixToolPairs() to remove tool_use
blocks where the next message has no matching tool_result.
Pipeline: fixToolPairs → fixToolAdjacency → stripTrailingAssistantOrphanToolUse
Closes#2382
Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
* refactor(dashboard): sidebar subtitles, providers UX, monaco self-host
Sidebar:
- Add subtitleKey to all ~50 menu items so every entry shows a short
description line (previously only 7 had subtitles).
- Inject 50 new sidebar.*Subtitle keys across all 42 i18n locales
(en/pt-BR translated; remaining locales fall back to English).
- Fix DATA_÷IC glitch: replace invalid Material Symbols icon
"data_compression" with "compress" on analytics-compression.
- Rename "Compression Combos" -> "Engine Combos" to avoid truncation
and disambiguate from the OmniProxy Combos item.
Auto-routing banner:
- Move AutoRoutingBanner from DashboardLayout (rendered on every page)
to /home only, so it no longer follows the user across the dashboard.
Monaco editor:
- Add shared MonacoEditor wrapper that calls loader.config({ monaco })
to load Monaco from the bundled monaco-editor package instead of the
jsdelivr CDN (blocked by CSP script-src 'self'), fixing the
"Monaco initialization: error" runtime error.
- Migrate the 5 direct dynamic imports of @monaco-editor/react to the
wrapper (playground, search-tools, translator).
Providers page UX:
- Replace the static legend + 4-stat divider + duplicate filter chips
with a single row of clickable category pills with embedded counters
(All, Free, OAuth, API Key, IDE, Compatible, Web Cookie, Search,
Audio, Local, Cloud Agent).
- Remove redundant per-section Free only / Configured only toggles and
the Zed Import button from the OAuth section header.
- Introduce a dedicated "IDE Providers" section (Cursor, Zed, Trae)
rendered under OAuth Providers; exclude IDE_PROVIDER_IDS from OAuth
to avoid duplication.
- Add zed and trae providers, plus IDE_PROVIDER_IDS set.
- Move the Zed keychain import to /dashboard/providers/zed as a
contextual Card, instead of cluttering every OAuth section header.
- Extend test-batch route and validation schema with mode: "ide".
* feat(dashboard): add token saver controls to endpoint and context pages
Expose the Token Saver master settings from the endpoint page and
surface its disabled state across the Caveman and RTK context pages.
Update default compression behavior to start disabled with lighter
intensity presets, and add Caveman input compression controls so users
can configure input and output modes separately.
Tighten provider page section rendering by gating compatible, free,
oauth, and api key blocks behind their visibility checks and simplify
several summary labels.
* feat(dashboard): add runtime page and rename limits to quota
Introduce a dedicated runtime observability page for circuit
breakers, cooldowns, lockouts, sessions, and quota alerts.
Split provider quota out of the old limits route, add a redirect from
`/dashboard/limits` to `/dashboard/quota`, and update sidebar/header
labels and i18n keys to match the new navigation.
Enhance provider quota filtering state and remove the tier coverage
widget from the dashboard home view.
* feat(dashboard): redesign budget page and add quota sharing preview
Budget (/dashboard/costs/budget) gets a full rewrite:
- Hero with 6 KPIs (today, month, projected EOM, blocked, at-risk, active)
- Status pills with counts (blocked/alerting/warning/safe/no-limit)
- Templates row (localStorage) with bulk-apply to selected keys
- Multi-key table with checkbox selection and colored progress bar
- Expandable rows with projection card and per-provider cost breakdown
(last 30d via /api/usage/analytics?apiKeyIds=) plus inline edit form
Quota sharing (/dashboard/costs/quota-share) is new and ships as a beta
UI preview backed by localStorage. Pool persistence in the DB and
request-pipeline enforcement are intentionally deferred to a follow-up.
The page lets operators:
- Create pools from a provider connection + quota window
- Edit allocations per API key with % split and equal-split helper
- Toggle hard/soft/burst policy intent
Donut chart rendered with inline SVG; allocation editor in a modal.
Sidebar gets the new "Quota Sharing" entry under Costs Parameters; i18n
keys propagated across all 41 locales with PT-BR translation.
---------
Co-authored-by: diegosouzapw <diego.souza.pw@gmail.com>
Error message sanitization (Hard Rule #12):
- claude-auth/export, codex-auth/export, gemini-cli-auth/export routes: replace
raw err.message with sanitizeErrorMessage() from open-sse/utils/error.ts
- imageGeneration, musicGeneration, videoGeneration handlers: import
sanitizeErrorMessage and replace all err.message in return values
- veoaifree-web executor: replace raw upstream response data in errResp() calls
with static strings
OAuth callback page (callback/page.tsx):
- Remove useSearchParams/Suspense dependency that caused hydration failures in
popup windows navigating back from Google OAuth (COOP header severs opener)
- Use window.location.search directly in useEffect with three send methods:
postMessage, BroadcastChannel, localStorage
- Fix postMessage target from "*" to window.location.origin (semgrep finding)
- Move setCurrentUrl call to manual-only branch to avoid unnecessary renders
copilot-web executor:
- Move accessToken from WebSocket URL query string to Authorization header
(avoids credential exposure in server logs)
- Add MAX_POOL_SIZE=100 cap to sessionPool with LRU eviction of oldest entry
CodeQL ReDoS fixes (js/polynomial-redos #233-240):
- Replace while(s.endsWith("/")) s=s.slice(0,-1) pattern (O(n²) allocations)
with index-based loop (O(n) time, single final slice) in:
bin/cli/api.mjs, all 6 cli-helper config generators, opencode-provider
Gemini OAuth:
- mapTokens: add idToken field to fix "missing id_token" export error
Docker images launched without a sibling Redis container used to spam
'[REDIS] Error: connect ECONNREFUSED 127.0.0.1:6379' for every
rate-limit and API-key-auth cache lookup. The root cause was a default
of process.env.REDIS_URL || 'redis://localhost:6379' that turned the
opt-in cache into a hard dependency.
Three coordinated changes:
1. src/shared/utils/rateLimiter.ts — gate Redis on REDIS_URL being
explicitly set. getRedisClient() returns null when disabled; the
single connection-error handler dedupes via a redisErrorLogged latch
so a sustained outage produces one warn instead of per-request flood.
checkRateLimit() routes to the existing in-memory store on both the
'disabled' and 'test' paths.
2. src/lib/db/apiKeys.ts — short-circuit Redis-backed auth cache reads
and writes when getRedisClient() returns null. SQLite remains
authoritative; the cache is purely an optimization.
3. Same file — replace the wildcard scope matcher's dynamic RegExp
compilation with a deterministic segment walker. Eliminates the
ReDoS surface on operator-supplied scope patterns and silences the
Semgrep js/regex-injection advisory that previously blocked edits to
this file.
Single-instance deployments now work silently out of the box;
multi-instance setups continue to use Redis when REDIS_URL is set.
Combo dispatch and the combo test button used to crash with
'TypeError: e.startsWith is not a function' when a step's modelStr
failed to resolve (regression after #2338 added per-account LKGP
routing for local/Docker providers). The TypeScript annotation says
the field is always a string, but malformed combo rows leaked through
to the dispatch path.
Two defensive boundary guards:
1. open-sse/services/combo.ts LKGP fallback findIndex — type-check
target.modelStr before calling startsWith.
2. src/app/api/combos/test/route.ts testComboTarget — coerce
target.modelStr at the entry, surface a clean 'Combo step is
missing a model id' error instead of crashing.
Regression test parses the source and asserts no unguarded
target.modelStr.<string-method> usages remain in combo.ts, so a
future refactor that reintroduces the pattern fails loudly.
Two related provider-registry fixes:
#2361: LLM7.io was visible in the dashboard provider catalog (entry in
src/shared/constants/providers.ts) but the executor registry in
open-sse/config/providerRegistry.ts had no llm7 entry. Every connection
test fell through with a credential error because there was no baseUrl
or authType configured. Added the standard OpenAI-compatible v1
endpoint with a small seed model catalogue.
#2360: Cohere was pointed at the native /v2/chat upstream which returns
the proprietary { message: { content: [{type:'text', text:...}] } }
shape. The combo test validator (extractComboTestResponseText) only
reads the OpenAI choices[] envelope, so a successful Cohere call
surfaced as 'Provider returned HTTP 200 but no text content.' Cohere
publishes an OpenAI-compatible compatibility layer at
/compatibility/v1 that returns { choices: [{ message: { content }}] }
so we route there instead of needing a Cohere-specific translator.
Regression test asserts both registry entries match the expected
shape so a future refactor that reverts the URLs fails loudly.
The native claude OAuth path (base.ts:794 applySystemTransformPipeline)
early-exited because DEFAULT_SYSTEM_TRANSFORMS_CONFIG.providers[claude]
was {enabled:false, pipeline:[]}. Result: third-party-agent fingerprints
(github.com/anomalyco/opencode, 'You are OpenCode', 'Here is some useful
information about the environment...') leaked into /v1/messages system
blocks, triggering Anthropic billing-gate:
[400] Third-party apps now draw from extra usage, not plan limits.
Mirror the cc-bridge defaults:
- DEFAULT_PARAGRAPH_REMOVAL_ANCHORS + OPENWEBUI_PARAGRAPH_ANCHORS
- DEFAULT_IDENTITY_PREFIXES + OPENWEBUI_IDENTITY_PREFIXES
- DEFAULT_TEXT_REPLACEMENTS as replace_text ops (allOccurrences:true)
- obfuscate_words
Omit prepend_system_block + inject_billing_header — base.ts:759-784
already handles those on the native claude OAuth path.
UI mirror RoutingTab.tsx and snapshot in system-transforms.test.ts
updated for parity. 56/56 transform-related tests pass.
Verified end-to-end 2026-05-18 after npm run build:cli + restart:
- request v8tq04 -> 200 in 1.84s
- request shape {max_tokens:32000, reasoning_effort:high} -> 200 in 1.99s
- x-omniroute-provider=cc (claude-code OAuth pool, account 62875e01)
- telemetry: [SystemTransforms] claude-native: drop_paragraph_if_contains,
drop_paragraph_if_starts_with, replace_text, replace_text, obfuscate_words
When the shared <Tooltip> appeared inside a modal (combo editor) or any
ancestor with overflow:hidden/auto, long labels were clipped — the
absolute-positioned <span> stayed inside the modal's stacking context.
Render the tooltip via createPortal to document.body by default
(usePortal prop, defaults to true). Coordinates are computed from the
trigger's getBoundingClientRect on each show and written directly to
the tooltip ref's .style — that avoids the cascading-render warning
that setState-inside-effect triggers, while still doing one synchronous
measure-and-position pass before the user sees any flicker.
Coordinates are clamped to the viewport bounds so a trigger near the
right edge produces a tooltip that stays on-screen instead of bleeding
off. Adds an optional multiline prop that swaps the legacy
whitespace-nowrap clamp for max-w-xs whitespace-normal break-words for
explanation strings (combo strategy help, etc.).
Backward compat: existing call sites do not need to change; the portal
+ clamp behavior is transparent to consumers.
Adds a deterministic test for the rawEffort resolution chain in
open-sse/executors/codex.ts so a future refactor that flips the priority
back (the bug we just fixed) trips an explicit assertion. Also verifies
end-to-end behavior of the priority order: modelEffort > explicitReasoning
> requestReasoningEffort > fallbackReasoningEffort.
The source fix itself landed earlier on this branch; this commit only
adds the test coverage.
Claude Code Pro/Team users hit a 429 cascade where every Claude account
got marked rate-limited for only a few seconds, retried, hit 429 again,
and the cycle exhausted all accounts until the 5h subscription window
finally reset. Root cause: Anthropic OAuth 429 bodies carry phrases like
'Usage Limit Reached' or 'Claude Pro usage limit reached' that don't
contain the word 'quota'. classifyErrorText fell through to
RATE_LIMIT_EXCEEDED with the OAuth ~5s base cooldown.
Three targeted changes in open-sse/services/accountFallback.ts:
1. classifyErrorText: recognize the Anthropic OAuth phrases ('usage limit
reached', 'claude pro usage limit', 'you've reached your usage limit'
and variants) and return QUOTA_EXHAUSTED.
2. checkFallbackError: new branch that, when the classifier flags
QUOTA_EXHAUSTED for a non-credits/non-daily case, applies a deliberate
1h cooldown (subscription quotas need real time to reset; the existing
COOLDOWN_MS.paymentRequired is only 2 minutes).
3. parseRetryFromErrorText: parse absolute ISO 8601 timestamps in the
body ('Try again at 2026-05-17T10:00:00Z', 'Please wait until ...').
When present, honor the upstream's stated recovery time instead of
the 1h default.
Cross-provider fallback for direct (non-combo) calls remains a separate
feature — operators wanting that should route Claude through a combo
that includes openrouter/claude or another fallback target.
`validateResponseQuality` flagged any response with `content: null` as
empty and triggered a false-positive 502 combo fallback, even when the
upstream returned the entire answer in `reasoning_content`. This
affected every reasoning model that omits `content` by design:
moonshotai/Kimi-K2.5-TEE, zai-org/GLM-5-TEE, zai-org/GLM-4.7-TEE,
DeepSeek-R1 and Qwen-thinking variants via Chutes.ai, Nvidia, and other
OpenAI-compatible gateways.
Treat a non-empty `reasoning_content` (or its legacy `reasoning` alias)
as valid content. Empty/whitespace-only strings still fall through to
the existing empty-content rejection so we don't weaken the guard.
Backward compat verified: regular content-only and tool_calls-only
responses still validate without change.
`.dockerignore` excluded everything under `docs/` except `openapi.yaml`,
which broke the in-product Docs viewer at `/docs/*` with "ENOENT: no
such file or directory, open '/app/docs/SETUP_GUIDE.md'" for every help
page. The previous block-list was meant to keep the image small but it
hid the ~5 MB English markdown tree that the viewer actually reads.
Replace the block with a targeted exclude of the heavy assets that
account for ~45 MB of the original ~50 MB:
- docs/i18n/** (translated copies — viewer falls back to English)
- docs/screenshots/**
- docs/diagrams/exported/** plus raster/SVG variants
Note: Go filepath.Match (Docker's matcher) treats `*` as not crossing
`/`, so the existing `*.md` rule still excludes only root-level
markdown — nested `docs/**/*.md` is implicitly kept without a
re-include rule that would have brought i18n back.
Added a regression test that parses .dockerignore and asserts the
critical English docs survive the filter while the heavy paths still
do not.
The auto-routing path in src/sse/handlers/chat.ts called `getSettings()`
on every `auto` / `auto/\*` request, but the symbol was never imported in
this module (only `getCachedSettings` was). The runtime ReferenceError
crashed the request with a 500 before any routing could happen.
Replace the call with `getCachedSettings` (already imported, identical
return shape, plus the cached variant benefits the auto-routing hot path).
A regression-guard test scans chat.ts to fail loudly if a future refactor
re-introduces the unimported call pattern.
