* perf: startup parallelization, stream TextEncoder lift, auth middleware bottlenecks
Startup (~100-300ms faster cold start):
- Parallelize 4 early imports via Promise.all() in registerNodejs()
- Parallelize 10 independent background services via Promise.allSettled()
- Each service has independent try/catch — no failure domino effect
Streaming pipeline (8 fewer TextEncoder GC allocations per SSE event):
- Lift new TextEncoder() from per-chunk inside buildClaudeStreamingResponse
to function scope alongside existing decoder singleton
Auth middleware bottlenecks (from PerfBottleneckAnalysis):
- Backoff decay loop: replace updateProviderConnection (full CRUD:
SELECT+encrypt+cache-invalidate+backup) with resetConnectionBackoff
(targeted UPDATE of backoff/error columns only)
- Dual .filter() for quota: replace two passes calling
isQuotaExhaustedForRequest per connection with a single for loop
partitioning into withQuota/exhaustedQuota
- Debug-log filter recomputation: capture connectionFilterStatus Map
during the filter pass; debug loop reads 6 string comparisons instead
of 6 function calls per connection
Supporting:
- Add resetConnectionBackoff to src/lib/db/providers.ts (patterned after
clearConnectionErrorIfUnchanged, no CAS check)
- Re-export resetConnectionBackoff from src/lib/localDb.ts
- Update integration-wiring.test.ts regex for parallelized dynamic import
* perf: P2C quota cache, lazy provider init, structuredClone elimination, getSettings→getCachedSettings
- **auth.ts: P2C quota re-evaluation cache** — quotaResults Map threaded
through selectPoolSubset → compareP2CConnections → getP2CConnectionScore.
Populated during filter + partition passes, eliminating redundant
evaluateQuotaLimitPolicy / isQuotaExhaustedForRequest calls when the
P2C comparator re-evaluates previously-scored connections.
- **constants.ts: lazy PROVIDERS via Proxy** — replaces eager
generateLegacyProviders() + loadProviderCredentials() at module load
with Proxy delegating to deferred init on first property access.
- **providerModels.ts: lazy PROVIDER_MODELS + PROVIDER_ID_TO_ALIAS** —
same Proxy pattern for both exports; generateModels()/generateAliasMap()
deferred until first read.
- **stream.ts: structuredClone → minimal object spread** — replaces
O(n) deep clone of SSE response chunks with targeted reconstruction
of only mutated fields (usage, delta.content, finish_reason).
- **progressTracker.ts: TextDecoder lift** — module-level decoder
instead of per-chunk new TextDecoder().
- **Route files: getSettings() → getCachedSettings()** — 13 API route
files converted from uncached per-request DB reads to TTL-cached
wrapper (5s default), eliminating redundant queries on every request.
- **settings.ts: re-export getCachedSettings** from readCache for
non-localDb consumers.
- **Remove settingsCache.ts** — dead file, no imports reference it.
TS compile: 0 errors. Auth tests: 225/225 pass. Services: 269/269 pass.
* perf: Phase 1 tangible wins — egressCache eviction, mmap_size PRAGMA, composite indexes, proxyFallback lazy import
- egressCache: lazy TTL eviction on getCachedEgressIp access (bounds memory
leak to distinct proxy URLs, typically <100)
- mmap_size: apply stored PRAGMA from key_value table (256MiB default) after
applyStoredDatabaseOptimizationSettings — setting was stored but never applied
- schemaColumns: add idx_uh_provider_model_timestamp (covers getModelLatencyStats)
and idx_pc_provider_auth_type (covers 6+ provider_connections queries)
- proxyFallback: convert static import to dynamic import() inside error handler
(defers 210ms module load from startup to first proxy-retry scenario)
* perf: add dedup expression index, unref() sweep timers
- Add COALESCE expression index idx_uh_dedup on usage_history
matching the exact dedup query pattern. Eliminates FULL TABLE
SCAN on every saveRequestUsage insert.
- Add composite idx_uh_provider_model_timestamp on usage_history.
- Add composite idx_pc_provider_auth_type on provider_connections.
- Add .unref() to setInterval in batchProcessor.ts (polling loop).
- Add .unref() to setInterval in runtimeHeartbeat.ts (heartbeat).
* perf: bump SQLite cache_size default from 16MB to 64MB
New installs now start with 64MB page cache (was 16MB). Existing
users' stored settings are unchanged. Reduces disk reads for the
typical ~250MB database by keeping ~25% of pages in memory.
Also resolved pre-existing merge conflict in webhooks.ts.
* docs: add Redis production config guide and proxy port clash investigation report
- docs/redis-production-config.md: comprehensive Redis tuning guide
covering client options, server config, Docker settings, scaling,
and monitoring for all three Redis workloads (rate limiting,
auth cache, quota store)
- docs/proxy-port-clash-report.md: investigation confirming proxy
subsystem has no port binding issues; real EADDRINUSE history
traced to process supervisor crash-loop restart race (#4425) and
live-dashboard port clash (#6324), both already fixed
* fix: address PR #7893 review — add Proxy traps, extract migrations to reduce providers.ts size
- Add set trap to PROVIDER_ID_TO_ALIAS Proxy (providerModels.ts)
- Add deleteProperty traps to all three lazy Proxies (PROVIDERS,
PROVIDER_MODELS, PROVIDER_ID_TO_ALIAS)
- Extract autoMigrateLegacyEncryptedConnections and getGheCopilotHosts
from providers.ts (1129→1036 lines, -93) into providers/migrations.ts
- Both functions re-exported via providers.ts for backward compat
File-size ratchet resolved: src/lib/db/providers.ts now 1036 lines.
* fix: resolve merge conflict markers in 3 route/test files
- model-combo-mappings/route.ts: kept upstream version (Zod pagination
via validateBody + isValidationFailure), restored missing return
statement for GET handler
- playground/presets/route.ts: kept stashed version details (satisfies
type-narrowing + inlined Response) — functionally identical
- error-sanitization.test.ts: matches upstream exactly (no diff)
Test verification: same 7 pre-existing failures confirmed on upstream
baseline (c1bdd91e7). Zero regressions from conflict resolution.
Closes remaining uncommitted work from PR #7046 rebase.
* test(db): add resetConnectionBackoff coverage + fix file-size ratchet regression
- Add tests/unit/reset-connection-backoff.test.ts: covers the new
resetConnectionBackoff lightweight-UPDATE helper (clears backoff/error
columns and re-activates a connection, unconditional-write behavior on
terminal statuses, no-op for empty/unknown ids). Zero prior coverage
per pre-merge review of PR #7893 (Hard Rule #8).
- open-sse/services/batchProcessor.ts: fold the new unref() call into the
existing setInterval(...).unref() chain instead of a separate statement,
keeping the file at the frozen 915-line ratchet (Timeout.unref() already
returns `this`, so no type cast is needed).
- src/lib/localDb.ts: drop one blank separator line so the new
resetConnectionBackoff re-export stays within the frozen 808-line ratchet.
Pre-merge fix for PR #7893 (perf/startup-stream-auth-optimizations) per
/green-prs plan-file _tasks/pipeline/prs/1-analyzed/7893-*.plan.md.
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: oyi77 <oyi77@users.noreply.github.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouzapw@users.noreply.github.com>
* fix(mitm): gate Agent Bridge DNS and Trust Cert on sudo password (#7938)
Extend the #7865 sudo gate to setup wizard DNS, Start DNS, and Trust Cert.
Start server still runs without a password but skips privileged cert/DNS
steps instead of spawning sudo -S with an empty string. Add a shared sudo
password modal on the Agent Bridge page for DNS and trust-cert actions.
Fixes#7938
* fix(mitm): use .tsx extension for MitmSudoPasswordModal hook
JSX in a .ts file broke dashboard typecheck and ESLint on CI.
* fix(mitm): skip DNS teardown on stop when sudo password missing (#7938)
stopMitm() no longer invokes removeDNSEntry with an empty password when
the server was started in skip mode. The MITM process is still killed.
* refactor(mitm): extract privileged step helpers to satisfy file-size cap
manager.ts exceeded the 800-line cap after #7938 gates. Move DNS teardown
and the shared sudo skip runner into dedicated modules; behavior unchanged.
CCR stores blocks keyed by principalId (the API key's DB row id). On
stdio transport there is no HTTP context, so resolveMcpCallerApiKeyId()
always returned undefined and the fallback resolved to 'anonymous' —
a store-key miss ('block not found').
Add resolvePrincipalFromEnv() that reads OMNIROUTE_API_KEY or
ROUTER_API_KEY from the environment and resolves through the same
getApiKeyMetadata() lookup that storage uses. Both storage and retrieval
now get the same principal id, so the store key matches.
Closes#7883
Co-authored-by: Erick Kinnee <erick@ekinnee.dev>
Windows auto-start previously wrote a HKCU\Run registry entry that
launched node.exe directly, causing a visible console window at logon.
Closing that window also killed the background server.
Adopt the same approach as 9Router: write a OmniRoute.vbs script to
the Windows Startup folder that calls WScript.Shell.Run with SW_HIDE (0)
so OmniRoute starts fully hidden. The VBS runs serve --no-open --tray
via the existing buildServeExecLine helper.
Legacy migration — enableWin() removes the old HKCU\Run entry so stale
entries don't linger, and isEnabledWin() falls back to checking the
registry for users who enabled autostart before this change.
Co-authored-by: tientien17 <tientien17@users.noreply.github.com>
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
The /api/v1/providers/{id}/models endpoint returns invalid_provider for
local self-hosted providers (Ollama, LM Studio, vLLM, etc.) because it
only resolves providers via getRegistryEntry() from the open-sse
registry, which does not include LOCAL_PROVIDERS.
After getRegistryEntry() misses, fall back to the dashboard-facing
provider catalog (getProviderById / getProviderByAlias from
@/shared/constants/providers), which covers LOCAL_PROVIDERS and all
other dashboard provider categories. Registry hits retain existing
precedence.
Closes#7910
Co-authored-by: Erick Kinnee <erick@ekinnee.dev>
Adds a Kaspersky subsection to the existing 'Antivirus False Positives'
troubleshooting section: explains PDM:Trojan.Win32.Generic is a behavioral
heuristic on the unsigned installer, which files it rolls back (playwright /
tls-client native DLL) and why, plus how to verify the sha512 against latest.yml,
restore + exclude, and report the FP to Kaspersky.
Refs #7903, #5946
* fix(cli): spawn opencode.cmd shim with shell:true on win32 (#7913)
runOpenCodeAuth spawned the opencode.cmd shim with shell:false on win32,
which throws spawnSync EINVAL under Node's hardened child_process
handling (post CVE-2024-27980). Mirrors the fix already applied to
codex (resolveCodexSpawn in launch-codex.mjs, #6263) and
qodercli/Auggie (#6263/#6304): shell:isWin, unchanged elsewhere.
Exported runOpenCodeAuth for testability and added a regression test
covering both the win32 shell:true path and the non-regressing
linux/darwin bare-binary path.
* fix(cli): make opencode --auth win32 spawn testable without module mocks (#7913)
The regression test used t.mock.module, which needs --experimental-test-module-mocks
and fails to even run in CI (TypeError: t.mock.module is not a function → the fix was
unvalidated). Extract a pure resolveOpenCodeAuthSpawn(providerId, platform) helper and
test it directly (win32 → shell:true, linux/darwin → shell:false). Production behavior
of runOpenCodeAuth is unchanged.
* fix(sse): parse Gemini 429 RetryInfo.retryDelay for model lockout (#7940)
Gemini free-tier 429 bodies carry a short explicit retry hint --
error.details[].{"@type": google.rpc.RetryInfo, retryDelay: "26s"} plus a
"Please retry in Ns." message -- but parseRetryFromErrorText only matched
'reset after'/'will reset after' text, so quotaResetHintMs came back null and
recordModelLockoutFailure fell back to getMsUntilTomorrow() for
quota_exhausted, locking the model out for ~19h instead of ~26s.
parseRetryHintFromJsonBody (retryAfterJson.ts) now walks error.details[] for
a google.rpc.RetryInfo entry and parses its retryDelay via a shared
parseDelayString helper (moved out of accountFallback.ts so
parseRetryAfterFromBody and the model-lockout path use the same grammar).
parseRetryFromErrorText also gained a 'please retry in Ns' text fallback for
bodies without a parseable details[] array. Both new paths are capped by a
dedicated MAX_SHORT_RETRY_HINT_MS (24h), independent of the existing 30-day
MAX_PROVIDER_COOLDOWN_MS, since RetryInfo/please-retry-in are short
throttling hints, not long-lived quota resets like Antigravity's 160h.
Regression test: tests/unit/bug-7940-gemini-retrydelay.test.ts (RED before
the fix: parseRetryFromErrorText returned null and the resulting lockout was
~19h; GREEN after: ~26s).
* chore(quality): register bug-7940-gemini-retrydelay test in stryker tap.testFiles
* fix(sse): preserve parallel_tool_calls for GPT-5.6 ultra/max delegation under Codex Responses Lite (#7821)
* fix(codex): drop over-broad parallel_tool_calls allowlist entry — keep #2608 stripping intact (#7821)
The static RESPONSES_API_ALLOWLIST addition made parallel_tool_calls survive for
ALL models, breaking the #2608 non-passthrough stripping guarantee for gpt-5.5.
The real #7821 fix (isCodexDelegationDependentModel gating in
enforceCodexResponsesLiteParallelToolCalls) is model/effort-scoped and does not
need the allowlist entry — native Codex traffic returns before the allowlist runs.
* fix(api): classify /api/acp/agents as loopback-only (#7948)
/api/acp/agents is spawn-capable (POST registers a client-chosen `binary`
via src/lib/acp/registry.ts; GET / POST {action:"refresh"} runs
detectInstalledAgents() -> execFileSync(probe.command, probe.args, { shell })
transitively) but was never added to LOCAL_ONLY_API_PREFIXES in
src/server/authz/routeGuard.ts, unlike every sibling spawn-capable route
(Hard Rules #15/#17). A leaked JWT via tunnel could reach the version-probe
execFileSync path.
Adds the prefix to the loopback gate plus a direct regression test
(tests/unit/route-guard-acp-agents-local-only.test.ts) and an assertion in
tests/unit/check-route-guard-membership.test.ts documenting why the existing
source-scan subcheck cannot catch this class of gap (the spawn call is
transitive via registry.ts, not in the route file itself).
* chore(quality): register route-guard-acp-agents-local-only test in stryker tap.testFiles
The nightly-compat Node 24/26 shard failures were 17/18 base-red debt already
fixed forward on the release tip (same pattern as #7025/#7140/#7675/#7742,
tracked in #6949). The one genuine still-reproducing failure was a test-harness
timing-margin bug: ratelimit-admission-control-6593's pollUntil helper used a
fixed 2000ms deadline that races Bottleneck's QUEUED->EXECUTING event-loop-tick
transition under CI/devbox contention. Widened the default deadline to 10000ms;
the admission logic itself (checkQueueAdmission / RATE_LIMIT_QUEUE_FULL / 429) is
unchanged and covered by 3 passing pure-unit tests.
createSqliteNativeError() in bin/cli/sqlite.mjs only recognized the ABI-mismatch
native error class (NODE_MODULE_VERSION/ERR_DLOPEN_FAILED). It silently passed through
the 'Could not locate the bindings file' class thrown by the bindings package when the
better-sqlite3 native addon was never built/downloaded - the exact case hit by
'npx omniroute reset-password', since npx runs a fresh ephemeral install that never
builds the addon. Users got a raw multi-line path dump instead of guidance.
Widen the condition to also match 'Could not locate the bindings file',
MODULE_NOT_FOUND, and "Cannot find module 'better-sqlite3'", and point users at the
existing self-heal command `omniroute runtime repair`, same as the ABI-mismatch branch
already does.
Regression test: tests/unit/cli-sqlite-bindings-not-found-7868.test.ts - RED against the
reporter's exact error text before the fix, GREEN after.
#7858 — accumulateBotContent() silently returned an empty delta for any
unrecognized frame shape, and finish() only had a fallback for the
type:2 finalResultMessage case; a turn with no content in ANY known
shape closed with a bare `stop` + `[DONE]`, indistinguishable from a
genuine empty answer. finish() now emits a sanitized error (Hard Rule
#12) naming the resolved tier and the likely causes, and unrecognized
update-frame shapes are logged by argument KEY only (never content,
tokens, or cookies).
#7870 — the enterprise tier only changed buildWsUrl() query params;
buildChatInvocation() always fell back to the consumer
M365_DEFAULT_OPTION_SETS (which declares the MSA-only enable_msa_user
flag) and tone:"". resolveConnectionParams()/resolveTierOverrides() now
also resolve and surface the tier itself, threaded through wsChat() ->
sendChat() -> buildChatInvocation() via a new
resolveChatInvocationOverrides() helper, so an enterprise-tier
invocation declares the enterprise_*/bizchat_* option sets, the wider
allowedMessageTypes captured from the real enterprise HAR (Discussion
#7850), and tone:"Magic" — while individual and EDU payloads stay
byte-identical to today.
Regression tests: tests/unit/copilot-m365-web-silent-empty-7858.test.ts,
tests/unit/copilot-m365-enterprise-invocation-7870.test.ts.
Root cause: validate-release-green.mjs's ESLint gate runs
`npx eslint . --format json --suppressions-location ...` without
--pass-on-unpruned-suppressions. ESLint 9.x prints the valid JSON report
to stdout first, then (if the suppressions file has any stale entries)
appends 'There are suppressions left that do not occur anymore...' to
stderr and exits 2. The gate concatenates stdout+stderr, so
parseEslintJson() received valid JSON immediately followed by that
sentence, JSON.parse() threw, and the caller reported the generic
"could not parse eslint json" HARD failure instead of the real
(harmless) unpruned-suppressions housekeeping condition.
Fix: add --pass-on-unpruned-suppressions to the gate's eslint invocation
(unpruned suppressions are release-time housekeeping, not a contributor
defect), and harden parseEslintJson() with a bracket-depth scan so it
recovers the JSON array even when trailing non-JSON text is glued on.
Regression test: tests/unit/validate-release-green.test.ts — 'parseEslintJson
tolerates ESLint's trailing unpruned-suppressions stderr sentence (#7837)',
feeding parseEslintJson() the exact byte shape ESLint's own cli.js produces
in this scenario. Confirmed RED before the fix (parsed === null), GREEN after.
Gates run: node --import tsx/esm --test tests/unit/validate-release-green.test.ts (20/20 pass),
npm run typecheck:core (clean), eslint --suppressions-location on changed files (clean),
check-complexity.mjs + check-cognitive-complexity.mjs (OK, no regression),
check-mutation-test-coverage.mjs --strict (no drift), check-changelog-integrity.mjs (OK),
check-file-size.mjs (OK, no frozen files grown).
Closes#7837
* fix: hide internal reasoning replay placeholder
* fix: hide internal reasoning replay placeholder in OpenAI→Claude translation too
Mirror the isInternalReasoningPlaceholder() guard already applied to the
Responses-API and OpenAI-Responses reasoning paths in
openaiToClaudeResponse() (open-sse/translator/response/openai-to-claude.ts).
The internal reasoning-replay sentinel was still leaking into the Claude
"thinking" content block on this translation path.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* test: close both-add merge of #7912 and #7905 reasoning/tool tests
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
Rebuilt clean on release/v3.8.49 (branch carried old-main drift) — applies only
the 2 real commits' delta: SSE collector now captures native functionCall parts
in non-streaming, plus the test (typed emptyCollected() as AntigravityCollectedStream).
Co-authored-by: Wital <wital@example.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(combo): strip boolean reasoning field for opencode-go providers
opencode-go backed providers (ollama-cloud, opencode-go, opencode,
opencode-zen) use a Go ChatCompletionRequest struct where the reasoning
field is typed as openai.Reasoning (a structured type). When a client
sends reasoning: true or reasoning: false — valid per the OpenAI API —
the Go JSON decoder rejects it with:
400: json: cannot unmarshal bool into Go struct field
ChatCompletionRequest.reasoning of type openai.Reasoning
This strips the boolean reasoning field before forwarding to these
providers, allowing the upstream to apply its own default reasoning
behavior. Object/string forms are left untouched.
Observed in production: 3 consecutive 400 errors from ollama-cloud/glm-5.2
in a 30-second window, each with the unmarshal error.
* fix(opencode): add null/primitive guard in stripBooleanReasoning
Adds defensive check for null, undefined, and non-object inputs
as suggested in review. Added unit test coverage for these edge cases.
monaco-editor 0.56.0 (bumped in #7897) ships a restrictive `exports` map
("./*.js" -> "./esm/vs/*.js", "./*" -> "./esm/vs/*.js") that rewrites every
subpath by prepending esm/vs/. The pre-0.56 deep import
`monaco-editor/esm/vs/editor/editor.api` therefore resolved to the doubled,
non-existent `esm/vs/esm/vs/editor/editor.api.js` and broke the production
Turbopack build (Module not found in MonacoEditor.tsx).
Switch to the 0.56-compatible specifier `monaco-editor/editor/editor.api.js`,
which resolves to the same file (esm/vs/editor/editor.api.js) as before.
Adds tests/unit/monaco-editor-import-path.test.ts as a regression guard:
asserts the specifier has no esm/vs/ prefix and resolves to editor.api.js
against the installed monaco 0.56.
Rebuilt clean on release/v3.8.49 (branch forked from old main, ~drift). Resolved
2 real conflicts against the current tip: providerModelsConfig.ts keeps BOTH the
tip's DashScope text-model helpers (#7882) and this PR's ProviderModelsHeaderContext
type; OAuthModal.tsx takes this PR's DEVICE_CODE_PROVIDERS set (superset of the
tip's hardcoded chain + grok-cli), dropping the now-dead qwen entry (#7866 removed
qwen OAuth).
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
#7843's test reorganization removed the 2 no-explicit-any usages that this
suppression covered, leaving a stale entry that fails lint:json --max-warnings 0
(exit 2, 'suppressions left that do not occur anymore') on the release tip for
every fresh PR run. Pruning tightens the gate — no rebaseline.
* feat(qwen): add Qwen3.8 Max Preview catalogs [Part 2/3]
Rebuilt clean on release/v3.8.49 after Part 1 (#7866) squash-merged — applies
only the Part-2 delta (Qwen Web / Qoder qwen3.8-max-preview registration +
required-thinking allowlist + Qoder client rework) onto the current tip. No
migration in this part (that was Part 1).
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* feat(qwen): add regional Alibaba and Qwen Cloud providers [Part 3/3]
Rebuilt clean on top of Part 2 (#7874) over the current release tip — applies
only the Part-3 delta (alibaba Model Studio, Alibaba Token Plan, qwen-cloud,
qwen-cloud-token-plan with region selector). No migration in this part.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
Rebuilt clean on release/v3.8.49 after Part 1 (#7866) squash-merged — applies
only the Part-2 delta (Qwen Web / Qoder qwen3.8-max-preview registration +
required-thinking allowlist + Qoder client rework) onto the current tip. No
migration in this part (that was Part 1).
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* Create WEB-COOKIE-GUIDE.md for Web Cookie providers
Added a comprehensive guide for using Web Cookie providers with OmniRoute, including setup instructions, credential formats, limitations, and troubleshooting tips.
* Fix formatting in WEB-COOKIE-GUIDE.md
* Add Web Cookie Providers section to providers guide
Added section for Web Cookie Providers with a reference to the WEB-COOKIE-GUIDE.md.
* Enhance CLAUDE_WEB.md with user guidance
Added introductory information and guidance for new users of the Claude Web provider.
Agent clients often send message.content as [{type:\"text\",text:\"...\"}]
instead of a plain string. buildNotionMessageStep previously required a
string and silently dropped those turns, so system injects (jailbreak /
agentic conversion) and multimodal user messages never reached Notion.
Normalize string | content-parts | bare string parts via
extractNotionMessageText, and add regression coverage in the transcript
unit suite.
#7251 added four usage.* quota-visibility keys to en.json without the Vietnamese
counterparts, leaving __MISSING__ markers that fail i18n-vi-completeness on the
release tip for every fresh PR run. Translated with the locale's existing quota
vocabulary (hạn mức).
* feat(dashboard): add per-operator quota row visibility on usage tab
Adds a "hide this quota row" action (visibility_off icon button) to
each model-quota row on the provider limits card, and a "Hidden: …"
strip at the bottom of the card to restore any hidden row. The
visibility preference is keyed per-provider (settings.quotaVisibility)
and persisted via PATCH /api/settings, so it survives refresh/reload.
Distinct from the existing model-catalog isHidden/isDeleted mechanism
(collectHiddenQuotaModelIds/filterHiddenModelQuotas in
ProviderLimits/utils.tsx), which hides rows the ADMIN marked hidden in
the model catalog. This is a personal dashboard preference an operator
can toggle without touching the catalog — e.g. temporarily decluttering
a quota card with many low-signal rows.
New pure helpers (getQuotaVisibilityKey, filterQuotasByVisibility,
getHiddenQuotaRows) live in ProviderLimits/utils.tsx and are unit
tested directly; the settings key is added to DEFAULT_SETTINGS and
validated via updateSettingsSchema like the existing
providerStrategies field. New UI strings are filled in en.json and
synced to the other 42 locales as `__MISSING__` placeholders.
Co-authored-by: nguyenha935 <208228297+nguyenha935@users.noreply.github.com>
Inspired-by: https://github.com/decolua/9router/pull/2371
* chore(changelog): fragment for #7251
* refactor(usage): extract useQuotaVisibility hook (file-size budget)
ProviderLimits/index.tsx grew past its frozen 1127-line budget with the
quota-visibility wiring; extract the state + persistence + hide/show handlers
into a dedicated hook (same pattern as useCodexResetCreditRedemption).
No behavior change — the live validation evidence on the PR covers this flow
end-to-end.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* refactor(dashboard): shed QuotaCard complexity to baseline + type useQuotaVisibility settings fetch (#7251 CI green)
* test(dashboard): rename quota-row visibility test (path claimed by #7360)
* fix(dashboard): restore providerTierField case-collision fix dropped by merge auto-resolve
The git merge of origin/release/v3.8.49 auto-resolved providerTierFieldApi.ts
(added post-merge-base by commit 3ba3cd145e to fix a case-only filename
collision with ProviderTierField.tsx that breaks webpack on case-insensitive
filesystems) back down to its pre-fix name providerTierField.ts, silently
reverting that base-red fix and dropping its stryker tap.testFiles
registration and changelog fragment. Restore all four: the renamed helper
file, the import path in ProviderTierField.tsx, the import path in
tests/unit/provider-tier-field-helpers.test.ts, and the
combo-skip-conn-disable-plugin-block-7806.test.ts stryker registration.
---------
Co-authored-by: nguyenha935 <208228297+nguyenha935@users.noreply.github.com>
* fix: reserve chat admission before parsing
* fix: release admission on handler failure
* fix: reconcile chat admission with the #7862 parse-once route
Post-#7862 rebase: the admission-rebuilt request is json()-parsed directly over
the already-buffered bytes — the clone()+json() pair is gone, and the
parse-once regression tests now pin the post-admission contract (original
request: zero json() calls, zero clone() calls; the single materialization is
admitChatRequest()'s bounded byte reader).
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* feat(sse): add live gRPC-web quota fetcher for grok-cli (#6844)
* fix(sse): send gRPC-web request frame + decode real GetGrokCreditsConfig schema
Live validation against grok.com (real bearer token, tier-4 account) proved
the #6844 grok-cli quota fetcher was a silent no-op:
- The POST to GetGrokCreditsConfig had no body. gRPC-web requires a request
frame even for a no-argument RPC; without one the upstream returns
`grpc-status: 13 "Missing request message."` with a 0-byte response.
Fixed by sending the empty gRPC-web frame (flag 0x00 + 4-byte length 0).
- The decoder's field mapping (top-level field 1 = double percent, field 2 =
string resetAt) was reverse-engineered from a third-party doc and never
matched the real response. The real shape is: top-level field 1 is a
NESTED message whose subfield 1 is a fixed32 float usage ratio (0..1) and
subfield 5 is a Timestamp{seconds,nanos} reset time. grokCliQuotaFrame.ts
now decodes that nested shape; grokCliQuotaFetcher.ts's buildQuota()
rescales the decoder's 0-100 percentUsed back to the 0-1 fraction the rest
of the quota pipeline expects (quotaPreflight.ts::remainingPercentFrom).
- The response's 2nd gRPC-web frame (trailer, flag 0x80) is now explicitly
walked-and-skipped instead of relying on incidental length-bounding.
Test fixtures in both files now encode the real captured wire structure
(nested message, fixed32 ratio, Timestamp reset, trailer frame) instead of
the old synthetic fixed64-double buffers, and the stale "Cloudflare
non-blocking is an assumption" comment is corrected to reflect that it is
now live-validated.
Reject repair and Remove CA when no sudo password is supplied or cached,
instead of spawning sudo -S with an empty string. Add a password modal to
AgentBridgeMaintenanceCard and regression tests for the 400 gate.
Address PR review feedback: reject whitespace-only sudoPassword values,
avoid caching unusable passwords, extract closePasswordModal helper, and
replace the route test that invoked real sudo with pure gate assertions.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(notion-web): add browser fingerprint headers to reduce Cloudflare challenges
Adds sec-ch-ua, sec-fetch-*, cache-control, pragma, and priority headers
that real Chromium browsers send. Without these, Cloudflare may challenge
or block requests that look like non-browser clients.
Applied to:
- buildNotionExecuteHeaders (inference requests)
- buildNotionBrowserHeaders (workspace discovery)
- buildNotionModelsDiscoveryHeaders (model discovery)
Headers match the real browser capture from Chrome 149 on Linux.
Addresses gemini-code-assist review:
- Fixed platform mismatch: sec-ch-ua-platform now matches USER_AGENT (Windows)
- Deduplicated headers via shared BROWSER_HEADERS constant in notionWebModels.ts
- Both executor and model discovery use the same constant
* fix(notion-web): align Chrome version to 149 and add browser header tests
Addresses maintainer review feedback on #7864:
- Align User-Agent and NOTION_USER_AGENT to Chrome/149 (was 145 and 150)
matching sec-ch-ua already declaring v="149"
- Add test assertions that browser fingerprint headers (sec-ch-ua,
sec-fetch-mode, cache-control, pragma) are sent on both executor
and models-discovery requests
* refactor(providers): extract notion-web fallback catalog to its own module
notionWebModels.ts crossed the 800-line new-file cap (875) once the browser
header tests landed; move the NOTION_WEB_FALLBACK_MODELS catalog + its type to
notionWebFallbackModels.ts (pure data, re-exported for existing consumers).
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
Rebuilt clean on release/v3.8.49 (branch forked from an old main and carried
~68 files of base drift). Reconciled with #7237 on the tip: supportsVision
keeps the authoritative getResolvedModelCapabilities() resolution (the PR's
isVisionModelId heuristic predates that fix); the PR's real change lands —
OAuth 'claude' now counts as a direct Anthropic transport for OmniGlyph, and
claude-fable-5 joins the vision model ids. Plumbing test now pins the
'|| provider === "claude"' invariant instead of exact formatting.
Co-authored-by: quanturbo <168349709+quanturbo@users.noreply.github.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(vision-bridge): reroute auto/ prefix to vision model when images present
Rebuilt clean on release/v3.8.49 (the original branch forked from an old main
and dragged ~70 unrelated files of base drift). Reconciled with the newer
VibeProxy credential guards on the tip: the reroute now also fires for auto/
models, the keep-credentialed-model skip does not apply to auto (keeping auto
would land on a text-only candidate), and the reroute-target credential guard
is preserved.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* test(guardrails): compact image_url literals to fit the 800-line test cap
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: herjarsa <204746071+herjarsa@users.noreply.github.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(usage): harden account identity reconciliation
* fix(db): renumber codex strong-identity migration 128 -> 129
release/v3.8.49 tip took slot 128 via #7839 (auto_candidate_overrides) after
this branch forked; renumber the new migration and its test references.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(sse): convert OpenAI media parts to Claude blocks in the CC bridge
OpenAI-format clients (OpenCode/Kilo/Cline) reach the Claude-Code-compatible
bridge untranslated: chatCore skips the OpenAI->Claude translator when
sourceFormat is OPENAI, so image_url / AI-SDK image / file parts either went
upstream in OpenAI shape (silently ignored) or were dropped by the text-only
extraction, and media-only user turns were removed by hasValidContent().
- claudeCodeCompatible: convertOpenAiMediaBlock() converts image_url
(base64 + remote), AI-SDK string image and file parts (pdf->document,
image mime->image) to Claude blocks in both bridge paths; Claude-native
blocks pass through unchanged and the text-only wire image is preserved.
- claudeHelper: hasValidContent() now counts image/document blocks so
media-only user turns are not silently deleted.
Reported-by: beingshafin
Refs #7777
* refactor(sse): extract CC media-block conversion to ccOpenAiMediaBlocks.ts
claudeCodeCompatible.ts is frozen at 1202 lines by check:file-size; the #7777
helpers pushed it to 1291. Move them to a dedicated module, no behavior change.
* test(quality): register cc-bridge-openai-image-7777 test in stryker tap.testFiles
