Requests to opencode (noAuth: true) were failing with "No credentials for
provider: opencode" because getProviderCredentials found no DB connections and
returned null — triggering the 400 error path in chatHelpers.
Inject a synthetic credential object (connectionId: "noauth", no apiKey/token)
before the regular connection lookup so the executor receives valid credentials
and skips the Authorization header. Also enable model import for noAuth providers
(canImportModels = true when isFreeNoAuth).
Pass the connection identifier along with token credentials during
connection checks so downstream auth flows can use the full context
for refresh and validation behavior.
OpenCode Free (noAuth: true) was routed through OAuthModal which tried to call
a non-existent /api/oauth/opencode/authorize endpoint, resulting in a 500 error.
Detect noAuth free providers via FREE_PROVIDERS[id]?.noAuth and render a
NoAuthProviderCard (lock_open + description) instead of the connections section
with the "+ Add" button that triggered the broken flow.
Add subtitleKey to SidebarItemDefinition and render subtitles under
sidebar labels for: Endpoints, API Manager, Combos, Batch, Caveman,
RTK, and Webhooks. Helps non-technical users understand navigation.
Simple mode shows stats, language packs, and output mode only.
Advanced mode reveals the full CompressionSettingsTab with all
engine internals, thresholds, and tool strategies.
Add two OpenAI-compatible API-key providers via the Gitlawb Opengateway
gateway at opengateway.gitlawb.com:
- gitlawb (alias glb): xiaomi-mimo endpoint with 5 MiMo models
- gitlawb-gmi (alias glb-gmi): gmi-cloud endpoint with 40+ models
including GPT-5.x, Claude 4.x, DeepSeek, Gemini, Qwen, GLM, Kimi
Both providers include CLI-mimicking headers (User-Agent, X-Title,
HTTP-Referer) to avoid upstream rate limiting. GMI Cloud provider
has passthroughModels enabled since model access varies per API key.
Propagate invalid refresh-token errors instead of collapsing them to null
so callers can distinguish expired credentials from transient failures.
Mark affected connections as expired and inactive when refresh fails
with an unrecoverable error, and persist that state during credential
updates. Add tests covering retry bail-out and Claude/Codex refresh
error handling.
Tailscale and ngrok expandable rows used <button> as outer container while also
containing inner <button> elements (copy URL, action buttons). Nested buttons are
invalid HTML and caused a React hydration error that prevented the app from
loading in the browser (stuck on Loading... spinner).
- Use Input's built-in icon prop so the search icon renders inside the correct
positioned context (Input's internal div.relative) instead of misaligned outside
- Switch from className to inputClassName so padding applies to the actual <input>
element, not the outer wrapper div
- Remove flex-1 spacer; make search container flex-1 so it fills available width
- ProviderCard: add cloud-agent dot (violet) to DOT_COLORS
- page.tsx: web-cookie/search/audio/cloud-agent/local/upstream-proxy
sections now pass their actual type as authType instead of displayAuthType
(which was always "apikey" for all static catalog groups)
- page.tsx: split search bar row into 25% input + 75% dot-type legend
showing all 10 auth types with their colors and translated labels
Add passthroughModels: true to the opencode registry entry so that unknown
model IDs trigger model lockout instead of connection cooldown. Fix dot color
for FREE_PROVIDERS in the Free Tier section by using toggleAuthType === "free"
to select the green dot instead of the blue oauth dot.
Moves Compatible Providers to the top (before Expiration Banner) so users can
add custom OpenAI/Anthropic compatible providers without scrolling. Reduces
ProviderCard icon from 32px to 28px and increases grid density by one column at
each breakpoint (gap-4→gap-3). Adds a curated Free Tier Providers section with
27 providers (OAuth/noAuth group + API-key free-tier group), positioned between
Expiration Banner and OAuth Providers. Cards in the free section suppress the
hasFree badge since context makes it implicit.
Adds 'opencode' to FREE_PROVIDERS as a no-auth provider using the public
OpenCode endpoint (https://opencode.ai/zen/v1). The existing OpencodeExecutor
already skips the Authorization header when no API key is present. Registry
entry reuses the opencode executor and shares models from the zen/v1 endpoint.
The existing /api/combos GET requires a management token, which broke
read-only integrations (opencode-omniroute-auth plugin and similar) that
need to enrich combo capabilities from a normal Bearer API key. Those
clients got 403 AUTH_001 'Invalid management token' even though the same
API key could list models via /v1/models.
This adds GET /v1/combos with the same auth model as /v1/models:
- Accepts valid Bearer API key OR dashboard session cookie.
- Falls back to anonymous when REQUIRE_API_KEY=false (single-user local).
- Projects ONLY public metadata: name, strategy, description, model id,
providerId, comboName (for combo-refs). Internal routing details
(connectionId, weights, labels, sortOrder, config) are stripped.
/api/combos (management writes) is unchanged.
- Add /dashboard/audit/a2a page with A2aAuditTab: lists tasks with skill/state
filters, colored state badges, duration, events and artifacts counts
- Add "A2A Audit" item to Audit sidebar group (Monitoring section)
- Remove duplicate "MCP Audit" from MCP Server sidebar group — it stays
only in the Audit group under Monitoring
- Improve McpAuditTab: fetch /api/mcp/audit/stats and show 4-card stat bar
(calls 24h, success rate, avg duration, top tool) above the filters
- Add audit-a2a to HIDEABLE_SIDEBAR_ITEM_IDS
- Add i18n keys: auditA2a in sidebar + header sections, a2a* in compliance namespace
- Rename sidebar/page titles: "mcp" → "MCP Server", "a2a" → "A2A Server" (en.json)
- Wrap top header section in <Card> on both MCP and A2A pages for consistent styling
- Remove redundant "hub MCP Server" / "group_work A2A Server" headings from page body
- Add MCP_GROUP collapsible sidebar group (MCP Server + MCP Audit) in Agentic Features
- Update AGENTIC_FEATURES_ITEMS type to SidebarSectionChild[] to support groups
- Remove Integration Surface card (tab switcher + Protocols tab card)
- API endpoints list always visible (no tab toggle needed)
- Cloud OmniRoute moved to first position inside Tunnels accordion section
- Tunnels header always visible (was conditional on tunnel flags)
- Cloudflare row: no longer collapsible — flat row with inline notice/error
- Remove leading comma from LAN IP and Tailscale IP inline displays
- Remove Cloudflare URL notice text (always-shown description removed)
- Remove double border between Tunnels header and Cloud OmniRoute row
- ngrok authtoken label: "not set in environment" (was "not set")
- MCP page: description + 3-step quick start merged into header area
- A2A page: description + 3-step quick start merged into header area
- Local Server: show LAN IPs inline (comma-separated) instead of chips below name
- Tailscale row: show Tailscale IP (100.x) inline with comma in row header
- Cloudflare expanded: remove readOnly URL input (URL visible in Active Endpoints bar)
- Tailscale expanded: remove both URL inputs; sudo field always visible (not conditional on running state)
- ngrok expanded: remove readOnly URL input; keep only authtoken field
- tailscaleTunnel: add 'serve status' fallback for older/permissioned CLI builds
- tailscaleTunnel: use settings.tailscaleEnabled as fallback when live funnel detection fails
- tailscaleTunnel: use path.format() to avoid CWE-22 false positive on sibling binary path
- api/network/info: new endpoint returning LAN IPs and Tailscale interface IP
- endpoint page: show machine LAN IP chips in Local Server row for network access
- endpoint page: show Tailscale 100.x IP URL in expanded Tailscale panel
- endpoint page: fix Tailscale Stop Funnel icon (vpn_lock_off -> vpn_key_off, valid glyph)
- Remove inline URL <code> blocks from all 5 connection rows (URLs now show only in the Active Endpoints bar)
- Show Active Endpoints bar when any URL is active (was: only when > 1)
- Fix Tailscale missing from Active bar by falling back to tunnelUrl when apiUrl is null
- Persist ngrok authtoken to /api/settings after first successful enable; restore on startup so it never needs re-entering
- /dashboard/mcp: adiciona ServiceToggle (ON/OFF), TransportSelector (stdio/SSE/streamable-http) e DisabledPanel
- /dashboard/a2a: adiciona ServiceToggle (ON/OFF) e DisabledPanel
- /dashboard/endpoint: remove abas MCP, A2A e API Endpoints (agora têm páginas próprias), renderiza só EndpointPageClient
- ApiEndpointsTab: remove sub-aba Webhooks (migrada para /dashboard/webhooks)
- DeepSeekWebExecutor with ds_session_id cookie auth
- DeepSeekWebWithAutoRefreshExecutor for session management
- Keccak-based PoW solver (DeepSeekHashV1)
- SSE stream transformation to OpenAI format
- Provider constant and alias (ds-web)
- 23 unit tests + live integration test
Authored-by: Paijo <oyi77@users.noreply.github.com>
Removes default daily/weekly/monthly request caps (1K/5K/20K) that were
silently applied to API keys without explicit rate limits, causing
surprise 429s in production aggregator deployments.
Authored-by: josephvoxone <josephvoxone@users.noreply.github.com>
- Rename first section from "Routing" to "OmniProxy" with collapsible header
- Accordion behavior: opening a section closes all non-pinned sections
- Pin button (push_pin) on section headers — visible on hover, always visible when pinned
- Pinned sections stay open regardless of accordion toggle
- Both expanded + pinned state persisted to localStorage
- i18n: add omniProxySection key to all 41 locales
Complete the width standardization pass — DashboardLayout provides p-4 sm:p-6 lg:p-10
and max-w-7xl mx-auto, so page-level containers must not add their own padding or width
constraints.
- analytics/loading, providers/loading, settings/loading: remove p-6 from loading skeletons
- providers/error, settings/error: remove p-6 from error boundary pages
- endpoint/ApiEndpointsTab: remove p-6 max-w-6xl mx-auto (loading + main return); collapse
redundant wrapper div in loading state
- endpoint/components/A2ADashboard, MCPDashboard: remove p-6 max-w-7xl mx-auto (both states);
collapse loading wrapper div to single element
- settings/pricing: remove max-w-6xl mx-auto p-6
- system/proxy: remove max-w-6xl mx-auto
