Commit Graph

450 Commits

Author SHA1 Message Date
Diego Rodrigues de Sa e Souza
3d75fb3fae Release v3.8.0 (#2073)
Integrated into release/v3.8.0
2026-05-10 00:55:06 -03:00
diegosouzapw
171081dbbb fix(core): harden input handling and compression cleanup
Replace regex-based compression artifact cleanup with linear helpers to
avoid pathological backtracking and normalize whitespace safely.
Tighten request and response parsing in assess, Gemini translation, and
executor telemetry to avoid unsafe property access and invalid category
filtering.

Also add managed database backup support for legacy encrypted
connection migration, improve SQLite load error handling, and cover the
regressions with unit tests.
2026-05-06 02:29:25 -03:00
Diego Rodrigues de Sa e Souza
7665ad3950 Release v3.7.9 (continued development) (#1982)
* chore: add GPT-5.5 Instant and support Node 26 (#1977)

chore: add GPT-5.5 Instant model to Codex registry + Node 26 support with CI + improved native SQLite error handling. Integrated into release/v3.7.9

* feat: enhance cost formatting and add Codex GPT-5.5 pricing support

* fix formatting

---------

Co-authored-by: backryun <bakryun0718@proton.me>
Co-authored-by: Jan Leon <jan.gaschler@gmail.com>
Co-authored-by: 05dunski <05dunski-kredo@icloud.com>
2026-05-06 01:21:31 -03:00
diegosouzapw
c63c5d5008 fix: resolve MCP endpoint auth bypass (#1970) and finalize DB settings 2026-05-05 09:59:43 -03:00
Sergey Morozov
8077e9b62b feat(settings): add request body limit setting (#1968)
Integrated into release/v3.7.9
2026-05-05 09:12:35 -03:00
payne
64b1a20010 fix(api): expose models.dev context windows in /v1/models (#1972)
Integrated into release/v3.7.9
2026-05-05 09:08:18 -03:00
diegosouzapw
afe4b19588 fix: resolve analytics tracking issues, provider alias mapping, and fallback calculation 2026-05-05 01:17:52 -03:00
Paijo
6a45ea2c97 feat(db): consolidate all database settings into SystemStorageTab (closes #1935) (#1947)
Integrated into release/v3.7.9
2026-05-04 19:25:41 -03:00
Aculeasis
3f900a833e fix(proxy): use credentials.connectionId instead of non-existent credentials.id for image proxy resolution (#1929)
Integrated into release/v3.7.9
2026-05-04 19:23:27 -03:00
diegosouzapw
7985f6818e Fix analytics fallback count test 2026-05-04 16:58:38 -03:00
diegosouzapw
3b473082e5 Merge main into release/v3.7.9 2026-05-04 16:55:04 -03:00
backryun
4dc959c1f2 chore(provider): Add reka models list (#1956)
Integrated into release/v3.7.9
2026-05-04 16:45:24 -03:00
diegosouzapw
0024d20e28 fix(settings): include usage and budget records in json backups
Export and restore usage history, domain cost history, and domain
budget data so analytics and budget state survive settings transfers.

Also adjust cost overview fallbacks to rank by request volume when
cost data is unavailable, count conversationState entries in chat
request logging, and align e2e coverage with the proxy settings route.
2026-05-04 16:28:47 -03:00
diegosouzapw
a1d40035df feat: support root user for MITM sudo handling (#1948) 2026-05-04 14:03:48 -03:00
Paijo
adf99811fa feat: add auto-assessment engine for combo self-healing (#1918)
Integrated into release/v3.7.9
2026-05-04 10:04:24 -03:00
Jan Leon
9577a8d9e8 feat: enhance cost formatting and add Codex GPT-5.5 pricing support (#1944)
Integrated into release/v3.7.9
2026-05-04 09:39:48 -03:00
Diego Rodrigues de Sa e Souza
99c6dc7fd6 Release v3.7.9 (#1917)
* chore(release): v3.7.9 — gemini-cli cloud code separation

* chore(provider): Update Jina AI model catalog (#1874)

Integrated into release/v3.7.9

* docs: update CHANGELOG for PR 1874 and retroactive credits

* fix: resolve stream defaults and codex prompt mapping (#1873, #1872)

* chore(compression): start caveman compression update

* feat(compression): expand caveman compression and analytics pipeline

Add caveman intensity levels, output mode instructions, validation, and
preview diffs across the compression pipeline.

Extend MCP and dashboard settings to support auto-trigger mode, system
prompt preservation, MCP description compression, and caveman rule
metadata. Record richer compression analytics with receipt fields,
validation fallbacks, output mode data, and add the related database
migration.

Improve preservation handling for code, URLs, markdown, math, and other
protected content while adding broad unit, integration, and golden-set
coverage for caveman parity and compression behavior.

* feat(compression): expose rule intensities and track usd savings

Add estimated USD savings to compression analytics so saved tokens can
be reported in cost terms alongside existing token metrics.

Expose caveman rule intensity metadata for settings consumers and add a
settings API route alias for rule lookup. Also preserve system prompts
when aggressive compression falls back to lite mode.

* feat(compression): RTK compression roadmap (#1889)

* chore(rtk): initialize compression roadmap branch

* feat(compression): add RTK engine and compression combos

Introduce RTK command-aware tool-output compression alongside
stacked RTK -> Caveman pipelines for mixed prompt contexts.

Add engine registration, declarative RTK filter packs, language-aware
Caveman rule loading, compression combo persistence and assignments,
analytics grouped by engine/combo, and new MCP/API endpoints for
configuration, previews, filters, and combo management.

Expose the new capabilities in the dashboard with dedicated Context &
Cache pages for Caveman, RTK, and compression combos, and update docs,
i18n strings, migrations, and tests to cover the expanded compression
surface.

* feat(compression): expand RTK DSL, filter catalog, and recovery APIs

Add RTK parity features across the compression pipeline, dashboard,
and management APIs. This expands the built-in filter catalog, adds
trust-gated custom filter loading, inline filter verification, code
stripping, smarter detection, and optional redacted raw-output
retention for authenticated recovery.

Also extend Caveman with file-based multilingual rule packs, localized
output-mode instructions, stricter preview/config schemas, engine
registry metadata, analytics fields, and broad unit test coverage for
RTK, rule loading, and stacked compression behavior.

* fix(auth): protect oauth routes and health reset operations

Require authenticated dashboard access for OAuth endpoints that can
create or import provider connections when login enforcement is
enabled.

Move `/api/monitoring/health` to the readonly public route list so
safe methods remain public while DELETE now returns 401 for anonymous
requests.

Also update Next.js native `.node` handling to avoid webpack parse
failures from external packages such as ngrok and keytar, and add
coverage for the new auth behavior.

* build(compression): ship RTK rule and filter assets with app bundles

Include compression JSON assets in Next output tracing, prepublish copies,
and pack artifact policy checks so standalone and packaged builds can
load RTK filters and caveman rule packs at runtime.

Also harden compression runtime behavior by resolving alternate asset
directories, scoping rule cache entries by source path, carrying RTK raw
output pointers through stacked runs, degrading oversized preview diffs,
and applying combo language/output mode defaults during chat routing.

Add coverage for packaging rules, provider-scoped model parsing, smart
truncate edge cases, raw output retention, and combo-driven compression
behavior.

* docs(workflows): update local repo paths to OmniRoute

Replace outdated `/home/diegosouzapw/dev/proxys/9router` references
with the current `OmniRoute` directory across deploy, release, and
version bump workflow guides so local command examples match the
renamed repository layout

* feat(compression): complete RTK parity coverage

* test(build): align next config assertions

---------

Co-authored-by: diegosouzapw <diego.souza.pw@gmail.com>

* feat(compression): expand caveman parity and MCP metadata compression

Compress MCP registry and list metadata descriptions for tools, prompts,
resources, and resource templates while keeping tool-response bodies
unchanged. Expose those savings in compression status as
`mcp_metadata_estimate` metadata rather than provider usage.

Add Caveman rule-pack support for custom regex flags and match-specific
replacement maps, update English rules for upstream parity, and tighten
article and pleasantry handling. Also process RTK multipart text blocks
independently so mixed media content compresses safely without
duplicating output.

* feat(compression): unify config validation and persist MCP savings

Centralize compression config schemas across settings, preview, RTK,
and combo APIs to enforce consistent validation for stacked pipelines
and engine-specific options.

Expand caveman and stacked compression behavior by applying default
combos at runtime, surfacing validation and fallback metadata, and
exposing aggressive and ultra adapter schemas for configuration UI and
tests.

Persist MCP description compression snapshots into analytics without
counting them as provider usage, and extend the dashboard with the new
RTK controls and localized labels.

* fix(auth): require dashboard management auth for compression preview

Block preview requests unless they come from a valid management session
token so protected settings cannot be probed through the preview API.

Add unit coverage for unauthenticated requests, invalid bearer tokens,
and successful authenticated preview execution.

* fix(compression): preserve stacked defaults and secure metadata routes

Only apply saved default compression combos when they contain a stacked
pipeline so seeded Caveman-only defaults do not replace the builtin
stacked behavior.

Also require management auth for compression language pack and rules
metadata endpoints, and defer usage receipt attachment until compression
analytics writes have completed to keep analytics records consistent.

* fix(compression): align seeded standard savings combo with stacked default

Update the seeded default compression combo to use the RTK then
Caveman pipeline in both fresh installs and upgraded databases.

Add a targeted migration and runtime guard that only rewrites the
legacy seeded record when its original metadata and single-step
pipeline still match, preserving user-customized default combos.
Refresh docs and tests to reflect the stacked default and expanded
RTK filter catalog.

* docs(compression): document RTK+Caveman stacked savings ranges

Refresh the compression docs and README to describe the default
stacked pipeline in terms of eligible-context savings instead of the
older generic token-saving range.

Add upstream RTK and Caveman benchmark references, explain the
multiplicative savings math behind the stacked default, and update
feature summaries plus package metadata to match the revised
positioning.

* feat(image-gen): add NanoGPT image generation provider (#1899)

Integrated into release/v3.7.9

* fix(codex): sanitize raw responses input (#1895)

Integrated into release/v3.7.9

* Fix combo provider breaker profile handling (#1891)

Integrated into release/v3.7.9

* fix(combos): align strategy contracts (#1892)

Integrated into release/v3.7.9

* feat(proxy): move proxy configuration to dedicated System → Proxy page (#1907)

Integrated into release/v3.7.9

* feat: add K/M/B/T cost shortener to prevent UI overflow (#1902)

Integrated into release/v3.7.9

* feat(providers): implement bulk paste for extra API keys (#1916)

Integrated into release/v3.7.9

* fix(migrations): treat duplicate-column ALTER as no-op (#1886)

Integrated into release/v3.7.9

* fix(analytics): robust model pricing resolution, dark mode charts and SQL aggregation fixes (#1896)

Integrated into release/v3.7.9 (migration renumbered to 044)

* fix(oauth): per-connection mutex for rotating refresh tokens (#1885)

Integrated into release/v3.7.9

* fix: resolve 3 bugs — Codex tool normalization (#1914), image gen proxy (#1904), zero-arg MCP tools (#1898)

- fix(codex): flatten Chat Completions tool format to Responses format in
  normalizeCodexTools. Prevents 'Missing required parameter: tools[0].name'
  upstream errors when clients send {type:'function', function:{name,...}}
  instead of {type:'function', name,...}.

- fix(proxy): add proxy-aware execution context to image generation route.
  Image requests now correctly use proxy settings from the connection's
  ProxyRegistry assignment, matching the pattern used by chat pipeline.

- fix(translator): inject properties:{} into zero-argument MCP tool schemas
  during Anthropic→OpenAI translation. OpenAI strict mode requires explicit
  properties even for empty object schemas.

Closes #1914, Closes #1904, Closes #1898

* chore(release): v3.7.9 — all changes in ONE commit

* fix: allow local ollama provider connections (#1893)

* fix(copilot): emit compatible reasoning text deltas (#1919)

Integrated into release/v3.7.9

* fix(api-manager): show validation errors inline in modals, not behind backdrop (#1920)

Integrated into release/v3.7.9

* docs: update changelog and pr body with merged prs

* fix(providers): route agentrouter through anthropic endpoint headers

Update the AgentRouter provider registry to use the Claude-compatible
messages API and required Anthropic-style authentication headers. This
bypasses unauthorized_client_error responses and exposes the supported
model list through passthrough configuration.

Also update the changelog and release PR notes to document the fix for
#1921

* feat(logs): show compression tokens in request log UI (#1923)

* docs: add PR #1923 to changelog

---------

Co-authored-by: diegosouzapw <diego.souza.pw@gmail.com>
Co-authored-by: backryun <bakryun0718@proton.me>
Co-authored-by: Aculeasis <42580940+Aculeasis@users.noreply.github.com>
Co-authored-by: Raxxoor <manker_lol@hotmail.com>
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: Tubagus <54710482+0xtbug@users.noreply.github.com>
Co-authored-by: smartenok-ops <smartenok@gmail.com>
Co-authored-by: Gi99lin <74502520+Gi99lin@users.noreply.github.com>
Co-authored-by: ivan-mezentsev <ivan@mezentsev.me>
Co-authored-by: Andrew Munsell <andrew@wizardapps.net>
2026-05-04 01:36:53 -03:00
diegosouzapw
9e1d4885b5 fix: resolve 3 bugs — Codex tool normalization (#1914), image gen proxy (#1904), zero-arg MCP tools (#1898)
- fix(codex): flatten Chat Completions tool format to Responses format in
  normalizeCodexTools. Prevents 'Missing required parameter: tools[0].name'
  upstream errors when clients send {type:'function', function:{name,...}}
  instead of {type:'function', name,...}.

- fix(proxy): add proxy-aware execution context to image generation route.
  Image requests now correctly use proxy settings from the connection's
  ProxyRegistry assignment, matching the pattern used by chat pipeline.

- fix(translator): inject properties:{} into zero-argument MCP tool schemas
  during Anthropic→OpenAI translation. OpenAI strict mode requires explicit
  properties even for empty object schemas.

Closes #1914, Closes #1904, Closes #1898
2026-05-03 17:51:22 -03:00
Gi99lin
1d38900f17 fix(analytics): robust model pricing resolution, dark mode charts and SQL aggregation fixes (#1896)
Integrated into release/v3.7.9 (migration renumbered to 044)
2026-05-03 16:19:08 -03:00
diegosouzapw
6e38bd5393 fix(compression): preserve stacked defaults and secure metadata routes
Only apply saved default compression combos when they contain a stacked
pipeline so seeded Caveman-only defaults do not replace the builtin
stacked behavior.

Also require management auth for compression language pack and rules
metadata endpoints, and defer usage receipt attachment until compression
analytics writes have completed to keep analytics records consistent.
2026-05-03 14:06:37 -03:00
diegosouzapw
dde74281de fix(auth): require dashboard management auth for compression preview
Block preview requests unless they come from a valid management session
token so protected settings cannot be probed through the preview API.

Add unit coverage for unauthenticated requests, invalid bearer tokens,
and successful authenticated preview execution.
2026-05-03 12:53:45 -03:00
diegosouzapw
a7233d1bf1 feat(compression): unify config validation and persist MCP savings
Centralize compression config schemas across settings, preview, RTK,
and combo APIs to enforce consistent validation for stacked pipelines
and engine-specific options.

Expand caveman and stacked compression behavior by applying default
combos at runtime, surfacing validation and fallback metadata, and
exposing aggressive and ultra adapter schemas for configuration UI and
tests.

Persist MCP description compression snapshots into analytics without
counting them as provider usage, and extend the dashboard with the new
RTK controls and localized labels.
2026-05-03 12:38:21 -03:00
Diego Rodrigues de Sa e Souza
743be29852 feat(compression): RTK compression roadmap (#1889)
* chore(rtk): initialize compression roadmap branch

* feat(compression): add RTK engine and compression combos

Introduce RTK command-aware tool-output compression alongside
stacked RTK -> Caveman pipelines for mixed prompt contexts.

Add engine registration, declarative RTK filter packs, language-aware
Caveman rule loading, compression combo persistence and assignments,
analytics grouped by engine/combo, and new MCP/API endpoints for
configuration, previews, filters, and combo management.

Expose the new capabilities in the dashboard with dedicated Context &
Cache pages for Caveman, RTK, and compression combos, and update docs,
i18n strings, migrations, and tests to cover the expanded compression
surface.

* feat(compression): expand RTK DSL, filter catalog, and recovery APIs

Add RTK parity features across the compression pipeline, dashboard,
and management APIs. This expands the built-in filter catalog, adds
trust-gated custom filter loading, inline filter verification, code
stripping, smarter detection, and optional redacted raw-output
retention for authenticated recovery.

Also extend Caveman with file-based multilingual rule packs, localized
output-mode instructions, stricter preview/config schemas, engine
registry metadata, analytics fields, and broad unit test coverage for
RTK, rule loading, and stacked compression behavior.

* fix(auth): protect oauth routes and health reset operations

Require authenticated dashboard access for OAuth endpoints that can
create or import provider connections when login enforcement is
enabled.

Move `/api/monitoring/health` to the readonly public route list so
safe methods remain public while DELETE now returns 401 for anonymous
requests.

Also update Next.js native `.node` handling to avoid webpack parse
failures from external packages such as ngrok and keytar, and add
coverage for the new auth behavior.

* build(compression): ship RTK rule and filter assets with app bundles

Include compression JSON assets in Next output tracing, prepublish copies,
and pack artifact policy checks so standalone and packaged builds can
load RTK filters and caveman rule packs at runtime.

Also harden compression runtime behavior by resolving alternate asset
directories, scoping rule cache entries by source path, carrying RTK raw
output pointers through stacked runs, degrading oversized preview diffs,
and applying combo language/output mode defaults during chat routing.

Add coverage for packaging rules, provider-scoped model parsing, smart
truncate edge cases, raw output retention, and combo-driven compression
behavior.

* docs(workflows): update local repo paths to OmniRoute

Replace outdated `/home/diegosouzapw/dev/proxys/9router` references
with the current `OmniRoute` directory across deploy, release, and
version bump workflow guides so local command examples match the
renamed repository layout

* feat(compression): complete RTK parity coverage

* test(build): align next config assertions

---------

Co-authored-by: diegosouzapw <diego.souza.pw@gmail.com>
2026-05-03 00:37:08 -03:00
diegosouzapw
aa40bc34f5 feat(compression): expose rule intensities and track usd savings
Add estimated USD savings to compression analytics so saved tokens can
be reported in cost terms alongside existing token metrics.

Expose caveman rule intensity metadata for settings consumers and add a
settings API route alias for rule lookup. Also preserve system prompts
when aggressive compression falls back to lite mode.
2026-05-02 12:57:37 -03:00
diegosouzapw
0f35c148ea feat(compression): expand caveman compression and analytics pipeline
Add caveman intensity levels, output mode instructions, validation, and
preview diffs across the compression pipeline.

Extend MCP and dashboard settings to support auto-trigger mode, system
prompt preservation, MCP description compression, and caveman rule
metadata. Record richer compression analytics with receipt fields,
validation fallbacks, output mode data, and add the related database
migration.

Improve preservation handling for code, URLs, markdown, math, and other
protected content while adding broad unit, integration, and golden-set
coverage for caveman parity and compression behavior.
2026-05-02 12:39:04 -03:00
backryun
c49929327a chore(provider): Update Jina AI model catalog (#1874)
Integrated into release/v3.7.9
2026-05-02 09:52:24 -03:00
diegosouzapw
4b9c129e1c fix: harden security scan findings 2026-05-02 04:51:38 -03:00
diegosouzapw
01092fa349 fix: resolve runtime metadata and migration directory lookup
Export shared runtime platform and architecture helpers so provider
registry header generation uses the same process-based detection logic
as header profiles instead of direct os module calls.

Improve migration directory resolution by searching upward through
common project layouts and checking multiple candidate paths before
falling back to OMNIROUTE_MIGRATIONS_DIR errors.
2026-05-01 22:00:04 -03:00
diegosouzapw
41ff569260 fix: resolve maxConcurrent display and binding bug (#1859) 2026-05-01 21:48:20 -03:00
backryun
fa950a8a49 fix(Upstage):Update Model list (#1855)
Integrated into release/v3.7.8
2026-05-01 13:48:13 -03:00
Paijo
9042d5049d feat: integrate 1proxy free proxy marketplace (closes #1788) (#1847)
Integrated into release/v3.7.8
2026-05-01 08:41:19 -03:00
Antigravity Assistant
934c133103 fix(analytics): avoid persisting inferred API key ownership
Stop usage analytics reads from backfilling missing API key attribution
into historical rows so legacy records remain unchanged and surface as
unknown instead of guessed ownership.

Also require management authentication on admin concurrency and
compression analytics endpoints, and preserve image payloads during lite
compression unless a model is explicitly marked as non-vision.
2026-04-30 20:31:00 -03:00
Antigravity Assistant
fa0f3cc8be Merge release/v3.7.7 into compression phase 5 2026-04-30 17:52:23 -03:00
Antigravity Assistant
7b21e04604 Merge release/v3.7.7 into compression phase 4 2026-04-30 17:37:57 -03:00
Antigravity Assistant
5e0d6263ed Merge release/v3.7.7 into compression phase 3 2026-04-30 17:22:03 -03:00
Antigravity Assistant
595b5dc642 Merge release/v3.7.7 into compression phase 2 2026-04-30 17:07:39 -03:00
Antigravity Assistant
16f14b76a9 Merge release/v3.7.7 into prompt compression phase 1 2026-04-30 16:51:44 -03:00
Gi99lin
e929559e9a feat(analytics): Custom date range, API key filter & NULL key enrichment (#1830)
Integrated into release/v3.7.7
2026-04-30 15:58:00 -03:00
payne
6c172df547 fix(rate-limit): watchdog, env override, and stage tracing to prevent silent wedges (#1828)
Integrated into release/v3.7.7
2026-04-30 15:48:50 -03:00
Antigravity Assistant
cc460b36b9 fix(ci): fix typecheck implicit any errors and CodeQL regex alert 2026-04-30 14:44:58 -03:00
Diego Rodrigues de Sa e Souza
3ec9ca11b1 Release v3.7.6 (#1803)
* feat(api-keys): add rename support in permissions modal

Add an editable key name field at the top of the permissions modal,
allowing users to rename API keys alongside existing permission settings.

The backend already supported name updates via PATCH /api/keys/:id — this
wires the UI to send the name field and refreshes the key list on success.

Changes:
- Add keyName state and text input to PermissionsModal
- Update handleUpdatePermissions to validate and send name in PATCH body
- Add integration test for rename via PATCH (valid, empty, too-long names)
- Update E2E mock to handle PATCH requests

* chore(release): bump version to 3.7.6

* chore(release): v3.7.6 — merge API key rename feature and sync docs

* chore(release): expand contributor credits to 155 PRs across full project history

- Expanded acknowledgment table from 29 to 53 contributors
- Added 100+ previously uncredited PRs from project inception through v3.7.5
- Moved contributor credits section to v3.7.6 (current release)
- Synced llm.txt version to 3.7.6

* fix: resolve security ReDoS in codex and bugs #1797 #1789

* feat(dashboard): implement remaining v3.7.6 dashboard features and fixes

* fix(xiaomi-mimo): update models to V2.5, fix Token Plan validation and default region (#1823)

Integrated into release/v3.7.6

* fix(dashboard): correct loadPresets ReferenceError in CostOverviewTab

* fix(codex): omit compact client metadata (#1822)

Integrated into release/v3.7.6

* feat(chatgpt-web): support thinking_effort (Standard/Extended) for thinking-capable models (#1821)

Integrated into release/v3.7.6

* Fix endpoint visibility, A2A status, and API catalog (#1806)

Integrated into release/v3.7.6

* fix(analytics): use pure SQL aggregations — no history rows loaded (#1802)

Integrated into release/v3.7.6

* fix(stability): resolve codex input validation, enable combo circuit breaker, and fix broken unit tests

* docs(changelog): update for stability bug fixes #1804 #1805

* fix: clear active requests and recover providers (#1824)

Integrated into release/v3.7.6

* feat: inject fallback tool names to prevent upstream 400 errors (#1775)

* feat: auto-restore probe-failed database to prevent data loss (#1810)

* fix: safely cast inputs to strings before calling trim() to avoid crashes on numeric fields in proxy modal (#1825)

* chore(release): v3.7.6 — final stability patches for production

* test: update expected db probe-failure error message for auto-restore feature

* chore(workflow): mandate implementation plan generation in resolve-issues

* docs(changelog): rewrite v3.7.6 with complete commit-accurate entries

* feat(analytics): add cost-based usage insights and activity streaks

Expand usage analytics to report total cost, per-series cost totals,
API key counts, and current activity streaks using pricing-aware token
calculations.

Also make probe-failed database recovery choose the newest backup by
its embedded timestamp instead of filesystem mtime so auto-restore
selects the intended snapshot reliably.

* fix(mitm): enforce transparent interception on port 443 only

Reject non-443 MITM port updates in the settings API and normalize
stored configuration back to the required transparent interception
port.

Lock the dashboard port field to 443, update the validation copy, and
add integration coverage to prevent stale custom ports from being
accepted or surfaced.

* docs(changelog): update for analytics and mitm features

---------

Co-authored-by: Andrew Munsell <andrew@wizardapps.net>
Co-authored-by: Antigravity Assistant <bot@antigravity.local>
Co-authored-by: Gi99lin <74502520+Gi99lin@users.noreply.github.com>
Co-authored-by: Sergey Morozov <tr0st@bk.ru>
Co-authored-by: payne <baboialex95@gmail.com>
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: ipanghu <bypanghu@163.com>
2026-04-30 14:08:50 -03:00
Diego Rodrigues de Sa e Souza
24ffdde03d Release v3.7.5 (#1753)
* docs(changelog): record PR #1748 for next release

* fix(models): apply blocked providers filter to non-chat catalog models (#1752)

* chore(release): v3.7.5 — integrate ngrok tunnel and fix models filter (#1753, #1752)

* chore(release): update changelog format for v3.7.5

* Speed up endpoint initial render

* Address endpoint review feedback

* Add endpoint loading model translations

* fix: resolve build issues and implement memory UPSERT logic (#1763)

* fix: resolve build issues for v3.7.5 and apply memory/translation fixes

1. antigravityHeaders.ts: restore ANTIGRAVITY_LOAD_CODE_ASSIST_* exports for oauth.ts compatibility
2. next.config.mjs: add @ngrok/ngrok to serverExternalPackages and webpack externals to handle native .node modules
3. Memory system: UPSERT logic to prevent duplicate entries with same apiKeyId + key
4. Chinese translations: complete CLI tools and memory dashboard localizations
5. Test fixes: unique keys for pagination tests to comply with unique constraint

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: address Gemini Code Assist review feedback

1. store.ts: add expires_at to UPDATE statement in UPSERT logic
   - Previously, expires_at was not being persisted to database on update
   - This caused state mismatch between returned Memory object and actual DB row

2. package-lock.json: revert react-markdown registry to official npmjs.org
   - Mirror-specific registry URL (npmmirror.com) should not be in lockfile

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* fix(antigravity): normalize Gemini bridge payloads (#1769)

* fix(antigravity): normalize Gemini bridge payloads

Clamp Claude bridge output tokens, use Gemini-valid system roles and tool names, and serialize antigravity requests from a cloned body so Cloud Code payload shaping stays valid.

* fix(cli): stop fallback after unsafe known paths

Preserve known-path security checks by stopping command discovery when a configured CLI path is suspicious or non-executable, instead of falling through to PATH discovery.

* test(memory): make query result assertion deterministic

Avoid relying on database result ordering when checking filtered memory keys so the unit suite remains stable across runs.

* fix(review): preserve safe cloning and CLI reasons

Handle non-cloneable antigravity request bodies without throwing and preserve specific CLI known-path failure reasons instead of masking them as not_found.

* fix(sse): propagate AbortSignal to pre-fetch semaphore and rate-limit awaits (#1771)

When a combo target takes too long, the request-level deadline fires
and calls abortController.abort() on the stream controller, but the
abort signal never reaches pending awaits in acquireAccountSemaphore()
or withRateLimit(). These awaits sit between stream controller creation
and executor.execute(), causing requests to hang indefinitely past the
600s deadline.

Pass streamController.signal to both functions so they can respond to
abort events and terminate early when the request deadline expires.

Signed-off-by: wucm667 <stevenwucongmin@gmail.com>

* Fix model sync import handling (#1755)

* Fix model sync import handling

* Align model import storage semantics

* Address model review feedback

* fix(codex): stabilize copilot responses reasoning and tool replay (#1750)

* chore(xiaomi): Update Xiaomi provider model list (#1759)

* Move DB health to management API (#1757)

* Move DB health to management API

* Address DB health review feedback

* fix(kiro): support organization IDC OAuth with regional endpoints and refresh (#1754)

* fix(kiro): support organization IDC OAuth with regional endpoints and refresh

* fix(kiro): refresh IDC tokens with stored region

---------

Co-authored-by: ngocdb <ngocdb@ngocdb.local>

* chore(workflows): add strict PR contributor credit policy

- Add ABSOLUTE PROHIBITION section to review-prs.md
- Add PR PROHIBITION rule to resolve-issues.md
- Add contributor credit rule to AGENTS.md Review Focus
- Based on audit finding: 37 PRs had code absorbed without merge credit

* chore(release): acknowledge 29 community contributors with retroactive credit

This commit formally recognizes 29 contributors whose code was manually
integrated across releases v3.4.0 through v3.7.4 without proper GitHub
merge credit. Their PRs were resolved locally due to merge conflicts
but closed instead of merged, preventing them from appearing in the
Contributors graph. We have updated our workflows to ensure this never
happens again.

Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Benson K B <4044180+benzntech@users.noreply.github.com>
Co-authored-by: clousky2020 <33016567+clousky2020@users.noreply.github.com>
Co-authored-by: Raxxoor <7317522+dhaern@users.noreply.github.com>
Co-authored-by: Jason Landbridge <15127381+JasonLandbridge@users.noreply.github.com>
Co-authored-by: slewis3600 <35925982+slewis3600@users.noreply.github.com>
Co-authored-by: Markus Hartung <12826053+hartmark@users.noreply.github.com>
Co-authored-by: Hernan Javier Ardila Sanchez <204746071+herjarsa@users.noreply.github.com>
Co-authored-by: 3_1_3_u <5846351+andruwa13@users.noreply.github.com>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: i1hwan <35260883+i1hwan@users.noreply.github.com>
Co-authored-by: xandr0s <1709302+xandr0s@users.noreply.github.com>
Co-authored-by: backryun <24198422+backryun@users.noreply.github.com>
Co-authored-by: Owen <36758131+kang-heewon@users.noreply.github.com>
Co-authored-by: Ravi Tharuma <25951435+RaviTharuma@users.noreply.github.com>
Co-authored-by: Chris <3751981+christopher-s@users.noreply.github.com>
Co-authored-by: Wellington Fonseca <5421548+wlfonseca@users.noreply.github.com>
Co-authored-by: Ethan Hunt <136065060+only4copilot@users.noreply.github.com>
Co-authored-by: tombii <6607822+tombii@users.noreply.github.com>
Co-authored-by: AndrewDragonIV <7906124+AndrewDragonIV@users.noreply.github.com>
Co-authored-by: Danh Thanh <50534210+dt418@users.noreply.github.com>
Co-authored-by: Will F <30637450+willbnu@users.noreply.github.com>
Co-authored-by: defhouse <232128212+defhouse@users.noreply.github.com>
Co-authored-by: Skydwest <186351198+mercs2910@users.noreply.github.com>
Co-authored-by: zenobit <6384793+zen0bit@users.noreply.github.com>
Co-authored-by: Ivan <16905671+razllivan@users.noreply.github.com>
Co-authored-by: foxy1402 <45601526+foxy1402@users.noreply.github.com>
Co-authored-by: Luan Dias <65574834+luandiasrj@users.noreply.github.com>
Co-authored-by: Sergei Korolev <891832+knopki@users.noreply.github.com>
Co-authored-by: dail45 <69967573+dail45@users.noreply.github.com>

* fix(combo): include 429 in provider circuit breaker to stop infinite retry on exhausted quotas (#1767)

Previously, PROVIDER_FAILURE_ERROR_CODES only included {408, 500, 502, 503, 504},
meaning 429 responses never counted toward the circuit breaker threshold. This caused
exhausted accounts to be retried every 3-5 seconds indefinitely instead of being
blocked by the provider breaker.

Adding 429 ensures persistent rate limiting triggers the circuit breaker after the
configured failure threshold, giving the provider time to recover.

* fix(claude): respect client thinking/effort params to prevent forced quota drain (#1761)

Previously, OmniRoute unconditionally injected thinking: {type: 'adaptive'} and
output_config: {effort: 'high'} for Claude Opus 4.7 in Claude Code client requests.
This caused Claude Max 5h quota to drain in ~15 minutes.

Now checks the original client body: if thinking or output_config are explicitly set
(even to null or a different value), the injection is skipped. Users can opt-out by
sending thinking: null or output_config: {effort: 'low'}.

* Add MseeP.ai badge to README.md (#1727)

Integrated into release/v3.7.5

* chore(docs): update CHANGELOG for PR #1727

* fix(tests): update stream-utils assertion for responses api compliance

* feat: Fix support for claude-cli using Gemini provider (#1779)

Integrated into release/v3.7.5

* fix(codex): align client identity metadata (#1778)

Integrated into release/v3.7.5

* fix(blackbox-web): correct cookie name and populate session/subscription fields (#1776)

Integrated into release/v3.7.5

* Fix Codex /responses/compact passthrough (#1777)

Integrated into release/v3.7.5

* test(reasoning-cache): isolate DB state using mkdtempSync to prevent 401 middleware errors

* chore(release): v3.7.5 — integrate remaining PRs and finalize stability

* chore(config): remove local patch artifacts and trim workspace config

Delete temporary patch scripts and local OMC session files that should not
ship with the repository.

Also remove the Next.js config file and expand editor and TypeScript
exclusions to ignore large local workspace directories and reduce
unnecessary indexing.

* fix(antigravity): cap Claude bridge output tokens (#1785)

Integrated into release/v3.7.5

* fix(codex): stabilize Copilot responses replay state (#1791)

Integrated into release/v3.7.5

* fix(chatgpt-web): restore validator + expand model catalog to ChatGPT Plus tier (#1792)

Integrated into release/v3.7.5

* fix(antigravity): scrub internal OmniRoute headers (#1794)

Integrated into release/v3.7.5

* fix(grok-web): fix Grok validator and cookie parsing (#1793)

Integrated into release/v3.7.5

* chore(release): v3.7.5 — finalize changelog for LTS patch

* feat(api-keys): add rename support in permissions modal

Add an editable key name field at the top of the permissions modal,
allowing users to rename API keys alongside existing permission settings.

The backend already supported name updates via PATCH /api/keys/:id — this
wires the UI to send the name field and refreshes the key list on success.

Changes:
- Add keyName state and text input to PermissionsModal
- Update handleUpdatePermissions to validate and send name in PATCH body
- Add integration test for rename via PATCH (valid, empty, too-long names)
- Update E2E mock to handle PATCH requests

* chore(release): finalize v3.7.5 LTS release with schema and db initialization fixes

* test: fix json escaping in stream-utilities test

* fix(build): restore next.config.mjs that was accidentally deleted

* fix(sse): decrement pending requests on passthrough mode failure (#1798)

Integrated into release/v3.7.5

* fix(grok-web): repair validator probe + accept full cookie blobs (#1793)

Integrated into release/v3.7.5

* docs(i18n): sync documentation updates to 40 languages

---------

Signed-off-by: wucm667 <stevenwucongmin@gmail.com>
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
Co-authored-by: R.D. <rogerproself@gmail.com>
Co-authored-by: clousky2020 <33016567+clousky2020@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: cloudy <37777261+uwuclxdy@users.noreply.github.com>
Co-authored-by: wucm667 <109257021+wucm667@users.noreply.github.com>
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: ivan-mezentsev <ivan@mezentsev.me>
Co-authored-by: backryun <bakryun0718@proton.me>
Co-authored-by: Dao Bao Ngoc <42265865+daongoc315@users.noreply.github.com>
Co-authored-by: ngocdb <ngocdb@ngocdb.local>
Co-authored-by: Benson K B <4044180+benzntech@users.noreply.github.com>
Co-authored-by: Raxxoor <7317522+dhaern@users.noreply.github.com>
Co-authored-by: Jason Landbridge <15127381+JasonLandbridge@users.noreply.github.com>
Co-authored-by: slewis3600 <35925982+slewis3600@users.noreply.github.com>
Co-authored-by: Markus Hartung <12826053+hartmark@users.noreply.github.com>
Co-authored-by: Hernan Javier Ardila Sanchez <204746071+herjarsa@users.noreply.github.com>
Co-authored-by: 3_1_3_u <5846351+andruwa13@users.noreply.github.com>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: i1hwan <35260883+i1hwan@users.noreply.github.com>
Co-authored-by: xandr0s <1709302+xandr0s@users.noreply.github.com>
Co-authored-by: backryun <24198422+backryun@users.noreply.github.com>
Co-authored-by: Owen <36758131+kang-heewon@users.noreply.github.com>
Co-authored-by: Ravi Tharuma <25951435+RaviTharuma@users.noreply.github.com>
Co-authored-by: Chris <3751981+christopher-s@users.noreply.github.com>
Co-authored-by: Wellington Fonseca <5421548+wlfonseca@users.noreply.github.com>
Co-authored-by: Ethan Hunt <136065060+only4copilot@users.noreply.github.com>
Co-authored-by: tombii <6607822+tombii@users.noreply.github.com>
Co-authored-by: AndrewDragonIV <7906124+AndrewDragonIV@users.noreply.github.com>
Co-authored-by: Danh Thanh <50534210+dt418@users.noreply.github.com>
Co-authored-by: Will F <30637450+willbnu@users.noreply.github.com>
Co-authored-by: defhouse <232128212+defhouse@users.noreply.github.com>
Co-authored-by: Skydwest <186351198+mercs2910@users.noreply.github.com>
Co-authored-by: zenobit <6384793+zen0bit@users.noreply.github.com>
Co-authored-by: Ivan <16905671+razllivan@users.noreply.github.com>
Co-authored-by: foxy1402 <45601526+foxy1402@users.noreply.github.com>
Co-authored-by: Luan Dias <65574834+luandiasrj@users.noreply.github.com>
Co-authored-by: Sergei Korolev <891832+knopki@users.noreply.github.com>
Co-authored-by: dail45 <69967573+dail45@users.noreply.github.com>
Co-authored-by: MseeP.ai <mseep@skydeck.ai>
Co-authored-by: Markus Hartung <mail@hartmark.se>
Co-authored-by: Raxxoor <manker_lol@hotmail.com>
Co-authored-by: Jack <5443152+hijak@users.noreply.github.com>
Co-authored-by: Sergey Morozov <tr0st@bk.ru>
Co-authored-by: payne <baboialex95@gmail.com>
Co-authored-by: Antigravity Assistant <bot@antigravity.local>
Co-authored-by: Andrew Munsell <andrew@wizardapps.net>
2026-04-30 01:27:03 -03:00
oyi77
71702a086c feat(compression): Phase 5 - analytics DB, APIs, dashboard UI, analytics tab, combo override, playground preview
- Add compression_analytics table (migration 032)
- Add compressionAnalytics.ts DB module (insert + summary query)
- Add GET /api/analytics/compression endpoint (since=24h|7d|30d|all)
- Add POST /api/compression/preview endpoint (Zod-validated)
- Add CompressionAnalyticsTab.tsx with KPI cards, mode/provider bars, hourly chart
- Wire Compression tab into /dashboard/analytics page
- Add /dashboard/compression page (thin wrapper over CompressionSettingsTab)
- Add ultra mode to MODES array in CompressionSettingsTab
- Add per-combo compression override dropdown (persists via PUT /api/combos/:id)
- Add compressionOverride field to updateComboSchema Zod validation
- Add compression preview panel to PlaygroundMode (collapsible, CSS-only)
2026-04-29 11:50:11 +07:00
Raxxoor
6d6a4abb8a fix(antigravity): stabilize streaming and usage refresh (#1748)
Integrated into release/v3.7.5 (PR #1748)
2026-04-28 23:01:23 -03:00
Diego Rodrigues de Sa e Souza
0cd388efb8 Release v3.7.4 (#1730)
* chore(release): v3.7.4 — version bump, openapi and changelog sync

* fix: preserve previous_response_id and conversation_id fields on empty input array (#1729)

* fix: bypass UI validation block for optional API keys and fix string fallback typing (#1721)

* fix(proxy): disable HTTP keep-alive and pipelining in Undici proxy dispatcher to prevent socket hang up

* feat(proxy): implement bulk proxy import via pipe-delimited parser with update-or-create logic

* docs: update changelog for v3.7.4 fixes and proxy features

* test: update responses store expectations for empty input arrays

* feat(pwa): add fullscreen installable PWA with manifest, service worker, and cross-platform app icons. (#1728)

Integrated into release/v3.7.4

* Fix image provider validation and Stability image requests (#1726)

Integrated into release/v3.7.4

* docs: add PR 1726 and PR 1728 to v3.7.4 changelog

* fix(security): replace insecure Math.random with crypto.getRandomValues for fallback UUID generation

* fix(migrations): intercept 007 migration to use IF NOT EXISTS logic on fresh installs

Fixes #1733

* test: fix typescript compilation errors in unit tests

* fix(db): reconcile legacy reasoning cache migration

* chore(release): bump to v3.7.4 — changelog, docs, version sync

* fix(cc-compatible): preserve Claude Code system skeleton (#1740)

Integrated into release/v3.7.4

* docs(changelog): update for PR #1740 merge

* docs(changelog): include workflow updates

* fix(db): reconcile legacy reasoning cache migration (#1734)

Integrated into release/v3.7.4

* Add endpoint tunnel visibility settings (#1743)

Integrated into release/v3.7.4

* Normalize max reasoning effort for Codex routing (#1744)

Integrated into release/v3.7.4

* Fix Claude Code gateway config helper (#1745)

Integrated into release/v3.7.4

* Refresh CLI fingerprint provider profiles (#1746)

Integrated into release/v3.7.4

* Integrated into release/v3.7.4 (PR #1742)

* docs(changelog): update for PRs 1742-1746

---------

Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
Co-authored-by: Yash Ghule <y.ghule77@gmail.com>
Co-authored-by: backryun <bakryun0718@proton.me>
Co-authored-by: dhaern <manker_lol@hotmail.com>
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Duncan L <leungd@gmail.com>
2026-04-28 20:46:25 -03:00
oyi77
6bf7b9601d feat(compression): Phase 3 — aggressive mode with summarization, tool compression, and progressive aging
Implements the aggressive compression pipeline (issue #1588) with three
core stages: tool-result compression, progressive aging, and rule-based
summarization. Includes downgrade chain to caveman/lite when savings are
insufficient.

Core modules:
- summarizer.ts: RuleBasedSummarizer with intent/file/error/decision
  extraction, code fence trimming, skip-already-compressed guard
- toolResultCompressor.ts: 5 auto-detected strategies (fileContent,
  grepSearch, shellOutput, json, errorMessage) with toggle support
- progressiveAging.ts: 4-tier degradation (verbatim→light→moderate→
  fullSummary) with [COMPRESSED:aging:<tier>] markers
- aggressive.ts: Orchestrator with 3-step pipeline and downgrade chain
  (aggressive→caveman→lite→as-is)

Integration:
- strategySelector.ts: applyCompression() now dispatches mode='aggressive'
- compression.ts: aggressiveConfig CRUD with deep merge of nested objects
- API route: Zod schema for aggressiveConfig thresholds/strategies
- CompressionSettingsTab: aggressive mode card, thresholds, toggles, i18n
- Migration 031: SELECT 1 no-op (config stored as kv key)

Tests: 109 across 8 files (types, summarizer, toolResultCompressor,
progressiveAging, aggressive, integration, golden eval, caveman regression)
All pass. Typecheck clean. Lint clean (0 errors). Build succeeds.
2026-04-28 16:58:17 +07:00
diegosouzapw
96fa89052b chore: resolve merge conflicts from main into release/v3.7.2 2026-04-28 02:53:34 -03:00
backryun
a16e47c593 fix(providers): refresh web client user agents (#1699)
Integrated release/v3.7.2 changes — refreshed web client user agents, env docs, Gemini OAuth fix
2026-04-28 02:41:19 -03:00
Nam Hoang
73022ff3b3 fix(oauth): target specific connection by id on re-auth token exchange (#1702)
Integrated into release/v3.7.2 — fixes OAuth re-auth targeting specific connection by ID
2026-04-28 02:28:50 -03:00
oyi77
c0d92f3569 feat(ui): add compression settings tab, compression log viewer, and settings API route
- CompressionSettingsTab.tsx: full UI for compression config (enable/mode/caveman)
- CompressionLogTab.tsx: compression stats viewer with rulesApplied display
- /api/settings/compression: GET/PUT API route with Zod validation
- Settings page: wire CompressionSettingsTab under AI tab
- i18n: 28 compression keys added to all 33 locale files
2026-04-28 00:55:30 +07:00