pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-01 04:42:10 +03:00
Code Issues Packages Projects Releases Wiki Activity
4,571 Commits 96 Branches 313 Tags
41167dcf0b68f7bfc3b31a47fd00a51da82f2940
Commit Graph

4571 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
KooshaPari
41167dcf0b chore(resilience): trim account fallback ratchet 2026-06-26 18:12:30 -07:00
KooshaPari
0d80f05e9e chore(resilience): keep lockout files under size ratchet 2026-06-26 18:12:30 -07:00
KooshaPari
0bc232693f fix(resilience): honor model lockout max cooldown 2026-06-26 18:12:30 -07:00
KooshaPari
e4fef27aac fix(gemini): normalize audio input mime 2026-06-26 18:12:30 -07:00
KooshaPari
fabc6af7ef test(resilience): guard stored quota cutoff booleans 2026-06-26 18:12:30 -07:00
Diego Rodrigues de Sa e Souza
594aa94945 feat(dashboard): click-to-edit model alias in provider page (#5119) 
Integrated into release/v3.8.38 (rebased on tip, i18n scope verified, CHANGELOG re-injected)
 2026-06-26 22:09:29 -03:00
Diego Rodrigues de Sa e Souza
c9fe0fb7a1 feat(providers): add ZenMux Free session-cookie provider (#5105) 
Integrated into release/v3.8.38 (rebased on tip, CHANGELOG re-injected)
 2026-06-26 22:08:28 -03:00
Diego Rodrigues de Sa e Souza
2b0e1dfd94 fix(sse): convert Gemini body to OpenAI format in antigravity MITM handler (#4845) 
Integrated into release/v3.8.38 (rebased on tip, CHANGELOG re-injected)
 2026-06-26 22:07:04 -03:00
Jan Leon
25b65ac34a Track final connection IDs in failover logs (#5016) 
Integrated into release/v3.8.38
 2026-06-26 22:04:39 -03:00
Jan Leon
b8070ed3a8 Ignore disconnect races during in-band stream error handling (#5007) 
Integrated into release/v3.8.38
 2026-06-26 22:04:33 -03:00
Diego Rodrigues de Sa e Souza
d6f402e0ad test(golden): redact OmniRoute app version from translate-path snapshot (#5126) 
Coverage shard golden unblock for #5078.
 2026-06-26 20:31:41 -03:00
Diego Rodrigues de Sa e Souza
fe8f1dac0f test(golden): redact live Node version from provider translate-path snapshot (#5125) 
Final golden unblock for #5078.
 2026-06-26 20:02:33 -03:00
Diego Rodrigues de Sa e Souza
58d942829f fix(translator): preserve reasoning-replay reasoning_content + repair 3 release-green test reds (#5122) 
Repairs 3 release-green test reds + test-masking; unblocks #5078.
 2026-06-26 19:12:46 -03:00
Diego Rodrigues de Sa e Souza
05071c011c test(release): relocate 2 orphan test files into the collected flat tests/unit dir (#5120) 
Unblocks Lint (test-discovery) on #5078. Integrated into release/v3.8.38.
 2026-06-26 17:26:40 -03:00
Diego Rodrigues de Sa e Souza
d1a3aa8909 feat(quota): add opt-in Codex/Claude auto-ping keepalive (#5102) 
Base-reds fixed (#5117); auto-ping keepalive + file-size rebaseline. Integrated into release/v3.8.38.
 2026-06-26 17:20:26 -03:00
Diego Rodrigues de Sa e Souza
68aeb89327 feat(dashboard): expose Fusion judgeModel + fusionTuning in the combo editor (#5074) 
Base-reds fixed (#5117); Fusion editor + file-size rebaseline. Integrated into release/v3.8.38.
 2026-06-26 17:15:38 -03:00
Diego Rodrigues de Sa e Souza
cfaba4410f fix(responses): default text.format for openai-compatible responses providers (#5101) 
Base-reds fixed (#5117); default text.format + file-size rebaseline. Integrated into release/v3.8.38.
 2026-06-26 17:13:19 -03:00
Diego Rodrigues de Sa e Souza
135b5daaa5 fix(translator): forward image tool_result blocks as image_url (#5100) 
Base-reds fixed (#5117); image tool_result→image_url. Integrated into release/v3.8.38.
 2026-06-26 17:11:15 -03:00
Diego Rodrigues de Sa e Souza
2b55659481 chore(quality): rebaseline file-size for responseSanitizer (#5117) + AddApiKeyModal drift 2026-06-26 16:47:07 -03:00
Diego Rodrigues de Sa e Souza
800b04ad6d fix(sse): repair release base-reds — malformed-response false positives + header casing + stale tests (#5117) 
Repairs the release/v3.8.38 base-reds; unblocks #5078.
 2026-06-26 16:30:51 -03:00
Diego Rodrigues de Sa e Souza
d486ed1643 fix(db): translate pt-BR SQLite driver-fallback log lines to English (#5103) (#5115) 2026-06-26 16:15:13 -03:00
Diego Rodrigues de Sa e Souza
db68c9b790 fix(diagnostics): treat non-streaming Claude messages shape as valid output (#5108) (#5116) 2026-06-26 16:14:14 -03:00
Diego Rodrigues de Sa e Souza
11cb8f0976 feat(providers): allow local/private provider URLs by default with scoped metadata-safe guard (#5066) (#5107) 2026-06-26 14:10:09 -03:00
Diego Rodrigues de Sa e Souza
cc6741dd8c fix(dashboard): surface detailed credential-validation error in add-connection modal (#5088) (#5106) 2026-06-26 14:09:41 -03:00
Diego Rodrigues de Sa e Souza
5315e73be5 fix(combo): fail over on empty-content 502 instead of exhausting the provider (#5085) (#5104) 2026-06-26 14:08:17 -03:00
Diego Rodrigues de Sa e Souza
721598fe02 feat(compression): compression playground (Play + Compare tabs) in the studio (#5080) 
Integrated into release/v3.8.38
 2026-06-26 13:10:06 -03:00
Diego Rodrigues de Sa e Souza
964ed04d3b chore(quality): rebaseline file-size for leva 5 PR batch drift 
6 frozen files grew from merged leva-5 PRs (cursor #4912, kiro #4911,
videoGeneration #5051, default #4727, base #4846, chat #5064); all covered
by per-PR tests. See _rebaseline_2026_06_26_leva5 in the baseline.
 2026-06-26 11:22:45 -03:00
Jan Leon
7b6a9ed33d Harden selected API error responses (#5032) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 11:20:18 -03:00
Randi
f7e5d2c268 feat(cc): add summarized thinking display toggle (#5055) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 11:18:22 -03:00
fulorgnas
ef99a3c5ba fix(compression): replace fileURLToPath(import.meta.url) with runtime anchors for standalone bundle (#5089) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 11:16:28 -03:00
Hernan Javier Ardila Sanchez
57d10ea9f7 fix(models): derive model discovery config from registry modelsUrl (#5087) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 11:14:53 -03:00
Hernan Javier Ardila Sanchez
7256d34a23 fix: preserve model hidden flags (isHidden) across model sync (#5086) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 11:13:24 -03:00
José Victor Ferreira
14eab57ed3 feat(video): add Alibaba DashScope (wan2.7-t2v) provider (#5051) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 11:10:33 -03:00
Éder Costa
98c5fac3ad fix(sse): robust Anthropic /v1/messages streaming — real ping keepalive + client-disconnect guard (#5063) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 11:09:12 -03:00
Éder Costa
1b041d8acc fix(sse): don't cool down the connection on a self-inflicted upstream timeout (504) (#5064) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 11:06:45 -03:00
Diego Rodrigues de Sa e Souza
a835192a9c fix(tts): resolve Gemini TTS models from catalog (#4934) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 11:04:16 -03:00
Diego Rodrigues de Sa e Souza
c5c8db77da fix(translator): preserve cache_control for DashScope OpenAI-compat providers (port from 9router#2069) (#5013) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 11:00:39 -03:00
Diego Rodrigues de Sa e Souza
ac8bd72e91 fix(oauth): support Kiro IDC (organization) token import (#4944) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 10:58:50 -03:00
Diego Rodrigues de Sa e Souza
abcf593213 feat(proxy): auth-less host:port batch import (#4938) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 10:57:52 -03:00
Diego Rodrigues de Sa e Souza
2ed7d532f9 feat(cursor): parse Composer DeepSeek-style inline tool calls (#4912) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 10:57:19 -03:00
Diego Rodrigues de Sa e Souza
2dbd3e933a feat(sse): Kiro inline <thinking> stream splitter (#4911) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 10:56:54 -03:00
Diego Rodrigues de Sa e Souza
f52863c80a fix(sse): dedupe case-variant Anthropic version/beta headers (#4846) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 10:55:21 -03:00
Diego Rodrigues de Sa e Souza
f8a17c4126 feat(blackbox): refresh provider model catalog (#4935) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 10:53:27 -03:00
Diego Rodrigues de Sa e Souza
63a5bc9413 fix(sse): guard non-JSON SSE lines and duplicate [DONE] (#4937) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 10:52:54 -03:00
Diego Rodrigues de Sa e Souza
eb712d2966 fix(sse): keep streaming for forceStream providers when client requests JSON (#5021) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 10:52:11 -03:00
Diego Rodrigues de Sa e Souza
36c62c7a38 fix(codebuddy): only send reasoning params when client requests reasoning (#5019) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 10:51:28 -03:00
Diego Rodrigues de Sa e Souza
7bda901ce7 fix(executors): strip client_metadata for cerebras and mistral (#4727) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 10:49:58 -03:00
Diego Rodrigues de Sa e Souza
66d78772e6 chore(release): open v3.8.38 development cycle 2026-06-26 04:08:40 -03:00
Diego Rodrigues de Sa e Souza
555b21d296 Release v3.8.37 (#5053) 
* chore(release): open v3.8.37 development cycle

* chore(ci): harden release flow — ratchet decoupling, fast-path drift gates, build-scope guard, heap default (#5054)

Implements improvements 1-4 from the v3.8.36 release benchmark (_tasks/release-bench/v3.8.36/PLANO-MELHORIA.md):

1. Quality Ratchet decoupled from flaky coverage (ci.yml): the shard→coverage→ratchet
   chain meant a single flaky Coverage Shard SKIPPED the whole Quality Ratchet on the
   release PR (v3.8.36 #4854), so cycle drift only surfaced post-merge in #5029. The job
   now runs on !cancelled(); coverage download is continue-on-error and the ratchet runs
   --allow-missing, so the DETERMINISTIC gates (eslint/complexity/cognitive/duplication/
   codeql) stay blocking even when coverage is unavailable.

2. Fast-path drift gates (quality.yml PR→release): added check:complexity,
   check:cognitive-complexity, and a new lightweight check:pack-policy (pack-artifact
   unexpected-files check WITHOUT a build, via --policy-only) so drift + stray-tarball-file
   regressions are caught/rebaselined PER-PR instead of cascading onto the release PR.

3. Build heap default 4096→8192 MB (build-next-isolated.mjs): the clean graph peaks
   ~3.9 GB and brushed the old 4 GB ceiling; 8 GB gives headroom. Comment notes heap is
   NOT the fix for a poisoned scope (run check:build-scope instead).

4. check:build-scope gate (new): fails if .ts/.tsx/.js/.jsx files in the tsconfig scope
   exceed a threshold — catches worktrees/cruft leaking into the build scope (the v3.8.36
   OOM root cause: 355,215 vs 4,547 files) BEFORE it detonates next build. Wired into the
   fast-path.

* fix(auth): only trust forwarding headers from loopback TCP peers (#4689)

Integrated into release/v3.8.37 — loopback-gated forwarding headers (IP spoofing fix). Cherry-picked onto current release tip; ipUtils.test.ts 9/9 green.

* fix(codex): treat OAuth 401 as unrecoverable refresh failure (#4686)

Integrated into release/v3.8.37 — codex OAuth 401 treated as unrecoverable refresh. Cherry-picked onto release tip; token-refresh-service.test.ts 38/38 green.

* fix(translator): preserve reasoning_effort for non-Copilot Responses clients (#4688)

Integrated into release/v3.8.37 — preserve reasoning_effort for non-Copilot Responses clients. Cherry-picked onto release tip; tests 47/47 green.

* fix(translator): coerce tool descriptions to strings in OpenAI normalization (#4675)

Integrated into release/v3.8.37 — coerce tool descriptions to strings in OpenAI normalization. Cherry-picked onto release tip; tests 3/3 green.

* feat(sse): x-omniroute-strip-reasoning header to drop reasoning_content (#4678)

Integrated into release/v3.8.37 — x-omniroute-strip-reasoning header. Cherry-picked onto release tip (resolved chatCore.ts/headers.ts adjacency conflict, kept resolveCompressionHeader + isStripReasoningRequested); tests 8/8 green.

* fix(combo): flatten Anthropic tool messages + tool history to prevent upstream 503 (#4648)

Integrated into release/v3.8.37 — flattenToolHistory helper (combo anti-503). Cherry-picked onto release tip; tests 9/9 green.

* feat(headroom): proxy lifecycle management + dashboard UI (Docker sidecar supported) (#4649)

Integrated into release/v3.8.37 — headroom proxy lifecycle (status/start/stop, local-only + spawn-capable per Rules #15/#17). Cherry-picked onto release tip; lifecycle 7/7 + route-guard 43/43 + check:cycles green.

* feat(cli): multi-model support for Factory Droid CLI (#4682)

Integrated into release/v3.8.37 — Factory Droid multi-model support. Cherry-picked onto release tip (kept readJsoncConfig + droidCustomModels imports); droid-custom-models 11/11 green.

* fix(providers): require Default Model in compatible-provider API-key setup (#4641)

Integrated into release/v3.8.37 — require Default Model in compatible-provider API-key setup. Cherry-picked fix + test-move onto release tip (kept release providerSpecificData + QuotaScrapingFields; fixed moved-test import path; baseline rebaseline unneeded, 865<866); UI test 2/2 green.

* fix(dashboard): stop double-masking already-masked API key in list (E2E 3/9 regression) (#4671)

Integrated into release/v3.8.37 — render server-masked key verbatim (drop redundant maskKey call). Note: release's maskKey already guards '****' (since v3.8.34), so this is a safe simplification; added a contract test pinning the **** passthrough invariant (2/2 green, would fail against the pre-guard maskKey = the historical double-mask bug).

* chore(quality): rebaseline file-size for rc17 PR batch drift

Own growth from the merged rc17 PRs (#4678/#4686/#4688) at existing chokepoints —
cohesive, not extractable:
- open-sse/handlers/responseSanitizer.ts 1103->1122 (SanitizeOpenAIResponseOptions + stripReasoning, #4678)
- open-sse/services/tokenRefresh.ts 2070->2090 (codex 401 unrecoverable-refresh guard, #4686)
- tests/unit/token-refresh-service.test.ts 1322->1353 (401 regression case, #4686)
- tests/unit/translator-openai-responses-req.test.ts 1047->1050 (reasoning_effort assertion, #4688)

* docs(env): document HEADROOM_URL in .env.example + ENVIRONMENT.md

The headroom proxy lifecycle (#4649) reads HEADROOM_URL (src/lib/headroom/detect.ts,
default http://localhost:8787) but it was missing from the env contract, tripping
check:env-doc-sync. Adds the var to both .env.example (commented, has a default) and
the Proxy Health table in ENVIRONMENT.md.

* fix(sse): stream writer mock abort() returns a Promise (#4788)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; tests green.

* fix(cli): fall back to default data dir when DATA_DIR is not writable (#4767)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; tests green.

* fix(oauth): verify Cursor installation on Linux before auto-import (#4770)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; tests green.

* fix(sse): track Ollama streaming usage from raw NDJSON chunks (#4754)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; tests green.

* fix(sse): strip enumDescriptions from antigravity tool schema (#4740)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; tests green.

* fix(sse): include low-level cause details in formatProviderError (#4741)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; tests green.

* fix(translator): strip x-anthropic-billing-header in claude-to-openai (#4728)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; tests green.

* fix(sse): gate Kiro image attachments behind a Claude-capability check (#4763)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; tests green.

* fix(sse): read Antigravity usage from the response.usageMetadata envelope (#4785)

Integrated into release/v3.8.37 — Antigravity response.usageMetadata envelope. Cherry-picked onto release tip (resolved test-tail adjacency with #4754 Ollama block); usage-extractor 23/23 green.

* fix(api): fall back to existing access token for any OAuth provider on refresh failure (#4786)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; tests green.

* fix(cli): verify launchd registration + skip self-SIGTERM in macOS autostart (#4765)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; tests green.

* fix(executors): anthropic-compatible-* gateways get Bearer alongside x-api-key (#4729)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; tests green.

* fix(sse): json_schema fallback for OpenAI-compatible providers (#4766)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; tests green.

* fix(sse): use workos auth token shape for cline (#4787)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; tests green.

* feat(sse): parse Gemini CLI 429 retryDelay from structured RetryInfo (#4738)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; tests green.

* fix(sse): finalize tool_calls finish_reason on early stream end in OpenAI Responses translator (#4764)

Integrated into release/v3.8.37 — computeFinishReason finalizes tool_calls on early stream end (Responses translator). Cherry-picked onto release tip; responses-translation-fixes 29/29 green.

* test(sse): golden-lock provider.ts translate-path across all providers (#4734)

Integrated into release/v3.8.37 — golden-lock for provider.ts translate-path. Cherry-picked onto release tip; snapshot regenerated against the current provider set (UPDATE_GOLDEN=1, 167 entries); golden test 3/3 deterministic.

* chore(quality): rebaseline file-size for rc17 leva2 PR batch drift

Own growth from the merged leva2 PRs (cohesive, not extractable):
- src/lib/usage/providerLimits.ts 950->955 (#4786)
- open-sse/executors/default.ts NEW frozen @828 (#4729 + #4766 + #4787 header branches)
- open-sse/translator/request/openai-to-kiro.ts 807->814 (#4763)
- open-sse/translator/response/openai-responses.ts 923->937 (#4764)
- tests/unit/executor-default-base.test.ts 1339->1440 (#4766)
- tests/unit/translator-openai-to-kiro.test.ts 918->980 (#4763)

* fix(dashboard): align Engine Combos editor engines with API schema (#4955) (#5062)

The named-combos pipeline dropdown offered four engines (headroom,
session-dedup, ccr, llmlingua) that stackedPipelineStepSchema rejects, so
selecting one made PUT /api/context/combos/[id] return HTTP 400 while
saveCombo swallowed the non-OK response (if (!res.ok) return). Editing the
default 'Standard Savings' combo and changing an engine reproduced the 400.

- Add canonical STACKED_PIPELINE_ENGINE_INTENSITIES next to the schema as the
  single source of truth; the client dropdown imports it so it can never drift
  from the discriminated union the API validates against.
- Surface save errors and empty-name/empty-pipeline validation in the editor
  instead of failing silently.
- Add a parity unit test asserting the UI engine map equals the schema union
  and that every (engine, intensity) the UI emits is accepted.

* fix(sse): filter nameless hosted tools when converting Responses API to Chat format (#4789)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* fix(dashboard): keep desktop sidebar visible via explicit CSS class (#4812)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* fix(sse): strip enumDescriptions from Antigravity tool schemas (#4813)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* fix(dashboard): resolve passthrough model aliases by providerId in ModelSelectModal (#4815)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* fix(oauth): allow per-connection refresh lead-time override via providerSpecificData.refreshLeadMs (#4818)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* fix(sse): strip X-Stainless-* headers and normalize SDK User-Agent for OpenAI-compatible endpoints (#4820)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* fix(sse): strip Gemini built-in tools when functionDeclarations present in Antigravity envelope (#4821)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* fix(api): surface a Docker-localhost hint on provider-node validation connection errors (#4822)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* fix(sse): resolve bare model names to connection defaultModel before upstream calls (#4825)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* fix(build): trace-include sql.js sql-wasm.wasm in standalone bundle (#4839)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* fix(sse): strip Composer <｜final｜> sentinel markers leaking after Composer reasoning (#4842)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* fix(config): sync full SiliconFlow model list into registry (#4844)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* fix(sse): close reasoning before message content in Responses stream (#4848)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* fix(sse): reject unsupported Kiro [1m] context suffix (#4816)

Integrated into release/v3.8.37 — cherry-picked onto release tip; test-tail conflict with #4763 resolved (kept both image + [1m] test blocks); CHANGELOG re-merged; 29/29 green.

* fix(db): validate HuggingFace tokens via whoami-v2 auth probe (#4819)

Integrated into release/v3.8.37 — defining commit re-homed onto the god-file-split validation module (validateHuggingFaceProvider in validation/openaiFormat.ts + map wiring); 115/115 green.

* fix(sse): make anthropic-version default-guard case-insensitive (#4823)

Integrated into release/v3.8.37 — conflict with #4729 Bearer-fallback resolved (kept both Bearer fallback + case-insensitive anthropic-version guard); 48/48 green.

* fix(sse): sanitize Kiro tool schemas to avoid 400 "Improperly formed request" (#4847)

Integrated into release/v3.8.37 — conflict in kiro-to-openai.ts resolved (kept release fallbackToolCallId + adopted #1375 toolNameMap remap); 7/7 green.

* feat(sse): add GPT-4 to the GitHub Copilot provider (#4798)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* feat(sse): add GPT-4o mini to GitHub Copilot provider (#4797)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* feat(api): add MiniMax-M3 pricing row (#4814)

Integrated into release/v3.8.37 — pricing row re-homed onto god-file-split pricing/regional.ts (pricing.ts is now a barrel); 4/4 green.

* fix(cli): save runtime deps with --save-exact so a sibling install can't prune them (#4841)

Integrated into release/v3.8.37 — trayRuntime conflict resolved (kept release SYSTRAY_SPEC + added --save-exact); 2/2 green.

* fix(sse): preserve required fields in antigravity tool schemas (#4843)

Integrated into release/v3.8.37 — conflict resolved (kept #4740/#4813 enumDescriptions strip + typed normalizeSchemaTypes, added required-preservation helpers; test-tail merged keeping both enumDescriptions + required tests); 7/7 green.

* chore(quality): rebaseline file-size for rc17b leva3 PR batch drift

* fix(sse): strip reasoning blobs from agentic context to prevent O(n^2) token growth (#4849)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* fix(sse): unwrap Qoder HTTP 200 SSE error envelope so fallback can trigger (#4850)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* fix(sse): strip temperature for Claude models with extended thinking (#4853)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* fix(sse): emit valid concatenable kiro tool_calls.arguments deltas (#4855)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* feat(sse): add toggleable tool-source diagnostics (#4856)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* fix(sse): redact api key from the AUTH debug log in the chat handler (#4858)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* fix(sse): forward AI SDK image parts in Responses translator (#4859)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* fix(sse): resolve custom combos by id and case-insensitive name (#4446) (#4869)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* fix(sse): exclude WS bridge controller-closed error from provider breaker (#4602) (#4870)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* feat(providers): add xAI Grok inbound translators and thinking patcher (#4910)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* feat(embeddings): add dimensions override field to embedding combos (#4913)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* feat(oauth): Codex bulk-import endpoint — POST /api/oauth/codex/import (#4914)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* fix(antigravity): retry transient upstream failures (#4941)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* fix(sse): surface malformed HTTP-200 upstream responses (#4942)

Integrated into release/v3.8.37 — cherry-picked defining commit onto release tip; CHANGELOG re-merged; tests green.

* fix(sse): normalize Codex custom tools (apply_patch) to { input: string } schema (#4862)

Integrated into release/v3.8.37 — conflict in request/openai-responses.ts resolved (kept #4789 nameless-tool skip + added #1007 custom-tool {input:string} normalization); 48/48 green incl. #4789/#4859 regression.

* fix(sse): dense, deterministic output ordering in Responses API response.completed (#4906)

Integrated into release/v3.8.37 — manual integration with #4862 in response/openai-responses.ts (custom-tool funcItem + dense recordCompletedItem). Fixed a latent #4848 interaction: the close-reasoning-before-message guard force-closed <think>-tag reasoning prematurely, which dense output (#4906) then snapshotted as a partial buffer ("plan" vs "planning") — scoped the guard to native reasoning_content (!inThinking) in BOTH transformer + translator paths. Full Responses suite 203/203 green incl. #4848/#4862 regression.

* feat(sse): auto-promote successful combo model to position #1 (#4852)

Integrated into release/v3.8.37 — dropped the stale file-size-baseline.json hunk (re-derived against the rc17b rebaseline); code+test applied clean; 13/13 green.

* feat(providers): add Pioneer AI (Fastino Labs) provider (#4909)

Integrated into release/v3.8.37 — providers.ts apikey block re-homed onto god-file-split src/shared/constants/providers/apikey/frontier-labs.ts (inline APIKEY_PROVIDERS no longer exists); registry/pioneer + providers/index.ts applied clean; 6/6 green.

* add DGrid AI gateway provider (#4931)

Integrated into release/v3.8.37 — rebased the contributor's commit onto the release tip; providers.ts god-file-split conflict resolved by relocating the dgrid APIKEY_PROVIDERS entry into apikey/gateways.ts; CHANGELOG added. 7/7 green. Thanks @dgridOP!

* chore(quality): rebaseline file-size for rc17b leva4 PR batch drift

* docs(routing): sync combo strategy docs for Fusion (17 strategies) (#5067)

Fusion (16th strategy, panel fan-out + judge synthesis) and headroom
shipped but the strategy-count docs were stale (14/15) and omitted both.
Update every combo-strategy reference to the canonical 17, add fusion +
headroom to all strategy tables, and add a dedicated Fusion section to
AUTO-COMBO.md documenting judgeModel / fusionTuning config + an example.

- CLAUDE.md, README.md, FEATURES.md, RESILIENCE_GUIDE.md,
  ARCHITECTURE.md, OPEN_SSE_ARCHITECTURE.md, OMNIROUTE_VS_ALTERNATIVES.md,
  docs/README.md, request-pipeline.mmd: 14/15 -> 17, list fusion + headroom
- docs/routing/AUTO-COMBO.md: strategy table + new Fusion strategy section
- docs/openapi.yaml: add reset-window, headroom, fusion to the strategy enum

* fix(oauth): classify /api/oauth/cursor/auto-import as local-only (route-guard) (#5070)

The Cursor auto-import route runs execFile("which", ["cursor"]) to verify a
local Cursor install before importing credentials — a child-process spawn. The
check:route-guard-membership gate (Hard Rules #15/#17) flagged it as an
unclassified spawn-capable route: reachable past the loopback gate, an
RCE-via-tunnel surface (a leaked JWT over a tunnel could trigger the spawn).

Classify the specific path in LOCAL_ONLY_API_PREFIXES so loopback enforcement
runs unconditionally before any auth check. Scoped to the exact path — the rest
of /api/oauth/ (browser redirect/callback flows) stays remote-reachable.

TDD: added a failing-then-passing assertion in route-guard-local-prefix.test.ts
(classification + an over-broadening guard proving sibling OAuth paths stay
remote). check:route-guard-membership now reports 0 new gaps.

* chore(release): v3.8.37 — 2026-06-26

---------

Co-authored-by: dgridOP <dgrid_op@outlook.com>
v3.8.37 		2026-06-26 02:51:06 -03:00
Diego Rodrigues de Sa e Souza
b5c789a3b4 fix(build): exclude .claude/.worktrees from tsconfig scope to stop next build OOM (#5031) 
Root cause of the local build:release OOM/GC-livelock (deploy blocker, 2026-06-25):
tsconfig.json uses include: ["**/*.ts","**/*.tsx","**/*.js","**/*.jsx"] (recursive
glob) but exclude did NOT list .claude — where git worktrees live (.claude/worktrees/).
With 69 active port-* worktrees, the TS scope was 355,215 files (352,261 of them inside
.claude/worktrees) vs 4,547 real source files. next build's type-check/scan processed ~70x
the codebase, OOMing at 4GB AND 16GB and GC-livelocking at 32GB/64GB. CI built fine because
its checkout is clean (no worktrees). After excluding .claude/.worktrees, build:release
completes in 17m with the DEFAULT 4GB heap.

Changes:
- tsconfig.json exclude: + .claude .worktrees .source coverage @omniroute .tmp dist _ideia;
  removed 6 stale entries for dirs that no longer exist.
- .dockerignore: + .claude .source (the _* glob already covered underscore dirs).
- CLAUDE.md: standardize ALL worktrees under .claude/worktrees/ (was split with .worktrees/),
  the single gitignored + build-excluded location the native EnterWorktree tool uses.
v3.8.36 		2026-06-25 17:22:41 -03:00