Phases 3-4 of #3384 (Phases 1-2 shipped DB schema + resolveInterceptSearch in
release/v3.8.47). Adds resolveInterceptFetch(provider, model) as a structural
twin of resolveInterceptSearch, and open-sse/services/webFetchInterception.ts
(mirroring webSearchFallback.ts) to rewrite a provider-native web_fetch tool
declaration into a synthetic omniroute_web_fetch function tool. The synthetic
tool call is dispatched through the existing handleToolCallExecution path
(same as omniroute_web_search) to a new web_fetch builtin skill handler that
resolves credentials and calls handleWebFetch() against /v1/web/fetch.
Strictly opt-in: with no interceptFetch DB row configured (the default), the
outgoing request body is byte-identical to pre-change behavior — no heuristic
default bypass like the interceptSearch sibling, to guarantee zero overhead
when disabled (Hard Rule #20).
Also ships the dashboard toggle (owner decision, overriding the plan's
backend-only recommendation): ProviderInterceptionSection.tsx on the provider
detail page, backed by GET/PUT/DELETE /api/providers/[id]/interception-rules,
covering both interceptSearch and interceptFetch from one control.
chatCore.ts touch is minimal (frozen file): one resolver call + one
prepareWebFetchFallbackBody call mirroring the existing interceptSearch block,
plus threading provider/model into the existing handleToolCallExecution call.
Replace the AgentBridge static server's single self-signed leaf cert
(scoped only to the 4 antigravity hosts) with a persisted local root CA
+ per-SNI leaf certs, reusing the CA/leaf crypto already proven for the
TPROXY capture mode (tproxy/dynamicCert.ts). server.cjs switches from a
static key/cert to an SNICallback so every host in MITM_TOOL_HOSTS gets
a matching leaf, not just antigravity.
- src/mitm/cert/rootCa.ts: load-or-generate-once CA persistence
(ca.key/ca.crt under <DATA_DIR>/mitm/), private key chmod 0o600.
- src/mitm/cert/migration.ts: pure migration gate — an already-trusted
legacy leaf install stays on the old leaf until the operator opts in
via MITM_ROOT_CA_ENABLED=true; a fresh install gets the CA model
automatically. A CA that can sign a leaf for any host is materially
more powerful than the old fixed-SAN leaf, so the switch is never
silent for an already-trusted install.
- src/mitm/cert/install.ts: installCaCert() — thin wrapper over the
existing cert-path-agnostic installCertResult(), same
omniroute-mitm.crt trust-store slot the old leaf used (supersedes it,
no dual-trust cleanup needed).
- src/mitm/manager.ts: wires the migration gate + CA load/install into
the bridge-start sequence, passes the resolved MITM_CERT_MODE to the
spawned server.cjs child so it can't drift from manager.ts's decision.
- src/mitm/server.cjs: async-bootstraps server creation behind the same
MITM_CERT_MODE gate; default ("legacy") reproduces the exact prior
synchronous behavior. The CJS/ESM boundary (server.cjs is spawned via
plain `node`, no TS loader) is crossed via a new
_internal/rootCaShim.cjs CJS twin of the CA/leaf crypto, matching the
established pattern of the sibling _internal/*.cjs shims in this file.
Validated: 14 new unit tests (CA generate-once, 0o600 key perms, CA
basicConstraints, leaf issuance across every MITM_TOOL_HOSTS host, SAN
match, chain validation against the CA, leaf caching, migration-gate
branches) plus a manual live smoke test spawning server.cjs in both
legacy and root-ca mode (confirmed a real TLS handshake with SNI
api.githubcopilot.com returns a CA-issued leaf for that host).
Deferred to VPS live validation (OS-trust-store mutation is not
unit-testable): actual OS trust-store install of the CA cert via
installCaCert() on Linux/macOS/Windows.
Phase 1 of client-side quota tracking for NVIDIA NIM (no rate-limit
headers, no usage API):
- Register nvidia in PROVIDER_DEFAULT_RATE_LIMITS (40 RPM sliding
window, matching the documented free-tier note), operator-overridable
via a new ResilienceSettings.providerQuotaOverrides map.
- Per-connection concurrency cap (default 6) via a new
nvidiaConcurrencyGate leaf module wrapping rateLimitSemaphore,
wired into DefaultExecutor.execute().
- Per-model 429 lockout: confirmed already satisfied by #6773's
passthroughModels flag on the nvidia registry entry (no new code
needed) — added as a regression-guard test instead.
Phase 2 (AIMD adaptive ceiling learning) and Phase 3 (dashboard quota
card + combo-routing headroom preference) are explicitly deferred to
follow-up issues, per the plan's own scope note.
#7775 (pin Kimi providers first + supporter card accent) grew
tests/unit/providers-page-utils.test.ts from 1107 to 1294 lines without
updating config/quality/file-size-baseline.json, leaving the test-file-size
gate red on the release tip and blocking the whole PR queue.
* feat(dashboard): pin Kimi providers first in category + official supporter card accent
Kimi (Moonshot AI) official-partnership highlight on the providers dashboard:
Kimi-family providers (kimi-coding, kimi-web, moonshot) now render first
within whichever category/group they already appear in, and their
ProviderCard shows a Kimi-blue (#1783FF) accent border/glow plus an
"Official Supporter" badge. Presentation-only — routing/fallback order is
untouched.
* docs(changelog): add fragment for Kimi provider card highlight (#7775)
* feat(dashboard): strengthen Kimi card accent + prove featured-first per real section
Owner refinement: make the official Kimi blue (#1783FF) border clearly
legible (2px, higher opacity) and add a subtle whole-card tint alongside
the existing glow, so the accent reads unmistakably as "the official Kimi
color" in both light and dark theme, not just a faint hairline.
Also adds concrete section-scoped regression tests against the REAL
provider catalog (not synthetic mocks), mirroring page.tsx's exact
category-building call chain, proving where each Kimi-family card actually
lands today:
- OAuth section -> kimi-coding first
- Web Cookie section -> kimi-web first
- API Key -> LLM subsection -> moonshot first (kimi-k3's home provider)
- kimi-coding-apikey and kimi (both hiddenFromDashboard) never render as
their own card in any section, confirmed across all 9 categories.
The executor's non-streaming path collects the upstream SSE and returns a
finished OpenAI chat.completion payload. The test still treated the body as
raw SSE and piped it through parseSSEToGeminiResponse, which correctly
returns null for non-SSE input — failing the release-tip unit suite.
Verified the production output is exactly what the test's own assertions
expect (content 'Hello again', usage 2/3/5, finish_reason stop, 2 fetch
calls incl. the 429 retry), so this realigns the test with the real
contract rather than weakening it: 3 pass/1 fail -> 4 pass/0 fail.
resolveSudoSpawn() drops the `sudo -S` prefix when already root, when sudo
is not installed (slim containers) or under OMNIROUTE_NO_SUDO (#6122), so the
spawned command is `tee` rather than `sudo` in those environments. The three
addDNSEntries assertions hardcoded `sudo` and failed whenever the suite ran
as root. Assert the effective invocation (tee -a <hosts file>) instead, still
checking the -S password flag when elevation is actually in play.
Proof: with OMNIROUTE_NO_SUDO=1 the file went 3 failing -> 8 passing; the
unelevated (sudo) path stays 8 passing.
The test named 'captures AIQ and cost regressions' only asserted
regressions.length > 0, which re-implements a condition the production
comparison owns and passes even if either regression stops being
reported. Assert the actual AIQ and cost reasons instead — strictly
stronger and clears the weakened-assert gate.
* docs(readme): width + content overhaul — uniform tables, full CLI grid, condensed What's New
- All remaining spacer-calibrated tables re-targeted +100px so every table
clamps to the same full column width as the Why OmniRoute table.
- Free-tier section: the 4 text bullets are gone — the animated budget card
already carries all of it.
- What's New: every highlight condensed to a 1-2 line bullet (links kept).
- Compatible CLIs: the grid now lists all 25 tools from the dashboard
registries (19 CLI Code's + 6 CLI Agents — Cline, Roo Code, Aider,
ForgeCode, jcode, DeepSeek TUI, CodeWhale, Smelt, Pi, Grok Build, Hermes
Agent, Goose, Open Interpreter, Warp AI, Agent Deck…) in 2 full-width
rows; tools without a brand asset use a neutral terminal glyph
(public/providers/cli-generic.svg) — no invented logos.
- Major-labs providers grid: 3x6 -> 2x9 full-width rows.
- Free Forever: 2 rows -> a single 7-card full-width row.
- Explore More section removed; Dashboard screenshots promoted to their own
top-level section.
* docs(readme): force full-width card grids via in-cell spacers (GitHub strips td width)
* docs(readme): CLI grid 3 balanced rows, dark-safe Cline/Roo icons, fix 251->259 heading
* docs(readme): replace img spacers with NBSP runs — img max-width:100% collapses all-or-nothing past the container; text min-content never does
* docs(readme): calibrate card-grid NBSP runs to measured 3.14px (match Why table width); Roo icon via gh-dark-mode-only
* docs(readme): fine-tune markdown-table NBSP runs to measured widths (all ~1000px)
* docs(readme): sync stale counts to v3.8.49 reality — 268 providers (regen reference), 104 MCP tools, 25k+ tests, 26 CLIs, 40+ free-forever, 43 locales, 84 executors; fix 251-era anchors + nav
* docs(readme): animated hero card + The Promise six-pillar card — embed replaces hero text block, six static badges and the promise HTML table; all numbers from the v3.8.49 audit
* docs(diagrams): make hero/promise card reveals resilient — resting state is the final composition, entrance animates via 0s-begin hold pattern (GitHub camo drops offset-begin one-shots)
* docs(diagrams): pause-safe animation cycles — first frame is the finished composition (Chrome pause-animated-images freezes SVG imgs at t=0, where animation values override static attrs); hero/promise drop entrance reveals, budget bar/strike/dot cycles start at rest state
* docs(readme): unify all animated cards on the flat family style (no outer border/rounded frame/top strip) + fuse hero with the budget card at the top — star CTA back to text, money section moved under the hero, cli-terminal flattened with a t0 poster of the completed screen
* docs(readme): Why OmniRoute as an animated 10-row pain-vs-fix ledger card — extends the 6 original rows with resilience, key pools, local-first privacy and live analytics
* docs(readme): animated 18-strategy flow grid under the strategies table — one micro-stage per routing strategy, static tracks readable on the first frame
* docs(readme): blank line between strategies-grid img and the auto-combo sub note — the img HTML block was swallowing the note, rendering its markdown raw
* docs(readme): Private & Local-First as an 11-row guarantee ledger card — the 5 original bullets plus no-signup, loopback-only routes, header scrubbing, opt-in PII, sanitized errors and local audit trail, each with a receipt chip
* docs(readme): rebuild the resilience card — 3 self-healing layers with real mechanics (breaker states + thresholds, key cooldown with x2 backoff, model lockout) replacing the always-on combo card and the 3-row table
* docs(diagrams): rebuild cli-terminal as a compact half-height real terminal (1200x350) — pure terminal theme, real CLI commands and data tied to live counts, scrolling ticker of real subcommands
* docs(changelog): maintenance fragment for the README animated-card overhaul (#7769)
Clears the release base-red where account-fallback-lockout-eviction,
cliproxyapi-dedicated-credential-7645, combo-least-used-account,
combo/recovery-hint and route-guard-forge-jcode-settings-local-only
were covering mutated modules but missing from tap.testFiles.
Electron persists secrets (JWT_SECRET, API_KEY_SECRET, STORAGE_ENCRYPTION_KEY) to
<DATA_DIR>/server.env, but the CLI bootstrap only ever loaded <DATA_DIR>/.env. Copying
storage.sqlite + server.env from an Electron install to the CLI (exactly as the app's own
UI text instructs) silently lost STORAGE_ENCRYPTION_KEY, permanently corrupting every
encrypted provider credential.
bin/omniroute.mjs now does a one-time, one-directory migration: if <DATA_DIR>/.env is
absent but <DATA_DIR>/server.env is present, copy it to .env before the normal env-file
loading loop runs. An existing .env is never overwritten -- it always wins over a legacy
server.env.
dast-smoke.yml and 3 nightly API-only smoke workflows (nightly-schemathesis,
nightly-resilience, nightly-llm-security) ran "npm run build:cli" with no
preceding full build or downloaded .build/next artifact. scripts/build/
prepublish.ts silently falls back to a full Next.js production build
(dashboard UI + ~126 leaf pages + prerender) whenever the standalone
server.js is missing, which is always the case in these jobs. That inline
full build is the actual thing varying 6-29min on GitHub-hosted runners.
These workflows only exercise API routes (schemathesis/promptfoo hit
/api/monitoring/health, /v1/chat/completions, /v1/models, /api/auth,
/api/keys) and never touch the dashboard UI, so set
OMNIROUTE_BUILD_BACKEND_ONLY=1 on their "Build CLI bundle" step — an
existing, previously-unused escape hatch (scripts/build/backendOnlyPages.mjs)
that stubs the dashboard pages before the build and restores them after,
leaving every route.ts API handler intact.
npm-publish.yml is intentionally left untouched: it legitimately ships the
full dashboard UI in the published npm package.
Regression guard: tests/unit/build/backend-only-smoke-workflows.test.ts
asserts OMNIROUTE_BUILD_BACKEND_ONLY=1/OMNIROUTE_BUILD_PROFILE=backend on
all 5 "Build CLI bundle" steps across the 4 fixed workflows, and asserts
npm-publish.yml's build step is NOT backend-only.
Wildcard model aliases created via the Settings UI's "Wildcard Pattern"
mode were persisted to settings.wildcardAliases but getCombinedModelAliases()
never read that store, so the wildcard-matching step in getModelInfoCore()
never saw the user's patterns. Every request fell through to provider
inference and threw "Ambiguous model" for models multiple providers claim.
Fold settings.wildcardAliases entries into the merged alias map (keyed by
pattern string, folded in last so it never shadows exact aliases).
getNoAuthCandidates() in open-sse/services/autoCombo/virtualFactory.ts built the
candidate pool for no-auth providers (opencode/mimocode/etc.) without ever
consulting getHiddenModelsByProvider(), unlike the credentialed-connection loop
a few lines above it. A model hidden via the dashboard eye icon stayed in every
auto/* candidate pool forever and could still be selected.
Wire hiddenModelsMap into getNoAuthCandidates() the same way #7622 wired
noAuthProviderSpecificData in, mirroring the existing credentialed-connection
check.
- docs/routing/REASONING_ROUTING.md: migration renumbered 125->126
- docs/INCIDENT_RESPONSE.md, docs/PERF_BUDGETS.md: /api/version renamed to /api/system/version
- config/quality/eslint-suppressions.json: rebaseline no-explicit-any counts for
tests/unit/combo-routing-engine.test.ts (261->269) and
tests/unit/base-executor-sanitize-effort.test.ts (45->48), drifted by the prior
base-red full-suite realignment commits (dbc9f6081, 764a4aee0) whose sibling
test-file-size ratchet was already rebaselined in 00b853969 but this gate was missed
- tests/unit/call-log-provider-display.test.ts, tests/unit/m365-web-token-extraction-7078.test.ts:
removed the never-baselined explicit any usages (typed via inference instead)
* feat(providers): notion-web live models via getAvailableModels
Cookie-auth discovery against POST /api/v3/getAvailableModels (spaceId from
cookie or getSpaces) so /api/providers/{id}/models and /v1/models can surface
the real Notion AI picker catalog instead of a single stub notion-ai id.
Also injects a config transcript entry with the selected model codename on
runInferenceTranscript, seeds an offline fallback catalog, and documents that
space_id is needed for reliable discovery.
* fix(providers): address notion-web review + docs provider count
- Safe decodeURIComponent for malformed cookie values
- Use extractSpaceIdFromNotionCookie instead of case-sensitive space_id= includes
- Single trim in buildNotionTranscript
- Sync STRICT docs counts to 265 providers (README/AGENTS/CLAUDE)
* refactor(notion-web): extract helpers to keep parseNotionAvailableModels/pickFirstSpaceId under complexity cap
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Co-authored-by: artickc <artickc@users.noreply.github.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
The credential-health scheduler (src/lib/credentialHealth/scheduler.ts) auto-inits on
import, but nothing imported it at startup — only the on-demand credentialGate
(open-sse/services/credentialGate.ts) does, lazily on the first gated request. So the
boot-time sweep never ran, and web-session connections whose cookies expired overnight
stayed red/unavailable until a real request re-tripped the failure (the "*-web providers
go red on restart" complaint).
Wire initCredentialHealthCheck() into src/instrumentation-node.ts (the real Next.js
instrumentation startup) right after the runtime-settings restore, in its own try/catch
with a [STARTUP] log line. Idempotent and self-disabling via
OMNIROUTE_DISABLE_CREDENTIAL_HEALTH_CHECK; cadence tunable via
CREDENTIAL_HEALTH_CHECK_INTERVAL.
The wiring MUST live in instrumentation-node.ts, NOT the unused src/server-init.ts —
the latter never runs in production, which is why the earlier attempt (closed PR #7432)
was a no-op.
Test: tests/unit/credential-health-boot-wiring.test.ts asserts the boot wiring is present
in instrumentation-node.ts and absent from the dead server-init.ts.
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
GrokCliExecutor.execute() dispatches via raw https.request (nativePost)
instead of the shared fetch path, so it never inherited (nor delegated to)
BaseExecutor.execute()'s proactive-refresh gate the way codex.ts does via
super.execute(). The only refresh that ever fired was the reactive one on a
401/403 from upstream — the rotating xAI refresh_token idled until real
expiry, matching the "unusable within minutes, must delete/re-add" report.
Wires in the same needsRefresh()/refreshCredentials() gate, using
runWithOnPersist + isUnrecoverableRefreshError to keep the [refresh +
persist] atomic under the same per-connection mutex Codex/Claude rely on
for rotating refresh tokens (base.ts:592-644).
Also fixes the smaller, separate bug #2 from the same report: grok-cli was
absent from OAUTH_TEST_CONFIG in the connection-test route, so "Test
Connection" always reported "Provider test not supported" regardless of
token health. Added a checkExpiry entry (same pattern as qwen/cline/
kilocode — Grok Build's proxy doesn't expose a lightweight probe endpoint
with the cli-specific headers this shared prober sends). Extracted
OAUTH_TEST_CONFIG into its own module (oauthTestConfig.ts) so the new entry
doesn't grow the frozen route.ts past its file-size cap.
Bug #3 (no browser/device-code login for Grok Build) and bug #4 (quota
display) from the same issue are feature gaps, not regressions — left as
follow-ups per the triage plan-file.
Refs #7610
Mistral's quota-exhausted response is a bare 401 with a contentless
{"detail":"Unauthorized"} body — byte-identical to a genuinely revoked
key. classifyFailure() in the connection-test route always resolved
this to upstream_auth_error ("Invalid API key"), hiding the real
quota-exhaustion cause and misleading operators into rotating a still-
valid key.
classifyFailure() now accepts an optional `provider` and, for a bare
Mistral 401 with no explicit auth signal in the message (no "invalid
api key" / "token invalid" / "revoked" / "access denied" text), returns
`upstream_ambiguous_auth_or_quota` instead. A Mistral 401 that DOES
carry an explicit auth signal, and any non-Mistral 401, are unaffected
and still classify as upstream_auth_error (baseline preserved).
The new branching logic lives in a new module
(mistralAmbiguousAuth.ts) rather than inline in route.ts, keeping that
frozen file's line count within its file-size-baseline.json budget.
TDD: tests/unit/provider-test-mistral-401-classify.test.ts reproduces
the bug (RED against unfixed classifyFailure), proves the fix (GREEN),
and pins the baseline non-Mistral-401 behavior per the owner's
explicit requirement.
CLIProxyAPI requires its own separately-configured api-keys credential and
rejects any other token with 401. Both the direct mode:"cliproxyapi"
passthrough leg and the mode:"fallback" retry leg reused the resolved
connection's own credentials (the native provider's key) unchanged, making
the fallback path a permanent no-op for every provider configured this way.
Adds a dedicated cliproxyapi_api_key setting (settingsSchemas.ts) and a new
credential-resolution module (cliproxyapiCredentials.ts) that substitutes it
in at the executorProxy.ts choke point for both CLIProxyAPI-bound legs, so
CliproxyapiExecutor itself stays credential-source-agnostic. Falls back to
the connection's own credential when no dedicated key is configured,
preserving prior (workaround) behavior.
- validateWebCookieProvider's /models probe against lmarena's registered
baseUrl (a POST-only streaming endpoint from #6280) triggers a 307
REDIRECT_BLOCKED from safeOutboundFetch, which was surfaced as a raw
"Redirect blocked" error (unsupported:false) instead of the honest
"unsupported" signal — the dashboard rendered a hard Invalid state for a
perfectly valid cookie.
- Add toWebCookieValidationErrorResult() in validation/transport.ts: for
providers whose /models probe is known-unreliable (lmarena for now),
REDIRECT_BLOCKED now degrades to {valid:false, unsupported:true}, mirroring
the same REDIRECT_BLOCKED degrade already applied on the discovery path by
#6267. Deliberately scoped to lmarena only (see code comment) — other
web-cookie providers with a similarly-shaped baseUrl need their own proven
repro before joining the allowlist.
- Remove the now-stale comment at validation.ts claiming lmarena has no
providerRegistry entry (false since #6280 registered one).
- Regression test: tests/unit/arena-cookie-validation-redirect-7542.test.ts
(RED confirmed against unfixed code, GREEN after the fix).
Codex CLI injects prompt_cache_key natively for its own prompt caching.
injectPromptCacheKey() only guards against the router injecting a NEW
key for nvidia/codex/xai — it never strips a key that arrived already
present in the inbound body. NVIDIA NIM's OpenAI-compatible wrapper
rejects the field with a 400, and NIM has no documented support for
prompt caching (providerSupportsCaching already treats nvidia as
non-cache-capable).
Adds a provider-wide STRIP_RULES entry in paramSupport.ts (match-all,
since prompt_cache_key rejection isn't model-specific) so
stripUnsupportedParams() drops it for every nvidia target before the
request reaches DefaultExecutor.
The built-in "Chutes" provider preset hardcoded the non-resolving
domain api.chutesai.com (confirmed live: DNS NXDOMAIN). Every request
using the built-in preset failed with getaddrinfo ENOTFOUND,
independent of API key validity.
The correct, resolving host is llm.chutes.ai, already used elsewhere
in the codebase for model discovery
(providerModelsConfig.ts:184-187).
Regression test: tests/unit/chutes-registry-baseurl-7621.test.ts
(RED before the fix, GREEN after). The provider.ts translate-path
golden snapshot is updated to reflect the corrected URL only for
the chutes entry.
Two independent bugs, not migration 126:
1. tests/unit/db-migration-runner.test.ts and
tests/unit/migration-safety-abort-6260.test.ts: withNonTestEnvironment()
only sanitized process.argv, not process.execArgv. #7359 made
isAutomatedTestProcess() also scan execArgv (to catch `node --test`), so
under the node:test runner execArgv always retains `--test` and the
"simulate a non-test environment" helper became a no-op. The
mass-migration safety-abort check (gated on !isTestEnvironment) never
fired, migrations ran for real, and hit the hardcoded version-032
apikey-lifecycle special case against fixtures that never created
api_keys — surfacing as "no such table: api_keys" instead of the
expected MigrationSafetyAbortError. Fix: also strip test-token args from
process.execArgv in the test helper.
2. tests/unit/db-core-init.test.ts: SCHEMA_SQL created
idx_pc_auth_active_refresh on provider_connections(refresh_token)
unconditionally, before ensureProviderConnectionsColumns() ran its
column-healing pass — and that function never healed refresh_token in
the first place. A legacy provider_connections table predating that
column (simulated by the "max_concurrent column is healed" fixture)
fails startup with "no such column: refresh_token" instead of healing.
Fix: move the index into ensureProviderConnectionsColumns(), after
adding a defensive refresh_token backfill.
shouldSkipCloudSyncInitialization(env, argv) forwarded its own
parameters in the wrong order to isAutomatedTestProcess(argv, env) —
passing env where argv is expected and vice versa. Any real argv array
landed in the `env` position (harmless there) but the env object
landed in the `argv` position, and argv.some() then threw
`TypeError: argv.some is not a function` as soon as a caller passed an
explicit, correctly-ordered argv/env pair (tests/unit/model-sync-
scheduler.test.ts "initCloudSync skips auto initialization...").
Fixed the call-site argument order. Also hardened
isAutomatedTestProcess() to tolerate a non-array argv defensively
(return false instead of throwing) since this check gates production
background-task startup (auto-backup, migrations, cloud sync) and
must never crash the process it's protecting.
sortTargetsByUsage (open-sse/services/combo/targetSorters.ts, since
#7015/#7059) keys usage lookups by the per-target executionKey
(combo-name + step-id), not by the bare model string, so accounts
sharing a modelStr don't collapse into a single usage bucket.
Three tests called recordComboRequest() directly without a `target`,
so the recorded usage landed under a modelStr fallback key that never
matches the real executionKey computed at combo-resolution time —
every target read back as 0 usage and the original combo order won,
failing the "prefers the least-used model" assertions. Production is
unaffected: every real combo.ts call site already passes
`target: toRecordedTarget(target)`.
Fixed by priming usage through real handleComboChat calls (which
route recordComboRequest through the actual resolved target) instead
of calling recordComboRequest() directly with an unlinked target.
#7129 added claude-sonnet-4-6 to CONTEXT_1M_SUPPORTED_MODELS (1M context GA'd
2026-02-17) but missed this test in its sweep. A non-CC anthropic-compatible
target with extendedContext:true now legitimately receives the context-1m
beta header for this model — updating the stale undefined expectation.
