Commit Graph

305 Commits

Author SHA1 Message Date
diegosouzapw
6fada51fe8 fix(security): resolve CodeQL scanning alerts for SSRF, insecure randomness and incomplete URLs 2026-04-07 23:51:33 -03:00
diegosouzapw
26316d8d76 fix: Gemini OAuth, SkillsMP response, and PDF attachment handling (#1021) 2026-04-07 23:30:28 -03:00
diegosouzapw
7674059899 fix(oauth): handle null state in Cline exchange (#1016) 2026-04-07 23:29:29 -03:00
Luan Dias
6c2b37c595 feat: restore legacy JSON config import/export (#1012)
Adds legacy 9router JSON config import/export with Zero-Trust security (password/requireLogin redacted). Integrated into release/v3.5.4.
2026-04-07 17:27:22 -03:00
Paijo
b338cc88fb perf: reduce analytics page load — DB filter, parallel costs, merged queries (#1038)
Performance: reduces analytics page load via DB date filter, parallel cost calculation, and merged COUNT queries. Integrated into release/v3.5.4.
2026-04-07 17:27:19 -03:00
diegosouzapw
60b632418f fix(security): resolve SSRF vulnerability in sync-models via strict protocol and host validation 2026-04-07 11:53:49 -03:00
diegosouzapw
592ca9b5c4 fix: remove hardcoded localhost default arg from GET /api/keys, unify coverage to single coverage/ dir, fix test to pass explicit Request
- Remove `new Request('http://localhost/api/keys')` default arg from GET handler in src/app/api/keys/route.ts (line 26)
- Fix api-key-reveal-route.test.mjs to pass explicit Request instead of calling GET() with no args
- Add --output-dir coverage to all c8 scripts in package.json
- Add coverage.reportsDirectory: 'coverage' to vitest.config.ts and vitest.mcp.config.ts
- Fix CHANGELOG.md structure (# Changelog + [Unreleased] to top)
- Remove 30+ stale coverage-* directories from project root
- Coverage: Statements 78.76% | Branches 72.75% | Functions 80.93% | Lines 78.76% (all thresholds passed)
2026-04-05 23:21:08 -03:00
diegosouzapw
ea540569ed Merge branch 'review-pr-983' into release/v3.5.1 2026-04-04 09:22:41 -03:00
diegosouzapw
bd281e5753 chore(release): v3.5.1 — Qwen OAuth reliability & limits tracking sync 2026-04-04 09:10:56 -03:00
oyi77
7c59f05681 fix: resolve Gemini Code Assist review comments on models.dev integration
- CRITICAL: Fetch old settings BEFORE update in PATCH handler to correctly
  compare wasEnabled vs isEnabled for sync lifecycle management
- CRITICAL: Handle modelsDevSyncInterval changes (restart periodic sync with
  new interval when it changes)
- MEDIUM: Add error logging and user feedback to useEffect catch
- MEDIUM: Add revert logic to updateInterval on API failure

Fixes all 3 review comments from Gemini Code Assist on PR #983
2026-04-04 19:10:42 +07:00
oyi77
6dcde9fcbe fix: add Zod validation to models-dev API route
Fixes check:route-validation:t06 CI failure.
The POST handler now uses validateBody with modelsDevActionSchema
instead of raw request.json().catch().
2026-04-04 18:54:42 +07:00
oyi77
cc048e55bf feat: integrate models.dev as authoritative model database with UI controls
- Add models.dev sync engine (src/lib/modelsDevSync.ts) for pricing, capabilities, and model specs
- Fetch from https://models.dev/api.json (109 providers, 4,146+ models, MIT licensed)
- 4-layer pricing resolution: User Override > models.dev > LiteLLM > Hardcoded Default
- New model_capabilities DB table for synced capability data
- UI toggle in Settings > AI tab: enable/disable sync, configure interval (1h-7d), manual sync trigger
- Live stats dashboard showing provider/model/capability counts
- New API route /api/settings/models-dev for sync status and manual triggers
- Fix 39 missing i18n keys across all 30 languages (Memory & Skills tab fully translated)
- 25 unit + integration tests, 1,439 existing tests pass, lint clean, typecheck clean

Closes #979
2026-04-04 18:38:25 +07:00
R.D.
231ca8a935 support custom user agent for third-party providers 2026-04-04 01:09:51 -04:00
diegosouzapw
19f46eb817 chore(release): v3.5.0 — all changes in ONE commit 2026-04-03 19:27:15 -03:00
diegosouzapw
dd814d1591 Merge branch 'pr-959' into release/v3.5.0 2026-04-03 18:35:43 -03:00
Mikhail Salnikov
f7fbe3946d feat(usageTracking): make usage token buffer configurable
The hardcoded BUFFER_TOKENS = 2000 constant inflates prompt_tokens and
input_tokens in every API response, which is helpful for CLI tools that
rely on reported usage to manage context windows but misleading for SDK
users, cost dashboards, and any integration comparing token counts
across providers.

This change makes the buffer configurable via three layered sources
(in priority order):

  1. Environment variable: USAGE_TOKEN_BUFFER=0
  2. Settings API / Dashboard: PATCH /api/settings { usageTokenBuffer: 0 }
  3. Default: 2000 (preserves existing behavior)

Setting the value to 0 disables the buffer entirely, causing OmniRoute
to return raw provider token counts. The setting is cached in-process
with a 30-second TTL and invalidated immediately when updated through
the settings API.

Changes:
- open-sse/utils/usageTracking.ts: replace hardcoded constant with
  getBufferTokens() that reads env / DB settings with TTL cache
- src/shared/validation/settingsSchemas.ts: add usageTokenBuffer field
  (int, 0–50000) to the Zod update schema
- src/app/api/settings/route.ts: invalidate buffer cache on update
2026-04-03 23:20:40 +03:00
diegosouzapw
7f723a6bd5 fix(security): Enforce isAuthenticated across new settings and skills routes 2026-04-03 14:03:50 -03:00
diegosouzapw
7885153933 Merge PR 955 2026-04-03 13:10:08 -03:00
diegosouzapw
f5161404cb feat: complete Auto-Combo CRUD and fix missing translations 2026-04-03 13:06:05 -03:00
growab
6daa065b1e feat(proxy): add proxy support for OAuth, token refresh, and model sync (#953)
- Add proxy support to all OAuth flows (authorization, token exchange, import)
- Add proxy support to token refresh operations for all providers
- Add proxy support to model synchronization
- Initialize global fetch proxy patch at server startup
- Use Proxy Registry with priority: Provider Proxy → Global Proxy → Direct
- Fix Global Proxy display in settings UI to show proxy from Proxy Registry

Changes:
- open-sse/services/tokenRefresh.ts: Add proxyConfig parameter to all refresh functions
- src/sse/services/tokenRefresh.ts: Resolve proxy before calling refresh functions
- src/app/api/oauth/*/route.ts: Use resolveProxyForProvider for OAuth flows
- src/app/api/providers/[id]/models/route.ts: Add proxy support for model sync
- src/instrumentation-node.ts: Initialize proxy patch at startup
- src/app/api/settings/proxy/route.ts: Read Global Proxy from Proxy Registry
- src/lib/db/proxies.ts: Export resolveProxyForProvider
- src/lib/localDb.ts: Re-export resolveProxyForProvider
- src/models/index.ts: Re-export resolveProxyForProvider

15 files changed, 405 insertions(+), 240 deletions(-)

Co-authored-by: growab <growab@users.noreply.github.com>
2026-04-03 10:17:33 -03:00
Randi
1b873d3bad fix settings persistence and cache analytics layout (#952) 2026-04-03 10:17:30 -03:00
Randi
db0af86085 Clarify provider groups on the Providers page (#950) 2026-04-03 10:17:24 -03:00
oyi77
0420144104 feat: memory 500 fix, skills marketplace (SkillsMP), DB cleanup, LKGP toggle, and upstream 400 fixes
- fix(memory): wrap JSON.parse in try/catch in retrieval.ts to prevent 500 on corrupt metadata; add stats to GET /api/memory response
- fix(#949): add sanitizeToolId() to replace invalid chars in cross-provider tool IDs; clamp max_tokens to Math.max(1, value)
- feat(skills): add SkillsMP marketplace integration (search + install via /api/skills/marketplace); add skill upload/install modal and DELETE endpoint; wire skillsEnabled guard in executor
- feat(settings): add Maintenance section to General tab (Clear Cache + Purge Expired Logs buttons)
- feat(lkgp): add lkgpEnabled toggle and Clear LKGP Cache button to Routing settings; add clearAllLKGP(); respect toggle in LKGPStrategyImpl
- test: add vitest coverage for all new functionality

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-03 18:53:22 +07:00
diegosouzapw
d46e3f07c3 chore(release): v3.4.8 — security compliance and fix algorithms 2026-04-03 00:15:35 -03:00
diegosouzapw
954c40067e chore(release): merge PR 937 and fix catalog models context length types 2026-04-02 22:32:52 -03:00
diegosouzapw
20a72a0f45 feat(health): add cryptography health check node (#798) 2026-04-02 22:22:03 -03:00
R.D.
bcc374eb31 fix claude oauth and cc-compatible regressions 2026-04-02 20:54:19 -04:00
Chris Staley
75daf98112 fix(gemini): correct API field casing, add safety finish reasons, pagination timeout
Stability fixes for the Gemini provider — no new features:
- Map SAFETY/RECITATION/BLOCKLIST finish reasons (gemini-to-openai → content_filter)
- Add 15s per-page timeout on models sync pagination to prevent indefinite hangs
- Fix mime_type → mimeType in inlineData to match Gemini v1beta API (camelCase)
- Fix include_thoughts → includeThoughts to match Gemini API (camelCase)
- Add inlineData/mime_type fallback in gemini-to-openai request translator
2026-04-02 16:37:58 -06:00
Chris Staley
25c63c8b10 merge: sync with upstream origin/main (v3.4.5+v3.4.6)
Merges upstream changes including: circuit breaker fixes, Claude Code
compatible streaming, CLIProxyAPI routing, GitHub Copilot token refresh,
qoder PAT support, streaming timeouts, OpenAI response sanitization,
memory/skills sidebar, and i18n improvements.

Resolves conflicts in:
- providers/[id]/page.tsx: merged providerSupportsPat + Gemini synced models
- providers/route.ts: kept normalizeQoderPatProviderData, removed auto-sync
  (now handled client-side with progress dialog)
- i18n files: upstream already includes modelsImported/close keys
2026-04-02 15:55:18 -06:00
Chris Staley
a069df41b8 fix: address PR review — timeouts, pagination safety, standardized cooldowns
- Add 30s AbortSignal timeout to sync-models fetch in progress dialog
- Add duplicate nextPageToken detection to prevent infinite pagination
- Standardize retry-after defaults to COOLDOWN_MS.rateLimit (120s)
- Add connection metadata update (lastErrorType/lastError) for
  per-model lockout early return in auth.ts
- Clarify lockModel race safety in single-threaded Node.js
2026-04-02 15:48:36 -06:00
Chris Staley
b1183c2c9d feat(models): add pageSize=1000 and nextPageToken pagination for Gemini
Google AI Studio defaults to 50 models per page. Set pageSize=1000
to maximize per-page results and follow nextPageToken to fetch all
available models across pages. Also fixes query param separator when
base URL already contains query string.
2026-04-02 15:40:05 -06:00
Chris Staley
3ae810a18e fix(gemini): log sync errors, optimize synced models query
- Replace silent catch blocks with logged errors in catalog and v1beta
- Use SQL LIKE filter instead of fetching all rows and filtering in-memory
2026-04-02 14:42:38 -06:00
Chris Staley
2341bba973 feat(gemini): progress dialog on key save, remove hardcoded registry, categorize by endpoint
- Show import progress dialog when adding Gemini API key with model
  list, completion status, and Close button
- Remove hardcoded Gemini model registry — models come exclusively
  from Google API sync per API key
- Hide "Import from /models" button for Gemini (sync handles it)
- Remove server-side fire-and-forget auto-sync (client handles it)
- Categorize synced Gemini models by endpoint type in catalog:
  embedding, image, and audio (transcription + speech)
- Add modelsImported and close i18n keys to all 33 languages
2026-04-02 14:38:28 -06:00
Chris Staley
b4e674aeb0 fix(gemini): no registry fallback — show 0 models when no API keys exist
Removed hardcoded registry fallback for Gemini in dashboard, catalog,
and v1beta endpoints. Without synced models (no API keys), Gemini shows
nothing. Hardcoded entries are always removed from v1beta regardless
of sync result.
2026-04-02 12:12:57 -06:00
Chris Staley
8ed091703f feat(gemini): per-connection model tracking with cleanup on key delete
Store synced models keyed by providerId:connectionId so each API key's
models are tracked separately. On read, union across all connections.
On connection delete, remove only that key's models. Models with no
remaining connections are automatically excluded.
2026-04-02 12:00:59 -06:00
Chris Staley
464fd6d4d3 fix(v1beta): remove Gemini duplicates — filter non-consecutive entries, skip custom models 2026-04-02 11:47:41 -06:00
Chris Staley
5b140d26c3 feat(api): catalog and v1beta read from synced Gemini models 2026-04-02 11:42:46 -06:00
Chris Staley
125fb81fa3 feat(dashboard): Gemini Available Models reads from API sync, hide Custom Models 2026-04-02 11:41:28 -06:00
diegosouzapw
ee14372e20 Merge PR #912 (I18N String improvements) 2026-04-02 14:40:01 -03:00
Chris Staley
5c27e0f9ef feat(gemini): auto-trigger model sync when API key is saved 2026-04-02 11:39:29 -06:00
Chris Staley
7607cec7a2 feat(sync): write Gemini models to syncedAvailableModels with union logic 2026-04-02 11:38:38 -06:00
Diego Rodrigues de Sa e Souza
c87167cac4 Merge pull request #921 from rdself/coder/cc-compatible-streaming-ui
Fix CC compatible streaming and compatible provider UI
2026-04-02 14:36:59 -03:00
Diego Rodrigues de Sa e Souza
3319fd6a21 Merge pull request #916 from oyi77/feat/cliproxyapi-3-version-manager
feat(cliproxyapi): version manager service, API routes, CLI Tools UI & Docker
2026-04-02 14:36:43 -03:00
Diego Rodrigues de Sa e Souza
9fd5d8241e Merge pull request #914 from oyi77/feat/cliproxyapi-1-schema-settings
feat(cliproxyapi): DB schema, upstream proxy config & settings UI
2026-04-02 14:36:31 -03:00
Diego Rodrigues de Sa e Souza
0bfee823dd Merge pull request #913 from carmin777/feat/qoder-pat-qodercli
feat(qoder): support PAT via qodercli and remove stale qoder.cn defaults
2026-04-02 14:36:25 -03:00
Chris Staley
faae82eae1 feat(v1beta): use stored token limits and metadata in Gemini models endpoint 2026-04-02 10:18:26 -06:00
Chris Staley
49ac0cadfb feat(catalog): use stored inputTokenLimit for custom model context_length 2026-04-02 10:17:14 -06:00
Chris Staley
325d048340 feat(sync): carry Gemini metadata through model sync 2026-04-02 10:14:17 -06:00
Chris Staley
f1805c8536 feat(gemini): extract metadata from models API response 2026-04-02 10:13:11 -06:00
diegosouzapw
8c58f7a04e test(ci): fix t06 validation error by adding Zod validation to memory/skills routes and allow security audit failure 2026-04-02 09:26:09 -03:00