npx playwright falls back to a registry download when playwright is absent from
the slim runtime image's node_modules. On GitHub-hosted runners this download
fails with exit 127, breaking both amd64 and arm64 -web image builds.
Fix: COPY playwright and playwright-core from the builder stage and invoke
node node_modules/playwright/cli.js directly — no network access, same version,
and playwright remains available at runtime for web-session providers.
Update Codex CLI docs and configuration skill to use the v0.137+
profile file naming format: ~/.codex/<name>.config.toml instead of
the deprecated profile- prefix.
Clarify that missing profile files silently fall back to defaults, and
rename the setup workflow heading to match the config-codex-cli skill.
- Unit/integration tests: update hardcoded 42→43 in 7 test files
(agentSkillTools-mcp, agentSkills-catalog, agentSkills-generator,
agent-skills-content, agent-skills-discovery, listCapabilities-a2a)
to match the 43rd skill (config-codex-cli) added in the previous commit.
- Include CONFIG_SKILL_IDS in integration content test ALL_IDS so
skills/config-codex-cli/ is no longer "unexpected".
- listCapabilities.ts: change totalSkills from literal 42 to catalog.length
so it adapts to catalog growth automatically.
- computeCoverage assertions: include config.have in totalSkills check.
- CI: switch E2E artifact from upload-artifact path (ambiguous stripping)
to explicit tar archive. Fixes "Could not find a production build in
./.build/next" — the previous approach's download path was double-nested
(.build/next/next/...) due to upload-artifact LCA computation. tar -czf
stores .build/next/... relative to CWD; tar -xzf restores them verbatim.
- Also exclude .build/next/cache from the tar to keep archive lean.
- feat(translator): strip client_metadata in Responses→Chat translation
(Mistral 422 extra_forbidden fix); add regression test.
Upload the Next.js build from the build job and reuse it across E2E
shards to avoid rebuilding in each shard. Increase Playwright sharding
from 6 to 9, cache Chromium browsers, and lower the E2E timeout to match
the faster expected runtime.
Add a Codex CLI configuration skill for OmniRoute setup and ignore local
credential-bearing setup prompts.
- Remove 429 from PROVIDER_BREAKER_FAILURE_STATUSES; 429 belongs to
connection cooldown, not whole-provider breaker (CLAUDE.md §resilience).
PR #3366 correctly added 429 to PROVIDER_FAILURE_ERROR_CODES in
accountFallback.ts (combo infinite-retry fix) but the parallel change
to chat.ts was wrong — the integration test from v3.8.10 confirms this.
- Align stream-utils tests to PR #3399 (SYNTHETIC_CLAUDE_EMPTY_RESPONSE_TEXT
→ "", message.content → null) and PR #3355 (malformed tool-call buffer
now emitted as plain text, not suppressed).
- Align services-branch-hardening test to PR #3399 (pinnedModel always
null from applyComboAgentMiddleware; server-side session pinning replaced
client-side <omniModel> tag extraction).
- Align combo-routing-engine context-cache tests to PR #3399 (no <omniModel>
tag in output, no X-OmniRoute-Model header, priority routing unchanged).
- docs/guides/CODEX-CLI-CONFIGURATION.md was missing the YAML frontmatter
block required by fumadocs (title/version/lastUpdated), causing the
production build to fail with "invalid frontmatter" MDX error.
- CodexCliGuideModal.tsx called setLoading/setError synchronously in a
useEffect body, triggering the react-hooks/set-state-in-effect lint error.
Refactored to an internal async function with an `cancelled` guard to
prevent state updates on unmounted components.
Add a comprehensive guide for configuring Codex CLI to use OmniRoute as an OpenAI-compatible backend.
Document ready-to-use config examples, Responses API routing behavior, context window settings, token limits, model profiles, and troubleshooting guidance to help users avoid direct-provider compatibility issues.
The 35m bump still wasn't enough — shard 5/6 (responsive viewport matrix +
studio/smoke, ~24 serial tests after a ~5m build) was still cancelled at 35m,
and the `github` Playwright reporter buffers output so the cancelled log showed
no per-test results (couldn't tell which test was slow).
- e2e timeout-minutes 35 -> 50 (the shard observably needs >35m; other shards
finish in ~7m so they're unaffected).
- Playwright CI reporter github -> line so per-test progress + timing stream
live to the job log, making any genuinely slow/hung test diagnosable.
The heaviest E2E shard (5/6 — responsive viewport matrix + studio/smoke) overran
the job's 20m timeout-minutes because each shard re-runs `npm run build` (~5m)
before Playwright, then runs ~24 serial tests with retries:2. The job was killed
(CANCELLED mid-run, 'Terminate orphan process') instead of any test failing.
- Bump test-e2e timeout-minutes 20 -> 35 (cumulative build+tests headroom).
- Lower the Playwright per-test timeout 600s -> 180s so a genuine hang fails fast
and visibly (a clear per-test timeout) instead of silently eating the job budget.
* chore(release): open v3.8.15 development cycle
Version bump 3.8.14 -> 3.8.15 (root + electron + open-sse + openapi + lockfiles)
and seed the v3.8.15 changelog placeholder (root + 41 i18n mirrors).
* fix(catalog): add getTokenLimit fallback for combo targets with unknown context (#3369)
Integrated into release/v3.8.15. Fixes applied on the contributor's branch: removed duplicate JSDoc opening in accountFallback.ts and dropped a test asserting unreachable catalog behavior (models with no registry/spec/synced source are filtered before the getTokenLimit fallback at catalog.ts:499).
* fix(combo): add 429 to PROVIDER_FAILURE_ERROR_CODES to prevent infinite retry loop (#3366)
Integrated into release/v3.8.15. Comment block reconciled on the contributor's branch to remove the contradictory 'intentionally excluded' text that remained from the original code.
* fix(auto-combo): include no-auth providers declaratively (#3365)
Integrated into release/v3.8.15. Cleanup applied on contributor's branch: removed duplicate migration 095 (already exists from PR #3338), reverted CHANGELOG.md and i18n changelogs to release versions (release process owns these), dropped package version-bump noise from stale fork base. Core feature — declarative no-auth via serviceKinds metadata, declarative VEO as 'video' provider, anonymousFallback flag for opencode-zen/opencode-go — integrated cleanly.
* fix(migrations): restore 095_provider_node_custom_headers migration
The squash merge of PR #3365 accidentally deleted this migration because
the cleanup commit on the contributor's branch included 'git rm' for the
file (which was a duplicate on their branch). The migration was merged
in v3.8.14 via PR #3338 and must be present in the release branch.
Restoring from git history.
* fix: update Command Code base URL from /alpha/ to /provider/v1/ (#3372)
Integrated into release/v3.8.15.
* feat(error-rules): provider-specific error classification with scope (#3370)
Integrated into release/v3.8.15. PR has genuine value beyond #3369: (1) getProviderErrorRuleMatch now accepts native Headers objects from fetch(); (2) checkFallbackError also uses the provider rule registry — the real end-to-end wiring in the combo fallback path; (3) S4 end-to-end test proving the wiring fires. Merge commit on contributor branch resolved the add/add conflict by taking the #3370 version throughout.
* fix(auto-combo): validate web-session credentials (#3371)
Integrated into release/v3.8.15. Core feature: provider-aware web-session credential validation — hasUsableWebSessionCredential() replaces the broad Object.keys check in virtualFactory.ts, ensuring only sessions with the required storageKeys are included in auto-combo. Cleanup: removed duplicate 095 migration, reverted CHANGELOG/i18n, dropped package bump noise.
* fix(migrations): restore 095_provider_node_custom_headers (deleted again by #3371 squash)
Same issue as after #3365: git rm in the contributor cleanup commit
was included in the squash, deleting this migration from release.
Permanent fix needed: use 'git checkout origin/release -- <file>'
instead of 'git rm' when cleaning up duplicate files in contributor branches.
* fix(kiro): probe Windows %APPDATA%\kiro\storage.db in auto-import (#3363) (#3375)
Integrated into release/v3.8.15. Test fix applied: kiro-windows-auto-import-3363.test.ts now sets DATA_DIR to a fresh temp dir before importing app modules, ensuring isAuthRequired() sees an empty settings DB (no password → auth not required). This fixed test 4 (synthetic SQLite) which was getting 401 due to settings DB state leakage.
* chore(release): finalize v3.8.15 changelog — 2026-06-07
---------
Co-authored-by: Hernan Javier Ardila Sanchez <hjasgr@gmail.com>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: Muhammad Nabil Muyassar Rahman <65392758+TapZe@users.noreply.github.com>
Co-authored-by: kiro-agent[bot] <245459735+kiro-agent[bot]@users.noreply.github.com>
#3358 added the gemini-2.5-flash model spec with its real 65536 max-output cap
(previously the model had no spec and fell to an 8192 default). The Claude→Gemini
clamp test still asserted 8192, so it failed deterministically — the single real
failure behind the v3.8.14 CI red (Unit Tests 3/8, Coverage Shard 3/8, Node
24/26 Compatibility 1/2 all hit this one test; E2E 5/6 was fail-fast collateral).
The v3.8.14 merge introduced `executeWithUpstreamStartTimeout<any>(...)` in
chatCore.ts, pushing the file's explicit-any count to 1 over its budget of 0
(check:any-budget:t11, a blocking CI lint-job gate). The generic T is already
inferable from the `execute` callback's return type, so drop the explicit
`<any>` and let inference do it — no behavior change, typecheck:core stays clean.
The release PR #3340 was merged before these changelog lines landed: the #3356
Usage-Analytics-error bullet and the @nullbytef0x (#3357) / @Ardem2025 (#3358)
contributor rows. Code for all three was already in the squash; this only
completes the changelog/credits so the GitHub release notes are accurate.
* chore(release): open v3.8.14 development cycle
Version bump 3.8.13 -> 3.8.14 (root + electron + open-sse + openapi + lockfiles).
Seed the v3.8.14 changelog with the four post-tag hotfixes that shipped to
Docker/Electron in v3.8.13 but missed the immutable npm 3.8.13 (#3336 SSRF /
CodeQL #323, #3334/#3335/#3339 Electron packaging). i18n CHANGELOG mirrors get
the in-progress placeholder section.
* feat: add per-provider custom headers support for OpenAI/Anthropic-compatible nodes (#3338)
Integrated into release/v3.8.14
* fix: Kiro Builder ID token import fails with Bad credentials (#3333)
Integrated into release/v3.8.14 — adds Builder ID cached-creds + OIDC refresh path for Kiro token import, with regression tests (#3333).
* Improve code quality: auto-pr/docstrings-1780792063 (#3337)
Integrated into release/v3.8.14 — docstring for context analytics route re-export.
* fix(catalog): remove minimaxai/minimax-m3 from NVIDIA NIM tier (404 upstream) (#3329) (#3341)
NVIDIA NIM does not host minimaxai/minimax-m3 — every request returns
404 page not found, while sibling minimaxai/minimax-m2.7 on the same provider
works. Advertising a model that 404s is a catalog bug; remove it from the nvidia
tier (it remains on the tiers that actually serve MiniMax M3). Re-add only once
NVIDIA serves it.
Co-authored-by: mikmaneggahommie <mikmaneggahommie@users.noreply.github.com>
* fix(cli): write OpenCode config to ~/.config on all platforms incl. Windows (#3330) (#3343)
resolveOpencodeConfigDir used %APPDATA% on Windows, but OpenCode reads its
config from XDG ~/.config/opencode/ on every platform (on Windows:
%USERPROFILE%\.config\opencode\, NOT %APPDATA%). So a Windows user who
configured OpenCode via the dashboard had the file written where OpenCode never
looks — it silently had no effect.
Use the XDG path (XDG_CONFIG_HOME || ~/.config) unconditionally. Update the UI
note + route JSDoc, and flip the three tests that encoded the old %APPDATA%
behavior (t40 per-platform + card-note, cli-runtime-extended getCliConfigPaths).
Co-authored-by: abdulkadirozyurt <abdulkadirozyurt@users.noreply.github.com>
* fix(proxy): make auto-selection fallback opt-in (#3332) (#3344)
selectWorkingProxyFallback (Step 11 of resolveProxyForConnection) listed ALL
registry proxies, ignoring assignments and per-connection proxy_enabled, and
returned the first working one with level:'autoSelect'. So a single proxy added
to the registry silently became a global fallback for every connection's traffic.
Gate it behind a new PROXY_AUTO_SELECT_ENABLED feature flag (default off): the
fallback now no-ops unless the operator opts in. No registry proxy becomes a
silent global default anymore.
Co-authored-by: hertznsk <hertznsk@users.noreply.github.com>
* fix(sse): treat MiniMax M3 as multimodal so vision isn't stripped (#3328) (#3342)
MiniMax M3 via the opencode provider (oc/minimax-m3-free) appeared blind:
image inputs didn't reach the model, while the same model in Cline could
see them. Verified empirically that MiniMax M3 on the opencode upstream IS
multimodal -- a base64 image is described correctly (it returns 403 only
for remote image URLs, which it doesn't accept).
Root cause: OmniRoute treated MiniMax M3 as a non-vision model in two
places, so when compression was active the image was replaced with a text
placeholder before dispatch:
- compression's modelSupportsVision() heuristic (lite.ts) only matched
gpt-4/4o/claude-3/gemini/vision -- minimax was absent -> replaceImageUrls
stripped the image.
- the opencode minimax-m3-free catalog entry lacked supportsVision, so the
combo vision-capability gate could also exclude/mishandle it.
Add 'minimax-m3' to the vision heuristic and supportsVision: true to the
opencode minimax-m3-free entry. TDD: a failing-then-passing test in
compression/lite.test.ts proves replaceImageUrls now keeps images for
minimax-m3 ids, plus a registry assertion mirroring the #2822 qwen test.
Reported-by: @mikmaneggahommie
* docs(i18n): translate 25 core documentation files to Indonesian (#3348)
Integrated into release/v3.8.14 — Indonesian i18n docs.
* fix(review): resolve /review-reviews battery findings (LEDGER-1..11) on v3.8.14 (#3350)
Integrated into release/v3.8.14 — /review-reviews battery hardening (LEDGER-1..11) for #3338 custom-headers + #3333 kiro, plus cycle-test drift fixes (#3329/#3330/#3332).
* fix(provider-proxy): honor per-account proxy toggles (#3349)
Integrated into release/v3.8.14 — honor per-account proxy toggles + auto-fallback opt-in via PROXY_AUTO_SELECT_ENABLED.
* fix(dashboard): remove duplicate Distribute Proxies button on provider page (#3352)
* fix(providers): reduce proxy label noise (#3346)
Integrated into release/v3.8.14 — reduce proxy label noise + a11y (aria-label/sr-only).
* fix(duckduckgo): restore bare Response contract and rebase onto release/v3.8.14 (#3323)
Integrated into release/v3.8.14 — browser-backed cookie providers (duckduckgo/claude-web) with restored executor contract + unit tests.
* fix(noauth): expose only usable model aliases (#3345)
Integrated into release/v3.8.14 — noauth usable-alias filtering + registry alias plumbing (veo-free).
* fix(dashboard): stop infinite config-load loop on Hermes Agent detail page (#3353)
* fix(electron): tree-kill the server on exit/update to release the omniroute.exe lock (#3347) (#3354)
* chore(release): finalize v3.8.14 changelog + clear release-gate drift
- CHANGELOG: finalize the v3.8.14 section (date, full New Features/Bug Fixes/
Maintenance coverage of all 16 cycle commits, Contributors hall of 12).
- docs: document OMNIROUTE_BROWSER_POOL + WEB_COOKIE_USE_BROWSER (#3323) in
.env.example + ENVIRONMENT.md; regenerate the id/llm.txt strict mirror (#3348
had translated it; llm.txt mirrors must match root).
- test(proxy-fetch): #3323 made tlsClient.available a computed getter — stub it
via Object.defineProperty instead of assignment (5 tests were red on the base).
* fix(translator): coerce Gemini functionDeclaration parameters to an OBJECT schema (#3357) (#3360)
* fix(gemini): resolve truncation/suppression of false positive textual tool call markers in backticks (#3358)
Integrated into release/v3.8.14 — Gemini/Antigravity textual tool-call marker normalization (no false-positive suppression + split-chunk buffering).
* docs(changelog): add #3358 Gemini textual tool-call normalization to v3.8.14
* fix(dashboard): surface real analytics error instead of generic placeholder (#3356) (#3361)
The Analytics page discarded the server's error body on a non-OK response and
rendered a generic "An error occurred", so users (and maintainers) could not see
why /api/usage/analytics 500'd after an upgrade. Now the route returns the real
reason via buildErrorBody (sanitized, Hard Rule #12) and the page surfaces it via
a new readFetchErrorMessage helper that handles both the OpenAI-style and legacy
error shapes.
Reported-by: @superti4r
---------
Co-authored-by: PizzaV <103120356+pizzav-xyz@users.noreply.github.com>
Co-authored-by: Someres <168349709+quanturbo@users.noreply.github.com>
Co-authored-by: Dong Mengzhe <154944819+Lang-Qiu@users.noreply.github.com>
Co-authored-by: mikmaneggahommie <mikmaneggahommie@users.noreply.github.com>
Co-authored-by: abdulkadirozyurt <abdulkadirozyurt@users.noreply.github.com>
Co-authored-by: hertznsk <hertznsk@users.noreply.github.com>
Co-authored-by: Krisna Santosa <54174372+KrisnaSantosa15@users.noreply.github.com>
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Wilson <pedbookmed@gmail.com>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: Ardem2025 <ardemb22@gmail.com>
checkForUpdates() is fired unawaited from a setTimeout at startup. The
underlying autoUpdater.checkForUpdates() rejects on a 404 (release update
manifest not published yet), offline, or rate-limit — and the uncaught
rejection surfaced as an "Unhandled Rejection", which the packaged-app smoke
test treats as fatal (failed the macOS-intel v3.8.13 build; passed elsewhere
only by timing race). The autoUpdater "error" event still notifies the user;
wrap the await so the promise rejection never escapes. Adds a regression test.
POST /api/providers fires a credential-bearing self-fetch to the new
connection's /sync-models route (forwarding the management cookie + internal
sync auth headers). #3267 built that origin from new URL(request.url).origin —
the client-controlled Host header — so a (management-authenticated) caller
could redirect the internal request to an arbitrary host, exfiltrating the
internal sync auth token (CodeQL js/request-forgery, critical, alert #323).
Derive the origin from the trusted loopback/env-pinned base URL via a new
getModelSyncInternalBaseUrl() helper (same source the model-sync scheduler
already uses), never from the incoming request. Adds a regression test.
instrumentation-node.ts imported the #3292 cookie auto-refresh daemon via
"@/open-sse/services/autoRefreshDaemon". The @/ alias maps to src/, but the
daemon lives in the open-sse workspace, so the import resolved to the
non-existent src/open-sse/... and threw "Cannot find module" at runtime in the
built standalone. A try/catch made it non-fatal (the daemon silently never
ran), which kept typecheck and the dev server green, but the packaged Electron
app's strict startup-log smoke test failed on the "Cannot find module" line.
Use the correct @omniroute/open-sse alias, plus a regression test banning
@/open-sse/* imports across src/.
