Register AWS Polly as an audio provider with SigV4 request signing,
speech engine discovery, and API-key validation for managed provider
flows.
Add Lemonade as a self-hosted OpenAI-compatible provider, expand
static model discovery to audio registries, and support Azure OpenAI
deployment discovery from resource endpoints.
Sanitize sensitive provider-specific AWS fields in API responses and
update related tests and release notes.
* fix(claude): preserve tool_result adjacency in native and CC-compatible paths
* feat(providers): add Petals and Nous Research provider support
Register Nous Research as an OpenAI-compatible gateway with remote
model discovery and validation against chat completions.
Add Petals provider metadata, default config, validation, and a
specialized executor that maps OpenAI-style requests to the public
generate endpoint. Also allow optional API keys and configurable base
URLs for Petals in the dashboard and provider schemas.
Expand provider model and catalog tests to cover both integrations.
* fix(resilience): sync queue updates and clear stale discovery caches
Await runtime request queue updates so limiter settings and auto-enabled
API key protections are recomputed when resilience settings change.
Preserve cancelled batch state for in-flight work by marking input files
processed without generating output artifacts, and replace cached synced
models with an empty set when remote discovery returns no models so the
providers route falls back to the local catalog instead of stale cache.
---------
Co-authored-by: congvc <congvc-dev@gmail.com>
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
Register Empower and Poe as managed OpenAI-compatible providers with
static metadata, example models, and remote model catalog support.
Add Poe-specific credential validation against its balance endpoint and
tighten Zed credential imports by skipping unsupported entries and
deduplicating provider-token pairs before saving.
Add Runway as a managed API key provider with a static video model
catalog, dashboard metadata, and provider model route support.
Implement Runway-specific URL normalization, auth headers, credential
validation, and video generation handling for both text-to-video and
image-to-video flows, including task polling and output normalization.
Extend unit coverage for Runway validation, managed catalog exposure,
registry discovery, and end-to-end video handler behavior.
Expand the provider catalog with GitLab Duo PAT and OAuth support,
NLP Cloud, and new OpenAI-compatible gateways including Azure AI
Foundry, Bedrock, DataRobot, watsonx, OCI, SAP, Modal, Reka,
Clarifai, and Chutes.
Add specialized GitLab and NLP Cloud executors, provider-specific
URL normalization and validation flows, managed catalog/model
discovery updates, and dashboard metadata for the new providers.
Extend search support with You.com, including request building,
response normalization, validation coverage, and route/schema
registration.
Add Amazon Q as a Kiro-compatible OAuth provider across execution,
token refresh, usage reporting, dashboard connection flows, and model
catalog exposure.
Add Voyage AI embedding and rerank catalogs plus Jina AI rerank support,
including local model catalog handling, API key validation, provider
metadata, and rerank error reporting updates.
Refresh built-in GitHub Copilot and Kiro model registries to match the
current supported lineup and extend test coverage for the new provider
paths.
Register GLHF, CablyAI, TheB.AI, and FenayAI across the provider
registry, managed provider catalog, and provider metadata so they can be
configured like other API key-backed integrations.
Extend the provider models route to fetch remote model catalogs for these
gateways and add unit coverage for catalog resolution and managed
provider handling. Increase unit test concurrency to keep the expanded
test suite faster to run.
Treat LM Studio, vLLM, Llamafile, Triton, Docker Model Runner,
XInference, and oobabooga as managed local providers with default
base URLs and passthrough model discovery.
Avoid sending empty bearer headers during validation, model discovery,
and execution so self-hosted endpoints work without API keys while
still honoring custom base URLs and localized dashboard hints.
Introduce a custom CLI tools card that generates OpenAI-compatible
env vars and JSON config, and add a cost overview tab with pricing
source visibility.
Add persisted custom eval suites with authenticated CRUD routes and
validation, plus new translator stream transformation tooling and
richer live monitor routing details.
Improve localization coverage across dashboard flows and add unit
tests for custom CLI config, pricing sources, eval suites, and
stream transformation.
Unify audit access under the logs experience and add richer active
request visibility with sanitized client and provider payload previews.
Expose provider warnings from upstream responses in compliance audit
logs, surface learned rate-limit header data in health monitoring, and
add MCP cache stats and cache flush tools with test coverage.
Also add local provider catalog support for SD WebUI and ComfyUI,
include video generation in endpoint docs and UI, add eval run storage
migrations, and refresh docs and translations to match the expanded
feature set.
* feat(vision-bridge): add automatic image description fallback for non-vision models
Implements VisionBridgeGuardrail (priority 5) that intercepts image-bearing
requests to non-vision models, extracts descriptions via a configurable
vision model (default: gpt-4o-mini), and replaces images with text before
forwarding. Fails open on any error.
- Add VisionBridgeGuardrail class extending BaseGuardrail
- Add visionBridgeHelpers: extractImageParts, callVisionModel, replaceImageParts, resolveImageAsDataUri
- Add visionBridgeDefaults with configurable settings
- Register VisionBridgeGuardrail in GuardrailRegistry at priority 5
- Add 51 unit tests covering all spec scenarios (VB-S01 through VB-S10)
- Dependency injection for getSettings and callVisionModel (testable without SQLite)
Closesdiegosouzapw/OmniRoute#1424
* fix(vision-bridge): resolve Anthropic API, parallel processing, provider keys, structuredClone
Register LM Studio as an OpenAI-compatible local provider and map the
new grok-4.3 thinking model for web executor requests.
This update also hardens related platform behavior by switching backup
archive creation to execFileSync, validating ACP agent ids, expanding
shared CORS handling, and making prompt injection guard failures return
an explicit 500 response.
To preserve existing stored credentials, encryption now derives new
keys from a secret-based salt while still falling back to the legacy
static-salt key during decryption.
* test: resolve typescript strictness complaints in unit tests
* Update Claude Code obfuscation to version 2.1.114 (#1403)
* fix(cloud-code): scope thinking stripping to executor boundaries (#1401)
* fix(cloud-code): scope thinking stripping to executors
* fix(cloud-code): guard antigravity normalized body
* Update Claude Code obfuscation to version 2.1.114
- Update Claude Code version from 2.1.87 to 2.1.114
- Update X-Stainless-Package-Version from 0.80.0 to 0.81.0
- Add new beta flags: redact-thinking-2026-02-12, advisor-tool-2026-03-01, advanced-tool-use-2025-11-20
- Add missing headers: anthropic-version, anthropic-dangerous-direct-browser-access, x-app, X-Stainless-Timeout
- Add all X-Stainless-* headers (Arch, Lang, OS, Runtime, Runtime-Version, Retry-Count)
- Fix accept-encoding header: identity -> gzip, deflate, br, zstd
- Add connection: keep-alive header
- Update tool name mapping: add lsp, apply_patch, websearch
These changes ensure that requests from OpenCode through Omniroute are indistinguishable from genuine Claude Code 2.1.114 requests, allowing proper authentication with Anthropic's API without triggering extra credits errors.
* fix: resolve CodeQL password hash alert and TruffleHog CI failure
---------
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com>
Co-authored-by: Nikolay Popov <ekklesio.dev@gmail.com>
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
* fix(claude-code): scope obfuscation to cli clients and fix tests
* docs(workflows): enforce PR merge instead of manual close
* docs(changelog): update 3.6.9 notes with missing PR 1403 and fixes
* docs(workflows): update generate-release to use full changelog for PR body
* fix(tsc): silence baseUrl deprecation warnings for TS 5.5+
* fix(chatcore): apply proactive compression before provider translation (#1406)
Integrated into release/v3.6.9
* docs(changelog): add PR 1406
* Makes text visible in dark-mode (#1409)
Integrated into release/v3.6.9
* docs(changelog): add PR 1409
* chore: save local work
* chore(release): sync version references to 3.6.9
* fix(codex): prevent proactive token refresh consumption and strip background parameter
* ci: shard long-running suites and relax timeouts
* ci: allow manual CI dispatch for release branches
* feat(skills): provider-aware marketplace UX, scored AUTO injection, and memory pipeline hardening (#1411)
* fix/400 for GeminiCLI(add "ref" in GEMINI_UNSUPPORTED_SCHEMA_KEYS)
* feat(cc-compatible): align request shape with Claude CLI
* fix(cc-compatible): add Claude CLI system skeleton for OpenAI input
* preserve reasoning when translating chat to responses (#1414)
Integrated into release/v3.6.9
* fix(skills): optimize AUTO scoring and include Responses input context (#1418)
Integrated into release/v3.6.9
* chore: fix TS errors and update review-prs workflow
* fix(api): stop sending unsupported Gemini and Codex parameters
Prevent Gemini request translation from injecting default
thoughtSignature values that the upstream API strictly validates and
rejects. Only preserve real signatures resolved from prior upstream
responses, and strip additionalProperties from Gemini function schemas
to avoid 400 "Unknown name" errors.
Also remove fallback-injected session_id and conversation_id fields
before sending Codex requests, and restore compatibility with the
legacy OUTBOUND_SSRF_GUARD_ENABLED flag when determining whether
private provider URLs are allowed.
Updates the Gemini translator and regression tests for issue #1410
and related 400 error cases.
* fix(core): stabilization fixes for token refresh, usage translation, and testing
- Update Codex token refresh detection logic
- Mark provider connections invalid on unrecoverable refresh error
- Fix Claude usage translation under-reporting cached tokens
- Update test expectations
- Update CHANGELOG.md for v3.6.9
* fix(auth): reload fresh token state and unify expiry persistence
Refresh checks now re-read the latest stored provider connection before
attempting rotation so they do not use stale refresh tokens captured by
an earlier sweep.
Token updates also persist both expiresAt and tokenExpiresAt across the
health check, usage-limit refresh path, and SSE refresh flow. This keeps
known token expiry metadata in sync and avoids interval-based refreshes
for connections whose tokens are still valid well into the future.
* fix: resolve SSRF environment static evaluation bug (#1427)
Fix import aliases and strict TS typings for tests and ACP agents.
* test: resolve remaining strict type errors in test files
* test: fix provider service assertion for anthropic-compatible header
* fix(codex): respect openaiStoreEnabled setting during native passthrough (#1432)
* fix(codex): fix token refresh unrecoverable detection for expired tokens
* fix(ci): restore release v3.6.9 build and flaky tests
* fix(cc-compatible): trim default OpenAI system skeleton (#1433)
Integrated into release/v3.6.9
* fix: prevent masked API keys from being written to CLI tool configs (#1435)
* feat: mark Qwen provider as deprecated and add deprecation warning to CLI tool (#1437)
* docs(changelog): comprehensive v3.6.9 update with all 59 commits since v3.6.8
* test(ci): align qwen guide settings assertions
* fix(security): resolve CodeQL alert 163 for incomplete URL sanitization in Qwen CLI settings
---------
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
Co-authored-by: Nikolay Popov <74762779+nikolay-popov-ideogram@users.noreply.github.com>
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Nikolay Popov <ekklesio.dev@gmail.com>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: Tim Massey <tim-massey@users.noreply.github.com>
Co-authored-by: Paijo <oyi77@users.noreply.github.com>
Co-authored-by: dail45 <dail45@yandex.ru>
Co-authored-by: R.D. <rogerproself@gmail.com>
Require dashboard session cookies on protected management APIs and
reject bearer API keys with explicit 403 responses to prevent
privilege escalation across provider, settings, and model alias routes.
Add a dedicated payload rules management surface with dashboard UI,
OpenAPI documentation, route normalization, and tests for hot-reloaded
runtime updates.
Consolidate provider catalog metadata for dashboard pages, add
Perplexity web-cookie provider support, retire the legacy provider
creation page, and improve upstream proxy handling.
Harden startup and runtime behavior by moving cloud sync bootstrap to
server instrumentation, skipping background services during build/test,
making models.dev sync abortable, pruning isolated build artifacts, and
improving DB backup and recovery safeguards.
Introduce a runtime settings layer that hydrates persisted config at startup
and reapplies aliases, payload rules, cache behavior, CLI compatibility,
usage tuning, and related switches when settings change or SQLite updates.
Replace the legacy prompt injection middleware path with a guardrail
registry that supports prompt injection detection, PII masking, disabled
guardrail overrides, and post-call response handling across the chat
pipeline.
Add a metadata registry for model catalog and alias resolution so catalog
endpoints return enriched capabilities plus diagnostic headers and typed
alias errors instead of ad hoc responses.
Convert unsupported built-in web_search tools into an OmniRoute fallback
tool, execute them through builtin skills, and preserve Responses API
function call output with sanitized usage fields.
Centralize provider header fingerprints for GitHub, Cursor, Qwen, Qoder,
Kiro, and Antigravity, and migrate management passwords from env or
plaintext storage into persisted bcrypt hashes during startup and login.
Introduce runtime-configurable payload mutation/filter rules with file
reload support and a settings API so upstream request bodies can be
customized per model and protocol without restarts.
Expand search support with Google PSE, Linkup, SearchAPI, and SearXNG,
including validation, routing, analytics costing, MCP schema updates,
and search-type-aware provider selection. Update Pollinations to support
anonymous access, endpoint failover, and the latest public model lineup.
Add OmniRoute response metadata headers/SSE comments, per-connection
model exclusion rules, combo tag-based routing, buffered spend writes,
and scheduled daily/weekly/monthly budget resets. Update model catalog
and dashboard UIs to surface source labels and hide models excluded by
all active connections.
Expose client-visible Antigravity preview model aliases while resolving
them back to upstream IDs for execution and provider discovery. Refresh
the Antigravity user agent from cached latest release metadata so model
discovery and requests track current CLI versions more reliably.
Add configurable Gemini thought signature cache modes in settings to
allow validated client-provided signatures in bypass flows while
preserving the existing stored-signature behavior by default.
Also centralize Anthropics header/version constants, enrich image model
catalog metadata with input and output modalities, add dashboard image
input support for advanced image providers, and exclude task docs from
Next standalone tracing to keep isolated builds stable.
Add Fal.ai, Stability AI, Black Forest Labs, Recraft, and Topaz
image provider metadata and expose their static model catalogs through the
providers models API.
Unify dashboard image model listings with the runtime image registry to
avoid drift, add image model aliases for FLUX variants, and extend image
generation handling for new provider formats and edit endpoints.
Include tests covering alias resolution and provider-specific image
generation flows.
* fix(streaming): #1211 greedy strip omniModel tags to prevent literal \n\n artifacts
- Changed regex quantifier from ? to * in combo.ts, comboAgentMiddleware.ts,
and contextHandoff.ts to greedily strip all JSON-escaped newline sequences
surrounding <omniModel> tags in SSE streaming chunks
- Added \r to the character class for cross-platform robustness
- Fixed Playwright strict-mode violation in combo-unification.spec.ts
- Bumped OpenAPI version and CHANGELOG to 3.6.6
* fix: 3 bugs found during issue triage (#1175, #1187/#1218, #1202)
- fix(gemini): strip VS Code JSON Schema extensions from tool schemas (#1175)
Add enumDescriptions, markdownDescription, markdownEnumDescriptions,
enumItemLabels and tags to UNSUPPORTED_SCHEMA_CONSTRAINTS so the Gemini
sanitizer removes them before forwarding. GitHub Copilot injects these
non-standard fields into tool definitions, causing Gemini to reject with
'Unknown name enumDescriptions at functionDeclarations[n].parameters'.
- fix(health-check): unwrap proxy config object before passing to getAccessToken (#1187#1218)
resolveProxyForConnection() returns { proxy, level, levelId } but the health
check loop was passing the full wrapper to getAccessToken(), which expects the
inner config object (.host, .port etc). The proxy dispatcher validated .host
on the wrapper (undefined) and threw 'Context proxy host is required', silently
marking every connection as unhealthy every sweep. Fix mirrors the pattern
already used in chatHelpers.ts: proxyResult?.proxy || null.
- fix(ui): debounce models.dev sync interval slider to save only on release (#1202)
The slider's onChange fired updateInterval() on every drag tick, sending a
PATCH per pixel of movement. Rapid API responses overwrote UI state mid-drag.
Introduce draftIntervalHours for smooth visual feedback; the PATCH fires
on onMouseUp / onBlur once the user releases the control.
* fix(providers): update Xiaomi MiMo token-plan endpoints (#1238)
Integrated into release/v3.6.6
* fix(cc-compatible): trim beta flags and preserve cache passthrough (#1230)
Integrated into release/v3.6.6
* feat(memory+skills): full-featured memory & skills systems with tests (#1228)
Integrated into release/v3.6.6
* fix: forward client x-initiator header to GitHub Copilot upstream (#1227)
Integrated into release/v3.6.6
* feat(bailian-quota): add Alibaba Coding Plan quota monitoring (#1235)
* fix: resolve v3.6.6 backlog bugs (#1206, #1211, #1220, #1231)
- fix(core): #1206 inject startup guard against app/ and src/app/ conflict
- fix(health): #1220 add HEALTHCHECK_STAGGER_MS to prevent token refresh bursting
- fix(proxy): #1231 prioritize HTTP 429 over quota body heuristics
- fix(sse): #1211 strip leading double-newlines in responses API stream
* fix(tests): resolve memory migration and skills route pagination bugs from PR overlaps
* docs: Update CHANGELOG.md with v3.6.6 features (#1182, #1165, #1177)
* chore(release): bump version to 3.6.6
Update package versions for the electron app and open-sse package.
Sync llm.txt metadata and feature headings with the 3.6.6 release.
* feat(core): harden outbound provider calls and add cooldown retries
Add guarded outbound fetch helpers with private/local URL blocking,
controlled retries, timeout normalization, and route-level status
propagation for provider validation and model discovery.
Introduce cooldown-aware chat retries with configurable
requestRetry and maxRetryIntervalSec settings, model-scoped cooldown
responses, and improved rate-limit learning from headers and error
bodies so short upstream lockouts can recover automatically.
Also align Antigravity and Codex header handling, require API keys
for Pollinations, validate web runtime env at startup, restore
sanitized Gemini tool names in translated responses, and inject a
synthetic Claude text block when upstream SSE completes empty.
* feat(models): add glmt preset and hybrid token counting
Introduce GLM Thinking as a first-class provider preset with shared GLM
model metadata, pricing, usage sync, dashboard support, and provider
request defaults for higher token budgets and longer timeouts.
Use provider-side /messages/count_tokens when a Claude-compatible
upstream supports it, while preserving estimated fallback behavior for
missing models, missing credentials, and upstream failures.
Also add startup seeding for default model aliases and normalize common
cross-proxy model dialects so canonical slashful model ids do not get
misrouted during resolution.
* feat(api): add sync tokens and v1 websocket bridge
Add dedicated sync token storage, issuance, revocation, and bundle
download routes backed by stable config bundle versioning and ETag
support.
Expose the v1 websocket handshake route and custom Next server bridge so
OpenAI-compatible websocket traffic can be upgraded and proxied through
the dashboard and API bridge.
Expand compliance auditing with structured metadata, pagination, request
context, auth and provider credential events, and SSRF-blocked
validation logging.
* docs: Update all documentation for v3.6.6
- CHANGELOG: Add WebSocket bridge, GLM Thinking preset, safe outbound
fetch/SSRF guard, cooldown-aware retries, compliance audit v2, model
alias seeding, and all Internal Improvements for the 3 new commits
- README: Expand v3.6.x highlights table with 10 new features; add
SafeOutboundFetch, CooldownAwareRetry, SSRF guard, TPS metric, sync
tokens, WebSocket bridge to Resilience/Observability/Deployment tables
- ARCHITECTURE: Bump date; add new modules to executive summary, API
routes, SSE core services, Auth/Security section; add SSRF/Outbound
guard failure mode (section 6); expand module mapping
- ENVIRONMENT: Add OMNIROUTE_CRYPT_KEY/OMNIROUTE_API_KEY_BASE64 legacy
aliases, OUTBOUND_SSRF_GUARD_ENABLED, CODEX_CLIENT_VERSION, and
REQUEST_RETRY/MAX_RETRY_INTERVAL_SEC cooldown retry settings
- FEATURES: Add 6 new feature sections — V1 WebSocket Bridge, Sync
Tokens & Config Bundle, GLM Thinking Preset, Safe Outbound Fetch &
SSRF Guard, Cooldown-Aware Retries, Compliance Audit v2
* fix: use api64 for proxy test (#1255)
Integrated into release/v3.6.6 — IPv6 proxy test fix
* fix(page): update custom models section to include all providers #1200 (#1256)
Integrated into release/v3.6.6 — Gemini custom model picker fix
* fix: provide default client_id fallbacks to prevent broken OAuth requests (#1246)
Integrated into release/v3.6.6 — OAuth client_id default fallbacks
* fix: translate max_tokens/max_completion_tokens → max_output_tokens in Chat→Responses translator (#1245)
Integrated into release/v3.6.6 — max_tokens → max_output_tokens Responses API translation + unit tests
* feat(oauth): support cursor-agent CLI as Cursor credential source (#1258)
Integrated into release/v3.6.6 — cursor-agent CLI credential source support
* fix(cc-compatible): restore upstream SSE and correct stream/combo timeout behavior (#1257)
Integrated into release/v3.6.6 — CC-compatible upstream SSE restore + stream timeout fix + README table repair
* fix(cli-tools): resolve API key resolution and model mapping bugs in CLI tools (#1263)
Integrated into release/v3.6.6
* feat(cli-tools): add Qwen Code CLI integration (#1266)
Integrated into release/v3.6.6
* fix(i18n): add missing zh-CN translations and fix logger imports (#1269)
Integrated into release/v3.6.6
* fix(i18n): add Chinese i18n support to dashboard components (#1274)
Integrated into release/v3.6.6
* feat: update Pollinations to require API key, remove free tier flag (#1177)
* feat: friendly error messages for crypto/encryption failures (#1165)
* feat: add TPS (tokens per second) metric column to request logs (#1182)
* feat: merge custom/imported models into filter list for all providers (#1191)
* feat(fallback): Fix provider-profile-driven lockouts (#1267)
This integrates rdself's unify-provider-profile-locks PR manually to handle structural conflicts.
* fix(claude): proper Anthropic SDK integration (#1271)
* fix(healthcheck): use correct proxy wrapper format for getAccessToken (#1272)
* chore(release): v3.6.6 — skills registry stability fix + final integration
* fix(auth): harden bootstrap auth and memory dashboard behavior
Restrict unauthenticated writes to /api/settings/require-login to
the initial bootstrap window while keeping read-only checks public.
This prevents post-setup config changes without blocking first-run
login setup, and the onboarding flow now logs in immediately after
setting the password.
Restore memory API filtering and pagination behavior by supporting q
searches, honoring offset-based requests, and avoiding unrelated
fallback results when FTS misses. Update dashboard stats fallback to
use the response totals consistently.
Package the MCP server with explicit file entries and add regression
tests for bootstrap auth and memory route behavior
* fix(codex): remove max_output_tokens from body for compatibility
* chore(release): v3.6.6 — include PR 1274 fixes in changelog
* chore: exclude additional build artifacts and internal directories from npm package distribution
* fix: update Gemini OAuth test to match registry defaults + codex UI improvements
* fix: restore .mjs refs for scripts/ in test imports after ts migration
* fix: restore next.config.mjs ref in dev-origins test
* fix: implement db migration safety checks and codex config format
* fix: disable mass-migration abort during unit tests based on auto-backup flag
* fix: update script regex in auto-update tests to use .mjs
* feat: Add Perplexity Web (Session) provider (#1289)
Integrated into release/v3.6.6
* fix(cli): resolve codex routing config parsing, standardize select model button positioning, and clarify oauth documentation
* docs(changelog): record recent cli, provider, and test updates
Document the latest fixes for Codex routing configuration parsing and
Lobehub provider icon fallback behavior.
Add the note that the remaining JavaScript test files were migrated to
TypeScript ES modules to reflect the completed test stack transition.
* chore(release): merge #1286 minor improvements manually to avoid testing conflict
* chore(test): rename perplexity-web.test.mjs to .ts to maintain 100% TS codebase
* chore(docs): update CHANGELOG.md for perplexity-web provider
* fix(security): resolve CodeQL incomplete URL substring sanitization via URL parsing in test mocks
* fix: integrate compressContext() into chatCore.ts request pipeline
Proactively compress oversized contexts before sending to upstream providers,
preventing context_length_exceeded errors. Compression triggers at 85% of
model's context limit using the existing 3-layer compressContext() function.
- Import compressContext, estimateTokens, getTokenLimit from contextManager
- Add compression check after translation, before executor dispatch
- Estimate tokens and compare against 85% threshold of model's context limit
- Apply 3-layer compression (trim tools, compress thinking, purify history)
- Log compression events with before/after token counts and layers applied
- Audit compression events for observability
- Add unit tests verifying integration behavior
Closes#1290
* fix(tests): align reasoning expectations with GLM thinking structure
* fix: prevent orphaned tool_result messages in purifyHistory()
When purifyHistory() drops oldest messages to fit context window, it can
split tool_use/tool_result pairs — keeping the tool_result but dropping
the tool_use that initiated it. This causes upstream providers to reject
the request with format errors.
Add fixToolPairs() that runs after each purification pass to remove:
- OpenAI format: orphaned role='tool' messages without matching tool_calls ID
- Claude format: orphaned tool_result content blocks without matching tool_use ID
Closes#1291
* fix(tests): supply tool_use in mock so it is not dropped
* chore: convert remaining test to TypeScript
* fix(tests): restore compatibility with compressContext threshold test after tsx migration
* docs: finalize v3.6.6 release documentation
* fix(core): finalize provider removal, type issues, and codex API key config
* fix(dashboard): render Web/Cookie, Search, Audio provider sections and fix TypeScript errors
* fix: increase MCP web_search timeout to 60s (#1278)
* fix: route combo testing properly for embedding models (#1260)
* fix: accumulate excluded accounts in combo fallback loop (#1233)
* fix: strip leading whitespace and newlines from first streaming chunk (#1211)
* docs: clarify VPS and Docker settings for OAuth credentials (#1204)
* fix: return real retry-after for pipeline gates (#1301)
Integrated into release/v3.6.6 — returns real Retry-After values from pipeline gates
* feat: streaming semantic cache, Cursor auto-version detection, and call-log enhancements (#1296)
Integrated into release/v3.6.6 — streaming semantic cache, Cursor auto-version detection, call-log cache_source tracking
* feat(api): support more OpenAI types (image, embeddings, audio-transcriptions, audio-speech) (#1297)
Integrated into release/v3.6.6 — adds embeddings, audio-transcriptions, audio-speech, and images-generations support for custom OpenAI-compatible providers, plus Pollinations image registry
* deps: bump hono from 4.12.12 to 4.12.14 (#1302)
Integrated into release/v3.6.6
* deps: bump hono from 4.12.12 to 4.12.14 (#1306)
Integrated into release/v3.6.6
* chore: stabilization fixes for v3.6.6 (#1298, #1254, #59, CI)
* fix(providers): match correct endpoint for Xiaomi MiMo, strip routing prefix for custom openai endpoints (#1303, #1261)
* feat(storage): add database backup cleanup controls
* chore(release): v3.6.6 — Final Stabilization Push
* Backport call log storage refactor to release/v3.6.6 (#1307)
Integrated into release/v3.6.6
* deps: update dompurify to 3.4.0 to resolve CVE-XYZ (#60)
* test: disable sqlite auto backup in CI to resolve E2E timeout (#24481475058)
* chore(docs): sync CHANGELOG for v3.6.6 with missing features and fixes
* chore(release): prep v3.6.6 infrastructure and type safety fixes
- Migrated legacy .mjs scripts to .ts (bin, prepublish, policies)
- Resolved pre-commit strict lint (t11 budget) errors in combo.ts
- Explicitly typed all TS bindings in pack-artifact policies
- Updated package.json commands to run Node via tsx/esm internally
- Hardened CI/CD with explicit node version 22.22.2 checks
- Completed stage validations for v3.6.6 final release
* chore: fix TS build errors and e2e timeouts in CI
- Migrate nodeRuntimeSupport to TS interfaces avoiding implicit any
- Increase visibility timeouts in skills-marketplace E2E test to 15s to bypass CI flakiness
- Complete migration of .mjs scripts to .ts ensuring type safety
* chore(release): sync package version 3.6.6 across workspaces
* test(e2e): universally increase UI component visibility timeouts from 5s to 15s to bypass CI starvation
* chore(build): inject baseUrl, paths, and types:node into MITM tsconfig within prepublish hook to fix missing types in CI check
---------
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
Co-authored-by: Jack <5443152+hijak@users.noreply.github.com>
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: Samuel Cedric <ceds.sam@gmail.com>
Co-authored-by: Max Garmash <max@37bytes.com>
Co-authored-by: Markus Hartung <mail@hartmark.se>
Co-authored-by: Gi99lin <74502520+Gi99lin@users.noreply.github.com>
Co-authored-by: Payne <baboialex95@gmail.com>
Co-authored-by: Benson K B <bensonkbmca@gmail.com>
Co-authored-by: clousky2020 <33016567+clousky2020@users.noreply.github.com>
Co-authored-by: Ravi Tharuma <25951435+RaviTharuma@users.noreply.github.com>
Co-authored-by: oyi77 <oyi77@users.noreply.github.com>
Co-authored-by: Hdsje <vovan877@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: xiaoge1688 <moyekongling@gmail.com>
Adds a new provider that routes through Grok's internal NDJSON API using
an X/Grok subscription SSO cookie, enabling access to Grok 3, 4, 4.1,
4.2/4.20, and 4 Heavy via grok.com without xAI API costs.
- GrokWebExecutor with full NDJSON→OpenAI translation
- 12 models incl. grok-4.2 (4.20 beta), grok-4-heavy (SuperGrok)
- Dynamic x-statsig-id generation (base64 fake TypeError)
- W3C traceparent headers for Cloudflare compatibility
- Thinking/reasoning mode for mini/thinking/expert/heavy variants
- SSO cookie auth with auto-strip of 'sso=' prefix
- Fetch timeout + upstreamExtraHeaders (BaseExecutor parity)
- 16 unit tests, all passing
Derived from: GrokProxy, GrokBridge, grok-web-api, grok2api-merged,
Grok API Research Report
Add automated SQLite health diagnostics with optional auto-repair,
startup and scheduled execution, authenticated API routes, an MCP tool,
and dashboard visibility for status and repair actions.
Improve provider compatibility by adding Cursor usage fetching and
v3.1.0 parity headers, introducing a per-connection Codex Responses
store opt-in with session fallback, fixing Codex non-stream combo and
SSE translation behavior, sanitizing Gemini googleSearch tool payloads
and Qwen thinking tool_choice handling, and hardening cleanup and call
log storage paths.
- Add emailPrivacyStore (Zustand + persist) for global toggle state
- Add EmailPrivacyToggle component with eye open/closed icons
- Add pickDisplayValue() visibility-aware masking function
- Integrate toggle into provider detail, usage limits & playground pages
- Per-modal showEmail now uses global store (synced across all pages)
- Default: emails hidden; toggle persists across page reloads
- Add showEmails/hideEmails i18n keys
- Update CHANGELOG.md and openapi.yaml to v3.6.2
Fixes critical Anthropic streaming input token undercount + adds detailed token tracking with DB migration 018. Includes 18 new unit tests. Integrated into release/v3.5.4.
* feat(qoder): native cosy integration
* feat(qoder): implement native COSY encryption algorithm and remove CLI child instances, plus workflow bumps
* feat(resilience): context overflow fallback, OAuth token detection, empty content guard & context-optimized combo strategy
- Add isContextOverflowError + isContextOverflow detectors (400 + token-limit signals)
- Auto-fallback to next family model on context overflow in chatCore
- Add isEmptyContentResponse to catch fake-success empty responses, trigger fallback + recursive retry
- Add OAUTH_INVALID_TOKEN error type (T11) with isOAuthInvalidToken signal matching; warn instead of deactivating node
- Add getModelContextLimit helper in modelsDevSync (reads limit_context from synced capabilities)
- Upgrade getTokenLimit in contextManager to check models.dev DB before registry (fixes gemini-2.5-pro: 1000000→1048576)
- Add findLargerContextModel in modelFamilyFallback for context-aware model selection
- Add sortModelsByContextSize + context-optimized combo strategy in combo.ts
- Update context-manager unit test for corrected gemini-2.5-pro limit
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(review): address Gemini code review — tool_calls path, infinite recursion, dedup signals, findLargerContextModel
- Fix isEmptyContentResponse: check message.tool_calls/delta.tool_calls instead
of firstChoice.tool_calls (wrong OpenAI API path, caused tool-call responses
to be falsely flagged as empty)
- Fix empty content fallback: replace recursive handleChatCore call (infinite
recursion risk + wrong model due to original body.model) with non-recursive
pattern — call executeProviderRequest, parse fallback response body, reassign
responseBody and fall through to existing processing
- Fix context overflow: use findLargerContextModel over family candidates first,
fall back to getNextFamilyFallback — ensures we pick a model with actually
larger context window on overflow
- Fix signal dedup: export CONTEXT_OVERFLOW_SIGNALS + CONTEXT_OVERFLOW_REGEX
from errorClassifier.ts; import shared regex in modelFamilyFallback.ts,
removing duplicate signal list and per-call RegExp construction
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(UI): add context-optimized strategy to frontend schema and options
* fix(sse): preserve Responses API events in stream translation
When translating Claude-format responses (e.g. GLM) to Responses API
format for Codex CLI, the sanitizer stripped {event, data} structured
items to {"object":"chat.completion.chunk"}, losing all content and
the critical response.completed event.
Only run sanitizeStreamingChunk on OpenAI Chat Completions chunks,
skipping items that have the Responses API {event, data} structure.
* test(sse): add regression test for Claude→Responses stream sanitization
Verifies that {event,data} structured items from the Responses API
translator bypass sanitizeStreamingChunk when translating Claude-format
providers (e.g. GLM) to Responses API format for Codex CLI.
* fix(sse): strengthen Responses API event detection with response. prefix check
Use explicit `response.` prefix check instead of generic `event && data`
presence check, as recommended in PR review.
* fix: pin Next.js to 16.0.10 to prevent Turbopack hashed module bug
Remove ^ prefix from next and eslint-config-next to prevent
automatic upgrades to 16.1.x+ which introduced content-based
hashing for external module references in Turbopack.
Also remove duplicate Material Symbols @import from globals.css
(font already loaded via <link> in layout.tsx).
Fixes#509
* align cc-compatible cache handling with client passthrough
* chore: integrate resilience and turbopack fixes (PRs #992, #990, #987)
* chore(release): bump to v3.5.2 — changelog, docs, version sync
* docs(i18n): sync documentation updates to 33 languages
* fix(qoder): replace any with unknown to comply with strict any-budget
---------
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
Co-authored-by: oyi77 <oyi77@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Chris Staley <christopher-s@users.noreply.github.com>
Co-authored-by: Ivan <shanin-i2011@yandex.ru>
Co-authored-by: R.D. <rogerproself@gmail.com>
Add 9 new API-key providers for image, video, and media generation:
- Replicate (rep/) — ML model marketplace with passthrough models
- fal.ai (fal/) — fast inference for generative media
- Novita AI (novita/) — image/video generation platform
- Segmind (seg/) — image generation models
- Runware (rw/) — real-time image generation
- WaveSpeed AI (ws/) — fast media generation
- PiAPI (pi/) — multi-model API gateway
- GoAPI (ggo/) — aggregated AI API access
- LaoZhang AI (lz/) — multi-provider proxy
These providers support image/video/audio endpoints natively via
OpenAI-compatible format, solving the gap where only chat-focused
providers were registered.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
- Add "memory" and "skills" entries to HIDEABLE_SIDEBAR_ITEM_IDS and PRIMARY_SIDEBAR_ITEMS
- Add sidebar translation keys for memory and skills pages
- Add complete "memory" and "skills" i18n sections to en.json with all UI labels
- Replace all hardcoded English text in memory/page.tsx with useTranslations() calls
Memory and Skills pages now appear in the sidebar and render with proper i18n support.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Part 1 of CLIProxyAPI integration (#902).
- DB migration for version_manager + upstream_proxy_config tables
- DB modules: versionManager.ts (tool lifecycle CRUD), upstreamProxy.ts (proxy config CRUD + SSRF guard)
- localDb.ts re-exports for new modules
- Provider registration: UPSTREAM_PROXY_PROVIDERS in providers.ts
- Zod validation schemas for version-manager API routes
- Settings UI: CliproxyapiSettingsTab (Advanced tab)
- 47 unit tests for DB modules
