`validateResponseQuality()` only inspected a response's top-level `error`
field when `choices` was also missing/empty (the narrower #3424 case), so a
masked HTTP 200 that echoed a non-empty stub `choices` alongside a structured
error object — or a known exhaustion phrase like "insufficient credits" /
"quota exceeded" in the error envelope — slipped through as valid, and a
`priority` combo kept hammering the exhausted target instead of failing
over.
The check now inspects the error envelope (top-level `error` object, or a
bounded exhaustion-phrase match against error.message/code/type and
top-level message/detail) unconditionally, before any shape-specific
branch — never against `choices[].message.content`, so legitimate
completions that merely mention "quota" in prose are not misclassified.
Regression guard: tests/unit/masked-200-exhaustion-fallback-6427.test.ts
The fusion quorum-clamp/failure-detail root cause reported in #6454 was
already fixed and merged via #6521 (open-sse/services/fusion.ts already
carries Math.max(1, cfg.minPanel) + per-member failure reasons on this
branch). That merge never landed a CHANGELOG bullet for #6454 itself.
Backfills the missing bullet and adds a regression test at the exact
repro scale (11-member fusion-free-style panel, 2 cooling / 9 healthy)
to lock in that a cooling minority no longer sinks a healthy majority,
while a genuinely all-failed panel still returns the documented 503.
appendToolCallArgumentDelta() treated any non-string incoming fragment as
empty, silently dropping tool-call arguments delivered as an already-parsed
JSON object/array (a non-conformant shape some upstreams emit for
tool_calls[].function.arguments) instead of JSON-encoding them. This left
tool_use.input empty on the /anthropic streaming path and opened the door to
downstream [object Object] string coercion once buffers were concatenated.
Now JSON.stringify()s the non-string fragment instead of discarding it.
The fusion single-survivor degrade path (added for #6454) returned the
lone panel answer directly whenever only one panelist succeeded, ignoring
an explicitly configured judgeModel. With default minPanel=2 and a 2-model
panel, any single flaky panelist forced this path every request, so the
configured judge never ran and the response .model reflected a panel member.
The judge is now still invoked to synthesize a lone surviving answer when
judgeModel is explicitly configured; the direct-answer shortcut is kept only
for the implicit case (no judgeModel, judge defaults to panel[0]).
playground-api-tab.test.tsx's SSE test always took the disabled-button branch
(the fetch mock returned an empty model list) and asserted a tautology instead
of exercising the SSE path it claims to verify. The test now selects a real
model to enable Send, asserts it is actually enabled, and asserts the streamed
SSE content reached the response editor.
check-test-masking.mjs's tautology subcheck only compares base-vs-HEAD counts
within a PR's own diff and no-ops entirely outside PR context (no
GITHUB_BASE_SHA/REF) -- so a tautology merged once, or checked with a bare
local run, stayed invisible forever after. Added an always-on absolute-floor
scan (scanBareTautologies/countBareTautologies) over every tracked test file,
scoped to the bare expect(true).toBe(true)/assert.equal(1,1) patterns that
have zero legitimate uses in this codebase -- deliberately excluding
assert.ok(true), which has ~15 pre-existing verified-legitimate
try/catch-fallback uses and stays on the lenient diff-only path.
orderTargetsByHeadroom already loaded the per-connection DB snapshot (with
decrypted credentials) via expandTargetsByQuotaAwareConnections, but discarded
it before calling getSaturation. For Codex, fetchCodexSaturation forwards
straight to fetchCodexQuota(connectionId, connection), which needs the
connection object (or a prior registerCodexConnection() call that never
happens before headroom ranking runs) to read accessToken. Without it,
fetchCodexQuota returned null for every candidate, saturation failed open to
0 across the board, and headroom ranking fell back to the original combo
order regardless of actual free quota.
getSaturation() and the headroom SaturationFetcher seam now accept and thread
the loaded connection snapshot through to fetchCodexQuota.
Regression guard: tests/unit/headroom-codex-quota-snapshot-6379.test.ts
(seeds two real Codex connections in a throwaway SQLite DB with a fake
upstream fetch, confirms RED on unfixed code, GREEN after the fix).
fix(api): return 415 on /v1/messages for non-JSON Content-Type via requireJsonContentType middleware (#6414) Integrated into release/v3.8.47. (thanks @chirag127)
* fix(api): exempt test-model requests from Output Styles injection (#6240)
Root cause: handleChatCore's Phase 4A Output Styles injection (chatCore.ts)
was gated only by the operator's global compression.enabled switch,
independent of the per-request x-omniroute-compression header. The
dashboard 'Test model' action (modelTestRunner.ts) never sent that header,
so a globally-enabled Output Style (e.g. 'Ultra terse') always leaked its
system-prompt injection into a plain connection test.
Fix: skip Output Styles injection when the request explicitly opts out via
x-omniroute-compression: off, and always send that header from
buildInternalChatRequest / buildInternalRerankRequest.
Regression guard: tests/integration/test-model-compression-off-6240.test.ts,
tests/unit/model-test-runner-compression-off-6240.test.ts
* chore: sync CHANGELOG to release tip (#6511; bullet re-added at merge)
Post-release closing fixes: crypto.randomInt for proxy-pool random rotation (silences CodeQL js/insecure-randomness #698/#699) + date the [3.8.46] CHANGELOG section. See PR #6580.
* feat(quality): validate-release-green --full-ci reproduces the ci.yml static gate set
The curated HARD/DRIFT lists in validate-release-green were a hand-maintained
subset — v3.8.46 leaked 11 static base-reds (route-validation:t06, docs-symbols,
bundle-size --ratchet, test-masking, file-size, …) to the release PR because they
live only in the ci.yml gate jobs, costing ~2h of layered CI. --full-ci reads
ci.yml itself and runs every npm run check:* / lint from the lint / quality-gate /
quality-extended / docs-sync-strict / pr-test-policy jobs (-- ratchet flags
preserved; test-masking against GITHUB_BASE_REF=main; skips pr-evidence +
codeql-ratchet which can't run in a local working-tree pre-flight). Reading from
ci.yml keeps the set current as gates are added. Also wired into
nightly-release-green so a static base-red opens a tracking issue the night it
lands. Regression guard: +5 extractCiGates cases (18/18 pass).
* chore(quality): add 3 covering tests to stryker tap.testFiles (pre-existing drift on release/v3.8.47)
check:mutation-test-coverage (fast-gates) flagged 3 unit tests that cover mutated
modules but were missing from stryker.conf.json tap.testFiles — pre-existing drift
on release/v3.8.47, surfaced by this PR's CI. Adds codex-quota-selection-hydration
(auth.ts), combo-roundrobin-compat-fallback-6238 (circuitBreaker.ts), and
combo-rr-fallback-advance-948 (rrState.ts) so their mutant kills count.
Parallel-cycle model (2026-07-04): cut from the frozen release/v3.8.46 tip at the
v3.8.46 release freeze so development continues immediately on v3.8.47 while the
captain closes v3.8.46. Bumps package.json x3 + openapi + lockfile to 3.8.47, adds
the '## [3.8.47] — TBD' living CHANGELOG section, and syncs the 42 i18n mirrors.
Closing v3.8.46 fixes reach this branch via the Phase 5 sync-back.
- Type 12 no-explicit-any errors in 3 new test files (real types, no masking):
chat-early-schema-validation-6412, models-catalog-envkey-6406, zed-provider.
- Suppress MitmProxyTab.tsx no-html-link-for-pages (false positive: the link is
an /api/settings/mitm cert download, an API route not a Next page).
- Allowlist tests/integration/v1-contracts-behavior.test.ts net -2 asserts: #6303
moved embedding/image shape coverage to models-catalog-route + specialty tests.
- Rebaseline cycle drift measured on the release tip (captain fixes are net-zero,
verified): cognitive 877->882, cyclomatic 2035->2050, file-size proxies/chat/
ApiManagerPageClient/ProxyRegistryManager + models-catalog-route testcap +5.
- Fix stale CLAUDE.md: no-explicit-any is error (not warn) in tests/ since #6218.
randomNumericId builds a non-secret synthetic device/web id. The v3.8.45 switch
to crypto.getRandomValues closed js/insecure-randomness but 'cryptoByte % 10' is
biased (256 is not a multiple of 10), tripping js/biased-cryptographic-random.
Draw each digit by rejection sampling — discard bytes in the biased tail so the
remaining range divides evenly — giving a uniform distribution (verified) while
staying crypto-backed.
#6366 switched the output base from path.resolve to path.join(process.cwd(),
outputDir) to keep Turbopack's static analyzer from tracing the project root.
path.join mangles an absolute outputDir (a tmp dir in the generator tests) into
cwd/tmp/…, so apply mode reported success while writing nothing at the expected
path. Guard with path.isAbsolute — absolute paths pass through, the relative
production case ('skills') keeps the Turbopack-friendly join form. The existing
agentSkills-generator suite is the regression guard (now 21/21).
