Combo dispatch and the combo test button used to crash with
'TypeError: e.startsWith is not a function' when a step's modelStr
failed to resolve (regression after #2338 added per-account LKGP
routing for local/Docker providers). The TypeScript annotation says
the field is always a string, but malformed combo rows leaked through
to the dispatch path.
Two defensive boundary guards:
1. open-sse/services/combo.ts LKGP fallback findIndex — type-check
target.modelStr before calling startsWith.
2. src/app/api/combos/test/route.ts testComboTarget — coerce
target.modelStr at the entry, surface a clean 'Combo step is
missing a model id' error instead of crashing.
Regression test parses the source and asserts no unguarded
target.modelStr.<string-method> usages remain in combo.ts, so a
future refactor that reintroduces the pattern fails loudly.
Two related provider-registry fixes:
#2361: LLM7.io was visible in the dashboard provider catalog (entry in
src/shared/constants/providers.ts) but the executor registry in
open-sse/config/providerRegistry.ts had no llm7 entry. Every connection
test fell through with a credential error because there was no baseUrl
or authType configured. Added the standard OpenAI-compatible v1
endpoint with a small seed model catalogue.
#2360: Cohere was pointed at the native /v2/chat upstream which returns
the proprietary { message: { content: [{type:'text', text:...}] } }
shape. The combo test validator (extractComboTestResponseText) only
reads the OpenAI choices[] envelope, so a successful Cohere call
surfaced as 'Provider returned HTTP 200 but no text content.' Cohere
publishes an OpenAI-compatible compatibility layer at
/compatibility/v1 that returns { choices: [{ message: { content }}] }
so we route there instead of needing a Cohere-specific translator.
Regression test asserts both registry entries match the expected
shape so a future refactor that reverts the URLs fails loudly.
The native claude OAuth path (base.ts:794 applySystemTransformPipeline)
early-exited because DEFAULT_SYSTEM_TRANSFORMS_CONFIG.providers[claude]
was {enabled:false, pipeline:[]}. Result: third-party-agent fingerprints
(github.com/anomalyco/opencode, 'You are OpenCode', 'Here is some useful
information about the environment...') leaked into /v1/messages system
blocks, triggering Anthropic billing-gate:
[400] Third-party apps now draw from extra usage, not plan limits.
Mirror the cc-bridge defaults:
- DEFAULT_PARAGRAPH_REMOVAL_ANCHORS + OPENWEBUI_PARAGRAPH_ANCHORS
- DEFAULT_IDENTITY_PREFIXES + OPENWEBUI_IDENTITY_PREFIXES
- DEFAULT_TEXT_REPLACEMENTS as replace_text ops (allOccurrences:true)
- obfuscate_words
Omit prepend_system_block + inject_billing_header — base.ts:759-784
already handles those on the native claude OAuth path.
UI mirror RoutingTab.tsx and snapshot in system-transforms.test.ts
updated for parity. 56/56 transform-related tests pass.
Verified end-to-end 2026-05-18 after npm run build:cli + restart:
- request v8tq04 -> 200 in 1.84s
- request shape {max_tokens:32000, reasoning_effort:high} -> 200 in 1.99s
- x-omniroute-provider=cc (claude-code OAuth pool, account 62875e01)
- telemetry: [SystemTransforms] claude-native: drop_paragraph_if_contains,
drop_paragraph_if_starts_with, replace_text, replace_text, obfuscate_words
Claude Code Pro/Team users hit a 429 cascade where every Claude account
got marked rate-limited for only a few seconds, retried, hit 429 again,
and the cycle exhausted all accounts until the 5h subscription window
finally reset. Root cause: Anthropic OAuth 429 bodies carry phrases like
'Usage Limit Reached' or 'Claude Pro usage limit reached' that don't
contain the word 'quota'. classifyErrorText fell through to
RATE_LIMIT_EXCEEDED with the OAuth ~5s base cooldown.
Three targeted changes in open-sse/services/accountFallback.ts:
1. classifyErrorText: recognize the Anthropic OAuth phrases ('usage limit
reached', 'claude pro usage limit', 'you've reached your usage limit'
and variants) and return QUOTA_EXHAUSTED.
2. checkFallbackError: new branch that, when the classifier flags
QUOTA_EXHAUSTED for a non-credits/non-daily case, applies a deliberate
1h cooldown (subscription quotas need real time to reset; the existing
COOLDOWN_MS.paymentRequired is only 2 minutes).
3. parseRetryFromErrorText: parse absolute ISO 8601 timestamps in the
body ('Try again at 2026-05-17T10:00:00Z', 'Please wait until ...').
When present, honor the upstream's stated recovery time instead of
the 1h default.
Cross-provider fallback for direct (non-combo) calls remains a separate
feature — operators wanting that should route Claude through a combo
that includes openrouter/claude or another fallback target.
`validateResponseQuality` flagged any response with `content: null` as
empty and triggered a false-positive 502 combo fallback, even when the
upstream returned the entire answer in `reasoning_content`. This
affected every reasoning model that omits `content` by design:
moonshotai/Kimi-K2.5-TEE, zai-org/GLM-5-TEE, zai-org/GLM-4.7-TEE,
DeepSeek-R1 and Qwen-thinking variants via Chutes.ai, Nvidia, and other
OpenAI-compatible gateways.
Treat a non-empty `reasoning_content` (or its legacy `reasoning` alias)
as valid content. Empty/whitespace-only strings still fall through to
the existing empty-content rejection so we don't weaken the guard.
Backward compat verified: regular content-only and tool_calls-only
responses still validate without change.
Resolves conflicts in 9 files to bring 181 commits from release/v3.8.0 into
the dashboard refactor branch ahead of merging back to release.
Layout strategy: our pages overhaul (tabs→pages, restructured sidebar,
removed redundant headers, OpenCode Free no-auth card) is the source of
truth. Release's functional additions are adapted into our layout.
Conflict resolution:
- package.json/package-lock.json: take release's deps (axios bump, CLI v4
deps, tls-client-node/wreq-js move to optionalDependencies); re-add our
@xyflow/react addition; regenerate lockfile.
- src/shared/constants/sidebarVisibility.ts: keep our 9-section restructure
— release's new IDs (limits, media, cli-tools, agents, cloud-agents,
memory, skills, agent-skills, context-*) are all already present in our
groups.
- src/i18n/messages/en.json: auto-merge picked up all release's new keys
(autoCatalog*, quotaCutoffs*, systemTransforms*, schema-coercion, vision);
only naming conflict was OmniSkills/AgentSkills — kept ours (no space).
- src/app/(dashboard)/dashboard/HomePageClient.tsx: kept our Provider
Topology card; ported release's TierCoverageWidget (placed before
topology).
- src/app/(dashboard)/dashboard/settings/page.tsx: kept our redirect to
/settings/general (we moved tabs to separate pages); release's sticky
tab CSS change is moot in our structure.
- src/app/(dashboard)/dashboard/skills/page.tsx: rerere applied — release
hardcoded "OmniSkills" h1 was already removed by our header-cleanup
refactor.
- src/app/(dashboard)/dashboard/agent-skills/page.tsx: both branches
created this file independently with identical data source; kept our
Tailwind-themed 2-column grid (release's version used inline styles).
- src/app/(dashboard)/dashboard/batch/page.tsx: kept our single-tab
structure (FilesListTab moved to /batch/files page); ported release's
onRefresh prop addition.
- src/app/(dashboard)/dashboard/batch/files/page.tsx (not in conflict but
updated): added batches fetch + batches prop to preserve release's
feature of showing related batches in the file detail modal.
Pre-existing typecheck errors in open-sse/services/contextManager.ts
(lines 141, 154, 167) come from release/v3.8.0 and are not introduced by
this merge.
Add two OpenAI-compatible API-key providers via the Gitlawb Opengateway
gateway at opengateway.gitlawb.com:
- gitlawb (alias glb): xiaomi-mimo endpoint with 5 MiMo models
- gitlawb-gmi (alias glb-gmi): gmi-cloud endpoint with 40+ models
including GPT-5.x, Claude 4.x, DeepSeek, Gemini, Qwen, GLM, Kimi
Both providers include CLI-mimicking headers (User-Agent, X-Title,
HTTP-Referer) to avoid upstream rate limiting. GMI Cloud provider
has passthroughModels enabled since model access varies per API key.
Propagate invalid refresh-token errors instead of collapsing them to null
so callers can distinguish expired credentials from transient failures.
Mark affected connections as expired and inactive when refresh fails
with an unrecoverable error, and persist that state during credential
updates. Add tests covering retry bail-out and Claude/Codex refresh
error handling.
Add passthroughModels: true to the opencode registry entry so that unknown
model IDs trigger model lockout instead of connection cooldown. Fix dot color
for FREE_PROVIDERS in the Free Tier section by using toggleAuthType === "free"
to select the green dot instead of the blue oauth dot.
Adds 'opencode' to FREE_PROVIDERS as a no-auth provider using the public
OpenCode endpoint (https://opencode.ai/zen/v1). The existing OpencodeExecutor
already skips the Authorization header when no API key is present. Registry
entry reuses the opencode executor and shares models from the zen/v1 endpoint.
opencode-zen returns Claude-format SSE bodies (type: 'message_start', no
choices array) for qwen3.6-plus and qwen3.6-plus-free even when the request
hits the OpenAI-compatible /chat/completions endpoint. Clients expecting
OpenAI format fail Zod validation with 'expected choices (array), received
undefined'.
Flagging these two models with targetFormat: 'claude' makes the opencode
executor route through /messages and the response is parsed by the Claude
translator. This matches the existing minimax-m2.7/m2.5 pattern in
opencode-zen and is the minimum-risk fix that ships in v3.8.0.
The broader runtime format-detection refactor proposed by @raccoonwannafly
(detect Claude payload on 200 response from OpenAI endpoint) is deferred
to a dedicated PR with end-to-end tests.
Custom embedding models on the DeepInfra provider (e.g.
Qwen/Qwen3-Embedding-8B) were rejected by createEmbeddingResponse with
'Unknown embedding provider: deepinfra. No matching hardcoded or local
provider found.' because the registry only included Nebius/OpenAI/Together/
Fireworks/NVIDIA/Mistral/Voyage/Jina/Gemini. The fallback to
provider_nodes only resolves localhost/172.x dev URLs, so remote DeepInfra
keys had no path to /v1/embeddings.
Adds DeepInfra with 8 popular embedding models (Qwen3-Embedding-8B/4B/0.6B,
BGE Large/Base/M3, E5 Large v2, GTE Large) routed through
https://api.deepinfra.com/v1/openai/embeddings.
Part 1 (incomplete model list import) still needs reproduction details
from the reporter and will be tracked separately.
The OpenAI Responses API path emits 'developer' role messages. The previous
default preserved that role for any targetFormat=openai upstream, which broke
DeepSeek, MiniMax, Mimo, GLM, Fireworks, Together, and most other
OpenAI-compatible gateways with '[400]: unknown variant developer, expected
one of system/user/assistant/tool'.
New default: preserve developer only for the openai-family allowlist
(openai, azure-openai, azure, github, or any id containing 'openai').
Convert developer→system for everyone else when preserveDeveloperRole is
not explicitly set. The dashboard 'Compatibility → preserveOpenAIDeveloperRole
= true' toggle still forces preservation when needed.
- Promote prevHeaders from per-batch local to module-level global with 60s TTL
- Share rate-limit throttle state across sequential batches
- Use 24h time-based retry limit (MAX_RETRY_DURATION_MS) instead of count-only
- Increase baseMs to 5s and maxMs to 1h for batch-appropriate backoff
- Add getCachedHeaders/resetCachedHeaders test helpers
- 7/7 unit tests pass
Authored-by: Markus Hartung <hartmark@users.noreply.github.com>
- DeepSeekWebExecutor with ds_session_id cookie auth
- DeepSeekWebWithAutoRefreshExecutor for session management
- Keccak-based PoW solver (DeepSeekHashV1)
- SSE stream transformation to OpenAI format
- Provider constant and alias (ds-web)
- 23 unit tests + live integration test
Authored-by: Paijo <oyi77@users.noreply.github.com>
`fetch()` always transparently decompresses the upstream body before
exposing it via `.text()` or the stream reader, so forwarding the
upstream `content-encoding` header (e.g. `gzip`) to the downstream
OpenAI/Anthropic-compatible client makes the client attempt to gunzip
plain text and fail with `ZlibError: incorrect header check`.
Similarly, `content-length` becomes stale once we transform the response
body (non-stream path repacks via `new Response()`; stream path
re-streams through our SSE heartbeat / shape transforms), and
`transfer-encoding` is owned by the Node/Next runtime, not us.
This patch adds `open-sse/utils/upstreamResponseHeaders.ts` exporting:
- `stripStaleEncodingHeaders(input: Headers)` — returns a new `Headers`
with content-encoding, content-length, transfer-encoding removed
(case-insensitive, does not mutate input).
- `filterUpstreamResponseHeaderEntries(entries, extraToStrip)` — same
semantics for the entries-array path used by the streaming response
builder, plus user-supplied additional names (case-insensitive).
- `STRIP_UPSTREAM_HEADER_NAMES` — the canonical set, exported for tests.
`open-sse/handlers/chatCore.ts` now uses these helpers in two places:
1. Non-stream path (~L3211): replaces `new Headers(rawResult.response.headers)`
with `stripStaleEncodingHeaders(...)` so the repacked Response below
doesn't claim a stale encoding/length.
2. Stream path (~L4371): replaces an inline IIFE+filter that only
removed `content-type` with `filterUpstreamResponseHeaderEntries(...,
["content-type"])` so the stale encoding/length are also stripped
before we set our own `text/event-stream` content-type.
Both call sites carry a comment explaining the underlying fetch
decompression behavior.
Tests
-----
New `tests/unit/upstream-response-headers-strip.test.ts` adds 10 cases
covering: lowercase strip, mixed-case strip, input non-mutation, empty
input, default-set filter, case-insensitive extraToStrip, empty
extraToStrip preservation, empty entries, mixed-case default names, and
canonical set identity.
Verified locally
----------------
- `npx eslint open-sse/utils/upstreamResponseHeaders.ts open-sse/handlers/chatCore.ts tests/unit/upstream-response-headers-strip.test.ts` — clean.
- `npm run typecheck:core` — clean.
- `node --import tsx/esm --test tests/unit/upstream-response-headers-strip.test.ts tests/unit/upstream-headers-sanitize.test.ts tests/unit/chatcore-sanitization.test.ts tests/unit/chat-route-edge-cases.test.ts tests/unit/chatcore-translation-paths.test.ts tests/unit/chatcore-compression-integration.test.ts` — 95/95 pass.
- Full `npm run test:unit` / `test:coverage` deferred to upstream CI
(122 test files, exceeds local timeout window).
- Force skills: "" and params.stream: true in Command Code wrapper
- Align validation probe payload with upstream-required shape
- Default validation model to deepseek/deepseek-v4-flash
Co-authored-by: ddarkr <ddarkr@users.noreply.github.com>
Remove every reference to the competing open-source project from docs,
comparisons, i18n mirrors, comments, and source files so the branch
history does not expose competitive intelligence.
