Comment out the npm availability guard and unit test execution in the
pre-push hook so pushes are no longer blocked by local hook checks. This
shifts validation away from developer machines and avoids failures in
environments where npm is unavailable or hooks are undesired.
Hide admin password entry during setup, make doctor degrade to warnings
when source-only runtime checks are unavailable, and improve stop
behavior by attempting graceful shutdown before force killing ports.
Also use SQLite's backup API for safer snapshots under WAL, align CLI
key writes with the current provider_connections schema, and include
follow-on compatibility fixes for GLM provider detection, stream error
sanitization, and auth-aware test coverage.
Addresses code review feedback from PR #2152: use a proper
CustomModelEntry interface instead of Record<string, unknown>
bracket-access for custom model fields like inputTokenLimit.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Addresses code review feedback from PR #2136:
- Remove .ts extensions from @omniroute/open-sse imports for better
module resolution
- Replace all as any casts with proper types: ComboModelStep for
combo step iteration, Record<string, unknown> bracket access for
custom model fields, ManagedAvailableModel.contextLength type
for fallback models, and Error instanceof check for catch blocks
- Normalize provider alias resolution in combo context_length
calculation via resolveCanonicalProviderId for consistent
getTokenLimit lookups
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Integrated into release/v3.8.0 — cloud agent provider exports and logger import fixes were already present in the release branch. Thank you for the quick response to the crash report!
Remove upstream provider headers from non-stream chatCore JSON responses to
prevent authorization and API key values from being exposed to clients.
Add coverage to verify sensitive provider request headers are omitted while
OmniRoute metadata headers remain present.
Keep the tool/function-call preservation logic intact while removing noisy implementation comments from the PR diff.
Co-Authored-By: OpenClaude (dmassoneto) <openclaude@gitlawb.com>
Tighten executor, usage, model-resolution, and state-management
code with explicit types and safer record handling to reduce runtime
edge cases across providers.
Also normalize management-token failures to 403 responses, require API
keys consistently on cloud agent task routes with CORS-safe errors,
refresh stale Gemini CLI project IDs, prioritize Gemini search tools
correctly, add new provider/model registry entries, and serialize
integration tests for more reliable CI.
When thinking is enabled on models like Kimi, assistant messages containing
tool_calls must also include reasoning_content. The response sanitizer was
incorrectly stripping reasoning_content whenever visible content existed,
breaking subsequent requests with:
thinking is enabled but reasoning_content is missing in assistant tool
call message
Now reasoning_content is preserved when tool_calls are present, while still
being stripped for plain text responses to avoid client rendering issues.
- Add condition !msgRecord.tool_calls before deleting reasoning_content
- Update existing test to expect preserved reasoning_content with tool_calls
- Add TDD tests covering both preservation and stripping behaviors
- Add translator tests for reasoning_content + tool_calls handling
Co-Authored-By: OpenClaude (dmassoneto) <openclaude@gitlawb.com>
- Update types in several files to reduce usage of `any`
- Fix `fetch` body type error in `AntigravityExecutor` by returning `ReadableStream`
- Add `CLOUD_AGENT_PROVIDERS` constants
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
When the /v1/models catalog builds entries for individual provider
chat models, context_length was previously only set when the
REGISTRY provider entry carried defaultContextLength. For providers
without that field (or when alias resolution fails to map to a
REGISTRY key), models shipped without any context_length, causing
OpenCode and other clients to fall back to a ~4000 token limit.
Now getDefaultContextFallback calls getTokenLimit() as the ultimate
fallback, which resolves through env overrides, models.dev DB,
name heuristics, and hardcoded defaults — always returning a value.
Fixes the same class of bug as 3dc7542e (combo context_length)
but for individual (non-combo) models.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Skip the superseded 041 session_account_affinity migration when
the canonical 050 file is present, and remap legacy migration
markers so upgraded databases do not replay the duplicate slot.
Also include the CLI entrypoints in packaged artifacts and extend
management-auth coverage across admin memory, pricing, routing,
provider validation, and usage endpoints to keep release bundles
runnable and sensitive operations protected.
HIGH — open-sse/services/accountFallback.ts
ProviderProfile type was missing useUpstream429BreakerHints, and the
buildProviderProfile helper was not propagating the stored override.
Result: resolvedProfile.useUpstream429BreakerHints was always undefined,
so the circuit breaker silently ignored every user override and always
fell back to the per-provider default — making the new UI toggle a no-op.
Fix: add the optional field to ProviderProfile, populate it from
resilience.connectionCooldown[category].useUpstream429BreakerHints in
buildProviderProfile, and drop the now-unnecessary type cast at the
configureProviderBreaker call site.
MEDIUM — src/shared/utils/classify429.ts (2 call sites)
classify429FromError was casting response.headers / err.headers directly
to Record<string, string>. That breaks when the upstream uses a native
fetch Headers instance, because Headers does not respond to
Object.entries (used downstream in getHeader). On those errors the
classifier would silently see no headers and never produce a kind.
Fix: add a normalizeHeaders(raw) helper that detects a Headers-like
.entries() method and converts via Object.fromEntries, falling back to
the previous plain-object treatment. Use it at both call sites.
All 39 existing tests still pass.
rdself flagged in #2116 that the per-failure-kind breaker cooldown lacks a
user-controlled switch and should default conservatively for reverse-proxy
/ CLI-backed providers where forwarded 429 metadata is unreliable. This
PR adds the toggle, the per-provider default policy, and surfaces it in
the Resilience settings UI.
Why
---
A provider routed through cliproxyapi / lm-studio / vllm / etc may produce
429 metadata that the upstream layer fabricated. Letting that drive
circuit-breaker cooldown duration is unsafe by default. Direct cloud
providers (openai, anthropic, groq, cerebras, mistral, gemini, etc.) are
the safe ones to trust.
What
----
- New helper src/shared/utils/providerHints.ts:
defaultUseUpstream429BreakerHints(providerId) returns false for the
UPSTREAM_PROXY_PROVIDERS / SELF_HOSTED_CHAT_PROVIDER_IDS / isLocalProvider
/ isClaudeCodeCompatibleProvider sets; true for everything else.
resolveUseUpstream429BreakerHints() picks user override when set,
otherwise the per-provider default.
- Schema: connectionCooldownProfileSchema gains
useUpstream429BreakerHints: z.boolean().nullable().optional().
null is the explicit unset sentinel.
- Settings layer: ConnectionCooldownProfileSettings adds
useUpstream429BreakerHints?: boolean. Normalize preserves undefined
(no toBoolean coercion) and treats null as "delete the key". The
unset state survives all partial-merge round-trips. JSON serialization
omits the key when undefined.
- API route: PATCH /api/resilience detects useUpstream429BreakerHints
transitions (stored override change in either oauth or apikey profile)
and calls resetAllCircuitBreakers() so the registry stops serving
cached options.
- UI: ConnectionCooldownCard renderProfile gains a tri-state \<select\> with
options Default (per provider) / Always on / Always off. Read-only
rendering mirrors. Save handler converts undefined → null before PATCH
so JSON.stringify does not drop the key.
- Three wire-up call sites pass cooldownByKind + classifyError to
getCircuitBreaker only when useHints === true:
* open-sse/services/accountFallback.ts (configureProviderBreaker)
* src/sse/handlers/chat.ts (~L516)
* src/sse/handlers/chatHelpers.ts (~L151)
- classify429.ts gains classify429FromError(err) adapter that maps the
common HTTP-error shapes (axios-style err.response.status, low-level
err.status, message fallback) to FailureKind so callers can use it
directly as the breaker's classifyError option.
Backwards compatibility
-----------------------
Default behaviour is byte-identical when neither schema field nor user
override is touched, since useUpstream429BreakerHints stays undefined and
the helper returns the same per-provider policy that the breaker would
have applied with cooldownByKind unset. Existing code paths that never
construct a breaker with this option see no change.
Tests
-----
39 tests pass across 4 unit suites:
- tests/unit/provider-hints.test.ts (6 tests): per-provider defaults
for cloud / cliproxyapi / self-hosted / claude-code prefix; user
override truth-table in both directions including the v1 regression
test where proxy-with-override-true must resolve to true.
- tests/unit/resilience-settings-upstream429-breaker.test.ts (7 tests):
defaults absent; explicit boolean stored; null sentinel deletes the
key; key absent from JSON after delete; partial-merge omitting key
leaves existing value; toBoolean coercion explicitly avoided;
mixed-provider round-trip preserves disjoint per-profile settings.
- tests/unit/classify429.test.ts (carried from #2116, still passes).
- tests/unit/circuit-breaker-failure-kind.test.ts (carried, still passes).
Iteration history (codex audits)
--------------------------------
This plan went through 5 codex review rounds:
- v1 → 5 concerns (default-vs-gate logic, naming, missed third call
site, accountFallback layer separation, compat surface scope)
- v2 → HIGH: normalization could swallow per-provider default; 4 minor
- v3 → HIGH: binary BooleanField could not represent the unset state
- v4 → HIGH: PATCH partial-merge semantics — omitted key ≠ unset
- v5 → APPROVED with the null sentinel pattern
Audit trail and grep output for getCircuitBreaker call sites are in
the PR description.
Open questions for the maintainer (see PR body)
-----------------------------------------------
1. Hard gate vs default for proxy/CLI providers (v5 ships default-off,
user can override).
2. Cooldown values when toggle on are hardcoded for v1.
3. Reset granularity: resetAllCircuitBreakers() is coarse-grained but
matches existing patterns; per-profile reset is a follow-up.
4. The 3 getCircuitBreaker-with-options call sites duplicate logic —
a separate DRY refactor PR is suggested.
- Fix OAuth expiry handling for ISO strings in virtualFactory.ts
- Move AutoRoutingBanner test from src/ to tests/unit/shared/components/
- Remove mock metrics from analytics endpoint, return only real data
- Fix error handling for bare 'auto' prefix in chat.ts (check isAutoRouting)
- Update vitest.config.ts to include tests/unit/**/*.test.tsx pattern
- Replaced hardcoded LINUX_CA_DIR with dynamic filesystem probing to support Debian, Arch, Fedora, and openSUSE system trust stores.
- Added updateNssDatabases helper to seamlessly inject root certificates directly into browser NSS databases (e.g., ~/.pki/nssdb, ~/.mozilla/firefox).
- Supported standard and snap-based Chrome/Chromium and Firefox installations.
- Made browser cert injection resilient, executing under the current user to prevent file ownership issues, and safely falling back if certutil is absent.
Root cause: v3.7.9 fix for #1966 removed the unconditional CLAUDE_SYSTEM_PROMPT
injection, which also removed the else branch that always set result.system.
When Claude Code sends system prompt as body.system (native Anthropic array)
through /v1/chat/completions, the translator only looked at role='system'
messages in body.messages — body.system was silently dropped.
Fix: The translator now checks for body.system and preserves it:
- If both body.system and role='system' messages exist, they are merged
- If only body.system exists, it passes through as-is
- If only role='system' messages exist, behavior unchanged
- If neither exists, result.system remains undefined (no forced injection)
Also removes the dead CLAUDE_SYSTEM_PROMPT import.
Includes 4 regression tests covering all combinations.
- Add kiro-cli SQLite auto-import for enterprise SSO + headless environments
- Add image support (OpenAI + Anthropic formats → Kiro native)
- Move long tool descriptions to system prompt to prevent 400 errors
- Sync model list with live API: add auto-kiro, claude-sonnet-4, deepseek-3.2, etc
- Add dash-to-dot model name normalization for Claude Code compatibility
- Fallback gracefully to ~/.aws/sso/cache for social auth
Co-authored-by: christlau <christlau@users.noreply.github.com>
- Replace legacy getCursorUsage with dashboard API (cursor.com/api/dashboard/get-current-period-usage)
- Use WorkOS session cookie auth instead of Bearer token
- Surface 3 quota windows: Total, Auto + Composer, API
- Register cursor in USAGE_SUPPORTED_PROVIDERS
- Add fetchUserInfo() to resolve real email on import
- Remove ~170 lines of dead code (old fetcher + helpers)
- Add 6 comprehensive tests with fetch mocking
Co-authored-by: payne0420 <baboialex95@gmail.com>
- Add exact-match guard for /dashboard/onboarding before the broad /dashboard prefix
- Add setup_wizard and client_api_mcp to ClassificationReason union type
- Update test to verify PUBLIC classification
Co-authored-by: HomerOff <homeroff76@gmail.com>
- Add formatCurrencyCost() for adaptive decimal precision on cost cards
- Add codex-auto-review pricing alias to GPT-5.5
- Add getPricingModelCandidates() with Codex effort suffix stripping
- Fix fallback stats to exclude combo-routed requests and use case-insensitive comparison
- Add 3 new unit tests for Codex pricing resolution
Co-authored-by: 05dunski <jan.gaschler@gmail.com>
The export-json API now excludes usage_history, domain_cost_history, and
domain_budgets tables by default. These tables grow indefinitely and inflate
config backups to many MBs. Users can opt-in to including them via
?includeHistory=true query param.
Closes#2125
