Replace import("monaco-editor") with import("monaco-editor/esm/vs/editor/editor.api")
in MonacoEditor.tsx. The root package entry resolves to the minified bundle
(min/vs/editor/editor.main.js) which requires the monaco-editor-webpack-plugin
loader "vs/nls.messages-loader". The ESM API module has no such dependency and
satisfies loader.config({ monaco }) identically.
* refactor(dashboard): sidebar subtitles, providers UX, monaco self-host
Sidebar:
- Add subtitleKey to all ~50 menu items so every entry shows a short
description line (previously only 7 had subtitles).
- Inject 50 new sidebar.*Subtitle keys across all 42 i18n locales
(en/pt-BR translated; remaining locales fall back to English).
- Fix DATA_÷IC glitch: replace invalid Material Symbols icon
"data_compression" with "compress" on analytics-compression.
- Rename "Compression Combos" -> "Engine Combos" to avoid truncation
and disambiguate from the OmniProxy Combos item.
Auto-routing banner:
- Move AutoRoutingBanner from DashboardLayout (rendered on every page)
to /home only, so it no longer follows the user across the dashboard.
Monaco editor:
- Add shared MonacoEditor wrapper that calls loader.config({ monaco })
to load Monaco from the bundled monaco-editor package instead of the
jsdelivr CDN (blocked by CSP script-src 'self'), fixing the
"Monaco initialization: error" runtime error.
- Migrate the 5 direct dynamic imports of @monaco-editor/react to the
wrapper (playground, search-tools, translator).
Providers page UX:
- Replace the static legend + 4-stat divider + duplicate filter chips
with a single row of clickable category pills with embedded counters
(All, Free, OAuth, API Key, IDE, Compatible, Web Cookie, Search,
Audio, Local, Cloud Agent).
- Remove redundant per-section Free only / Configured only toggles and
the Zed Import button from the OAuth section header.
- Introduce a dedicated "IDE Providers" section (Cursor, Zed, Trae)
rendered under OAuth Providers; exclude IDE_PROVIDER_IDS from OAuth
to avoid duplication.
- Add zed and trae providers, plus IDE_PROVIDER_IDS set.
- Move the Zed keychain import to /dashboard/providers/zed as a
contextual Card, instead of cluttering every OAuth section header.
- Extend test-batch route and validation schema with mode: "ide".
* feat(dashboard): add token saver controls to endpoint and context pages
Expose the Token Saver master settings from the endpoint page and
surface its disabled state across the Caveman and RTK context pages.
Update default compression behavior to start disabled with lighter
intensity presets, and add Caveman input compression controls so users
can configure input and output modes separately.
Tighten provider page section rendering by gating compatible, free,
oauth, and api key blocks behind their visibility checks and simplify
several summary labels.
* feat(dashboard): add runtime page and rename limits to quota
Introduce a dedicated runtime observability page for circuit
breakers, cooldowns, lockouts, sessions, and quota alerts.
Split provider quota out of the old limits route, add a redirect from
`/dashboard/limits` to `/dashboard/quota`, and update sidebar/header
labels and i18n keys to match the new navigation.
Enhance provider quota filtering state and remove the tier coverage
widget from the dashboard home view.
* feat(dashboard): redesign budget page and add quota sharing preview
Budget (/dashboard/costs/budget) gets a full rewrite:
- Hero with 6 KPIs (today, month, projected EOM, blocked, at-risk, active)
- Status pills with counts (blocked/alerting/warning/safe/no-limit)
- Templates row (localStorage) with bulk-apply to selected keys
- Multi-key table with checkbox selection and colored progress bar
- Expandable rows with projection card and per-provider cost breakdown
(last 30d via /api/usage/analytics?apiKeyIds=) plus inline edit form
Quota sharing (/dashboard/costs/quota-share) is new and ships as a beta
UI preview backed by localStorage. Pool persistence in the DB and
request-pipeline enforcement are intentionally deferred to a follow-up.
The page lets operators:
- Create pools from a provider connection + quota window
- Edit allocations per API key with % split and equal-split helper
- Toggle hard/soft/burst policy intent
Donut chart rendered with inline SVG; allocation editor in a modal.
Sidebar gets the new "Quota Sharing" entry under Costs Parameters; i18n
keys propagated across all 41 locales with PT-BR translation.
---------
Co-authored-by: diegosouzapw <diego.souza.pw@gmail.com>
Docker images launched without a sibling Redis container used to spam
'[REDIS] Error: connect ECONNREFUSED 127.0.0.1:6379' for every
rate-limit and API-key-auth cache lookup. The root cause was a default
of process.env.REDIS_URL || 'redis://localhost:6379' that turned the
opt-in cache into a hard dependency.
Three coordinated changes:
1. src/shared/utils/rateLimiter.ts — gate Redis on REDIS_URL being
explicitly set. getRedisClient() returns null when disabled; the
single connection-error handler dedupes via a redisErrorLogged latch
so a sustained outage produces one warn instead of per-request flood.
checkRateLimit() routes to the existing in-memory store on both the
'disabled' and 'test' paths.
2. src/lib/db/apiKeys.ts — short-circuit Redis-backed auth cache reads
and writes when getRedisClient() returns null. SQLite remains
authoritative; the cache is purely an optimization.
3. Same file — replace the wildcard scope matcher's dynamic RegExp
compilation with a deterministic segment walker. Eliminates the
ReDoS surface on operator-supplied scope patterns and silences the
Semgrep js/regex-injection advisory that previously blocked edits to
this file.
Single-instance deployments now work silently out of the box;
multi-instance setups continue to use Redis when REDIS_URL is set.
When the shared <Tooltip> appeared inside a modal (combo editor) or any
ancestor with overflow:hidden/auto, long labels were clipped — the
absolute-positioned <span> stayed inside the modal's stacking context.
Render the tooltip via createPortal to document.body by default
(usePortal prop, defaults to true). Coordinates are computed from the
trigger's getBoundingClientRect on each show and written directly to
the tooltip ref's .style — that avoids the cascading-render warning
that setState-inside-effect triggers, while still doing one synchronous
measure-and-position pass before the user sees any flicker.
Coordinates are clamped to the viewport bounds so a trigger near the
right edge produces a tooltip that stays on-screen instead of bleeding
off. Adds an optional multiline prop that swaps the legacy
whitespace-nowrap clamp for max-w-xs whitespace-normal break-words for
explanation strings (combo strategy help, etc.).
Backward compat: existing call sites do not need to change; the portal
+ clamp behavior is transparent to consumers.
Adds an import flow that lets users bring an existing Codex auth.json
into OmniRoute without a fresh OAuth login. Both a file-upload tab and
a paste-JSON tab are supported.
- `codexAuthImport.ts`: pure parser + createConnectionFromAuthFile
(conflict detection, overwriteExisting, JWT email/exp extraction)
- `POST /api/providers/codex-auth/import`: Zod-validated endpoint with
audit log (`provider.credentials.imported`)
- `importCodexAuthSchema` in schemas.ts (discriminated union json/text,
256 KB cap on paste source)
- `<ImportCodexAuthModal>` in providers/[id]/page.tsx with upload/paste
tabs, email auto-detection, name/email/overwrite fields
- "Import auth" toolbar button shown only on the Codex provider page
- 29 unit tests (17 parser + 12 schema) — all passing
feat(ui): simple/advanced mode for Caveman & RTK + newbie UX improvements
Adapts oyi77's UX rework on top of our refactor/pages overhaul. Layout
priority: our 9-section sidebar restructure stays; PR's additions
(subtitles, intros, simple/advanced toggles, empty states, error labels)
are integrated into our structure.
Conflict resolution:
- index.tsx: union — exports InfoTooltip, PresetSlider (new shared
components from PR) alongside our NoAuthProviderCard.
- en.json: union — kept our "OmniSkills"/"AgentSkills" labels and
"API Key Manager" naming; added PR's subtitleKey strings, settings
intro keys, and empty state keys.
- sidebarVisibility.ts: kept our 9-section structure; added subtitleKey?:
string to SidebarItemDefinition and mapped subtitle keys onto the 7
matching items (endpoints, api-manager, combos, batch, context-caveman,
context-rtk, webhooks).
- Sidebar.tsx: kept our collapsible-section rendering; integrated PR's
subtitle support into resolveItem() and renderNavLink() label area.
- CavemanContextPageClient.tsx: took PR's version — adds SegmentedControl
for simple/advanced mode (gates full settings tab in advanced).
- RtkContextPageClient.tsx: took PR's version — adds SegmentedControl +
Collapsible filter catalog.
- settings/page.tsx: kept our redirect (we converted tabs→pages). Ported
PR's intro text paragraphs to /settings/ai, /settings/routing, and
/settings/resilience subpages using the auto-merged i18n keys.
- HomePageClient.tsx: kept ours — we removed Providers Overview card in
the refactor, and PR's empty state for that card is now redundant.
PR's equivalent empty state at /dashboard/providers (in
providers/page.tsx) auto-merged cleanly and serves the same purpose.
Closes#2316
Resolves conflicts in 9 files to bring 181 commits from release/v3.8.0 into
the dashboard refactor branch ahead of merging back to release.
Layout strategy: our pages overhaul (tabs→pages, restructured sidebar,
removed redundant headers, OpenCode Free no-auth card) is the source of
truth. Release's functional additions are adapted into our layout.
Conflict resolution:
- package.json/package-lock.json: take release's deps (axios bump, CLI v4
deps, tls-client-node/wreq-js move to optionalDependencies); re-add our
@xyflow/react addition; regenerate lockfile.
- src/shared/constants/sidebarVisibility.ts: keep our 9-section restructure
— release's new IDs (limits, media, cli-tools, agents, cloud-agents,
memory, skills, agent-skills, context-*) are all already present in our
groups.
- src/i18n/messages/en.json: auto-merge picked up all release's new keys
(autoCatalog*, quotaCutoffs*, systemTransforms*, schema-coercion, vision);
only naming conflict was OmniSkills/AgentSkills — kept ours (no space).
- src/app/(dashboard)/dashboard/HomePageClient.tsx: kept our Provider
Topology card; ported release's TierCoverageWidget (placed before
topology).
- src/app/(dashboard)/dashboard/settings/page.tsx: kept our redirect to
/settings/general (we moved tabs to separate pages); release's sticky
tab CSS change is moot in our structure.
- src/app/(dashboard)/dashboard/skills/page.tsx: rerere applied — release
hardcoded "OmniSkills" h1 was already removed by our header-cleanup
refactor.
- src/app/(dashboard)/dashboard/agent-skills/page.tsx: both branches
created this file independently with identical data source; kept our
Tailwind-themed 2-column grid (release's version used inline styles).
- src/app/(dashboard)/dashboard/batch/page.tsx: kept our single-tab
structure (FilesListTab moved to /batch/files page); ported release's
onRefresh prop addition.
- src/app/(dashboard)/dashboard/batch/files/page.tsx (not in conflict but
updated): added batches fetch + batches prop to preserve release's
feature of showing related batches in the file detail modal.
Pre-existing typecheck errors in open-sse/services/contextManager.ts
(lines 141, 154, 167) come from release/v3.8.0 and are not introduced by
this merge.
OpenCode Free (noAuth: true) was routed through OAuthModal which tried to call
a non-existent /api/oauth/opencode/authorize endpoint, resulting in a 500 error.
Detect noAuth free providers via FREE_PROVIDERS[id]?.noAuth and render a
NoAuthProviderCard (lock_open + description) instead of the connections section
with the "+ Add" button that triggered the broken flow.
Add subtitleKey to SidebarItemDefinition and render subtitles under
sidebar labels for: Endpoints, API Manager, Combos, Batch, Caveman,
RTK, and Webhooks. Helps non-technical users understand navigation.
Add two OpenAI-compatible API-key providers via the Gitlawb Opengateway
gateway at opengateway.gitlawb.com:
- gitlawb (alias glb): xiaomi-mimo endpoint with 5 MiMo models
- gitlawb-gmi (alias glb-gmi): gmi-cloud endpoint with 40+ models
including GPT-5.x, Claude 4.x, DeepSeek, Gemini, Qwen, GLM, Kimi
Both providers include CLI-mimicking headers (User-Agent, X-Title,
HTTP-Referer) to avoid upstream rate limiting. GMI Cloud provider
has passthroughModels enabled since model access varies per API key.
Adds 'opencode' to FREE_PROVIDERS as a no-auth provider using the public
OpenCode endpoint (https://opencode.ai/zen/v1). The existing OpencodeExecutor
already skips the Authorization header when no API key is present. Registry
entry reuses the opencode executor and shares models from the zen/v1 endpoint.
- Add /dashboard/audit/a2a page with A2aAuditTab: lists tasks with skill/state
filters, colored state badges, duration, events and artifacts counts
- Add "A2A Audit" item to Audit sidebar group (Monitoring section)
- Remove duplicate "MCP Audit" from MCP Server sidebar group — it stays
only in the Audit group under Monitoring
- Improve McpAuditTab: fetch /api/mcp/audit/stats and show 4-card stat bar
(calls 24h, success rate, avg duration, top tool) above the filters
- Add audit-a2a to HIDEABLE_SIDEBAR_ITEM_IDS
- Add i18n keys: auditA2a in sidebar + header sections, a2a* in compliance namespace
- Rename sidebar/page titles: "mcp" → "MCP Server", "a2a" → "A2A Server" (en.json)
- Wrap top header section in <Card> on both MCP and A2A pages for consistent styling
- Remove redundant "hub MCP Server" / "group_work A2A Server" headings from page body
- Add MCP_GROUP collapsible sidebar group (MCP Server + MCP Audit) in Agentic Features
- Update AGENTIC_FEATURES_ITEMS type to SidebarSectionChild[] to support groups
- DeepSeekWebExecutor with ds_session_id cookie auth
- DeepSeekWebWithAutoRefreshExecutor for session management
- Keccak-based PoW solver (DeepSeekHashV1)
- SSE stream transformation to OpenAI format
- Provider constant and alias (ds-web)
- 23 unit tests + live integration test
Authored-by: Paijo <oyi77@users.noreply.github.com>
Removes default daily/weekly/monthly request caps (1K/5K/20K) that were
silently applied to API keys without explicit rate limits, causing
surprise 429s in production aggregator deployments.
Authored-by: josephvoxone <josephvoxone@users.noreply.github.com>
