The #7786 squash accidentally committed its worktree copy
(.claude/worktrees/feat-7786/**, since untracked) and leaked probe tests
(repro-8522/probe-9033/repro-8956 — each now green via #9355/#9385/#9354)
plus a stray changelog.d/fixes/9159-fix.plan.md describing an UNMERGED fix
(would fabricate a changelog entry at release time — removed; #9159's own
PR ships its fragment).
This restores the PR's actual deliverable at the right paths: the
management-auth terminology guide (now with the required MDX frontmatter),
its docs test (3/3 green) and its changelog fragment.
* feat(providers): filter detail connections server-side
Filter provider detail requests at the database boundary while preserving
the full per-provider connection set needed by search, pagination, and bulk
actions. Alias-backed provider pages keep their existing aggregate behavior.
Co-authored-by: RobertsXML <RobertsXML@proton.me>
Inspired-by: https://github.com/decolua/9router/pull/2998
* chore(changelog): fragment for #9247
---------
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
Co-authored-by: RobertsXML <RobertsXML@proton.me>
* feat(sse): deprecate the gemini-cli upstream provider with a real migration path
Stored `gemini-cli` connections were being kept alive for nothing. Measured before
touching anything:
routable? absent from PROVIDERS, from REGISTRY, from OAUTH_PROVIDERS, and no
executor references it → the connection can NEVER serve a request
refreshing? yes, and successfully — it redeemed against PROVIDERS.gemini's client
(681255809395-oo8ft2o…), the same public Gemini CLI / Code Assist OAuth
client
So the scheduler made periodic upstream calls to Google to keep a credential fresh
that had nowhere to go. That is the waste this removes.
This is a deprecation, not a deletion, and the difference is deliberate. The path was
not dead code: #8232 added it after a user report (the UI advertises automatic OAuth
rotation and these rows never rotated), and #8275 narrowed it to exactly the legacy
refresh. Simply dropping it from `supportsTokenRefresh` would have produced a SILENT
skip — `Skipping … (refresh unsupported)` — leaving the row at "active" forever, doing
nothing. Worse than before.
Instead:
DEPRECATED_PROVIDERS + isDeprecatedProvider/getDeprecationNotice in tokenRefresh
one place naming the provider and where to migrate. A test asserts the migration
target is itself routable, so the notice can never point somewhere useless.
_getAccessTokenInternal returns the ESTABLISHED unrecoverable envelope
{ error: "unrecoverable_refresh_error", code: "provider_deprecated", migrateTo }
Reusing `error` means isUnrecoverableRefreshError and the manual-refresh route
already stop retrying — no new contract for callers to learn. The distinct `code`
is what makes it legible. A bare `null` would read as transient and retry forever.
tokenHealthCheck marks the connection terminal with the reason
Placed after the existing terminal-status guard, which makes it idempotent for
free: once "expired", later sweeps skip the row, so it writes once instead of
rewriting the same reason every cycle.
the manual-refresh route stops lying
It said "Refresh token expired. Please re-authenticate this account." — false
here: the token is fine, the provider is gone. Re-authenticating would loop
against something that no longer exists. It now reports the deprecation and the
migration target.
`gemini` uses the same OAuth client, so re-adding the account there is a working path,
not advice to start over.
Deliberately NOT touched:
Category A — the gemini-cli CLIENT identity (#7034): clientIdentityProfiles.ts,
clientApi.ts, googApiKeyAuth.ts. Same string, opposite direction — requests
ARRIVING from the Gemini CLI, where OmniRoute is the server. Deleting these is the
failure this change must never cause, so a test now asserts the profile survives.
Audited: `git diff --name-only` touches none of those files.
errorClassifier.ts's isCloudCodeProvider list still names gemini-cli. It is a
defensive 403→PROJECT_ROUTE_ERROR list shared with cloudcode/cloud-code; the entry
is unreachable for a non-routable provider, and editing a shared classification
path for a dead string is risk without upside.
Tests — 42 across the six files that mention the identifier, all green:
gemini-cli-legacy-refresh.test.ts 5 (3 assertions REWRITTEN, see below)
gemini-cli-deprecation.test.ts 5 (new)
client-identity-profiles.test.ts 9 (category A, untouched)
service-token-refresh.test.ts 14
errorclassifier-antigravity-403.test.ts 4
gemini-cli-ansi-sanitization.test.ts 5 (category C, untouched)
The three rewritten assertions in the legacy file are alignment, not weakening, and the
gate is right to ask: each is now STRONGER. "refresh succeeds against Google's token
endpoint" became "zero upstream calls happen at all"; "a 400 surfaces invalid_grant"
became "the envelope is unchanged but the code says provider_deprecated" plus a control
asserting `gemini` still reports invalid_grant, proving the real path was not blunted.
The file's header keeps the whole #8232 → #8275 → deprecation arc, because each step is
why the next made sense. Count unchanged; no test deleted, so no allowlist entry needed.
* docs(changelog): fragment for #8980
---------
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
Second aggregation pass, for the PRs merged after the main reconciliation:
#8860, #8861, #8862, #8863, #8865, #8866.
The `### 📝 Maintenance` heading added to the living section in 26a7783521 held —
[3.8.47] stays at its 234 bullets instead of absorbing this cycle's maintenance
entries. Credits attached where the fragment carried the number only in its
filename: @HouMinXi (#8860, #8865), @artickc (#8863), @rafaeldrincon (#8866).
#8862 already carried its own link and credit.
[3.8.49]: 1172 -> 1178 bullets · contributors 155 -> 156 · 42 i18n mirrors synced.
* feat(sse): add alternateFormats registry field and resolver
* feat(sse): honor per-connection targetFormat in getTargetFormat
Registry-driven format lookup now resolves an alternate protocol
declared for the provider when the connection's providerSpecificData
carries a matching targetFormat, falling back to the entry's default
format otherwise.
* feat(sse): resolve base URL from selected alternate format
resolveBaseUrl now falls back to the connection's selected alternate
protocol (providerSpecificData.targetFormat) before the provider's
default base URL, while a manual providerSpecificData.baseUrl override
still wins over both.
* feat(sse): apply alternate format auth header and extra headers
DefaultExecutor's registry authHeader lookup and BaseExecutor's shared
header preamble now both honor a connection's selected alternate
protocol: the alternate's authHeader wins over the registry default,
and its extra headers (e.g. Anthropic-Version) are merged in.
* refactor(sse): extract resolveAlternate helper into BaseExecutor
Centralizes the getRegistryEntry() + resolveAlternateFormat() pair
that resolveBaseUrl, buildHeadersPreamble, and DefaultExecutor's
authHeader lookup each duplicated, so a future call-site can't diverge
from the shared precedence. Also translates the PT-BR comments added
in the previous three commits to match the surrounding English. Pure
refactor — no behavior change.
* feat(sse): declare Anthropic-compatible variant for xiaomi-mimo
The provider publishes the same catalog over /anthropic/v1/messages on the same
host. Selecting it also required bypassing the per-provider URL normalizers in
DefaultExecutor.buildUrl(): normalizeXiaomiMimoChatUrl() appends /chat/completions
unconditionally, which mangled the alternate's already-complete endpoint into
.../anthropic/v1/messages/chat/completions.
* feat(sse): add xiaomi-mimo-token-plan provider with monthly quota
Token Plan is a separate product: tp- keys authenticate only on the regional
token-plan-sgp host and return 401 on api.xiaomimimo.com, where the existing
xiaomi-mimo provider points. Same pattern as qwen-cloud-token-plan.
Registers the monthly token allowance (no balance API upstream) and declares
the Anthropic-compatible variant on the token-plan host.
* feat(dashboard): add API protocol selector to connection modal
Providers that declare alternateFormats in the registry now expose an opt-in
protocol dropdown on the connection modal. The choice persists to
providerSpecificData.targetFormat as an explicit null when set back to the
default, since the PUT route merges { ...existing, ...incoming } and an omitted
key would keep the previous override.
* fix(i18n,quality): vi parity for the protocol selector + own-growth rebaselines
The three new provider keys landed only in en/pt-BR, so the vi parity test failed
(tests/unit/i18n-vi-completeness.test.ts asserts key parity AND no __MISSING__
markers — running i18n:sync-ui would have satisfied the first and broken the
second). Added translated values instead. Scoped to vi: it and pt-BR are the only
locales with a parity test.
Rebaselines are this PR's own growth: EditConnectionModal.tsx 1283->1316 (the
selector field) and open-sse/executors/base.ts 1540->1562 (alternate-format
resolution at the existing buildUrl/headers chokepoint).
Adds the changelog fragment.
---------
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
Aggregates every pending changelog.d fragment into the [3.8.49] section and
regenerates the contributors table from the reconciled bullets.
Three fixes this surfaced:
- The [3.8.49] section had no `### 📝 Maintenance` heading, so the aggregator's
findIndex matched the first one in the file — inside [3.8.47] — and would have
filed 92 maintenance bullets under the wrong release. Added the heading to the
living section; [3.8.47] stays at its original 234 bullets.
- 46 bullets carried no PR/issue reference. Fragments may keep the number only in
the filename (`<N>-slug.md`), which the aggregator does not copy into the bullet,
so the link and the credit were dropped on aggregation. Restored, scoped strictly
to the [3.8.49] range.
- 9 external contributors lost their attribution that way and are credited again:
@MisileLab (#8566), @MumuTW (#8619), @epsilonode (#8724), @hppsc1215 (#8835),
@sumanxg (#8837, #8856), @TitoTFP (#8838), @HouMinXi (#8842, #8845).
Contributors table: 84 → 155 entries, no one removed. 42 i18n mirrors synced.
check:changelog-integrity green — no base bullet lost.
* feat(ci): automate ratchet shrink-banking on the release branch (#8584)
The quality ratchet is only half automatic, and it is the wrong half. Raising a
cap is a manual JSON edit that takes ten seconds and is the fastest way to unblock
a red PR. Lowering one requires someone to run `--update` and commit the result —
and no workflow does: grepping `.github/workflows/` for `--update` finds only
wiki-sync.yml (unrelated) and ci.yml's check-quality-ratchet.mjs --require-tighten
(a different script against a different metric).
Measured on release/v3.8.49 at 4053e2314: 18 frozen files already at or under the
800-line new-file cap, the worst at 132x (src/shared/validation/schemas.ts, 19
lines carrying a 2,523 cap); the complexity ceiling walked 1794 -> 2169 across ~37
rebaseline notes with exactly one decrease (-1); "tighten via --update next cycle"
written 31 times and honoured once in six weeks. A cap that outlives the code that
earned it converts every completed decomposition into a growth allowance for
whoever edits that file next.
New job `bank-ratchet-shrinks` in nightly-release-green.yml measures the active
release branch, runs the two shrink-only `--update` paths, and opens ONE
always-current PR with the result. Schedule/dispatch only, deliberately not on
push: banking has no latency requirement, while a per-merge run would rebuild the
PR branch during merge campaigns and pay for a full ESLint walk each time.
Detection stays on push (release-green); only banking is batched. The job never
pushes to release/* — a human merges, so a bad measurement cannot land unreviewed.
scripts/quality/verify-ratchet-bank.mjs is the hard guarantee that the automation
can only ever write downward. It diffs the post-`--update` tree against HEAD and
aborts the job before a commit exists — opening no PR — unless every change is a
frozen/testFrozen entry lowered or removed, `count` lowered, or
cognitiveComplexity.value lowered. Raising a number, adding an entry, changing
cap/testCap, or deleting/rewriting a `_rebaseline_*` note all fail. A bot that
could raise a cap would be strictly worse than the status quo.
Verified both directions against the real baselines: --update + verifier reports
77 lowered / 14 removed / nothing raised, exit 0; hand-raising chatCore.ts to 9999
and cap to 1200 is rejected with exit 1. 22 unit tests cover each way the
automation could go wrong.
No product code changes.
* chore(skills): sync cli-backup-sync SKILL.md after rebase onto tip
* feat(adobe-firefly): reference image attach + /v1/images/edits (follow-up #8006)
Upload source images to Firefly storage (POST /v2/storage/image) and attach
them as referenceBlobs on generate-async, matching live firefly.adobe.com
captures (usage:general for nano multi-ref; usage:subject for gpt-image).
Also wire built-in adobe-firefly through OpenAI-compatible POST /v1/images/edits
(multipart or JSON data URLs, up to 4 refs) so Media edit-with-references
and Open WebUI image-edit hit the same path as image2image generate.
Unit suite: tests/unit/adobe-firefly.test.ts 41/41.
* test(api): add route-level coverage for Adobe Firefly /v1/images/edits + fix typecheck/file-size drift
Covers the referenceBlobs upload path, the 4-reference cap error, and the
credentials/rate-limit branches added to the /v1/images/edits route for
adobe-firefly (#8510). Also fixes a Buffer/BodyInit typecheck mismatch in
uploadAdobeFireflyImage and corrects the adobeFireflyClient.ts file-size
baseline entry to match the gate's actual LOC count (it counts the trailing
newline, so the frozen value is 2317, not 2316), plus a testFrozen entry for
adobe-firefly.test.ts's own +159 line growth from this PR. Moves the
handleAdobeFireflyImageGeneration re-export out of the middle of the import
block in imageGeneration.ts for readability.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(security): restore bounded JWT regex quantifiers dropped by edit-route refactor
The edits-route extraction (test commit 62785e972f) had accidentally
reverted 4 JWT-extraction regexes in adobeFireflyClient.ts from the
bounded {1,4096} quantifier back to unbounded +, undoing the ReDoS fix
from #8173 (CodeQL #754/#755/#756). Restored the bounded quantifiers;
behavior is unchanged (45/45 adobe-firefly tests still pass), only the
backtracking bound is back in place.
Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>
---------
Co-authored-by: ikelvingo <im.kelvinwong@gmail.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>
Mirror the search/route.ts pattern for /v1/web/fetch: skip rate-limited
stubs instead of letting them short-circuit auto-select, walk the
fixed-priority pool (fill-first) with a request-time fallback on
retryable/quota upstream statuses (429 always; 402/403 for
Firecrawl/Tavily/TinyFish quota-style tiers), and return a proper 429
(with Retry-After) when the whole pool is exhausted instead of a
generic 400. Explicit-provider requests never silently fall back.
* docs(i18n): full Russian README rewrite for native readers
Rewrite docs/i18n/ru/README.md from an outdated English dump into a proper Russian manual aligned with the modern product README (v3.8.x structure, free-tier budget, combos, compression, CLI/MCP). Fix relative screenshot/doc links for the i18n path.
* fix(8217): changelog fragment bullet prefix
---------
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
Two accuracy problems in buildCodexUsageQuotas (open-sse/services/codexUsageQuotas.ts):
1. ChatGPT Codex's /wham/usage advertises a latent per-feature ceiling for the
spark feature (metered_feature codex_bengalfox) to accounts by default. A
never-used bucket is unanchored (used_percent 0, reset_after_seconds ==
limit_window_seconds), so it recomputes its reset as now + full_window on
every fetch and was rendered as a permanent GPT-5.3-Codex-Spark row at 100%
for a model the operator never used. Skip latent windows (isLatentWindow);
they reappear once the feature is actually used. The label now comes from the
payload's own limit_name, falling back to the constant.
2. primary_window/secondary_window were labeled session/weekly purely by
position, ignoring limit_window_seconds, so a 7-day primary_window showed
'Session'. The session/weekly keys (routing semantics) stay unchanged; only
the display label is corrected from the real window duration
(windowDurationLabel), so a 7-day window shows 'Weekly'.
Fixes#8051.
One-shot 提供商->提供者 normalization across src/i18n/messages/zh-CN.json
(679 substitutions) and bin/cli/locales/zh-CN.json (54), mirroring #8024's
zh-TW pass. Adds a versioned terminology glossary
(scripts/i18n/glossary/zh-CN.json), a protected-names list
(scripts/i18n/glossary/protected-terms.json), and a pure-function
consistency check (scripts/i18n/check-glossary-consistency.mjs,
npm run i18n:check-glossary) wired into CI as the i18n-glossary-zhcn job.
zh-CN added to the visual-QA harness default locales. Complements the
existing parity (check-ui-keys-coverage.mjs) and ICU (validate_translation.py)
gates without replacing them.
* feat: provider tab account search + mirrored top pagination (#7937)
Two client-side UI improvements to the provider connections/accounts list
(all data already loaded in memory; PAGE_SIZE=50):
- Mirror the pagination bar ABOVE the list (previously bottom-only) in both
the flat/untagged branch and the tagged/grouped branch.
- Add a case-insensitive substring account search input (id/tag/name/email)
to the left of the status filter pills, searching across ALL accounts
(not just the current page), resetting pagination to page 0 on change.
- Add pagination to the tagged/grouped view, which previously had none.
New pure helper `connectionsSearchFilter.ts` keeps the substring matcher
testable and out of the already-large ConnectionsListPanel.tsx.
Closes#7937
* i18n(vi): add providers.accountSearchPlaceholder for locale parity (#7937)
* feat: narrow mcp:connect scope + per-key HTTP tool-scope binding (#7895)
Adds MCP_CONNECT_SCOPE ("mcp:connect"), a narrow additive API-key scope
(kept out of MANAGEMENT_API_KEY_SCOPES, same precedent as SELF_USAGE_SCOPE)
that authorizes ONLY the /api/mcp/ LOCAL_ONLY route-guard carve-out --
remote MCP-only callers no longer need broad manage/admin scope just to
reach the transport routes. Scoped strictly to /api/mcp/; every other
LOCAL_ONLY bypass prefix still requires hasManageScope() unchanged.
Also resolves the caller's real api_keys.scopes over HTTP/SSE
(httpAuthContext.ts::resolveMcpCallerAuthInfo) and passes it to the MCP
SDK's transport.handleRequest(req, { authInfo }), so extra.authInfo.scopes
reaching tool calls reflects the Bearer key's own scopes instead of the
OMNIROUTE_MCP_SCOPES env fallback -- scopeEnforcement.ts already prioritized
authInfo, it was simply unfed over HTTP. Does not flip the
OMNIROUTE_MCP_ENFORCE_SCOPES default; stdio is unaffected (no per-caller
identity, stays on the meta/env fallback chain).
Closes#7895
* test(mcp): register mcp-connect-scope test in stryker tap.testFiles (#7895)
* feat(oauth): add browser login for Grok Build provider (#7013)
* feat(oauth): grok-build supports device_code AND browser-PKCE side-by-side (#7013)
Reworks #7735 so the browser PKCE login is added ALONGSIDE the device_code flow
(#7358) instead of replacing it; the OAuthModal lets the user pick either method.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
Adds hailuo-web as a new free web-cookie chat provider targeting the
MiniMax consumer chat product at hailuo.ai (chat.minimax.io), distinct
from the existing paid API-key minimax/minimax-cn providers.
Ported from the g4f reference implementation
(g4f/Provider/needs_auth/mini_max/{HailuoAI,crypt}.py):
- MD5-chain request signing (generate_yy_header/get_body_to_yy)
- Custom event:/data: SSE parsing (send_result/message_result/close_chunk),
where message_result.content is a cumulative snapshot diffed into deltas
- Device-fingerprint query params, derived deterministically per-connection
from the token when the user hasn't captured the real browser values
New catalog entry, executor, registry entry, dispatch wiring, tests
(17 cases covering signing test vectors independently verified via
Python hashlib.md5, SSE parsing, streaming/non-streaming dispatch, and
401-terminal vs 429-transient error mapping), and a regenerated
provider-translate-path golden snapshot (purely additive diff).
* feat(dashboard): add per-operator quota row visibility on usage tab
Adds a "hide this quota row" action (visibility_off icon button) to
each model-quota row on the provider limits card, and a "Hidden: …"
strip at the bottom of the card to restore any hidden row. The
visibility preference is keyed per-provider (settings.quotaVisibility)
and persisted via PATCH /api/settings, so it survives refresh/reload.
Distinct from the existing model-catalog isHidden/isDeleted mechanism
(collectHiddenQuotaModelIds/filterHiddenModelQuotas in
ProviderLimits/utils.tsx), which hides rows the ADMIN marked hidden in
the model catalog. This is a personal dashboard preference an operator
can toggle without touching the catalog — e.g. temporarily decluttering
a quota card with many low-signal rows.
New pure helpers (getQuotaVisibilityKey, filterQuotasByVisibility,
getHiddenQuotaRows) live in ProviderLimits/utils.tsx and are unit
tested directly; the settings key is added to DEFAULT_SETTINGS and
validated via updateSettingsSchema like the existing
providerStrategies field. New UI strings are filled in en.json and
synced to the other 42 locales as `__MISSING__` placeholders.
Co-authored-by: nguyenha935 <208228297+nguyenha935@users.noreply.github.com>
Inspired-by: https://github.com/decolua/9router/pull/2371
* chore(changelog): fragment for #7251
* refactor(usage): extract useQuotaVisibility hook (file-size budget)
ProviderLimits/index.tsx grew past its frozen 1127-line budget with the
quota-visibility wiring; extract the state + persistence + hide/show handlers
into a dedicated hook (same pattern as useCodexResetCreditRedemption).
No behavior change — the live validation evidence on the PR covers this flow
end-to-end.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* refactor(dashboard): shed QuotaCard complexity to baseline + type useQuotaVisibility settings fetch (#7251 CI green)
* test(dashboard): rename quota-row visibility test (path claimed by #7360)
* fix(dashboard): restore providerTierField case-collision fix dropped by merge auto-resolve
The git merge of origin/release/v3.8.49 auto-resolved providerTierFieldApi.ts
(added post-merge-base by commit 3ba3cd145e to fix a case-only filename
collision with ProviderTierField.tsx that breaks webpack on case-insensitive
filesystems) back down to its pre-fix name providerTierField.ts, silently
reverting that base-red fix and dropping its stryker tap.testFiles
registration and changelog fragment. Restore all four: the renamed helper
file, the import path in ProviderTierField.tsx, the import path in
tests/unit/provider-tier-field-helpers.test.ts, and the
combo-skip-conn-disable-plugin-block-7806.test.ts stryker registration.
---------
Co-authored-by: nguyenha935 <208228297+nguyenha935@users.noreply.github.com>
* feat(sse): add live gRPC-web quota fetcher for grok-cli (#6844)
* fix(sse): send gRPC-web request frame + decode real GetGrokCreditsConfig schema
Live validation against grok.com (real bearer token, tier-4 account) proved
the #6844 grok-cli quota fetcher was a silent no-op:
- The POST to GetGrokCreditsConfig had no body. gRPC-web requires a request
frame even for a no-argument RPC; without one the upstream returns
`grpc-status: 13 "Missing request message."` with a 0-byte response.
Fixed by sending the empty gRPC-web frame (flag 0x00 + 4-byte length 0).
- The decoder's field mapping (top-level field 1 = double percent, field 2 =
string resetAt) was reverse-engineered from a third-party doc and never
matched the real response. The real shape is: top-level field 1 is a
NESTED message whose subfield 1 is a fixed32 float usage ratio (0..1) and
subfield 5 is a Timestamp{seconds,nanos} reset time. grokCliQuotaFrame.ts
now decodes that nested shape; grokCliQuotaFetcher.ts's buildQuota()
rescales the decoder's 0-100 percentUsed back to the 0-1 fraction the rest
of the quota pipeline expects (quotaPreflight.ts::remainingPercentFrom).
- The response's 2nd gRPC-web frame (trailer, flag 0x80) is now explicitly
walked-and-skipped instead of relying on incidental length-bounding.
Test fixtures in both files now encode the real captured wire structure
(nested message, fixed32 ratio, Timestamp reset, trailer frame) instead of
the old synthetic fixed64-double buffers, and the stale "Cloudflare
non-blocking is an assumption" comment is corrected to reflect that it is
now live-validated.
Level 1: GET /v1/auto-combo/{channel}/candidates lists an auto/* channel's
candidate pool with live reachability (provider circuit breaker via
getStatus()/canExecute(), connection cooldown, model lockout).
Level 2: per-API-key candidate exclusions, persisted in a new
auto_candidate_overrides table and enforced at the virtualFactory.ts
candidate-pool chokepoint via a pure, fail-open filter — mirrors the #7622/
#7646 precedent exactly (zero touches to the frozen combo.ts god-file).
Levels 3 (weights/ordering) and 4 (policy pin) are deferred to a follow-up
issue, as is the dashboard UI (Step 4) and its i18n strings.
classifyTier() already honored a DB-backed providerOverrides list keyed
by an arbitrary provider-id string (built-in or custom), but nothing
exposed it through the UI or API. Adds GET/PUT /api/settings/tier-config,
a generic Advanced Settings tier selector wired into EditConnectionModal,
and makes TierCoverageWidget consult the same override before falling
back to registry-membership classification.
Owner decision: scope is the 3 real ProviderTier machine values
(free/cheap/premium) — the enum is not extended to 4.
* docs: add design spec for GHE Copilot provider
* feat(mitm): add GHE Copilot target descriptor
* feat(executors): add GheCopilotExecutor for GHE Copilot
* feat(executors): register GheCopilotExecutor in factory
* feat(providers): add ghe-copilot provider with gheUrl validation
* feat(providers): add ghe-copilot to OAUTH_PROVIDERS and enforce HTTPS gheUrl validation
* test(ghe-copilot): add unit tests for GheCopilotExecutor and GHE_COPILOT_TARGET
* feat: complete GHE Copilot provider implementation
* feat: register ghe-copilot provider in registry
Add GHE Copilot registry entry (executor: "ghe-copilot") so the
provider is resolvable by the API routes and gets the same model
catalog as github Copilot.
* feat: wire ghe-copilot into OAuth flow with per-connection gheUrl
- Add gheCopilot OAuth provider (device-code flow targeting GHE host)
- Register in OAuth PROVIDERS map
- Thread gheUrl from query param → device-code request → poll →
postExchange → providerSpecificData so the GHE host is used end-to-end
- Restore corrupted src/lib/oauth/providers/github.ts from HEAD
* feat: add ghe-copilot device-code UI with gheUrl input
- Route ghe-copilot through the device-code OAuth branch (was falling
through to browser OAuth → "Browser OAuth unavailable" error)
- Add a gheUrl collection step so the enterprise host is supplied before
the device-code request, and thread it into /device-code + /poll
* fix: thread gheUrl through GHE Copilot pollToken + postExchange
pollToken read gheUrl from config (GITHUB_CONFIG, which has none) and
threw "gheUrl is required" on every poll — the connection hung forever
after device authorization. Now reads gheUrl from extraData (passed by
the route), and postExchange carries it forward into mapTokens so it is
persisted in providerSpecificData for the executor.
* fix: GHE Copilot chat routing + account test
- Capture endpoints.proxy from the GHE token response and store it as
copilotProxyUrl; route chat/responses traffic to that enterprise host
instead of the static gheUrl/chat/completions path (was 406/404).
- Always route GHE Copilot to /chat/completions (GHE proxy 404s on
/responses); the Responses API is served via the chat transformer.
- Strip the ghe-copilot/ prefix from the upstream model id.
- Remove openai-responses targetFormat from GHE models so chatCore does
not run the Responses transformer (which dropped `messages`).
- Add ghe-copilot to OAUTH_TEST_CONFIG (account test was "unsupported").
- Register executor in eslint suppressions.
* fix: drop stream:false for GHE Copilot
The GHE Copilot proxy rejects `stream: false` ("stream": false is not
supported). Only forward the flag when actually streaming; omit it
otherwise.
* fix: force stream:true upstream for GHE Copilot (streaming-only proxy)
The GHE Copilot proxy rejects `stream: false`. forceStream:true in the
registry makes chatCore pass upstreamStream=true, but GithubExecutor
.transformRequest ignores the stream arg (void stream) and keeps the
client's stream:false. Override transformRequest in GheCopilotExecutor to
force stream:true so the proxy accepts the request; chatCore drains the
SSE back to JSON for non-stream clients.
* fix: GHE Copilot live model discovery from copilotProxyUrl/models
- Add fetchGheCopilotModels/parseGheCopilotModels using enterprise proxy URL
and { models: [{ name }] } response shape (no static allowlist)
- Wire ghe-copilot into models-import route; use plain fetch (safeOutboundFetch
header guard strips the copilot bearer token -> 403)
- Import now returns real enterprise models (copilot-nes-oct, etc.) and chat
resolves them correctly
* fix: GHE Copilot uses endpoints.api host for chat + model discovery
The GHE token endpoint returns two hosts:
- endpoints.api (copilotApiUrl) -> chat/completions + real chat model
catalog, shape { data: [{ id }] }
- endpoints.proxy (copilotProxyUrl) -> NES/autocomplete/instant-apply only,
shape { models: [{ name }] }
We were routing chat AND model discovery to endpoints.proxy, so import only
returned completion models (copilot-nes-*, instant-apply) and never the real
chat models (claude-*, gpt-*, gemini-*).
- Executor: capture endpoints.api as copilotApiUrl; buildUrl prefers it
- OAuth postExchange/mapTokens: persist copilotApiUrl from endpoints.api
- Model discovery: fetch from copilotApiUrl/models, parse { data:[{id}] }
(and proxy { models:[{name}] }) shapes, no allowlist
- All traffic stays on the configured GHE host (deutschebahn.ghe.com),
never api.githubcopilot.com
Verified: import returns 28 real chat models; chat with gpt-4o streams OK.
* feat(providers): finalize GHE Copilot implementation and add changelog fragment
* fix(providers): resolve ghe-copilot no-explicit-any + complexity ratchet
- Replace the 6 explicit `any` types in GheCopilotExecutor
(transformRequest, refreshCredentials) with proper ProviderCredentials /
unknown / ExecutorLog types, and drop the config/quality/eslint-suppressions.json
allowlist entry added for them — policy requires new violations be fixed,
not frozen.
- Extract refreshViaGitHubToken() and buildRefreshedProviderSpecificData()
helpers out of refreshCredentials() to bring its cyclomatic complexity
(21) back under the repo's ratchet threshold (15); behavior unchanged.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(oauth): unblock #7546 file-size gate for GHE Copilot OAuth provider
Extracts the GHE enterprise-URL config step from OAuthModal.tsx into a
new leaf component (src/shared/components/oauthModal/GheConfigStep.tsx)
to shrink the frozen file's own growth, and rebaselines the two
remaining irreducible wiring bumps (device-code route.ts 960->963,
OAuthModal.tsx 1030->1056) with justification comments, mirroring the
existing #7399/#6636 precedent on this same file.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* chore(ghe-copilot): drop planning spec from docs/ and revert out-of-scope eslint bump
Planning artifacts live outside the repo tree; package.json/lock restored to the
release state (the eslint patch bump was unrelated drift from the fork's history).
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(oauth): validate gheUrl (HTTPS-only) at both raw entry points of the device-code flow
Applies the PR's existing providerSpecificData HTTPS rule to the OAuth route's
searchParams and device-flow extraData entry points, rejecting malformed or
non-HTTPS enterprise URLs with 400 before any upstream fetch. Private-IP hosts
stay allowed by design — on-prem GHE Server is the primary use case.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* chore(quality): extend oauth route file-size note for the gheUrl validation guards (963->970)
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: Alexander Helm <alexander.helm@deutschebahn.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouzapw@users.noreply.github.com>
Co-authored-by: hppsc1215 <hppsc1215@users.noreply.github.com>
Level 2 of the staged approach in #7286: wire the existing webTools.ts
prompt-emulation shim (already proven across 11 other web-cookie
executors) into gemini-web.ts. The client's tools[] array is now
serialized into the prompt typed into the Gemini web UI, and
<tool>{...}</tool> blocks in the response are parsed back into OpenAI
tool_calls -- including for streaming requests, replayed as a single
terminal SSE chunk since gemini-web buffers the whole response by
construction. Malformed tool JSON degrades to ordinary chat content,
never an error, matching the existing behavior of the other 11
executors. The no-tools code path is unchanged (regression guard).
Also Level 1: adds a "Tool calling" column (native/emulated/none) to
docs/reference/PROVIDER_REFERENCE.md for providers with confirmed
ground truth (the 11 already-wired web-cookie executors + gemini-web
-> emulated, claude-web -> none pending its own Level 3 decision).
Level 3 (claude-web) and Level 4 (supportsTools capability flag) are
explicitly out of scope -- claude-web/payload.ts is untouched.
Phases 3-4 of #3384 (Phases 1-2 shipped DB schema + resolveInterceptSearch in
release/v3.8.47). Adds resolveInterceptFetch(provider, model) as a structural
twin of resolveInterceptSearch, and open-sse/services/webFetchInterception.ts
(mirroring webSearchFallback.ts) to rewrite a provider-native web_fetch tool
declaration into a synthetic omniroute_web_fetch function tool. The synthetic
tool call is dispatched through the existing handleToolCallExecution path
(same as omniroute_web_search) to a new web_fetch builtin skill handler that
resolves credentials and calls handleWebFetch() against /v1/web/fetch.
Strictly opt-in: with no interceptFetch DB row configured (the default), the
outgoing request body is byte-identical to pre-change behavior — no heuristic
default bypass like the interceptSearch sibling, to guarantee zero overhead
when disabled (Hard Rule #20).
Also ships the dashboard toggle (owner decision, overriding the plan's
backend-only recommendation): ProviderInterceptionSection.tsx on the provider
detail page, backed by GET/PUT/DELETE /api/providers/[id]/interception-rules,
covering both interceptSearch and interceptFetch from one control.
chatCore.ts touch is minimal (frozen file): one resolver call + one
prepareWebFetchFallbackBody call mirroring the existing interceptSearch block,
plus threading provider/model into the existing handleToolCallExecution call.
