- Restored default adaptive thinking injection for non-Haiku Claude Code models when explicit client headers are omitted.
- Updated Claude OAuth unit tests to accurately account for dynamic cliUserID property injection in mapped credentials.
- Fixed module resolution regression in audio transcription handler caused by missing getCorsOrigin utility.
Replace regex-based compression artifact cleanup with linear helpers to
avoid pathological backtracking and normalize whitespace safely.
Tighten request and response parsing in assess, Gemini translation, and
executor telemetry to avoid unsafe property access and invalid category
filtering.
Also add managed database backup support for legacy encrypted
connection migration, improve SQLite load error handling, and cover the
regressions with unit tests.
- fix(codex): flatten Chat Completions tool format to Responses format in
normalizeCodexTools. Prevents 'Missing required parameter: tools[0].name'
upstream errors when clients send {type:'function', function:{name,...}}
instead of {type:'function', name,...}.
- fix(proxy): add proxy-aware execution context to image generation route.
Image requests now correctly use proxy settings from the connection's
ProxyRegistry assignment, matching the pattern used by chat pipeline.
- fix(translator): inject properties:{} into zero-argument MCP tool schemas
during Anthropic→OpenAI translation. OpenAI strict mode requires explicit
properties even for empty object schemas.
Closes#1914, Closes#1904, Closes#1898
- Strips empty arrays from streaming tool arguments in responsesTransformer and openai-to-claude
- Fixes zero-results issue when Claude Code invokes WebSearch with allowed_domains: []
- Resolves prompt body propagation failures by ensuring messages-to-input mapping happens before system role conversion in codex executor
* feat(api-keys): add rename support in permissions modal
Add an editable key name field at the top of the permissions modal,
allowing users to rename API keys alongside existing permission settings.
The backend already supported name updates via PATCH /api/keys/:id — this
wires the UI to send the name field and refreshes the key list on success.
Changes:
- Add keyName state and text input to PermissionsModal
- Update handleUpdatePermissions to validate and send name in PATCH body
- Add integration test for rename via PATCH (valid, empty, too-long names)
- Update E2E mock to handle PATCH requests
* chore(release): bump version to 3.7.6
* chore(release): v3.7.6 — merge API key rename feature and sync docs
* chore(release): expand contributor credits to 155 PRs across full project history
- Expanded acknowledgment table from 29 to 53 contributors
- Added 100+ previously uncredited PRs from project inception through v3.7.5
- Moved contributor credits section to v3.7.6 (current release)
- Synced llm.txt version to 3.7.6
* fix: resolve security ReDoS in codex and bugs #1797#1789
* feat(dashboard): implement remaining v3.7.6 dashboard features and fixes
* fix(xiaomi-mimo): update models to V2.5, fix Token Plan validation and default region (#1823)
Integrated into release/v3.7.6
* fix(dashboard): correct loadPresets ReferenceError in CostOverviewTab
* fix(codex): omit compact client metadata (#1822)
Integrated into release/v3.7.6
* feat(chatgpt-web): support thinking_effort (Standard/Extended) for thinking-capable models (#1821)
Integrated into release/v3.7.6
* Fix endpoint visibility, A2A status, and API catalog (#1806)
Integrated into release/v3.7.6
* fix(analytics): use pure SQL aggregations — no history rows loaded (#1802)
Integrated into release/v3.7.6
* fix(stability): resolve codex input validation, enable combo circuit breaker, and fix broken unit tests
* docs(changelog): update for stability bug fixes#1804#1805
* fix: clear active requests and recover providers (#1824)
Integrated into release/v3.7.6
* feat: inject fallback tool names to prevent upstream 400 errors (#1775)
* feat: auto-restore probe-failed database to prevent data loss (#1810)
* fix: safely cast inputs to strings before calling trim() to avoid crashes on numeric fields in proxy modal (#1825)
* chore(release): v3.7.6 — final stability patches for production
* test: update expected db probe-failure error message for auto-restore feature
* chore(workflow): mandate implementation plan generation in resolve-issues
* docs(changelog): rewrite v3.7.6 with complete commit-accurate entries
* feat(analytics): add cost-based usage insights and activity streaks
Expand usage analytics to report total cost, per-series cost totals,
API key counts, and current activity streaks using pricing-aware token
calculations.
Also make probe-failed database recovery choose the newest backup by
its embedded timestamp instead of filesystem mtime so auto-restore
selects the intended snapshot reliably.
* fix(mitm): enforce transparent interception on port 443 only
Reject non-443 MITM port updates in the settings API and normalize
stored configuration back to the required transparent interception
port.
Lock the dashboard port field to 443, update the validation copy, and
add integration coverage to prevent stale custom ports from being
accepted or surfaced.
* docs(changelog): update for analytics and mitm features
---------
Co-authored-by: Andrew Munsell <andrew@wizardapps.net>
Co-authored-by: Antigravity Assistant <bot@antigravity.local>
Co-authored-by: Gi99lin <74502520+Gi99lin@users.noreply.github.com>
Co-authored-by: Sergey Morozov <tr0st@bk.ru>
Co-authored-by: payne <baboialex95@gmail.com>
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: ipanghu <bypanghu@163.com>
* docs(changelog): record PR #1748 for next release
* fix(models): apply blocked providers filter to non-chat catalog models (#1752)
* chore(release): v3.7.5 — integrate ngrok tunnel and fix models filter (#1753, #1752)
* chore(release): update changelog format for v3.7.5
* Speed up endpoint initial render
* Address endpoint review feedback
* Add endpoint loading model translations
* fix: resolve build issues and implement memory UPSERT logic (#1763)
* fix: resolve build issues for v3.7.5 and apply memory/translation fixes
1. antigravityHeaders.ts: restore ANTIGRAVITY_LOAD_CODE_ASSIST_* exports for oauth.ts compatibility
2. next.config.mjs: add @ngrok/ngrok to serverExternalPackages and webpack externals to handle native .node modules
3. Memory system: UPSERT logic to prevent duplicate entries with same apiKeyId + key
4. Chinese translations: complete CLI tools and memory dashboard localizations
5. Test fixes: unique keys for pagination tests to comply with unique constraint
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: address Gemini Code Assist review feedback
1. store.ts: add expires_at to UPDATE statement in UPSERT logic
- Previously, expires_at was not being persisted to database on update
- This caused state mismatch between returned Memory object and actual DB row
2. package-lock.json: revert react-markdown registry to official npmjs.org
- Mirror-specific registry URL (npmmirror.com) should not be in lockfile
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix(antigravity): normalize Gemini bridge payloads (#1769)
* fix(antigravity): normalize Gemini bridge payloads
Clamp Claude bridge output tokens, use Gemini-valid system roles and tool names, and serialize antigravity requests from a cloned body so Cloud Code payload shaping stays valid.
* fix(cli): stop fallback after unsafe known paths
Preserve known-path security checks by stopping command discovery when a configured CLI path is suspicious or non-executable, instead of falling through to PATH discovery.
* test(memory): make query result assertion deterministic
Avoid relying on database result ordering when checking filtered memory keys so the unit suite remains stable across runs.
* fix(review): preserve safe cloning and CLI reasons
Handle non-cloneable antigravity request bodies without throwing and preserve specific CLI known-path failure reasons instead of masking them as not_found.
* fix(sse): propagate AbortSignal to pre-fetch semaphore and rate-limit awaits (#1771)
When a combo target takes too long, the request-level deadline fires
and calls abortController.abort() on the stream controller, but the
abort signal never reaches pending awaits in acquireAccountSemaphore()
or withRateLimit(). These awaits sit between stream controller creation
and executor.execute(), causing requests to hang indefinitely past the
600s deadline.
Pass streamController.signal to both functions so they can respond to
abort events and terminate early when the request deadline expires.
Signed-off-by: wucm667 <stevenwucongmin@gmail.com>
* Fix model sync import handling (#1755)
* Fix model sync import handling
* Align model import storage semantics
* Address model review feedback
* fix(codex): stabilize copilot responses reasoning and tool replay (#1750)
* chore(xiaomi): Update Xiaomi provider model list (#1759)
* Move DB health to management API (#1757)
* Move DB health to management API
* Address DB health review feedback
* fix(kiro): support organization IDC OAuth with regional endpoints and refresh (#1754)
* fix(kiro): support organization IDC OAuth with regional endpoints and refresh
* fix(kiro): refresh IDC tokens with stored region
---------
Co-authored-by: ngocdb <ngocdb@ngocdb.local>
* chore(workflows): add strict PR contributor credit policy
- Add ABSOLUTE PROHIBITION section to review-prs.md
- Add PR PROHIBITION rule to resolve-issues.md
- Add contributor credit rule to AGENTS.md Review Focus
- Based on audit finding: 37 PRs had code absorbed without merge credit
* chore(release): acknowledge 29 community contributors with retroactive credit
This commit formally recognizes 29 contributors whose code was manually
integrated across releases v3.4.0 through v3.7.4 without proper GitHub
merge credit. Their PRs were resolved locally due to merge conflicts
but closed instead of merged, preventing them from appearing in the
Contributors graph. We have updated our workflows to ensure this never
happens again.
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Benson K B <4044180+benzntech@users.noreply.github.com>
Co-authored-by: clousky2020 <33016567+clousky2020@users.noreply.github.com>
Co-authored-by: Raxxoor <7317522+dhaern@users.noreply.github.com>
Co-authored-by: Jason Landbridge <15127381+JasonLandbridge@users.noreply.github.com>
Co-authored-by: slewis3600 <35925982+slewis3600@users.noreply.github.com>
Co-authored-by: Markus Hartung <12826053+hartmark@users.noreply.github.com>
Co-authored-by: Hernan Javier Ardila Sanchez <204746071+herjarsa@users.noreply.github.com>
Co-authored-by: 3_1_3_u <5846351+andruwa13@users.noreply.github.com>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: i1hwan <35260883+i1hwan@users.noreply.github.com>
Co-authored-by: xandr0s <1709302+xandr0s@users.noreply.github.com>
Co-authored-by: backryun <24198422+backryun@users.noreply.github.com>
Co-authored-by: Owen <36758131+kang-heewon@users.noreply.github.com>
Co-authored-by: Ravi Tharuma <25951435+RaviTharuma@users.noreply.github.com>
Co-authored-by: Chris <3751981+christopher-s@users.noreply.github.com>
Co-authored-by: Wellington Fonseca <5421548+wlfonseca@users.noreply.github.com>
Co-authored-by: Ethan Hunt <136065060+only4copilot@users.noreply.github.com>
Co-authored-by: tombii <6607822+tombii@users.noreply.github.com>
Co-authored-by: AndrewDragonIV <7906124+AndrewDragonIV@users.noreply.github.com>
Co-authored-by: Danh Thanh <50534210+dt418@users.noreply.github.com>
Co-authored-by: Will F <30637450+willbnu@users.noreply.github.com>
Co-authored-by: defhouse <232128212+defhouse@users.noreply.github.com>
Co-authored-by: Skydwest <186351198+mercs2910@users.noreply.github.com>
Co-authored-by: zenobit <6384793+zen0bit@users.noreply.github.com>
Co-authored-by: Ivan <16905671+razllivan@users.noreply.github.com>
Co-authored-by: foxy1402 <45601526+foxy1402@users.noreply.github.com>
Co-authored-by: Luan Dias <65574834+luandiasrj@users.noreply.github.com>
Co-authored-by: Sergei Korolev <891832+knopki@users.noreply.github.com>
Co-authored-by: dail45 <69967573+dail45@users.noreply.github.com>
* fix(combo): include 429 in provider circuit breaker to stop infinite retry on exhausted quotas (#1767)
Previously, PROVIDER_FAILURE_ERROR_CODES only included {408, 500, 502, 503, 504},
meaning 429 responses never counted toward the circuit breaker threshold. This caused
exhausted accounts to be retried every 3-5 seconds indefinitely instead of being
blocked by the provider breaker.
Adding 429 ensures persistent rate limiting triggers the circuit breaker after the
configured failure threshold, giving the provider time to recover.
* fix(claude): respect client thinking/effort params to prevent forced quota drain (#1761)
Previously, OmniRoute unconditionally injected thinking: {type: 'adaptive'} and
output_config: {effort: 'high'} for Claude Opus 4.7 in Claude Code client requests.
This caused Claude Max 5h quota to drain in ~15 minutes.
Now checks the original client body: if thinking or output_config are explicitly set
(even to null or a different value), the injection is skipped. Users can opt-out by
sending thinking: null or output_config: {effort: 'low'}.
* Add MseeP.ai badge to README.md (#1727)
Integrated into release/v3.7.5
* chore(docs): update CHANGELOG for PR #1727
* fix(tests): update stream-utils assertion for responses api compliance
* feat: Fix support for claude-cli using Gemini provider (#1779)
Integrated into release/v3.7.5
* fix(codex): align client identity metadata (#1778)
Integrated into release/v3.7.5
* fix(blackbox-web): correct cookie name and populate session/subscription fields (#1776)
Integrated into release/v3.7.5
* Fix Codex /responses/compact passthrough (#1777)
Integrated into release/v3.7.5
* test(reasoning-cache): isolate DB state using mkdtempSync to prevent 401 middleware errors
* chore(release): v3.7.5 — integrate remaining PRs and finalize stability
* chore(config): remove local patch artifacts and trim workspace config
Delete temporary patch scripts and local OMC session files that should not
ship with the repository.
Also remove the Next.js config file and expand editor and TypeScript
exclusions to ignore large local workspace directories and reduce
unnecessary indexing.
* fix(antigravity): cap Claude bridge output tokens (#1785)
Integrated into release/v3.7.5
* fix(codex): stabilize Copilot responses replay state (#1791)
Integrated into release/v3.7.5
* fix(chatgpt-web): restore validator + expand model catalog to ChatGPT Plus tier (#1792)
Integrated into release/v3.7.5
* fix(antigravity): scrub internal OmniRoute headers (#1794)
Integrated into release/v3.7.5
* fix(grok-web): fix Grok validator and cookie parsing (#1793)
Integrated into release/v3.7.5
* chore(release): v3.7.5 — finalize changelog for LTS patch
* feat(api-keys): add rename support in permissions modal
Add an editable key name field at the top of the permissions modal,
allowing users to rename API keys alongside existing permission settings.
The backend already supported name updates via PATCH /api/keys/:id — this
wires the UI to send the name field and refreshes the key list on success.
Changes:
- Add keyName state and text input to PermissionsModal
- Update handleUpdatePermissions to validate and send name in PATCH body
- Add integration test for rename via PATCH (valid, empty, too-long names)
- Update E2E mock to handle PATCH requests
* chore(release): finalize v3.7.5 LTS release with schema and db initialization fixes
* test: fix json escaping in stream-utilities test
* fix(build): restore next.config.mjs that was accidentally deleted
* fix(sse): decrement pending requests on passthrough mode failure (#1798)
Integrated into release/v3.7.5
* fix(grok-web): repair validator probe + accept full cookie blobs (#1793)
Integrated into release/v3.7.5
* docs(i18n): sync documentation updates to 40 languages
---------
Signed-off-by: wucm667 <stevenwucongmin@gmail.com>
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
Co-authored-by: R.D. <rogerproself@gmail.com>
Co-authored-by: clousky2020 <33016567+clousky2020@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: cloudy <37777261+uwuclxdy@users.noreply.github.com>
Co-authored-by: wucm667 <109257021+wucm667@users.noreply.github.com>
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: ivan-mezentsev <ivan@mezentsev.me>
Co-authored-by: backryun <bakryun0718@proton.me>
Co-authored-by: Dao Bao Ngoc <42265865+daongoc315@users.noreply.github.com>
Co-authored-by: ngocdb <ngocdb@ngocdb.local>
Co-authored-by: Benson K B <4044180+benzntech@users.noreply.github.com>
Co-authored-by: Raxxoor <7317522+dhaern@users.noreply.github.com>
Co-authored-by: Jason Landbridge <15127381+JasonLandbridge@users.noreply.github.com>
Co-authored-by: slewis3600 <35925982+slewis3600@users.noreply.github.com>
Co-authored-by: Markus Hartung <12826053+hartmark@users.noreply.github.com>
Co-authored-by: Hernan Javier Ardila Sanchez <204746071+herjarsa@users.noreply.github.com>
Co-authored-by: 3_1_3_u <5846351+andruwa13@users.noreply.github.com>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: i1hwan <35260883+i1hwan@users.noreply.github.com>
Co-authored-by: xandr0s <1709302+xandr0s@users.noreply.github.com>
Co-authored-by: backryun <24198422+backryun@users.noreply.github.com>
Co-authored-by: Owen <36758131+kang-heewon@users.noreply.github.com>
Co-authored-by: Ravi Tharuma <25951435+RaviTharuma@users.noreply.github.com>
Co-authored-by: Chris <3751981+christopher-s@users.noreply.github.com>
Co-authored-by: Wellington Fonseca <5421548+wlfonseca@users.noreply.github.com>
Co-authored-by: Ethan Hunt <136065060+only4copilot@users.noreply.github.com>
Co-authored-by: tombii <6607822+tombii@users.noreply.github.com>
Co-authored-by: AndrewDragonIV <7906124+AndrewDragonIV@users.noreply.github.com>
Co-authored-by: Danh Thanh <50534210+dt418@users.noreply.github.com>
Co-authored-by: Will F <30637450+willbnu@users.noreply.github.com>
Co-authored-by: defhouse <232128212+defhouse@users.noreply.github.com>
Co-authored-by: Skydwest <186351198+mercs2910@users.noreply.github.com>
Co-authored-by: zenobit <6384793+zen0bit@users.noreply.github.com>
Co-authored-by: Ivan <16905671+razllivan@users.noreply.github.com>
Co-authored-by: foxy1402 <45601526+foxy1402@users.noreply.github.com>
Co-authored-by: Luan Dias <65574834+luandiasrj@users.noreply.github.com>
Co-authored-by: Sergei Korolev <891832+knopki@users.noreply.github.com>
Co-authored-by: dail45 <69967573+dail45@users.noreply.github.com>
Co-authored-by: MseeP.ai <mseep@skydeck.ai>
Co-authored-by: Markus Hartung <mail@hartmark.se>
Co-authored-by: Raxxoor <manker_lol@hotmail.com>
Co-authored-by: Jack <5443152+hijak@users.noreply.github.com>
Co-authored-by: Sergey Morozov <tr0st@bk.ru>
Co-authored-by: payne <baboialex95@gmail.com>
Co-authored-by: Antigravity Assistant <bot@antigravity.local>
Co-authored-by: Andrew Munsell <andrew@wizardapps.net>
- #1712: Strip existing billing headers before injecting to fix prompt cache misses
- #1719: Strip output_config.format for non-Anthropic Claude endpoints
- #1707: Set terminal error state on quality validation failure (false ALL_ACCOUNTS_INACTIVE)
- #1706: Wrap proxy_assignments queries in try-catch for missing table on Electron
- #1704: Fix Windows file URL path resolution in migration runner with cwd fallback
- Replace polynomial regex /\/+$/ with loop-based stripTrailingSlashes()
across 8 enterprise provider configs (azure-openai, azureAi, bedrock,
datarobot, oci, sap, watsonx, audioSpeech) — fixes js/polynomial-redos
- Add prototype-pollution denylist guard in usageHistory.ts to reject
__proto__/constructor/prototype as model keys — fixes
js/prototype-polluting-assignment (#167, #168)
- Suppress 3 false-positive js/insufficient-password-hash alerts in
chatgpt-web.ts and builtins.ts where SHA-256 is used for cache-key
derivation, not password storage (#176, #177, #178)
- Add stripTrailingSlashes unit tests with ReDoS regression check
The billing header fingerprint was computed from the first user message text
via computeFingerprint(), which changes every conversation turn. This mutated
the system[] prefix on each request, invalidating Anthropic's prompt-cache
prefix and forcing ~100% cache_create (vs 96% cache_read with stable prefix).
Now uses a per-day SHA-256 hash of the date + ccVersion, keeping the billing
header format while preserving prompt-cache prefix stability across turns.
Includes 6 unit tests.
The prompt_cache_key was derived from the account-wide workspaceId, meaning
all conversations from the same OAuth account shared one cache partition.
The official Codex CLI uses conversation_id (a unique UUID per session).
Priority: body.session_id > body.conversation_id > workspaceId.
Session IDs are captured BEFORE deletion from the body.
Includes 10 unit tests.
