* docs(changelog): record PR #1748 for next release
* fix(models): apply blocked providers filter to non-chat catalog models (#1752)
* chore(release): v3.7.5 — integrate ngrok tunnel and fix models filter (#1753, #1752)
* chore(release): update changelog format for v3.7.5
* Speed up endpoint initial render
* Address endpoint review feedback
* Add endpoint loading model translations
* fix: resolve build issues and implement memory UPSERT logic (#1763)
* fix: resolve build issues for v3.7.5 and apply memory/translation fixes
1. antigravityHeaders.ts: restore ANTIGRAVITY_LOAD_CODE_ASSIST_* exports for oauth.ts compatibility
2. next.config.mjs: add @ngrok/ngrok to serverExternalPackages and webpack externals to handle native .node modules
3. Memory system: UPSERT logic to prevent duplicate entries with same apiKeyId + key
4. Chinese translations: complete CLI tools and memory dashboard localizations
5. Test fixes: unique keys for pagination tests to comply with unique constraint
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: address Gemini Code Assist review feedback
1. store.ts: add expires_at to UPDATE statement in UPSERT logic
- Previously, expires_at was not being persisted to database on update
- This caused state mismatch between returned Memory object and actual DB row
2. package-lock.json: revert react-markdown registry to official npmjs.org
- Mirror-specific registry URL (npmmirror.com) should not be in lockfile
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix(antigravity): normalize Gemini bridge payloads (#1769)
* fix(antigravity): normalize Gemini bridge payloads
Clamp Claude bridge output tokens, use Gemini-valid system roles and tool names, and serialize antigravity requests from a cloned body so Cloud Code payload shaping stays valid.
* fix(cli): stop fallback after unsafe known paths
Preserve known-path security checks by stopping command discovery when a configured CLI path is suspicious or non-executable, instead of falling through to PATH discovery.
* test(memory): make query result assertion deterministic
Avoid relying on database result ordering when checking filtered memory keys so the unit suite remains stable across runs.
* fix(review): preserve safe cloning and CLI reasons
Handle non-cloneable antigravity request bodies without throwing and preserve specific CLI known-path failure reasons instead of masking them as not_found.
* fix(sse): propagate AbortSignal to pre-fetch semaphore and rate-limit awaits (#1771)
When a combo target takes too long, the request-level deadline fires
and calls abortController.abort() on the stream controller, but the
abort signal never reaches pending awaits in acquireAccountSemaphore()
or withRateLimit(). These awaits sit between stream controller creation
and executor.execute(), causing requests to hang indefinitely past the
600s deadline.
Pass streamController.signal to both functions so they can respond to
abort events and terminate early when the request deadline expires.
Signed-off-by: wucm667 <stevenwucongmin@gmail.com>
* Fix model sync import handling (#1755)
* Fix model sync import handling
* Align model import storage semantics
* Address model review feedback
* fix(codex): stabilize copilot responses reasoning and tool replay (#1750)
* chore(xiaomi): Update Xiaomi provider model list (#1759)
* Move DB health to management API (#1757)
* Move DB health to management API
* Address DB health review feedback
* fix(kiro): support organization IDC OAuth with regional endpoints and refresh (#1754)
* fix(kiro): support organization IDC OAuth with regional endpoints and refresh
* fix(kiro): refresh IDC tokens with stored region
---------
Co-authored-by: ngocdb <ngocdb@ngocdb.local>
* chore(workflows): add strict PR contributor credit policy
- Add ABSOLUTE PROHIBITION section to review-prs.md
- Add PR PROHIBITION rule to resolve-issues.md
- Add contributor credit rule to AGENTS.md Review Focus
- Based on audit finding: 37 PRs had code absorbed without merge credit
* chore(release): acknowledge 29 community contributors with retroactive credit
This commit formally recognizes 29 contributors whose code was manually
integrated across releases v3.4.0 through v3.7.4 without proper GitHub
merge credit. Their PRs were resolved locally due to merge conflicts
but closed instead of merged, preventing them from appearing in the
Contributors graph. We have updated our workflows to ensure this never
happens again.
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Benson K B <4044180+benzntech@users.noreply.github.com>
Co-authored-by: clousky2020 <33016567+clousky2020@users.noreply.github.com>
Co-authored-by: Raxxoor <7317522+dhaern@users.noreply.github.com>
Co-authored-by: Jason Landbridge <15127381+JasonLandbridge@users.noreply.github.com>
Co-authored-by: slewis3600 <35925982+slewis3600@users.noreply.github.com>
Co-authored-by: Markus Hartung <12826053+hartmark@users.noreply.github.com>
Co-authored-by: Hernan Javier Ardila Sanchez <204746071+herjarsa@users.noreply.github.com>
Co-authored-by: 3_1_3_u <5846351+andruwa13@users.noreply.github.com>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: i1hwan <35260883+i1hwan@users.noreply.github.com>
Co-authored-by: xandr0s <1709302+xandr0s@users.noreply.github.com>
Co-authored-by: backryun <24198422+backryun@users.noreply.github.com>
Co-authored-by: Owen <36758131+kang-heewon@users.noreply.github.com>
Co-authored-by: Ravi Tharuma <25951435+RaviTharuma@users.noreply.github.com>
Co-authored-by: Chris <3751981+christopher-s@users.noreply.github.com>
Co-authored-by: Wellington Fonseca <5421548+wlfonseca@users.noreply.github.com>
Co-authored-by: Ethan Hunt <136065060+only4copilot@users.noreply.github.com>
Co-authored-by: tombii <6607822+tombii@users.noreply.github.com>
Co-authored-by: AndrewDragonIV <7906124+AndrewDragonIV@users.noreply.github.com>
Co-authored-by: Danh Thanh <50534210+dt418@users.noreply.github.com>
Co-authored-by: Will F <30637450+willbnu@users.noreply.github.com>
Co-authored-by: defhouse <232128212+defhouse@users.noreply.github.com>
Co-authored-by: Skydwest <186351198+mercs2910@users.noreply.github.com>
Co-authored-by: zenobit <6384793+zen0bit@users.noreply.github.com>
Co-authored-by: Ivan <16905671+razllivan@users.noreply.github.com>
Co-authored-by: foxy1402 <45601526+foxy1402@users.noreply.github.com>
Co-authored-by: Luan Dias <65574834+luandiasrj@users.noreply.github.com>
Co-authored-by: Sergei Korolev <891832+knopki@users.noreply.github.com>
Co-authored-by: dail45 <69967573+dail45@users.noreply.github.com>
* fix(combo): include 429 in provider circuit breaker to stop infinite retry on exhausted quotas (#1767)
Previously, PROVIDER_FAILURE_ERROR_CODES only included {408, 500, 502, 503, 504},
meaning 429 responses never counted toward the circuit breaker threshold. This caused
exhausted accounts to be retried every 3-5 seconds indefinitely instead of being
blocked by the provider breaker.
Adding 429 ensures persistent rate limiting triggers the circuit breaker after the
configured failure threshold, giving the provider time to recover.
* fix(claude): respect client thinking/effort params to prevent forced quota drain (#1761)
Previously, OmniRoute unconditionally injected thinking: {type: 'adaptive'} and
output_config: {effort: 'high'} for Claude Opus 4.7 in Claude Code client requests.
This caused Claude Max 5h quota to drain in ~15 minutes.
Now checks the original client body: if thinking or output_config are explicitly set
(even to null or a different value), the injection is skipped. Users can opt-out by
sending thinking: null or output_config: {effort: 'low'}.
* Add MseeP.ai badge to README.md (#1727)
Integrated into release/v3.7.5
* chore(docs): update CHANGELOG for PR #1727
* fix(tests): update stream-utils assertion for responses api compliance
* feat: Fix support for claude-cli using Gemini provider (#1779)
Integrated into release/v3.7.5
* fix(codex): align client identity metadata (#1778)
Integrated into release/v3.7.5
* fix(blackbox-web): correct cookie name and populate session/subscription fields (#1776)
Integrated into release/v3.7.5
* Fix Codex /responses/compact passthrough (#1777)
Integrated into release/v3.7.5
* test(reasoning-cache): isolate DB state using mkdtempSync to prevent 401 middleware errors
* chore(release): v3.7.5 — integrate remaining PRs and finalize stability
* chore(config): remove local patch artifacts and trim workspace config
Delete temporary patch scripts and local OMC session files that should not
ship with the repository.
Also remove the Next.js config file and expand editor and TypeScript
exclusions to ignore large local workspace directories and reduce
unnecessary indexing.
* fix(antigravity): cap Claude bridge output tokens (#1785)
Integrated into release/v3.7.5
* fix(codex): stabilize Copilot responses replay state (#1791)
Integrated into release/v3.7.5
* fix(chatgpt-web): restore validator + expand model catalog to ChatGPT Plus tier (#1792)
Integrated into release/v3.7.5
* fix(antigravity): scrub internal OmniRoute headers (#1794)
Integrated into release/v3.7.5
* fix(grok-web): fix Grok validator and cookie parsing (#1793)
Integrated into release/v3.7.5
* chore(release): v3.7.5 — finalize changelog for LTS patch
* feat(api-keys): add rename support in permissions modal
Add an editable key name field at the top of the permissions modal,
allowing users to rename API keys alongside existing permission settings.
The backend already supported name updates via PATCH /api/keys/:id — this
wires the UI to send the name field and refreshes the key list on success.
Changes:
- Add keyName state and text input to PermissionsModal
- Update handleUpdatePermissions to validate and send name in PATCH body
- Add integration test for rename via PATCH (valid, empty, too-long names)
- Update E2E mock to handle PATCH requests
* chore(release): finalize v3.7.5 LTS release with schema and db initialization fixes
* test: fix json escaping in stream-utilities test
* fix(build): restore next.config.mjs that was accidentally deleted
* fix(sse): decrement pending requests on passthrough mode failure (#1798)
Integrated into release/v3.7.5
* fix(grok-web): repair validator probe + accept full cookie blobs (#1793)
Integrated into release/v3.7.5
* docs(i18n): sync documentation updates to 40 languages
---------
Signed-off-by: wucm667 <stevenwucongmin@gmail.com>
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
Co-authored-by: R.D. <rogerproself@gmail.com>
Co-authored-by: clousky2020 <33016567+clousky2020@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: cloudy <37777261+uwuclxdy@users.noreply.github.com>
Co-authored-by: wucm667 <109257021+wucm667@users.noreply.github.com>
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: ivan-mezentsev <ivan@mezentsev.me>
Co-authored-by: backryun <bakryun0718@proton.me>
Co-authored-by: Dao Bao Ngoc <42265865+daongoc315@users.noreply.github.com>
Co-authored-by: ngocdb <ngocdb@ngocdb.local>
Co-authored-by: Benson K B <4044180+benzntech@users.noreply.github.com>
Co-authored-by: Raxxoor <7317522+dhaern@users.noreply.github.com>
Co-authored-by: Jason Landbridge <15127381+JasonLandbridge@users.noreply.github.com>
Co-authored-by: slewis3600 <35925982+slewis3600@users.noreply.github.com>
Co-authored-by: Markus Hartung <12826053+hartmark@users.noreply.github.com>
Co-authored-by: Hernan Javier Ardila Sanchez <204746071+herjarsa@users.noreply.github.com>
Co-authored-by: 3_1_3_u <5846351+andruwa13@users.noreply.github.com>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: i1hwan <35260883+i1hwan@users.noreply.github.com>
Co-authored-by: xandr0s <1709302+xandr0s@users.noreply.github.com>
Co-authored-by: backryun <24198422+backryun@users.noreply.github.com>
Co-authored-by: Owen <36758131+kang-heewon@users.noreply.github.com>
Co-authored-by: Ravi Tharuma <25951435+RaviTharuma@users.noreply.github.com>
Co-authored-by: Chris <3751981+christopher-s@users.noreply.github.com>
Co-authored-by: Wellington Fonseca <5421548+wlfonseca@users.noreply.github.com>
Co-authored-by: Ethan Hunt <136065060+only4copilot@users.noreply.github.com>
Co-authored-by: tombii <6607822+tombii@users.noreply.github.com>
Co-authored-by: AndrewDragonIV <7906124+AndrewDragonIV@users.noreply.github.com>
Co-authored-by: Danh Thanh <50534210+dt418@users.noreply.github.com>
Co-authored-by: Will F <30637450+willbnu@users.noreply.github.com>
Co-authored-by: defhouse <232128212+defhouse@users.noreply.github.com>
Co-authored-by: Skydwest <186351198+mercs2910@users.noreply.github.com>
Co-authored-by: zenobit <6384793+zen0bit@users.noreply.github.com>
Co-authored-by: Ivan <16905671+razllivan@users.noreply.github.com>
Co-authored-by: foxy1402 <45601526+foxy1402@users.noreply.github.com>
Co-authored-by: Luan Dias <65574834+luandiasrj@users.noreply.github.com>
Co-authored-by: Sergei Korolev <891832+knopki@users.noreply.github.com>
Co-authored-by: dail45 <69967573+dail45@users.noreply.github.com>
Co-authored-by: MseeP.ai <mseep@skydeck.ai>
Co-authored-by: Markus Hartung <mail@hartmark.se>
Co-authored-by: Raxxoor <manker_lol@hotmail.com>
Co-authored-by: Jack <5443152+hijak@users.noreply.github.com>
Co-authored-by: Sergey Morozov <tr0st@bk.ru>
Co-authored-by: payne <baboialex95@gmail.com>
Co-authored-by: Antigravity Assistant <bot@antigravity.local>
Co-authored-by: Andrew Munsell <andrew@wizardapps.net>
Register AWS Polly as an audio provider with SigV4 request signing,
speech engine discovery, and API-key validation for managed provider
flows.
Add Lemonade as a self-hosted OpenAI-compatible provider, expand
static model discovery to audio registries, and support Azure OpenAI
deployment discovery from resource endpoints.
Sanitize sensitive provider-specific AWS fields in API responses and
update related tests and release notes.
Expand the provider catalog with GitLab Duo PAT and OAuth support,
NLP Cloud, and new OpenAI-compatible gateways including Azure AI
Foundry, Bedrock, DataRobot, watsonx, OCI, SAP, Modal, Reka,
Clarifai, and Chutes.
Add specialized GitLab and NLP Cloud executors, provider-specific
URL normalization and validation flows, managed catalog/model
discovery updates, and dashboard metadata for the new providers.
Extend search support with You.com, including request building,
response normalization, validation coverage, and route/schema
registration.
Treat LM Studio, vLLM, Llamafile, Triton, Docker Model Runner,
XInference, and oobabooga as managed local providers with default
base URLs and passthrough model discovery.
Avoid sending empty bearer headers during validation, model discovery,
and execution so self-hosted endpoints work without API keys while
still honoring custom base URLs and localized dashboard hints.
* fix(streaming): #1211 greedy strip omniModel tags to prevent literal \n\n artifacts
- Changed regex quantifier from ? to * in combo.ts, comboAgentMiddleware.ts,
and contextHandoff.ts to greedily strip all JSON-escaped newline sequences
surrounding <omniModel> tags in SSE streaming chunks
- Added \r to the character class for cross-platform robustness
- Fixed Playwright strict-mode violation in combo-unification.spec.ts
- Bumped OpenAPI version and CHANGELOG to 3.6.6
* fix: 3 bugs found during issue triage (#1175, #1187/#1218, #1202)
- fix(gemini): strip VS Code JSON Schema extensions from tool schemas (#1175)
Add enumDescriptions, markdownDescription, markdownEnumDescriptions,
enumItemLabels and tags to UNSUPPORTED_SCHEMA_CONSTRAINTS so the Gemini
sanitizer removes them before forwarding. GitHub Copilot injects these
non-standard fields into tool definitions, causing Gemini to reject with
'Unknown name enumDescriptions at functionDeclarations[n].parameters'.
- fix(health-check): unwrap proxy config object before passing to getAccessToken (#1187#1218)
resolveProxyForConnection() returns { proxy, level, levelId } but the health
check loop was passing the full wrapper to getAccessToken(), which expects the
inner config object (.host, .port etc). The proxy dispatcher validated .host
on the wrapper (undefined) and threw 'Context proxy host is required', silently
marking every connection as unhealthy every sweep. Fix mirrors the pattern
already used in chatHelpers.ts: proxyResult?.proxy || null.
- fix(ui): debounce models.dev sync interval slider to save only on release (#1202)
The slider's onChange fired updateInterval() on every drag tick, sending a
PATCH per pixel of movement. Rapid API responses overwrote UI state mid-drag.
Introduce draftIntervalHours for smooth visual feedback; the PATCH fires
on onMouseUp / onBlur once the user releases the control.
* fix(providers): update Xiaomi MiMo token-plan endpoints (#1238)
Integrated into release/v3.6.6
* fix(cc-compatible): trim beta flags and preserve cache passthrough (#1230)
Integrated into release/v3.6.6
* feat(memory+skills): full-featured memory & skills systems with tests (#1228)
Integrated into release/v3.6.6
* fix: forward client x-initiator header to GitHub Copilot upstream (#1227)
Integrated into release/v3.6.6
* feat(bailian-quota): add Alibaba Coding Plan quota monitoring (#1235)
* fix: resolve v3.6.6 backlog bugs (#1206, #1211, #1220, #1231)
- fix(core): #1206 inject startup guard against app/ and src/app/ conflict
- fix(health): #1220 add HEALTHCHECK_STAGGER_MS to prevent token refresh bursting
- fix(proxy): #1231 prioritize HTTP 429 over quota body heuristics
- fix(sse): #1211 strip leading double-newlines in responses API stream
* fix(tests): resolve memory migration and skills route pagination bugs from PR overlaps
* docs: Update CHANGELOG.md with v3.6.6 features (#1182, #1165, #1177)
* chore(release): bump version to 3.6.6
Update package versions for the electron app and open-sse package.
Sync llm.txt metadata and feature headings with the 3.6.6 release.
* feat(core): harden outbound provider calls and add cooldown retries
Add guarded outbound fetch helpers with private/local URL blocking,
controlled retries, timeout normalization, and route-level status
propagation for provider validation and model discovery.
Introduce cooldown-aware chat retries with configurable
requestRetry and maxRetryIntervalSec settings, model-scoped cooldown
responses, and improved rate-limit learning from headers and error
bodies so short upstream lockouts can recover automatically.
Also align Antigravity and Codex header handling, require API keys
for Pollinations, validate web runtime env at startup, restore
sanitized Gemini tool names in translated responses, and inject a
synthetic Claude text block when upstream SSE completes empty.
* feat(models): add glmt preset and hybrid token counting
Introduce GLM Thinking as a first-class provider preset with shared GLM
model metadata, pricing, usage sync, dashboard support, and provider
request defaults for higher token budgets and longer timeouts.
Use provider-side /messages/count_tokens when a Claude-compatible
upstream supports it, while preserving estimated fallback behavior for
missing models, missing credentials, and upstream failures.
Also add startup seeding for default model aliases and normalize common
cross-proxy model dialects so canonical slashful model ids do not get
misrouted during resolution.
* feat(api): add sync tokens and v1 websocket bridge
Add dedicated sync token storage, issuance, revocation, and bundle
download routes backed by stable config bundle versioning and ETag
support.
Expose the v1 websocket handshake route and custom Next server bridge so
OpenAI-compatible websocket traffic can be upgraded and proxied through
the dashboard and API bridge.
Expand compliance auditing with structured metadata, pagination, request
context, auth and provider credential events, and SSRF-blocked
validation logging.
* docs: Update all documentation for v3.6.6
- CHANGELOG: Add WebSocket bridge, GLM Thinking preset, safe outbound
fetch/SSRF guard, cooldown-aware retries, compliance audit v2, model
alias seeding, and all Internal Improvements for the 3 new commits
- README: Expand v3.6.x highlights table with 10 new features; add
SafeOutboundFetch, CooldownAwareRetry, SSRF guard, TPS metric, sync
tokens, WebSocket bridge to Resilience/Observability/Deployment tables
- ARCHITECTURE: Bump date; add new modules to executive summary, API
routes, SSE core services, Auth/Security section; add SSRF/Outbound
guard failure mode (section 6); expand module mapping
- ENVIRONMENT: Add OMNIROUTE_CRYPT_KEY/OMNIROUTE_API_KEY_BASE64 legacy
aliases, OUTBOUND_SSRF_GUARD_ENABLED, CODEX_CLIENT_VERSION, and
REQUEST_RETRY/MAX_RETRY_INTERVAL_SEC cooldown retry settings
- FEATURES: Add 6 new feature sections — V1 WebSocket Bridge, Sync
Tokens & Config Bundle, GLM Thinking Preset, Safe Outbound Fetch &
SSRF Guard, Cooldown-Aware Retries, Compliance Audit v2
* fix: use api64 for proxy test (#1255)
Integrated into release/v3.6.6 — IPv6 proxy test fix
* fix(page): update custom models section to include all providers #1200 (#1256)
Integrated into release/v3.6.6 — Gemini custom model picker fix
* fix: provide default client_id fallbacks to prevent broken OAuth requests (#1246)
Integrated into release/v3.6.6 — OAuth client_id default fallbacks
* fix: translate max_tokens/max_completion_tokens → max_output_tokens in Chat→Responses translator (#1245)
Integrated into release/v3.6.6 — max_tokens → max_output_tokens Responses API translation + unit tests
* feat(oauth): support cursor-agent CLI as Cursor credential source (#1258)
Integrated into release/v3.6.6 — cursor-agent CLI credential source support
* fix(cc-compatible): restore upstream SSE and correct stream/combo timeout behavior (#1257)
Integrated into release/v3.6.6 — CC-compatible upstream SSE restore + stream timeout fix + README table repair
* fix(cli-tools): resolve API key resolution and model mapping bugs in CLI tools (#1263)
Integrated into release/v3.6.6
* feat(cli-tools): add Qwen Code CLI integration (#1266)
Integrated into release/v3.6.6
* fix(i18n): add missing zh-CN translations and fix logger imports (#1269)
Integrated into release/v3.6.6
* fix(i18n): add Chinese i18n support to dashboard components (#1274)
Integrated into release/v3.6.6
* feat: update Pollinations to require API key, remove free tier flag (#1177)
* feat: friendly error messages for crypto/encryption failures (#1165)
* feat: add TPS (tokens per second) metric column to request logs (#1182)
* feat: merge custom/imported models into filter list for all providers (#1191)
* feat(fallback): Fix provider-profile-driven lockouts (#1267)
This integrates rdself's unify-provider-profile-locks PR manually to handle structural conflicts.
* fix(claude): proper Anthropic SDK integration (#1271)
* fix(healthcheck): use correct proxy wrapper format for getAccessToken (#1272)
* chore(release): v3.6.6 — skills registry stability fix + final integration
* fix(auth): harden bootstrap auth and memory dashboard behavior
Restrict unauthenticated writes to /api/settings/require-login to
the initial bootstrap window while keeping read-only checks public.
This prevents post-setup config changes without blocking first-run
login setup, and the onboarding flow now logs in immediately after
setting the password.
Restore memory API filtering and pagination behavior by supporting q
searches, honoring offset-based requests, and avoiding unrelated
fallback results when FTS misses. Update dashboard stats fallback to
use the response totals consistently.
Package the MCP server with explicit file entries and add regression
tests for bootstrap auth and memory route behavior
* fix(codex): remove max_output_tokens from body for compatibility
* chore(release): v3.6.6 — include PR 1274 fixes in changelog
* chore: exclude additional build artifacts and internal directories from npm package distribution
* fix: update Gemini OAuth test to match registry defaults + codex UI improvements
* fix: restore .mjs refs for scripts/ in test imports after ts migration
* fix: restore next.config.mjs ref in dev-origins test
* fix: implement db migration safety checks and codex config format
* fix: disable mass-migration abort during unit tests based on auto-backup flag
* fix: update script regex in auto-update tests to use .mjs
* feat: Add Perplexity Web (Session) provider (#1289)
Integrated into release/v3.6.6
* fix(cli): resolve codex routing config parsing, standardize select model button positioning, and clarify oauth documentation
* docs(changelog): record recent cli, provider, and test updates
Document the latest fixes for Codex routing configuration parsing and
Lobehub provider icon fallback behavior.
Add the note that the remaining JavaScript test files were migrated to
TypeScript ES modules to reflect the completed test stack transition.
* chore(release): merge #1286 minor improvements manually to avoid testing conflict
* chore(test): rename perplexity-web.test.mjs to .ts to maintain 100% TS codebase
* chore(docs): update CHANGELOG.md for perplexity-web provider
* fix(security): resolve CodeQL incomplete URL substring sanitization via URL parsing in test mocks
* fix: integrate compressContext() into chatCore.ts request pipeline
Proactively compress oversized contexts before sending to upstream providers,
preventing context_length_exceeded errors. Compression triggers at 85% of
model's context limit using the existing 3-layer compressContext() function.
- Import compressContext, estimateTokens, getTokenLimit from contextManager
- Add compression check after translation, before executor dispatch
- Estimate tokens and compare against 85% threshold of model's context limit
- Apply 3-layer compression (trim tools, compress thinking, purify history)
- Log compression events with before/after token counts and layers applied
- Audit compression events for observability
- Add unit tests verifying integration behavior
Closes#1290
* fix(tests): align reasoning expectations with GLM thinking structure
* fix: prevent orphaned tool_result messages in purifyHistory()
When purifyHistory() drops oldest messages to fit context window, it can
split tool_use/tool_result pairs — keeping the tool_result but dropping
the tool_use that initiated it. This causes upstream providers to reject
the request with format errors.
Add fixToolPairs() that runs after each purification pass to remove:
- OpenAI format: orphaned role='tool' messages without matching tool_calls ID
- Claude format: orphaned tool_result content blocks without matching tool_use ID
Closes#1291
* fix(tests): supply tool_use in mock so it is not dropped
* chore: convert remaining test to TypeScript
* fix(tests): restore compatibility with compressContext threshold test after tsx migration
* docs: finalize v3.6.6 release documentation
* fix(core): finalize provider removal, type issues, and codex API key config
* fix(dashboard): render Web/Cookie, Search, Audio provider sections and fix TypeScript errors
* fix: increase MCP web_search timeout to 60s (#1278)
* fix: route combo testing properly for embedding models (#1260)
* fix: accumulate excluded accounts in combo fallback loop (#1233)
* fix: strip leading whitespace and newlines from first streaming chunk (#1211)
* docs: clarify VPS and Docker settings for OAuth credentials (#1204)
* fix: return real retry-after for pipeline gates (#1301)
Integrated into release/v3.6.6 — returns real Retry-After values from pipeline gates
* feat: streaming semantic cache, Cursor auto-version detection, and call-log enhancements (#1296)
Integrated into release/v3.6.6 — streaming semantic cache, Cursor auto-version detection, call-log cache_source tracking
* feat(api): support more OpenAI types (image, embeddings, audio-transcriptions, audio-speech) (#1297)
Integrated into release/v3.6.6 — adds embeddings, audio-transcriptions, audio-speech, and images-generations support for custom OpenAI-compatible providers, plus Pollinations image registry
* deps: bump hono from 4.12.12 to 4.12.14 (#1302)
Integrated into release/v3.6.6
* deps: bump hono from 4.12.12 to 4.12.14 (#1306)
Integrated into release/v3.6.6
* chore: stabilization fixes for v3.6.6 (#1298, #1254, #59, CI)
* fix(providers): match correct endpoint for Xiaomi MiMo, strip routing prefix for custom openai endpoints (#1303, #1261)
* feat(storage): add database backup cleanup controls
* chore(release): v3.6.6 — Final Stabilization Push
* Backport call log storage refactor to release/v3.6.6 (#1307)
Integrated into release/v3.6.6
* deps: update dompurify to 3.4.0 to resolve CVE-XYZ (#60)
* test: disable sqlite auto backup in CI to resolve E2E timeout (#24481475058)
* chore(docs): sync CHANGELOG for v3.6.6 with missing features and fixes
* chore(release): prep v3.6.6 infrastructure and type safety fixes
- Migrated legacy .mjs scripts to .ts (bin, prepublish, policies)
- Resolved pre-commit strict lint (t11 budget) errors in combo.ts
- Explicitly typed all TS bindings in pack-artifact policies
- Updated package.json commands to run Node via tsx/esm internally
- Hardened CI/CD with explicit node version 22.22.2 checks
- Completed stage validations for v3.6.6 final release
* chore: fix TS build errors and e2e timeouts in CI
- Migrate nodeRuntimeSupport to TS interfaces avoiding implicit any
- Increase visibility timeouts in skills-marketplace E2E test to 15s to bypass CI flakiness
- Complete migration of .mjs scripts to .ts ensuring type safety
* chore(release): sync package version 3.6.6 across workspaces
* test(e2e): universally increase UI component visibility timeouts from 5s to 15s to bypass CI starvation
* chore(build): inject baseUrl, paths, and types:node into MITM tsconfig within prepublish hook to fix missing types in CI check
---------
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
Co-authored-by: Jack <5443152+hijak@users.noreply.github.com>
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: Samuel Cedric <ceds.sam@gmail.com>
Co-authored-by: Max Garmash <max@37bytes.com>
Co-authored-by: Markus Hartung <mail@hartmark.se>
Co-authored-by: Gi99lin <74502520+Gi99lin@users.noreply.github.com>
Co-authored-by: Payne <baboialex95@gmail.com>
Co-authored-by: Benson K B <bensonkbmca@gmail.com>
Co-authored-by: clousky2020 <33016567+clousky2020@users.noreply.github.com>
Co-authored-by: Ravi Tharuma <25951435+RaviTharuma@users.noreply.github.com>
Co-authored-by: oyi77 <oyi77@users.noreply.github.com>
Co-authored-by: Hdsje <vovan877@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: xiaoge1688 <moyekongling@gmail.com>
Add automated SQLite health diagnostics with optional auto-repair,
startup and scheduled execution, authenticated API routes, an MCP tool,
and dashboard visibility for status and repair actions.
Improve provider compatibility by adding Cursor usage fetching and
v3.1.0 parity headers, introducing a per-connection Codex Responses
store opt-in with session fallback, fixing Codex non-stream combo and
SSE translation behavior, sanitizing Gemini googleSearch tool payloads
and Qwen thinking tool_choice handling, and hardening cleanup and call
log storage paths.
Move model routing management into Settings and add a unified
model alias editor for exact and wildcard remaps.
Sync combo defaults with global routing strategy settings, add
localized combo onboarding copy, and expand routing i18n across
supported locales.
Also fix supporting routing behavior by accepting all strategy
values in settings schemas, preserving connection ids in combo
tests, honoring non-stream JSON requests for CC-compatible
providers, and handling hashed external package subpaths.
- Add emailPrivacyStore (Zustand + persist) for global toggle state
- Add EmailPrivacyToggle component with eye open/closed icons
- Add pickDisplayValue() visibility-aware masking function
- Integrate toggle into provider detail, usage limits & playground pages
- Per-modal showEmail now uses global store (synced across all pages)
- Default: emails hidden; toggle persists across page reloads
- Add showEmails/hideEmails i18n keys
- Update CHANGELOG.md and openapi.yaml to v3.6.2
* fix(minimax): switch auth from x-api-key to Authorization Bearer (#1076)
Integrated into release/v3.5.6 — MiniMax auth fix with authHeader consistency normalization
* feat(CI,i18n): autogenerate language files + Add missing strings (#1071)
Integrated into release/v3.5.6 — i18n translations for memory, skills, and missing keys across 31 languages
* fix(ci): restore i18n continue-on-error, remove auto-commit race condition
* fix(husky): load nvm in hooks for VS Code compatibility
* fix(husky): gracefully skip hooks when npm is not in PATH
* fix: convert OpenAI function tool_choice to Claude tool format (#1072)
* fix: prevent EPIPE feedback loop filling logs at GB/s (#1006)
* fix: fallback to native fetch when undici dispatcher fails (#1054)
* fix: improve Qoder PAT validation with actionable error messages (#966)
- Add QODER_PERSONAL_ACCESS_TOKEN env var fallback for both validation and execution
- Pre-flight ping check to diagnose connectivity issues (Docker/proxy)
- Detect encrypted auth blobs from ~/.qoder/.auth/user and guide to website PAT
- Clear error messages for auth failures with link to integrations page
- Treat non-auth 4xx as auth-pass (request format issue, not token issue)
- Update tests to cover new validation paths (23 tests, all passing)
* feat: Improve the Chinese translation (#1079)
Integrated into release/v3.5.6
* chore(release): v3.5.6 — i18n updates and credential security fixes
* fix(ci): resolve e2e and docs-sync pipeline failures
* fix(security): bump next to 16.2.3 to resolve SNYK-JS-NEXT-15954202
* fix: guard Memory/Cache UI against null toLocaleString crash (#1083)
* fix: translate OpenAI tool_choice type 'function' to Claude 'tool' format (#1072)
* fix: pass custom baseUrl in provider API key validation (#1078)
* docs: update CHANGELOG with v3.5.6 bug fixes and security patches
* docs: rewrite implement-features workflow with 5-phase harvest-research-report-plan-execute pipeline
* docs: organize _ideia/ into viable/defer/notfit + add Phase 2.5 auto-response workflow
* docs: implementation plans for #1025, #750, #960, #1046 + close already-implemented #833, #973, #982
* feat: mask email addresses in dashboard for privacy (#1025)
* feat: add OpenRouter and GitHub to embedding/image provider registries (#960)
* feat: add model visibility toggle and search filter to provider page (#750)
* docs: move implemented features to notfit, update task plans status
* chore: untrack _ideia/ and _tasks/ from git — private/internal only
* chore(release): bump to v3.5.6 — changelog, docs, version sync & any-budget fix
* fix: remove explicit .ts extension in qoderCli import that caused 500 error in production build
---------
Co-authored-by: Jean Brito <jeanfbrito@gmail.com>
Co-authored-by: zenobit <zenobit@disroot.org>
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
Co-authored-by: Ethan Hunt <136065060+only4copilot@users.noreply.github.com>
The word 'any' in a JSDoc comment was matched by the regex-based t11 checker. Reworded to 'prefixes' to eliminate the false positive.
Made-with: Cursor
- #493: Fix custom provider model naming — removed incorrect prefix
stripping in DefaultExecutor.transformRequest() that broke org-scoped
model IDs like 'zai-org/GLM-5-FP8'
- #490: Enable context cache protection for streaming responses using
TransformStream to inject omniModel tag as final SSE content delta
before [DONE] marker
- #452: Add per-API-key request-count limits (max_requests_per_day,
max_requests_per_minute) with in-memory sliding window counter,
schema auto-migration, and Check 5 in enforceApiKeyPolicy()
* feat: add api-key Kimi Coding provider support
* fix(kimi-coding): honor apikey auth header in executor
Ensure DefaultExecutor sends x-api-key for kimi-coding-apikey at runtime
and deduplicate shared kimi coding config blocks in registry and models
config to reduce drift between oauth and apikey variants.
---------
Co-authored-by: OmniRoute Agent <agent@omniroute.local>
Allow provider_nodes to configure custom chat and models endpoint
paths via chatPath/modelsPath fields. This enables providers with
non-standard versioned APIs (e.g. /v4/chat/completions) to work
without embedding the version prefix in base_url.
- Add migration 003: chat_path and models_path columns
- Update Zod schemas (create, update, validate)
- Update CRUD in providers.ts (INSERT/UPDATE)
- Wire chatPath/modelsPath through API routes and providerSpecificData cascade
- Read chatPath in DefaultExecutor and BaseExecutor buildUrl()
- Use modelsPath in validate endpoint
- Add Advanced Settings UI section (collapsible) in create/edit modals
- Update base URL hint to reference Advanced Settings
- Add i18n keys across all 30 locales
- Add unit tests for buildUrl with custom paths
Backward compatible: NULL chatPath/modelsPath = default behavior.
- Changed model.split('/').pop() to model.split('/').slice(1).join('/')
- Preserves vendor namespace in model names (e.g. moonshotai/Kimi-K2-Instruct)
- Also fixes multimodal image_url → input_image conversion for Responses API (#242)
- image_url parts from Chat Completions are now properly converted to input_image format
OmniRoute is an intelligent API gateway that unifies 20+ AI providers behind a single
OpenAI-compatible endpoint. Features include intelligent routing with 6 strategies,
multi-format translation (OpenAI/Claude/Gemini/Responses API), circuit breakers,
semantic caching, combo fallback chains, real-time health monitoring, and a full
dashboard with provider management, analytics, and CLI tool integration.
Key highlights:
- 20+ providers (Claude Code, Codex, Gemini CLI, GitHub Copilot, iFlow, Qwen, Kiro, etc.)
- 6 routing strategies (Fill First, Round Robin, P2C, Random, Least Used, Cost Optimized)
- Export/Import database backup with full archive support
- Translator Playground with 4 modes (Playground, Chat Tester, Test Bench, Live Monitor)
- 100% TypeScript across src/ and open-sse/
- Docker support with multi-stage builds
- Comprehensive documentation and 9 dashboard screenshots
