Previously, OmniRoute unconditionally injected thinking: {type: 'adaptive'} and
output_config: {effort: 'high'} for Claude Opus 4.7 in Claude Code client requests.
This caused Claude Max 5h quota to drain in ~15 minutes.
Now checks the original client body: if thinking or output_config are explicitly set
(even to null or a different value), the injection is skipped. Users can opt-out by
sending thinking: null or output_config: {effort: 'low'}.
* fix(antigravity): normalize Gemini bridge payloads
Clamp Claude bridge output tokens, use Gemini-valid system roles and tool names, and serialize antigravity requests from a cloned body so Cloud Code payload shaping stays valid.
* fix(cli): stop fallback after unsafe known paths
Preserve known-path security checks by stopping command discovery when a configured CLI path is suspicious or non-executable, instead of falling through to PATH discovery.
* test(memory): make query result assertion deterministic
Avoid relying on database result ordering when checking filtered memory keys so the unit suite remains stable across runs.
* fix(review): preserve safe cloning and CLI reasons
Handle non-cloneable antigravity request bodies without throwing and preserve specific CLI known-path failure reasons instead of masking them as not_found.
- #1712: Strip existing billing headers before injecting to fix prompt cache misses
- #1719: Strip output_config.format for non-Anthropic Claude endpoints
- #1707: Set terminal error state on quality validation failure (false ALL_ACCOUNTS_INACTIVE)
- #1706: Wrap proxy_assignments queries in try-catch for missing table on Electron
- #1704: Fix Windows file URL path resolution in migration runner with cwd fallback
- Replace polynomial regex /\/+$/ with loop-based stripTrailingSlashes()
across 8 enterprise provider configs (azure-openai, azureAi, bedrock,
datarobot, oci, sap, watsonx, audioSpeech) — fixes js/polynomial-redos
- Add prototype-pollution denylist guard in usageHistory.ts to reject
__proto__/constructor/prototype as model keys — fixes
js/prototype-polluting-assignment (#167, #168)
- Suppress 3 false-positive js/insufficient-password-hash alerts in
chatgpt-web.ts and builtins.ts where SHA-256 is used for cache-key
derivation, not password storage (#176, #177, #178)
- Add stripTrailingSlashes unit tests with ReDoS regression check
The billing header fingerprint was computed from the first user message text
via computeFingerprint(), which changes every conversation turn. This mutated
the system[] prefix on each request, invalidating Anthropic's prompt-cache
prefix and forcing ~100% cache_create (vs 96% cache_read with stable prefix).
Now uses a per-day SHA-256 hash of the date + ccVersion, keeping the billing
header format while preserving prompt-cache prefix stability across turns.
Includes 6 unit tests.
The prompt_cache_key was derived from the account-wide workspaceId, meaning
all conversations from the same OAuth account shared one cache partition.
The official Codex CLI uses conversation_id (a unique UUID per session).
Priority: body.session_id > body.conversation_id > workspaceId.
Session IDs are captured BEFORE deletion from the body.
Includes 10 unit tests.
Reported by user testing in Open WebUI: across three turns
user "test 1" -> "1"
user "test 2" -> "12" (should be "2")
user "test 3. reply only with 3" -> "1123" (should be "3")
The model was literally APPENDING prior assistant outputs into the new
generation instead of producing a fresh response. Root cause: when
sending each prior turn as a separate `assistant`-role entry in
`/backend-api/f/conversation`'s `messages` array, ChatGPT's web API
("action: next") treats those as in-progress messages the model can
continue rather than as completed turns. So the new generation extends
the most recent assistant message.
Fix: don't replay prior turns as separate messages. Instead fold the
full history into the system message as plain text and send only the
current user query as a single new turn. Verified end-to-end:
Turn 1 -> "1"
Turn 2 -> "2"
Turn 3 -> "3"
user "favorite color is teal" / assistant "Got it" / user "what color?"
-> "Teal" (memory still preserved through the system-message channel)
Streaming + multi-turn -> correct, real-time chunks
Updated two unit tests that previously asserted history items showed up
as separate `user`/`assistant` messages in the request — they now check
for the single-user-message + history-in-system-message shape.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Round of fixes addressing the gemini-code-assist and chatgpt-codex review
comments on the initial PR.
## High priority
- **PoW solver no longer blocks the event loop** (gemini #1, #2). The 100k
prekey solver and 500k proof-of-work solver were synchronous SHA3-512
loops that pinned a CPU core for tens to hundreds of milliseconds per
request. Both are now async and `await`-yield to the event loop every
1000 iterations via setImmediate, so concurrent requests and I/O still
get scheduled. Wall time is approximately the same; what changes is
fairness, not throughput.
- **Real upstream streaming for stream=true requests** (codex #6). The
conv call now passes `stream: true` through to the TLS client when the
caller asked for streaming. The TLS client uses tls-client-node's
streamOutputPath primitive to write the response body to a temp file
as it arrives, and we tail that file as a ReadableStream so clients
see chunks in real time instead of getting one buffered burst at the
end. Also peeks the first 256 bytes — if the response starts with
`{` it's almost certainly a JSON error envelope, so we wait for the
full body and surface as a non-streaming error response.
## Medium priority
- **Per-cookie device id** (gemini #3). Replaced the single
process-wide DEVICE_ID with a per-cookie SHA-256-derived UUID that's
stable across requests for one connection but unique per cookie. This
matches how the browser's persistent oai-did cookie behaves and
avoids cross-account fingerprint sharing. Cache is bounded to 200
entries with FIFO eviction.
- **Removed dead conv-cache code** (gemini #4). The convCache /
convLookup / convStore trio (~70 LOC) was unused — conversationId is
hard-pinned to null because Temporary Chat conversation_ids 404 on
reuse. Deleted entirely; the comment explains why we don't persist.
- **No more console.log in the conv 4xx path** (gemini #5). Replaced
with log?.warn so it respects the application's logging
configuration.
- **Bound the warmup cache** (codex #7). The (cookie, accessToken) ->
timestamp map was unbounded; long-running multi-user deployments
with rotating tokens would grow it forever. Now capped at 200
entries with FIFO eviction (Map iteration order = insertion order).
- **Honor abort signals in TLS fetch** (codex #8). tlsFetchChatGpt now
checks options.signal before issuing the upstream call, after the
call returns, and the streaming body listens for abort to stop
tailing the temp file. tls-client-node's koffi binding can't cancel
an in-flight request mid-call, but we no longer process / re-emit a
response that the caller has already given up on.
## Tests
All 27 chatgpt-web tests still pass; updated several to find calls by
URL via findIndex rather than hardcoded indices, since the warmup
sequence (/me, /conversations, /models) and two-stage Sentinel
(prepare + chat-requirements) shifted positional offsets.
Manually verified end-to-end:
- Non-streaming completions
- Streaming completions (real-time chunks; SSE [DONE] terminator)
- Multi-turn with full history each turn (memory preserved correctly)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds a new chatgpt-web provider that routes through chatgpt.com's internal
backend-api using a Plus/Pro subscription session cookie, enabling access
to GPT-5.x models without an OpenAI API key.
Heavier than perplexity-web/grok-web because chatgpt.com layers more bot
protection — this PR builds out the full pipeline needed to look like a
real browser session.
## New executor: open-sse/executors/chatgpt-web.ts
Auth/request pipeline (per chat completion):
1. exchangeSession() GET /api/auth/session cookie -> JWT (cached ~5min)
2. fetchDpl() GET / scrape data-build + script src
3. runSessionWarmup() GET /backend-api/me, /conversations, /models
4. POST /sentinel/chat-requirements/prepare -> prepare_token
5. POST /sentinel/chat-requirements -> chat-requirements-token + PoW seed/diff
6. solveProofOfWork() SHA3-512 loop -> "gAAAAAB..." sentinel proof token
7. POST /backend-api/f/conversation with all sentinel headers
8. parse SSE stream -> OpenAI chat.completion[.chunk] format
Notable details:
- 18-element prekey config matching chat2api/openai-sentinel (browser fingerprint
values, U+2212 MINUS SIGN in `webdriver−false`). Thin shapes get escalated to
mandatory Turnstile.
- Two-stage Sentinel handshake (/prepare + /chat-requirements) — sending only
the prepare result returns a 403 "Unusual activity" response.
- `turnstile.required: true` from Sentinel is treated as advisory; the conv
endpoint accepts requests without a Turnstile token as long as PoW + chat-
requirements-token are valid. Optional bring-your-own Turnstile via
`providerSpecificData.turnstileToken` for accounts that hard-require it.
- SSE parser tracks message_id and resets the accumulator on a new turn —
chatgpt.com echoes prior assistant messages (with status finished_successfully)
before sending the new turn.
- entity["...","value", ...] internal markup stripped from output (browser
renders these client-side).
- Conversation-continuity cache disabled by default: we send
history_and_training_disabled: true (Temporary Chat mode) and those
conversation_ids expire too fast to reuse — re-using returned 404. Each
request now sends conversation_id: null and replays full history, matching
what Open WebUI and OpenAI-API-style clients send anyway.
## TLS impersonation: open-sse/services/chatgptTlsClient.ts
ChatGPT's Cloudflare config pins cf_clearance to JA3/JA4 TLS fingerprint +
HTTP/2 SETTINGS frame. Plain Node Undici fetch always returns
cf-mitigated: challenge regardless of cookies. The wrapper module loads
`tls-client-node` (Firefox 148 fingerprint) in native runtime mode (.so via
koffi) — managed mode spawns a sidecar that conflicts with OmniRoute's
global fetch proxy patch.
- Lazy singleton TLSClient with process exit hooks
- Streaming-capable (file tail) and non-streaming modes
- Test injection point: __setTlsFetchOverrideForTesting() lets unit tests mock
the client without touching globalThis.fetch
## Provider wiring
- open-sse/executors/index.ts — register ChatGptWebExecutor with cgpt-web alias
- open-sse/config/providerRegistry.ts — registry entry, format=openai,
authHeader=cookie, model gpt-5.3-instant
- src/shared/constants/providers.ts — WEB_COOKIE_PROVIDERS UI metadata
(icon, color, authHint)
- src/lib/providers/validation.ts — validateChatGptWebProvider hits
/api/auth/session via the TLS client, detects cf-mitigated/HTML responses
and returns a clear "paste full Cookie line" hint instead of a generic
"Invalid"
- next.config.mjs — mark tls-client-node, koffi, tough-cookie as external
packages (Turbopack can't bundle the native .so)
## Cookie format
Validator and executor accept any of:
- bare value: "eyJhbGc..."
- unchunked cookie line: "__Secure-next-auth.session-token=eyJ..."
- chunked cookie line: "__Secure-next-auth.session-token.0=...; __Secure-next-auth.session-token.1=..."
- full DevTools Cookie header line: "Cookie: __Secure-next-auth.session-token.0=...; cf_clearance=...; ..."
NextAuth chunks the JWE when it exceeds 4KB; chunked cookies pass through
verbatim (NextAuth reassembles server-side). Recommend pasting the full
DevTools Cookie line so cf_clearance, __cf_bm, _cfuvid, _puid travel along —
without cf_clearance, Cloudflare blocks the request before NextAuth sees it.
## Tests
tests/unit/chatgpt-web.test.ts — 27 tests, all passing:
- Registration + alias resolution
- Token exchange (cookie -> Bearer flow)
- Token cache TTL
- Refreshed cookie surfaced via onCredentialsRefreshed callback
- Sentinel call ordering (session -> prepare -> chat-requirements -> conv)
- Sentinel chat-requirements-token forwarded on conv request
- PoW token has gAAAAAB prefix
- Turnstile.required: true does NOT block conv (passes through)
- Non-streaming chat.completion JSON
- Streaming SSE chunks ending with [DONE]
- Cumulative-parts diffing yields non-overlapping deltas
- Errors: 401 session, 403 sentinel, 429 conv rate-limit
- Empty messages -> 400 without any fetch
- Missing apiKey -> 401 without any fetch
- Cookie format: bare value, unchunked, chunked, "Cookie: ..." DevTools line
- Conversation continuity: each call starts a fresh conversation
- Browser-like headers on conv POST (UA, Origin, Sec-Fetch-Site, Accept)
- Payload shape (action, model=gpt-5-3, history_and_training_disabled)
- Provider registry contains chatgpt-web with gpt-5.3-instant model
Verification: typecheck:core clean, lint clean (no new warnings),
end-to-end manually verified across single-turn, multi-turn (memory
preserved), streaming, and Open WebUI-style sequential growing-history
flows.
## References
- bogdanfinn/tls-client (Go) — TLS impersonation upstream
- fatihkabakk/tls-client-node — Node bindings
- lanqian528/chat2api — Sentinel/PoW/prekey reference impl (Python)
- leetanshaj/openai-sentinel — Prekey config + SHA3-512 solver
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Register AWS Polly as an audio provider with SigV4 request signing,
speech engine discovery, and API-key validation for managed provider
flows.
Add Lemonade as a self-hosted OpenAI-compatible provider, expand
static model discovery to audio registries, and support Azure OpenAI
deployment discovery from resource endpoints.
Sanitize sensitive provider-specific AWS fields in API responses and
update related tests and release notes.
* fix(sse): preserve Responses API hosted tools in Codex executor
normalizeCodexTools was dropping every non-function tool, which stripped
Codex CLI's built-in image_generation tool (and other hosted tools like
web_search / file_search) before they reached OpenAI. Add a whitelist
and structural check so they pass through, while keeping unknown types
filtered locally with a debug log.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(sse): route DALL-E-style image generation through Codex hosted tool
Adds a Codex branch to the /v1/images/generations handler so DALL-E-style
requests with `model: codex/*` (or `cx/*`) are translated into /responses
calls with the `image_generation` hosted tool, then unpacked back into
OpenAI image response shape. Enables OpenWebUI and other clients that hit
the legacy images endpoint to drive Codex image generation.
Also defaults `store: false` in the Codex executor whenever an
`image_generation` tool is present — the Codex backend rejects store=true
with hosted image generation ("Store must be set to false").
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(sse): forward size/quality from DALL-E body to Codex image_generation tool
The Codex image-gen shim was ignoring `size` and `quality` from the incoming
/v1/images/generations body, so OpenWebUI's size and quality selectors had
no effect. Forward both into the hosted tool config, mapping DALL-E's
`standard`/`hd` to the image_generation tool's `medium`/`high` so legacy
clients keep working.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(providers): add Petals and Nous Research provider support
Register Nous Research as an OpenAI-compatible gateway with remote
model discovery and validation against chat completions.
Add Petals provider metadata, default config, validation, and a
specialized executor that maps OpenAI-style requests to the public
generate endpoint. Also allow optional API keys and configurable base
URLs for Petals in the dashboard and provider schemas.
Expand provider model and catalog tests to cover both integrations.
* fix(resilience): sync queue updates and clear stale discovery caches
Await runtime request queue updates so limiter settings and auto-enabled
API key protections are recomputed when resilience settings change.
Preserve cancelled batch state for in-flight work by marking input files
processed without generating output artifacts, and replace cached synced
models with an empty set when remote discovery returns no models so the
providers route falls back to the local catalog instead of stale cache.
---------
Co-authored-by: Payne <trader-payne@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
* fix(claude): preserve tool_result adjacency in native and CC-compatible paths
* feat(providers): add Petals and Nous Research provider support
Register Nous Research as an OpenAI-compatible gateway with remote
model discovery and validation against chat completions.
Add Petals provider metadata, default config, validation, and a
specialized executor that maps OpenAI-style requests to the public
generate endpoint. Also allow optional API keys and configurable base
URLs for Petals in the dashboard and provider schemas.
Expand provider model and catalog tests to cover both integrations.
* fix(resilience): sync queue updates and clear stale discovery caches
Await runtime request queue updates so limiter settings and auto-enabled
API key protections are recomputed when resilience settings change.
Preserve cancelled batch state for in-flight work by marking input files
processed without generating output artifacts, and replace cached synced
models with an empty set when remote discovery returns no models so the
providers route falls back to the local catalog instead of stale cache.
---------
Co-authored-by: congvc <congvc-dev@gmail.com>
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
Expand the provider catalog with GitLab Duo PAT and OAuth support,
NLP Cloud, and new OpenAI-compatible gateways including Azure AI
Foundry, Bedrock, DataRobot, watsonx, OCI, SAP, Modal, Reka,
Clarifai, and Chutes.
Add specialized GitLab and NLP Cloud executors, provider-specific
URL normalization and validation flows, managed catalog/model
discovery updates, and dashboard metadata for the new providers.
Extend search support with You.com, including request building,
response normalization, validation coverage, and route/schema
registration.
Add Amazon Q as a Kiro-compatible OAuth provider across execution,
token refresh, usage reporting, dashboard connection flows, and model
catalog exposure.
Add Voyage AI embedding and rerank catalogs plus Jina AI rerank support,
including local model catalog handling, API key validation, provider
metadata, and rerank error reporting updates.
Refresh built-in GitHub Copilot and Kiro model registries to match the
current supported lineup and extend test coverage for the new provider
paths.
Treat LM Studio, vLLM, Llamafile, Triton, Docker Model Runner,
XInference, and oobabooga as managed local providers with default
base URLs and passthrough model discovery.
Avoid sending empty bearer headers during validation, model discovery,
and execution so self-hosted endpoints work without API keys while
still honoring custom base URLs and localized dashboard hints.
Register LM Studio as an OpenAI-compatible local provider and map the
new grok-4.3 thinking model for web executor requests.
This update also hardens related platform behavior by switching backup
archive creation to execFileSync, validating ACP agent ids, expanding
shared CORS handling, and making prompt injection guard failures return
an explicit 500 response.
To preserve existing stored credentials, encryption now derives new
keys from a secret-based salt while still falling back to the legacy
static-salt key during decryption.
