pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-05 06:42:12 +03:00
Code Issues Packages Projects Releases Wiki Activity
4,579 Commits 205 Branches 313 Tags
b8cc4feef13e8178ea8b6781f30b1383cd1f35fa
Commit Graph

4579 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Diego Rodrigues de Sa e Souza
b8cc4feef1 fix(proxy): repair one-click Deno & Cloudflare relay deployments (#5128) (#5132) 2026-06-27 00:13:55 -03:00
Diego Rodrigues de Sa e Souza
86b8938e2c fix(security): exact-host Anthropic baseUrl check (CodeQL js/incomplete-url-substring-sanitization #674) (#5130) 
The anthropic-compatible Bearer-fallback gate decided whether a configured baseUrl
targeted the official api.anthropic.com host via a substring `.includes("api.anthropic.com")`.
A look-alike upstream such as `https://api.anthropic.com.evil.test` or
`https://evil.test/?x=api.anthropic.com` matched the substring and was wrongly treated as
official, suppressing the Bearer fallback meant for third-party gateways
(CodeQL #674, js/incomplete-url-substring-sanitization, high).

Replace the substring test with an exported `isOfficialAnthropicBaseUrl()` helper that
parses the URL and compares the hostname for exact equality. Empty baseUrl stays official;
scheme-less hosts are parsed with an assumed https://; an unparseable baseUrl falls back to
third-party (Bearer emitted) as the safer default. Behavior for legitimate official/third-party
baseUrls is unchanged.

Adds tests/unit/anthropic-official-baseurl-host.test.ts covering official, look-alike,
scheme-less, and unparseable inputs plus a static guard that the substring pattern is gone.
 2026-06-26 23:14:17 -03:00
Diego Rodrigues de Sa e Souza
5eaf230da9 chore(quality): reconcile complexity + file-size baselines for v3.8.38 owner-PR batch 
complexity 1972->1978 (+6) and file-size providers.ts 1093->1107 / usageHistory.ts
934->983 — drift from the /review-prs merge batch (#4845/#5105/#5020/#4940/#5093/
#5015 + #5121 cookie-dedup helper extraction). check:complexity/check:file-size do
not run on the PR->release fast-path, so the branch accrued unmeasured; all legit
feature/fix growth, not regression. See per-key justifications in each baseline.
 2026-06-26 22:55:40 -03:00
Jan Leon
c0830c95ab Hydrate quota cache and scope auto combo candidates (#5015) 
Integrated into release/v3.8.38 (rebased on tip). Kept core quota-cache hydration + auto-combo candidate scoping + combos UI; dropped out-of-scope toolCloaking refactor (conflicted with #4813 stripEnumDescriptions — took tip) and the unrelated sse-auth test split. Added quota-cache-hydrate-5015 regression test (Rule #18); combo-account-allowlist 8/8 + hydration 2/2 green.
 2026-06-26 22:51:25 -03:00
KooshaPari
09ac615894 fix(resilience): harden quota and model lockout edge cases (#5093) 
Integrated into release/v3.8.38 (rebased on tip). TRUST-BUT-VERIFY: dropped the PR's 0dd7df641 'fix unit gates' commit which reverted #5122 reasoning-replay (preserveReasoningContent) + re-introduced #4849 O(n^2) growth, and restored 5 tests it had realigned. Kept only the 3 declared resilience fixes (quota cutoff guard, gemini MIME, model-lockout maxCooldownMs); 23/23 green.
 2026-06-26 22:46:19 -03:00
Diego Rodrigues de Sa e Souza
9fd630c34b chore(test): reconcile golden snapshot + apikey count for new providers 
#5020 (grok-cli), #5065 (factory), #5105 (zenmux-free) added providers but did
not regenerate tests/snapshots/provider/translate-path.json (now +3 entries) nor
bump the APIKEY_PROVIDERS count (159->160 for the factory gateway). Test-only
reconciliation; no production change.
 2026-06-26 22:44:43 -03:00
KooshaPari
004c0c4fd1 feat(providers): add Factory (factory.ai) as a subscription gateway provider (#5065) 
Integrated into release/v3.8.38 (rebased on tip; added factory registry test for PR Test Policy + fixed check:env-doc-sync phantom FACTORY_API_KEY; factory loads in PROVIDERS, no Zod issue — that flag was a false positive)
 2026-06-26 22:36:03 -03:00
fulorgnas
2eefe2f76d feat: Add Grok Build (xAI) provider with OAuth import-token flow (#5020) 
Integrated into release/v3.8.38 (rebased on tip; Hard Rule #11 fix — Grok public client_id now via resolvePublicCred(grok_id), 3 literals removed; grok-oauth 7/7 + check:public-creds green)
 2026-06-26 22:31:40 -03:00
Randi
9e2c2817da fix(streaming): harden long OpenAI-compatible SSE streams (#5124) 
Integrated into release/v3.8.38 (rebased on tip; streamHandler conflict with #5007 disconnect-guard resolved — both coexist, stream-handler 22/22 green)
 2026-06-26 22:27:11 -03:00
dependabot[bot]
843680f6ca chore(deps): bump actions/cache from 5.0.5 to 6.0.0 (#5112) 
Integrated into release/v3.8.38 (retargeted main→release; workflow-only actions/cache bump — unit failures were stale main base-reds)
 2026-06-26 22:24:23 -03:00
R. Beltran
5f9bf378e7 fix(dashboard): key model visibility toggle on canonical providerId (#5091) 
Integrated into release/v3.8.38 (retargeted main→release; .tsx visibility-key test green 2/2)
 2026-06-26 22:24:16 -03:00
Diego Rodrigues de Sa e Souza
4bdbaa0062 fix(usage): dedupe request-usage logging and debounce stats (#4940) 
Integrated into release/v3.8.38 (rebased on tip; DB-handle hang was stale-base artifact — resetDbInstance already closes the handle, test green 5/5; file-size drift consolidated at release; CHANGELOG re-injected)
 2026-06-26 22:22:00 -03:00
Diego Rodrigues de Sa e Souza
57bed419c4 feat(mcp): web-session robustness — cookie dedup (PR6) + browser-pool observability (PR7) (#3368) (#5121) 
Integrated into release/v3.8.38 (rebased on tip; cookie-dedup branch extracted to findExistingCookieConnection helper → complexity-neutral; CHANGELOG added)
 2026-06-26 22:20:09 -03:00
Diego Rodrigues de Sa e Souza
594aa94945 feat(dashboard): click-to-edit model alias in provider page (#5119) 
Integrated into release/v3.8.38 (rebased on tip, i18n scope verified, CHANGELOG re-injected)
 2026-06-26 22:09:29 -03:00
Diego Rodrigues de Sa e Souza
c9fe0fb7a1 feat(providers): add ZenMux Free session-cookie provider (#5105) 
Integrated into release/v3.8.38 (rebased on tip, CHANGELOG re-injected)
 2026-06-26 22:08:28 -03:00
Diego Rodrigues de Sa e Souza
2b0e1dfd94 fix(sse): convert Gemini body to OpenAI format in antigravity MITM handler (#4845) 
Integrated into release/v3.8.38 (rebased on tip, CHANGELOG re-injected)
 2026-06-26 22:07:04 -03:00
Jan Leon
25b65ac34a Track final connection IDs in failover logs (#5016) 
Integrated into release/v3.8.38
 2026-06-26 22:04:39 -03:00
Jan Leon
b8070ed3a8 Ignore disconnect races during in-band stream error handling (#5007) 
Integrated into release/v3.8.38
 2026-06-26 22:04:33 -03:00
Diego Rodrigues de Sa e Souza
d6f402e0ad test(golden): redact OmniRoute app version from translate-path snapshot (#5126) 
Coverage shard golden unblock for #5078.
 2026-06-26 20:31:41 -03:00
Diego Rodrigues de Sa e Souza
fe8f1dac0f test(golden): redact live Node version from provider translate-path snapshot (#5125) 
Final golden unblock for #5078.
 2026-06-26 20:02:33 -03:00
Diego Rodrigues de Sa e Souza
58d942829f fix(translator): preserve reasoning-replay reasoning_content + repair 3 release-green test reds (#5122) 
Repairs 3 release-green test reds + test-masking; unblocks #5078.
 2026-06-26 19:12:46 -03:00
Diego Rodrigues de Sa e Souza
05071c011c test(release): relocate 2 orphan test files into the collected flat tests/unit dir (#5120) 
Unblocks Lint (test-discovery) on #5078. Integrated into release/v3.8.38.
 2026-06-26 17:26:40 -03:00
Diego Rodrigues de Sa e Souza
d1a3aa8909 feat(quota): add opt-in Codex/Claude auto-ping keepalive (#5102) 
Base-reds fixed (#5117); auto-ping keepalive + file-size rebaseline. Integrated into release/v3.8.38.
 2026-06-26 17:20:26 -03:00
Diego Rodrigues de Sa e Souza
68aeb89327 feat(dashboard): expose Fusion judgeModel + fusionTuning in the combo editor (#5074) 
Base-reds fixed (#5117); Fusion editor + file-size rebaseline. Integrated into release/v3.8.38.
 2026-06-26 17:15:38 -03:00
Diego Rodrigues de Sa e Souza
cfaba4410f fix(responses): default text.format for openai-compatible responses providers (#5101) 
Base-reds fixed (#5117); default text.format + file-size rebaseline. Integrated into release/v3.8.38.
 2026-06-26 17:13:19 -03:00
Diego Rodrigues de Sa e Souza
135b5daaa5 fix(translator): forward image tool_result blocks as image_url (#5100) 
Base-reds fixed (#5117); image tool_result→image_url. Integrated into release/v3.8.38.
 2026-06-26 17:11:15 -03:00
Diego Rodrigues de Sa e Souza
2b55659481 chore(quality): rebaseline file-size for responseSanitizer (#5117) + AddApiKeyModal drift 2026-06-26 16:47:07 -03:00
Diego Rodrigues de Sa e Souza
800b04ad6d fix(sse): repair release base-reds — malformed-response false positives + header casing + stale tests (#5117) 
Repairs the release/v3.8.38 base-reds; unblocks #5078.
 2026-06-26 16:30:51 -03:00
Diego Rodrigues de Sa e Souza
d486ed1643 fix(db): translate pt-BR SQLite driver-fallback log lines to English (#5103) (#5115) 2026-06-26 16:15:13 -03:00
Diego Rodrigues de Sa e Souza
db68c9b790 fix(diagnostics): treat non-streaming Claude messages shape as valid output (#5108) (#5116) 2026-06-26 16:14:14 -03:00
Diego Rodrigues de Sa e Souza
11cb8f0976 feat(providers): allow local/private provider URLs by default with scoped metadata-safe guard (#5066) (#5107) 2026-06-26 14:10:09 -03:00
Diego Rodrigues de Sa e Souza
cc6741dd8c fix(dashboard): surface detailed credential-validation error in add-connection modal (#5088) (#5106) 2026-06-26 14:09:41 -03:00
Diego Rodrigues de Sa e Souza
5315e73be5 fix(combo): fail over on empty-content 502 instead of exhausting the provider (#5085) (#5104) 2026-06-26 14:08:17 -03:00
Diego Rodrigues de Sa e Souza
721598fe02 feat(compression): compression playground (Play + Compare tabs) in the studio (#5080) 
Integrated into release/v3.8.38
 2026-06-26 13:10:06 -03:00
Diego Rodrigues de Sa e Souza
964ed04d3b chore(quality): rebaseline file-size for leva 5 PR batch drift 
6 frozen files grew from merged leva-5 PRs (cursor #4912, kiro #4911,
videoGeneration #5051, default #4727, base #4846, chat #5064); all covered
by per-PR tests. See _rebaseline_2026_06_26_leva5 in the baseline.
 2026-06-26 11:22:45 -03:00
Jan Leon
7b6a9ed33d Harden selected API error responses (#5032) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 11:20:18 -03:00
Randi
f7e5d2c268 feat(cc): add summarized thinking display toggle (#5055) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 11:18:22 -03:00
fulorgnas
ef99a3c5ba fix(compression): replace fileURLToPath(import.meta.url) with runtime anchors for standalone bundle (#5089) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 11:16:28 -03:00
Hernan Javier Ardila Sanchez
57d10ea9f7 fix(models): derive model discovery config from registry modelsUrl (#5087) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 11:14:53 -03:00
Hernan Javier Ardila Sanchez
7256d34a23 fix: preserve model hidden flags (isHidden) across model sync (#5086) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 11:13:24 -03:00
José Victor Ferreira
14eab57ed3 feat(video): add Alibaba DashScope (wan2.7-t2v) provider (#5051) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 11:10:33 -03:00
Éder Costa
98c5fac3ad fix(sse): robust Anthropic /v1/messages streaming — real ping keepalive + client-disconnect guard (#5063) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 11:09:12 -03:00
Éder Costa
1b041d8acc fix(sse): don't cool down the connection on a self-inflicted upstream timeout (504) (#5064) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 11:06:45 -03:00
Diego Rodrigues de Sa e Souza
a835192a9c fix(tts): resolve Gemini TTS models from catalog (#4934) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 11:04:16 -03:00
Diego Rodrigues de Sa e Souza
c5c8db77da fix(translator): preserve cache_control for DashScope OpenAI-compat providers (port from 9router#2069) (#5013) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 11:00:39 -03:00
Diego Rodrigues de Sa e Souza
ac8bd72e91 fix(oauth): support Kiro IDC (organization) token import (#4944) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 10:58:50 -03:00
Diego Rodrigues de Sa e Souza
abcf593213 feat(proxy): auth-less host:port batch import (#4938) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 10:57:52 -03:00
Diego Rodrigues de Sa e Souza
2ed7d532f9 feat(cursor): parse Composer DeepSeek-style inline tool calls (#4912) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 10:57:19 -03:00
Diego Rodrigues de Sa e Souza
2dbd3e933a feat(sse): Kiro inline <thinking> stream splitter (#4911) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 10:56:54 -03:00
Diego Rodrigues de Sa e Souza
f52863c80a fix(sse): dedupe case-variant Anthropic version/beta headers (#4846) 
Integrated into release/v3.8.38 (leva 5)
 2026-06-26 10:55:21 -03:00