Code review of plan 21 found two functional gaps:
FAIL #1 — toMemoryRetrievalConfig never forwarded the user query, so the
gate `if (config.query && useModernTable)` in retrieval.ts was always
false in the chat hot path. semantic/hybrid silently fell back to
"ORDER BY created_at DESC LIMIT 100", the pre-plan-21 behaviour.
sqlite-vec + RRF only ran in the Playground (retrievePreview, which
takes `query` positionally).
FAIL #2 — Bug #1 was not closed: searchSemanticMemory (Qdrant) was only
imported by /api/settings/qdrant/search, never by retrieval. With
vectorStore="qdrant", engineStatus reported backend="qdrant" but
retrieveMemories/retrievePreview kept using sqlite-vec — the status
diverged from the actual search path.
- settings.ts: toMemoryRetrievalConfig(settings, { query? }) accepts
and forwards the query.
- chatCore.ts: extracts the last user message from body.messages or
body.input (Chat + Responses APIs).
- retrieval.ts: adds a Qdrant branch in case "semantic", case "hybrid"
and retrievePreview; falls through to sqlite-vec on failure or empty
results so the §7 "degrades to sqlite-vec / FTS5" contract holds.
- engineStatus only reports backend="qdrant" when the user opted in
(settings.vectorStore === "qdrant") and Qdrant is healthy.
- memories[] tier union includes "qdrant".
331 memory unit tests pass; typecheck:core / typecheck:noimplicit:core /
check:cycles clean.
recordRequestStart() now performs a cheap DB lookup (isCustomHost) before
building the InterceptedRequest. Hosts registered in inspector_custom_hosts
with enabled=1 receive source="custom-host" and agent=undefined, so they
appear correctly under the "Custom" profile filter instead of being
silently routed to "agent-bridge" entries.
Added isCustomHost() helper to inspectorCustomHosts.ts and a unit test
covering enabled custom-host, non-custom host, and disabled custom-host cases.
Wires the previously-dead appendSessionRequest() DB function to a new
POST /api/tools/traffic-inspector/sessions/[id]/requests route.
appendSessionRequest now returns the inserted seq so callers can confirm order.
InspectorSessionRequestAppendSchema (1 MB cap) guards the endpoint.
Integration test covers seq increments 1-2-3, requestCount sync, 400/404 paths,
and stack-trace-free error responses.
Expands PlaygroundEndpoint type in src/lib/playground/codeExport.ts from 10 to
13 endpoints, adding `responses`, `video`, `music` to mirror the actual
OmniRoute API surface (/v1/responses, /v1/videos/generations,
/v1/music/generations).
This closes the divergence flagged in code review #2 between the contract
fixed by D4 (§3.1 of master-plan-group-C) and the dropdown values used in
ApiTab. The Monaco editor (ApiTab) keeps its own independent endpoint state
(D14) — this only aligns the codeExport-driven Export Code path used by the
Chat/Compare/Build/Scrape tabs.
Changes:
- codeExport.ts: PlaygroundEndpoint type expanded, PlaygroundStateSchema enum
updated, endpointToPath map updated, buildBody switch gains case branches
for responses/video/music with sensible defaults.
- StudioConfigPane.tsx: ENDPOINT_OPTIONS gains 3 new entries.
- playground-code-export.test.ts: endpointToPath assertion updated to 13
endpoints, +6 new tests for responses/video/music (security invariants +
defaults branches).
Also covers Gap 4 from review #2 (moderations/completions/web.fetch already
in the dropdown via the existing contract — confirmed by this audit).
Refs: _tasks/features-v3.8.6/refactorpages/_orchestration/master-plan-group-C.md
- Add `snapshotSession(sessionId)` to inspectorSessions.ts per master-plan §3.8:
returns parsed InterceptedRequest[] in seq order, or null for non-existent sessions.
Silently skips rows that fail InterceptedRequestSchema validation (defensive).
- Restore canonical no-arg form of `MitmHandlerBase.hookBufferUpdate(intercepted)`
per master-plan §3.5: when opts is omitted, derive completion fields from
the intercepted object itself (status/responseHeaders/responseBody/responseSize/
*LatencyMs) rather than no-op'ing. Extended opts form preserved for legacy callers.
- Update Zod record() calls in InterceptedRequestSchema to current (key,value) signature.
- Add 3 unit tests for snapshotSession (happy path / non-existent / silent skip).
- Add 2 unit tests for hookBufferUpdate (no-arg form + extended opts form).
Replace all icon specs to match the new 26 real action names. Every entry in
HIGH_LEVEL_ACTIONS now has a corresponding ACTIVITY_ICONS spec with appropriate
Material Symbols icon and i18nKeyVerb key. Old entries (provider.added, auth.login,
etc.) removed since those actions are no longer in the allowlist.
Replace the old "clean naming" allowlist (provider.added, auth.login, etc.) with
the 26 real action strings emitted by logAuditEvent calls in the codebase
(provider.credentials.*, auth.login.*, settings.update, sync.token.*, etc.).
Activity feed was empty because HIGH_LEVEL_ACTIONS used invented names that
never matched any real audit event.
- store.ts: wrap markMemoryNeedsReindex in safeMarkNeedsReindex helper that swallows
errors when the DB is no longer available (e.g. test teardown after the parent
promise resolved). Prevents fire-and-forget vector upserts from triggering
unhandledRejection in tests.
- memory-store.test.ts: drain setImmediate in afterEach/after hooks so pending
vector upsert tasks settle before DATA_DIR is removed.
- memory-settings.test.ts: extend deepEqual expected shape with the 7 new fields
introduced by plan 21 F5 (embeddingSource, embeddingProviderModel,
transformersEnabled, staticEnabled, rerankEnabled, rerankProviderModel,
vectorStore).
The previous expression was parsed as (A && B && C) || D, allowing D to evaluate
with creds possibly null. Wrap (apiKey || accessToken) in parens so creds-narrowing
covers the whole disjunction.
Implements VectorStore interface contract from master plan 21 §3.4:
- sqlite-vec v0.1.9 extension loaded via createRequire (ESM compat)
- vec0 virtual table with FLOAT[N] dimensions driven by EmbeddingResolution
- Upsert via DELETE+INSERT (vec0 does not support INSERT OR REPLACE)
- BigInt rowids required by vec0 v0.1.9 for primary key insertion
- Hybrid RRF (k=60) fusing FTS5 + vector KNN via UNION ALL + GROUP BY
- FTS join on m.memory_id = fts.rowid (migration 023 bridge column)
- VECTOR_STORE_DISABLE_VEC=true test seam for null-extension path
- sanitizeErrorMessage in 3 error paths (Hard Rule #12)
- Raw SQL exception documented in header comment (Hard Rule #5 §D5)
- 27 unit tests across 5 files; all lint/typecheck/cycles checks pass
scheduleRecordConsumption() wraps recordConsumption() in setImmediate so it
never adds latency to the client response path. Errors are caught and logged
via pino warn but NEVER propagated to the caller (B29 fail-open contract).
Implements the quota share enforcement gate and consumption recorder:
- enforceQuotaShare(): PRE-request check that returns allow/block/deprioritize
based on fair-share algorithm, saturation signals, and pool allocations.
- recordConsumption(): POST-response tracker that increments per-key counters
for each active plan dimension.
Both functions fail-open per B16/B29: any infra error → allow + warn log.
Adds "list-capabilities" entry to A2A_SKILL_HANDLERS in taskExecution.ts
(dynamic import pattern, consistent with the 5 existing skills) and adds
the 6th skill entry to /.well-known/agent.json with tags [discovery, capabilities]
and example questions for agent discovery.
Implements executeListCapabilities() which calls getCatalog() + computeCoverage()
from the agentSkills catalog (F1/F2) and returns a markdown table covering all
42 skills (22 API + 20 CLI) with ID, name, category, area, endpoints/commands,
and raw SKILL.md URL, matching the §3.7 result contract.
Re-exports all playground types and adds static MODEL_PRICING_TABLE with
8-10 popular models labeled (estimated) for client-side cost estimation (D13).
Exports getModelPricing and getProviderPricing helpers.
Adds META_SYSTEM_PROMPT, ImprovePromptRequestSchema, buildImproveChatBody,
and parseImprovedContent for the Prompt Improver feature (D8). Handles
system-only, prompt-only, and both-present scenarios with <<SYSTEM>>/<<PROMPT>>
markers.
Implements the catalog.ts public API defined in §3.3 of the master plan:
- getCatalog(): AgentSkill[] — returns 42 entries, lazy-cached in module scope
- getSkillById(id): AgentSkill | null — lookup by canonical ID
- filterCatalog(opts): AgentSkill[] — filter by category and/or area
- computeCoverage(): SkillCoverage — reads skills/ dir and counts SKILL.md present
- refreshCatalog(): void — invalidates cache (used by tests + generator)
- fetchSkillMarkdown(id): Promise<SkillMarkdown> — reads local fs first,
falls back to GitHub raw fetch with 1h Next.js cache (for F4 /raw route)
API_SKILL_IDS and CLI_SKILL_IDS exported as readonly string arrays (D28 order).
Single source of truth for all consumers (REST routes, MCP, A2A).
