The previous 90% default treated Codex accounts as unavailable while they
still had ~10% quota remaining. A 99% threshold reserves only a minimal
safety margin near true exhaustion while preserving usable quota.
- Export DEFAULT_QUOTA_THRESHOLD_PERCENT=99 from quotaCache.ts
- Replace CODEX_QUOTA_THRESHOLD_PERCENT in auth.ts with shared constant
- Update quota policy tests to match new default
Co-authored-by: dhaern <manker_lol@hotmail.com>
The stream readiness gate from PR #1693 validates SSE body content.
The test harness checked only `headers.accept` (lowercase) but executors
set `Accept` (capital A), causing the harness to return JSON instead of
SSE for streaming requests. Fixed by checking both header casings.
- Replace polynomial regex /\/+$/ with loop-based stripTrailingSlashes()
across 8 enterprise provider configs (azure-openai, azureAi, bedrock,
datarobot, oci, sap, watsonx, audioSpeech) — fixes js/polynomial-redos
- Add prototype-pollution denylist guard in usageHistory.ts to reject
__proto__/constructor/prototype as model keys — fixes
js/prototype-polluting-assignment (#167, #168)
- Suppress 3 false-positive js/insufficient-password-hash alerts in
chatgpt-web.ts and builtins.ts where SHA-256 is used for cache-key
derivation, not password storage (#176, #177, #178)
- Add stripTrailingSlashes unit tests with ReDoS regression check
Update the deterministic fallback API key to use hyphens instead of
underscores so generated keys match the expected format.
Also set API_KEY_SECRET in unit tests that exercise API key creation to
ensure consistent resolver behavior under test.
- CodexExecutor: isCodexResponsesWebSocketRequired now defaults to HTTP
unless codexTransport='websocket' is set in providerSpecificData
- CodexExecutor: store defaults to false unless openaiStoreEnabled=true
- CodexExecutor: WS unavailable now falls back to HTTP via super.execute()
instead of returning 503 (dead code path after guard refactor)
- Meta AI: X-FB-Friendly-Name updated from useAbraSendMessageMutation
to useEctoSendMessageSubscription
- Proxy middleware: tests now verify authz/pipeline.ts (refactored from proxy.ts)
- Chat pipeline: accept both 'Invalid'/'Incorrect' API key error messages
- Qwen retry: selective setTimeout mock to avoid tripping body read timeout
- Treat status 499 as terminal non-retryable error in both priority and
round-robin combo loops — no fallback to other models when client is gone
- Propagate AbortSignal from request into handleComboChat so the combo
loop can detect client disconnects before starting new model attempts
- Make retry/fallback delays abort-aware via signal.addEventListener
- Add 5 unit tests covering 499 early-exit, signal.aborted pre-check,
multi-model abort, 502 contrast behavior, and abort-during-wait
Integrated into release/v3.7.2 — implements conversation continuity for muse-spark-web executor with SHA-256 prefix hashing, TTL cache, and eviction-on-error
Centralize remote image downloads behind a shared helper that
validates outbound URLs, enforces redirect and size limits, and
applies request timeouts before bytes are read.
Wire the helper into image generation and vision bridge flows so
remote image inputs and result URLs follow the same fetch policy and
block redirects to private hosts. Update key management routes to use
structured logging and document the WebSocket bridge secret in the
example environment file.
The billing header fingerprint was computed from the first user message text
via computeFingerprint(), which changes every conversation turn. This mutated
the system[] prefix on each request, invalidating Anthropic's prompt-cache
prefix and forcing ~100% cache_create (vs 96% cache_read with stable prefix).
Now uses a per-day SHA-256 hash of the date + ccVersion, keeping the billing
header format while preserving prompt-cache prefix stability across turns.
Includes 6 unit tests.
The prompt_cache_key was derived from the account-wide workspaceId, meaning
all conversations from the same OAuth account shared one cache partition.
The official Codex CLI uses conversation_id (a unique UUID per session).
Priority: body.session_id > body.conversation_id > workspaceId.
Session IDs are captured BEFORE deletion from the body.
Includes 10 unit tests.
When a provider returns 429 with quota_exhausted reason, set cooldown until
tomorrow 00:00 instead of exponential backoff. Includes isDailyQuotaExhausted()
detection in chat handler and unit tests.
Co-authored-by: clousky2020 <clousky2020@users.noreply.github.com>
Integrated into release/v3.7.1 — fixes Electron installer shipping empty node_modules. Adds separate extraResources FileSet, CI smoke test job, and cross-platform packaged app validation script. Closes#1636.
Prevent upstream 400 failures when clients omit prior
reasoning_content in multi-turn tool-calling conversations.
Capture reasoning_content from streaming and non-streaming assistant
responses, persist it in a memory-plus-SQLite cache keyed by
tool_call_id, and re-inject it on later requests when available.
Add the reasoning cache migration, service layer, authenticated API
endpoints, dashboard tab, and unit coverage to support inspection,
cleanup, and crash recovery.
- PR #1630: Set NPM_CONFIG_LEGACY_PEER_DEPS=true in Dockerfile, remove duplicate COPY
- PR #1631: Hide deprecated gemini-claude-* models from catalogs, redirect to Claude 4.6
- Fix provider-models-route test to match renamed model display name
- Update CHANGELOG.md with both PR entries
- Use jsonc-parser to update only provider.omniroute in opencode.json,
preserving MCP servers, comments, and other provider entries
- Add /api/cli-tools/keys endpoint returning raw keys for CLI tools UI
(session-auth protected via requireCliToolsAuth)
- Fix OpenCode guide step 3 to use ICU-style {baseUrl} placeholder
instead of broken {{baseUrl}} across all 40+ locales
- Restore valid OpenCode light/dark SVG logos (were broken HTML downloads)
- Add customCliTab translation key to en.json
- Add modelLabels support for human-readable model names in config
- Fix 9 additional locale files (bn, fa, gu, in, mr, sw, ta, te, ur)
that were added after the original PR and still had double-braces
Co-authored-by: JasonLandbridge <JasonLandbridge@users.noreply.github.com>
- Add 'github' to hasPerModelQuota() so 429 on one model doesn't lock the
entire connection — same pattern already used for Gemini
- Add 'github' to getLimiterKey() for model-scoped Bottleneck rate limiter
keys (github:connectionId:model)
- Add unit tests for hasPerModelQuota, shouldMarkAccountExhaustedFrom429,
lockModelIfPerModelQuota (account-fallback-service.test.ts)
- Add integration test for model-scoped limiter keys (rate-limit-manager.test.ts)
Co-authored-by: slewis3600 <slewis3600@users.noreply.github.com>
- sync-env.mjs: add hasEncryptedCredentials() guard before generating
STORAGE_ENCRYPTION_KEY, matching the existing guard in bootstrap-env.mjs
- bootstrap-env.mjs: add decrypt-probe diagnostic on startup to detect
key mismatch and log actionable recovery instructions
- bin/omniroute.mjs: add 'reset-encrypted-columns' CLI recovery command
that nulls encrypted credential columns while preserving provider config
- tests/unit/sync-env.test.ts: isolate tests with DATA_DIR override
Root cause: postinstall → syncEnv() generated fresh crypto secrets into
the package-local .env on every 'npm install -g' upgrade, since the
package directory is wiped and recreated. The bootstrap-env guard never
triggered because sync-env already filled in the new keys. The DB still
contained credentials encrypted under the previous key, making them
permanently unrecoverable (AES-GCM auth-tag mismatch → silent 401s).
- guide-settings-route.test.ts: control XDG_CONFIG_HOME so OpenCode config
path resolves to the test dummy dir (CI runners have XDG set)
- proxy-registry-flow.test.ts: disable DASHBOARD_PASSWORD to prevent 401 on
direct route handler calls (CI postinstall auto-generates it)
- _chatPipelineHarness.ts: clear DASHBOARD_PASSWORD for all integration tests
using the shared chat pipeline harness
Replace placeholder builtin skill responses with real file, HTTP, and
code-execution flows constrained to per-key workspaces, size limits, and
sanitized request headers.
Harden the Docker sandbox with dropped capabilities, tmpfs-backed
workdirs, configurable runtime limits, and clearer failure behavior for
disabled browser automation.
Also consolidate legacy dashboard usage navigation into logs, remove
stale sidebar and SSE backup artifacts, and expand tests to lock in the
new runtime and routing contracts.
Several merges (primarily #1602 by @JasonLandbridge) added new i18n keys
with English values to all locale files instead of translated text.
This commit auto-translates all remaining untranslated pt-BR.json keys
using Google Translate, with manual fixups for technical terms (Proxy,
Fallback, Streaming, Playground, Skills, etc).
commit ff0a718e65
Author: Jean Brito <jean.f.brito@gmail.com>
Date: Sat Apr 25 16:45:23 2026 -0300
feat(providers): add CrofAI as a built-in API-key provider
CrofAI (https://crof.ai) ships an OpenAI-compatible /v1 endpoint with
Bearer auth and a /v1/models discovery route. It hosts a curated set of
hosted open models (DeepSeek V3.2/V4 Pro, Kimi K2.5/K2.6, GLM 4.7/5.x,
Gemma 4, MiniMax M2.5, Qwen3.5/3.6) that today users can only attach
through the generic "Add OpenAI Compatible" flow — losing branding,
defaults, prefix routing, and showing up under "API Key Compatible
Providers" instead of the curated "API Key Providers" section.
This change wires CrofAI as a first-class built-in, mirroring how Kimi
is registered (OpenAI format + bearer auth + seed model list).
Files touched (kept tight):
- src/shared/constants/providers.ts
Add `crof` to APIKEY_PROVIDERS with id/alias/name/icon/color/textIcon/website.
- src/shared/constants/config.ts
Register PROVIDER_ENDPOINTS.crof = "https://crof.ai/v1/chat/completions".
- open-sse/config/providerRegistry.ts
Add a `crof` REGISTRY entry: format "openai", executor "default",
authType "apikey", authHeader "bearer", and a seed model list pulled
from a live GET https://crof.ai/v1/models on 2026-04-25 (DeepSeek,
Kimi, GLM, Gemma, MiniMax, Qwen variants). Runtime /models discovery
keeps the live catalog up to date.
- src/shared/components/ProviderIcon.tsx
Map `crof -> "crof"` in PROVIDER_ICON_MAP. Not added to PNG_PROVIDERS
so the UI falls back to the textIcon ("CR") until a logo asset ships
at public/providers/crof.png.
- tests/unit/crof-provider.test.ts (new)
Pins the registration shape (provider identity, base URL, registry
entry, seed model families). Required by the repo's PR Test Policy.
Verified end-to-end against a locally rebuilt image:
- CrofAI appears under "API Key Providers" alongside GLM Coding/Minimax.
- The connection-add dialog opens with title "Add CrofAI API Key".
- POST /api/providers/validate returns "Valid" against /v1/models.
- POST /api/providers persists a connection (testStatus=active).
- POST /v1/chat/completions { model: "crof/kimi-k2.5", ... } returns 200
with a real Kimi K2.5 response — full proxy path resolves through the
new registry entry.
- npm run test:unit passes locally including tests/unit/crof-provider.test.ts.
Notes for the maintainer:
- No logo file is included; happy to follow up with a PNG for
public/providers/crof.png. Until then the UI uses the "CR" textIcon.
- Pricing (src/shared/constants/pricing.ts) is intentionally not
hardcoded — CrofAI exposes per-model pricing via /v1/models response,
and runtime sync is preferable to stale baked-in numbers. Happy to add
a stub block if requested.
- Anthropic-compatible endpoint (https://anthropic.nahcrof.com/v1/messages)
is not wired in this PR. Users can still add it via "Add Anthropic
Compatible" if needed.
# Conflicts:
# src/shared/components/ProviderIcon.tsx
Require management authentication across combo, settings, skill,
webhook, provider auth, restart, and shutdown management routes to
prevent unauthenticated access to privileged operations.
Tighten the OpenAPI try endpoint to only proxy same-origin OmniRoute API
paths and strip hop-by-hop or forwarded headers before dispatching.
Add unit coverage for the new auth guards and proxy validation rules.
