Symptom: freshly-added Codex accounts (e.g. davi/gabriel) showed "No quota data"
even when healthy. Root cause: the quota path reuses the access_token without
refreshing rotating providers (#3019, anti Auth0 family-revocation cascade), so a
Codex account whose short-lived access_token has expired can never surface quota
from the sync — the live fetch returns "Codex token expired".
Fix (opt-in, cascade-safe):
- refreshAndUpdateCredentials gains `allowRotatingRefresh` + a pure exported gate
`shouldAttemptRotatingRefresh`. The actual token mint is wrapped in
`serializeRefresh` (one refresh at a time per Auth0 rotation group) — so even N
concurrent per-account requests can never refresh siblings in parallel.
- The BULK scheduler (syncAllProviderLimits, concurrent) keeps the flag OFF →
#3019 fully preserved (guardian test codex-quota-sync-no-proactive-refresh stays
green). Only the on-demand, per-connection path (`GET /api/usage/[connectionId]`)
opts in.
- Frontend: the quota page auto-fetches LIVE on open for the VISIBLE connections
that have no cached quota (scoped to what's on screen — not all connections —
and skips entries already cached), so expired-token Codex accounts surface real
quota automatically and cascade-safely.
Adds unit coverage for the gate (bulk skips rotating, on-demand allows; non-rotating
always eligible). typecheck / lint clean.
Remove the Petals executor from registration and exports.
Improve type safety by replacing broad any usage in MCP tool registration
with inferred types and documenting dynamic handler type limitations.
Add request validation for the agent bridge cert route and expand tests to
ensure switch buttons explicitly declare type="button", preventing implicit
form submissions.
Integrated into release/v3.8.8. Applied review fixes: moved the SELECT 1 into a pingDb() db helper (no raw SQL in route, Hard Rule #5) + the 503 catch no longer leaks err.message (Hard Rule #12). Thanks @herjarsa!
POST /api/providers/[id]/refresh was the last unguarded proactive-refresh
entry point for rotating-refresh providers. The dashboard auto-refreshes every
expiring connection on a page load (and an old cached frontend bulk-calls this
endpoint), so each Codex account's single-use refresh_token got rotated; Auth0
then revoked the whole token family (openai/codex#9648) — every account but the
last died with [403] <!DOCTYPE. refreshAndUpdateCredentials (quota-sync) and the
connection-test route were already guarded; this closes the gap.
The route now skips proactive rotation when rotationGroupFor(provider) !== null
and returns {success,skipped,message}, deferring genuine expiry to the reactive,
serialized 401 path. Non-rotating providers keep refreshing on demand.
Test: codex-manual-refresh-rotating-guard (source-assertion, matches the
token-refresh-race-comprehensive #2941 style).
Add GET/POST /api/quota/groups and PATCH/DELETE /api/quota/groups/[id].
PATCH rename calls renameGroup then re-syncs quotaShared-* combos (via
dynamic-import syncQuotaCombos) for every pool in the group, since combo
names embed the group slug. DELETE maps the deleteGroup throw (protected
group-demo or pools still referencing the group) to 409 Conflict via
buildErrorBody — never 500. All handlers are management-gated via
requireManagementAuth and route all errors through buildErrorBody (Hard
Rule #12). 37-assertion source-scan test verifies auth, error sanitisation,
response shapes, Zod validation, PATCH re-sync wiring, and DELETE 409 logic.
Guard PUT and DELETE on /api/combos/[id] to return 409 when the target combo name
starts with QUOTA_MODEL_PREFIX; filter isHidden combos from the Combos page state
so quota-managed combos never appear as editable rows there.
Custom models (added via the UI) on opencode-go / openai-compatible nodes always
routed as OpenAI-compatible because there was no per-model targetFormat: addCustomModel
didn't accept it, the API schema stripped it, and getModelTargetFormat (static-registry
only) never saw it — so a custom model needing the Anthropic Messages shape fell back to
the provider default 'openai'.
Thread an optional targetFormat through addCustomModel / replaceCustomModels /
updateCustomModel + the providerModelMutationSchema + the POST/PUT route, surface it from
getModelInfo (one combined custom-model metadata lookup alongside apiFormat), and use it
in chatCore's targetFormat resolution before the provider default.
Closes#2905
Add a standalone OAuth provider `agy` (Antigravity CLI) next to gemini-cli/antigravity.
It reuses the antigravity inference backend (identical Google client_id +
daily-cloudcode-pa.googleapis.com endpoint, executor and token-refresh) but ships its own
model catalog — including the Claude models the backend exposes (claude-opus-4-6-thinking,
claude-sonnet-4-6) — its own account pool, and four ways to connect:
- token-file import (paste/upload the agy oauth token JSON)
- auto-detect a local CLI login (~/.gemini/antigravity-cli/antigravity-oauth-token)
- browser OAuth (via the shared OAuthModal Google loopback flow)
- bulk / ZIP import
New routes: POST /api/providers/agy-auth/{import,import-bulk,zip-extract,apply-local}.
Catalog pinned from the live :fetchAvailableModels endpoint. Docs (openapi.yaml,
ENVIRONMENT.md, .env.example, CHANGELOG) updated; new unit tests for registration,
the token parser, and route auth-hardening.
Two real security gaps closed and four cosmetic Socket.dev fingerprints removed.
See docs/security/SOCKET_DEV_FINDINGS.md for the per-finding maintainer
attestation.
Real bugs fixed:
- cloudSync: HMAC verification of `X-Cloud-Sig` + opt-in
`OMNIROUTE_CLOUD_SYNC_SECRETS=true` before overwriting `accessToken` /
`refreshToken` / `providerSpecificData` from a remote response. Closes the
silent-credential-swap surface (a misconfigured or hostile CLOUD_URL could
previously replace local tokens unverified).
- Zed import: split into 2-step `/discover` + `/import` flow. `/import` now
requires `confirmedAccounts: [{ service, account, fingerprint }]` and
re-reads the keychain server-side to filter by fingerprint, so a tampered
discover response cannot trick the endpoint into saving an unrelated token.
Cosmetic Socket.dev mitigations:
- runElevatedPowerShell writes the elevated payload to a per-call temp `.ps1`
file (mode 0o600) and references it via `-File`. Removes the textbook
`-EncodedCommand <base64utf16le>` pattern flagged as malware by Socket's AI
classifier.
- Maintainer attestation `SECURITY-AUDITOR-NOTE:` blocks added at every
flagged call site pointing to `docs/security/SOCKET_DEV_FINDINGS.md`.
Build-time hardening:
- `OMNIROUTE_BUILD_PROFILE=minimal` (`npm run build:secure`) physically
removes the four sensitive modules from the standalone bundle via webpack
`NormalModuleReplacementPlugin`. Stubs throw `FeatureDisabledError` at
runtime. Intended for the `omniroute-secure` artifact.
Tests:
- 24 new unit tests in `tests/unit/security/` covering the wrapper builder,
HMAC verification (4 cases), credential fingerprint determinism (5 cases),
confirmedAccounts validation + fingerprint filtering (6 cases), and the
minimal-build stubs (5 cases).
Docs:
- New `docs/security/SOCKET_DEV_FINDINGS.md` — per-finding attestation.
- New `socket.yml` — Socket.dev v2 config pointing at the attestation.
- Updated `SECURITY.md` — supply-chain scanner section.
- Updated `.env.example` — three new env vars documented.
Backwards compatibility:
- Cloud sync token overwrite is OFF by default. Users who relied on
it must set `OMNIROUTE_CLOUD_SYNC_SECRETS=true`. Breaking change documented
in CHANGELOG.
- Zed import 2-step is the new default; legacy 1-step preserved behind
`OMNIROUTE_ZED_IMPORT_LEGACY_ONE_STEP=true` and will be removed in v3.9.
Closes#2863
The route at `src/app/api/oauth/[provider]/[action]/route.ts` invokes
`providerData.mapTokens({ accessToken: token })` (object), matching the
cursor/kiro signature. The windsurf provider was declared with
`mapTokens(token: string)` instead, so the entire object was stored as
`accessToken`. When the connection record reached the SQLite layer it
crashed with:
SQLite3 can only bind numbers, strings, bigints, buffers, and null
Fix by aligning windsurf's `mapTokens` signature with the route caller
and the cursor/kiro convention. Also dedupe a copy-pasted second
`if (action === "import-token")` block in the route handler — the
second block was unreachable but identical to the first.
Adds two regression tests asserting that
`provider.mapTokens({ accessToken })` returns a string `accessToken` for
both windsurf and devin-cli, so a future signature drift trips the gate
instead of the SQLite bind error in production.
Post-merge contract fixes for v3.8.6:
- src/app/api/cli-tools/logs/route.ts (#2810) now uses the shared
requireCliToolsAuth guard (param renamed req->request) to satisfy the
cli-tools-auth-hardening contract test.
- Document OMNIROUTE_OPENCODE_QUOTA_URL (#2867) in docs/reference/ENVIRONMENT.md
to satisfy the env/docs sync contract.
start-callback-server, authorize, and poll-callback (GET + POST) now
return 410 Gone with a pointer to /import-token. The 410 short-circuit
runs before auth so the response is honest about the action being
permanently gone, not gated. Codex PKCE flow unchanged.
Tests: 5 new assertions cover GET + POST 410 paths and a Codex
regression check.
