#7775 (pin Kimi providers first + supporter card accent) grew
tests/unit/providers-page-utils.test.ts from 1107 to 1294 lines without
updating config/quality/file-size-baseline.json, leaving the test-file-size
gate red on the release tip and blocking the whole PR queue.
* feat(dashboard): pin Kimi providers first in category + official supporter card accent
Kimi (Moonshot AI) official-partnership highlight on the providers dashboard:
Kimi-family providers (kimi-coding, kimi-web, moonshot) now render first
within whichever category/group they already appear in, and their
ProviderCard shows a Kimi-blue (#1783FF) accent border/glow plus an
"Official Supporter" badge. Presentation-only — routing/fallback order is
untouched.
* docs(changelog): add fragment for Kimi provider card highlight (#7775)
* feat(dashboard): strengthen Kimi card accent + prove featured-first per real section
Owner refinement: make the official Kimi blue (#1783FF) border clearly
legible (2px, higher opacity) and add a subtle whole-card tint alongside
the existing glow, so the accent reads unmistakably as "the official Kimi
color" in both light and dark theme, not just a faint hairline.
Also adds concrete section-scoped regression tests against the REAL
provider catalog (not synthetic mocks), mirroring page.tsx's exact
category-building call chain, proving where each Kimi-family card actually
lands today:
- OAuth section -> kimi-coding first
- Web Cookie section -> kimi-web first
- API Key -> LLM subsection -> moonshot first (kimi-k3's home provider)
- kimi-coding-apikey and kimi (both hiddenFromDashboard) never render as
their own card in any section, confirmed across all 9 categories.
The executor's non-streaming path collects the upstream SSE and returns a
finished OpenAI chat.completion payload. The test still treated the body as
raw SSE and piped it through parseSSEToGeminiResponse, which correctly
returns null for non-SSE input — failing the release-tip unit suite.
Verified the production output is exactly what the test's own assertions
expect (content 'Hello again', usage 2/3/5, finish_reason stop, 2 fetch
calls incl. the 429 retry), so this realigns the test with the real
contract rather than weakening it: 3 pass/1 fail -> 4 pass/0 fail.
resolveSudoSpawn() drops the `sudo -S` prefix when already root, when sudo
is not installed (slim containers) or under OMNIROUTE_NO_SUDO (#6122), so the
spawned command is `tee` rather than `sudo` in those environments. The three
addDNSEntries assertions hardcoded `sudo` and failed whenever the suite ran
as root. Assert the effective invocation (tee -a <hosts file>) instead, still
checking the -S password flag when elevation is actually in play.
Proof: with OMNIROUTE_NO_SUDO=1 the file went 3 failing -> 8 passing; the
unelevated (sudo) path stays 8 passing.
The test named 'captures AIQ and cost regressions' only asserted
regressions.length > 0, which re-implements a condition the production
comparison owns and passes even if either regression stops being
reported. Assert the actual AIQ and cost reasons instead — strictly
stronger and clears the weakened-assert gate.
* docs(readme): width + content overhaul — uniform tables, full CLI grid, condensed What's New
- All remaining spacer-calibrated tables re-targeted +100px so every table
clamps to the same full column width as the Why OmniRoute table.
- Free-tier section: the 4 text bullets are gone — the animated budget card
already carries all of it.
- What's New: every highlight condensed to a 1-2 line bullet (links kept).
- Compatible CLIs: the grid now lists all 25 tools from the dashboard
registries (19 CLI Code's + 6 CLI Agents — Cline, Roo Code, Aider,
ForgeCode, jcode, DeepSeek TUI, CodeWhale, Smelt, Pi, Grok Build, Hermes
Agent, Goose, Open Interpreter, Warp AI, Agent Deck…) in 2 full-width
rows; tools without a brand asset use a neutral terminal glyph
(public/providers/cli-generic.svg) — no invented logos.
- Major-labs providers grid: 3x6 -> 2x9 full-width rows.
- Free Forever: 2 rows -> a single 7-card full-width row.
- Explore More section removed; Dashboard screenshots promoted to their own
top-level section.
* docs(readme): force full-width card grids via in-cell spacers (GitHub strips td width)
* docs(readme): CLI grid 3 balanced rows, dark-safe Cline/Roo icons, fix 251->259 heading
* docs(readme): replace img spacers with NBSP runs — img max-width:100% collapses all-or-nothing past the container; text min-content never does
* docs(readme): calibrate card-grid NBSP runs to measured 3.14px (match Why table width); Roo icon via gh-dark-mode-only
* docs(readme): fine-tune markdown-table NBSP runs to measured widths (all ~1000px)
* docs(readme): sync stale counts to v3.8.49 reality — 268 providers (regen reference), 104 MCP tools, 25k+ tests, 26 CLIs, 40+ free-forever, 43 locales, 84 executors; fix 251-era anchors + nav
* docs(readme): animated hero card + The Promise six-pillar card — embed replaces hero text block, six static badges and the promise HTML table; all numbers from the v3.8.49 audit
* docs(diagrams): make hero/promise card reveals resilient — resting state is the final composition, entrance animates via 0s-begin hold pattern (GitHub camo drops offset-begin one-shots)
* docs(diagrams): pause-safe animation cycles — first frame is the finished composition (Chrome pause-animated-images freezes SVG imgs at t=0, where animation values override static attrs); hero/promise drop entrance reveals, budget bar/strike/dot cycles start at rest state
* docs(readme): unify all animated cards on the flat family style (no outer border/rounded frame/top strip) + fuse hero with the budget card at the top — star CTA back to text, money section moved under the hero, cli-terminal flattened with a t0 poster of the completed screen
* docs(readme): Why OmniRoute as an animated 10-row pain-vs-fix ledger card — extends the 6 original rows with resilience, key pools, local-first privacy and live analytics
* docs(readme): animated 18-strategy flow grid under the strategies table — one micro-stage per routing strategy, static tracks readable on the first frame
* docs(readme): blank line between strategies-grid img and the auto-combo sub note — the img HTML block was swallowing the note, rendering its markdown raw
* docs(readme): Private & Local-First as an 11-row guarantee ledger card — the 5 original bullets plus no-signup, loopback-only routes, header scrubbing, opt-in PII, sanitized errors and local audit trail, each with a receipt chip
* docs(readme): rebuild the resilience card — 3 self-healing layers with real mechanics (breaker states + thresholds, key cooldown with x2 backoff, model lockout) replacing the always-on combo card and the 3-row table
* docs(diagrams): rebuild cli-terminal as a compact half-height real terminal (1200x350) — pure terminal theme, real CLI commands and data tied to live counts, scrolling ticker of real subcommands
* docs(changelog): maintenance fragment for the README animated-card overhaul (#7769)
Clears the release base-red where account-fallback-lockout-eviction,
cliproxyapi-dedicated-credential-7645, combo-least-used-account,
combo/recovery-hint and route-guard-forge-jcode-settings-local-only
were covering mutated modules but missing from tap.testFiles.
Electron persists secrets (JWT_SECRET, API_KEY_SECRET, STORAGE_ENCRYPTION_KEY) to
<DATA_DIR>/server.env, but the CLI bootstrap only ever loaded <DATA_DIR>/.env. Copying
storage.sqlite + server.env from an Electron install to the CLI (exactly as the app's own
UI text instructs) silently lost STORAGE_ENCRYPTION_KEY, permanently corrupting every
encrypted provider credential.
bin/omniroute.mjs now does a one-time, one-directory migration: if <DATA_DIR>/.env is
absent but <DATA_DIR>/server.env is present, copy it to .env before the normal env-file
loading loop runs. An existing .env is never overwritten -- it always wins over a legacy
server.env.
dast-smoke.yml and 3 nightly API-only smoke workflows (nightly-schemathesis,
nightly-resilience, nightly-llm-security) ran "npm run build:cli" with no
preceding full build or downloaded .build/next artifact. scripts/build/
prepublish.ts silently falls back to a full Next.js production build
(dashboard UI + ~126 leaf pages + prerender) whenever the standalone
server.js is missing, which is always the case in these jobs. That inline
full build is the actual thing varying 6-29min on GitHub-hosted runners.
These workflows only exercise API routes (schemathesis/promptfoo hit
/api/monitoring/health, /v1/chat/completions, /v1/models, /api/auth,
/api/keys) and never touch the dashboard UI, so set
OMNIROUTE_BUILD_BACKEND_ONLY=1 on their "Build CLI bundle" step — an
existing, previously-unused escape hatch (scripts/build/backendOnlyPages.mjs)
that stubs the dashboard pages before the build and restores them after,
leaving every route.ts API handler intact.
npm-publish.yml is intentionally left untouched: it legitimately ships the
full dashboard UI in the published npm package.
Regression guard: tests/unit/build/backend-only-smoke-workflows.test.ts
asserts OMNIROUTE_BUILD_BACKEND_ONLY=1/OMNIROUTE_BUILD_PROFILE=backend on
all 5 "Build CLI bundle" steps across the 4 fixed workflows, and asserts
npm-publish.yml's build step is NOT backend-only.
Wildcard model aliases created via the Settings UI's "Wildcard Pattern"
mode were persisted to settings.wildcardAliases but getCombinedModelAliases()
never read that store, so the wildcard-matching step in getModelInfoCore()
never saw the user's patterns. Every request fell through to provider
inference and threw "Ambiguous model" for models multiple providers claim.
Fold settings.wildcardAliases entries into the merged alias map (keyed by
pattern string, folded in last so it never shadows exact aliases).
getNoAuthCandidates() in open-sse/services/autoCombo/virtualFactory.ts built the
candidate pool for no-auth providers (opencode/mimocode/etc.) without ever
consulting getHiddenModelsByProvider(), unlike the credentialed-connection loop
a few lines above it. A model hidden via the dashboard eye icon stayed in every
auto/* candidate pool forever and could still be selected.
Wire hiddenModelsMap into getNoAuthCandidates() the same way #7622 wired
noAuthProviderSpecificData in, mirroring the existing credentialed-connection
check.
- docs/routing/REASONING_ROUTING.md: migration renumbered 125->126
- docs/INCIDENT_RESPONSE.md, docs/PERF_BUDGETS.md: /api/version renamed to /api/system/version
- config/quality/eslint-suppressions.json: rebaseline no-explicit-any counts for
tests/unit/combo-routing-engine.test.ts (261->269) and
tests/unit/base-executor-sanitize-effort.test.ts (45->48), drifted by the prior
base-red full-suite realignment commits (dbc9f6081, 764a4aee0) whose sibling
test-file-size ratchet was already rebaselined in 00b853969 but this gate was missed
- tests/unit/call-log-provider-display.test.ts, tests/unit/m365-web-token-extraction-7078.test.ts:
removed the never-baselined explicit any usages (typed via inference instead)
* feat(providers): notion-web live models via getAvailableModels
Cookie-auth discovery against POST /api/v3/getAvailableModels (spaceId from
cookie or getSpaces) so /api/providers/{id}/models and /v1/models can surface
the real Notion AI picker catalog instead of a single stub notion-ai id.
Also injects a config transcript entry with the selected model codename on
runInferenceTranscript, seeds an offline fallback catalog, and documents that
space_id is needed for reliable discovery.
* fix(providers): address notion-web review + docs provider count
- Safe decodeURIComponent for malformed cookie values
- Use extractSpaceIdFromNotionCookie instead of case-sensitive space_id= includes
- Single trim in buildNotionTranscript
- Sync STRICT docs counts to 265 providers (README/AGENTS/CLAUDE)
* refactor(notion-web): extract helpers to keep parseNotionAvailableModels/pickFirstSpaceId under complexity cap
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Co-authored-by: artickc <artickc@users.noreply.github.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
The credential-health scheduler (src/lib/credentialHealth/scheduler.ts) auto-inits on
import, but nothing imported it at startup — only the on-demand credentialGate
(open-sse/services/credentialGate.ts) does, lazily on the first gated request. So the
boot-time sweep never ran, and web-session connections whose cookies expired overnight
stayed red/unavailable until a real request re-tripped the failure (the "*-web providers
go red on restart" complaint).
Wire initCredentialHealthCheck() into src/instrumentation-node.ts (the real Next.js
instrumentation startup) right after the runtime-settings restore, in its own try/catch
with a [STARTUP] log line. Idempotent and self-disabling via
OMNIROUTE_DISABLE_CREDENTIAL_HEALTH_CHECK; cadence tunable via
CREDENTIAL_HEALTH_CHECK_INTERVAL.
The wiring MUST live in instrumentation-node.ts, NOT the unused src/server-init.ts —
the latter never runs in production, which is why the earlier attempt (closed PR #7432)
was a no-op.
Test: tests/unit/credential-health-boot-wiring.test.ts asserts the boot wiring is present
in instrumentation-node.ts and absent from the dead server-init.ts.
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
GrokCliExecutor.execute() dispatches via raw https.request (nativePost)
instead of the shared fetch path, so it never inherited (nor delegated to)
BaseExecutor.execute()'s proactive-refresh gate the way codex.ts does via
super.execute(). The only refresh that ever fired was the reactive one on a
401/403 from upstream — the rotating xAI refresh_token idled until real
expiry, matching the "unusable within minutes, must delete/re-add" report.
Wires in the same needsRefresh()/refreshCredentials() gate, using
runWithOnPersist + isUnrecoverableRefreshError to keep the [refresh +
persist] atomic under the same per-connection mutex Codex/Claude rely on
for rotating refresh tokens (base.ts:592-644).
Also fixes the smaller, separate bug #2 from the same report: grok-cli was
absent from OAUTH_TEST_CONFIG in the connection-test route, so "Test
Connection" always reported "Provider test not supported" regardless of
token health. Added a checkExpiry entry (same pattern as qwen/cline/
kilocode — Grok Build's proxy doesn't expose a lightweight probe endpoint
with the cli-specific headers this shared prober sends). Extracted
OAUTH_TEST_CONFIG into its own module (oauthTestConfig.ts) so the new entry
doesn't grow the frozen route.ts past its file-size cap.
Bug #3 (no browser/device-code login for Grok Build) and bug #4 (quota
display) from the same issue are feature gaps, not regressions — left as
follow-ups per the triage plan-file.
Refs #7610
Mistral's quota-exhausted response is a bare 401 with a contentless
{"detail":"Unauthorized"} body — byte-identical to a genuinely revoked
key. classifyFailure() in the connection-test route always resolved
this to upstream_auth_error ("Invalid API key"), hiding the real
quota-exhaustion cause and misleading operators into rotating a still-
valid key.
classifyFailure() now accepts an optional `provider` and, for a bare
Mistral 401 with no explicit auth signal in the message (no "invalid
api key" / "token invalid" / "revoked" / "access denied" text), returns
`upstream_ambiguous_auth_or_quota` instead. A Mistral 401 that DOES
carry an explicit auth signal, and any non-Mistral 401, are unaffected
and still classify as upstream_auth_error (baseline preserved).
The new branching logic lives in a new module
(mistralAmbiguousAuth.ts) rather than inline in route.ts, keeping that
frozen file's line count within its file-size-baseline.json budget.
TDD: tests/unit/provider-test-mistral-401-classify.test.ts reproduces
the bug (RED against unfixed classifyFailure), proves the fix (GREEN),
and pins the baseline non-Mistral-401 behavior per the owner's
explicit requirement.
CLIProxyAPI requires its own separately-configured api-keys credential and
rejects any other token with 401. Both the direct mode:"cliproxyapi"
passthrough leg and the mode:"fallback" retry leg reused the resolved
connection's own credentials (the native provider's key) unchanged, making
the fallback path a permanent no-op for every provider configured this way.
Adds a dedicated cliproxyapi_api_key setting (settingsSchemas.ts) and a new
credential-resolution module (cliproxyapiCredentials.ts) that substitutes it
in at the executorProxy.ts choke point for both CLIProxyAPI-bound legs, so
CliproxyapiExecutor itself stays credential-source-agnostic. Falls back to
the connection's own credential when no dedicated key is configured,
preserving prior (workaround) behavior.
- validateWebCookieProvider's /models probe against lmarena's registered
baseUrl (a POST-only streaming endpoint from #6280) triggers a 307
REDIRECT_BLOCKED from safeOutboundFetch, which was surfaced as a raw
"Redirect blocked" error (unsupported:false) instead of the honest
"unsupported" signal — the dashboard rendered a hard Invalid state for a
perfectly valid cookie.
- Add toWebCookieValidationErrorResult() in validation/transport.ts: for
providers whose /models probe is known-unreliable (lmarena for now),
REDIRECT_BLOCKED now degrades to {valid:false, unsupported:true}, mirroring
the same REDIRECT_BLOCKED degrade already applied on the discovery path by
#6267. Deliberately scoped to lmarena only (see code comment) — other
web-cookie providers with a similarly-shaped baseUrl need their own proven
repro before joining the allowlist.
- Remove the now-stale comment at validation.ts claiming lmarena has no
providerRegistry entry (false since #6280 registered one).
- Regression test: tests/unit/arena-cookie-validation-redirect-7542.test.ts
(RED confirmed against unfixed code, GREEN after the fix).
Codex CLI injects prompt_cache_key natively for its own prompt caching.
injectPromptCacheKey() only guards against the router injecting a NEW
key for nvidia/codex/xai — it never strips a key that arrived already
present in the inbound body. NVIDIA NIM's OpenAI-compatible wrapper
rejects the field with a 400, and NIM has no documented support for
prompt caching (providerSupportsCaching already treats nvidia as
non-cache-capable).
Adds a provider-wide STRIP_RULES entry in paramSupport.ts (match-all,
since prompt_cache_key rejection isn't model-specific) so
stripUnsupportedParams() drops it for every nvidia target before the
request reaches DefaultExecutor.
The built-in "Chutes" provider preset hardcoded the non-resolving
domain api.chutesai.com (confirmed live: DNS NXDOMAIN). Every request
using the built-in preset failed with getaddrinfo ENOTFOUND,
independent of API key validity.
The correct, resolving host is llm.chutes.ai, already used elsewhere
in the codebase for model discovery
(providerModelsConfig.ts:184-187).
Regression test: tests/unit/chutes-registry-baseurl-7621.test.ts
(RED before the fix, GREEN after). The provider.ts translate-path
golden snapshot is updated to reflect the corrected URL only for
the chutes entry.
Two independent bugs, not migration 126:
1. tests/unit/db-migration-runner.test.ts and
tests/unit/migration-safety-abort-6260.test.ts: withNonTestEnvironment()
only sanitized process.argv, not process.execArgv. #7359 made
isAutomatedTestProcess() also scan execArgv (to catch `node --test`), so
under the node:test runner execArgv always retains `--test` and the
"simulate a non-test environment" helper became a no-op. The
mass-migration safety-abort check (gated on !isTestEnvironment) never
fired, migrations ran for real, and hit the hardcoded version-032
apikey-lifecycle special case against fixtures that never created
api_keys — surfacing as "no such table: api_keys" instead of the
expected MigrationSafetyAbortError. Fix: also strip test-token args from
process.execArgv in the test helper.
2. tests/unit/db-core-init.test.ts: SCHEMA_SQL created
idx_pc_auth_active_refresh on provider_connections(refresh_token)
unconditionally, before ensureProviderConnectionsColumns() ran its
column-healing pass — and that function never healed refresh_token in
the first place. A legacy provider_connections table predating that
column (simulated by the "max_concurrent column is healed" fixture)
fails startup with "no such column: refresh_token" instead of healing.
Fix: move the index into ensureProviderConnectionsColumns(), after
adding a defensive refresh_token backfill.
shouldSkipCloudSyncInitialization(env, argv) forwarded its own
parameters in the wrong order to isAutomatedTestProcess(argv, env) —
passing env where argv is expected and vice versa. Any real argv array
landed in the `env` position (harmless there) but the env object
landed in the `argv` position, and argv.some() then threw
`TypeError: argv.some is not a function` as soon as a caller passed an
explicit, correctly-ordered argv/env pair (tests/unit/model-sync-
scheduler.test.ts "initCloudSync skips auto initialization...").
Fixed the call-site argument order. Also hardened
isAutomatedTestProcess() to tolerate a non-array argv defensively
(return false instead of throwing) since this check gates production
background-task startup (auto-backup, migrations, cloud sync) and
must never crash the process it's protecting.
sortTargetsByUsage (open-sse/services/combo/targetSorters.ts, since
#7015/#7059) keys usage lookups by the per-target executionKey
(combo-name + step-id), not by the bare model string, so accounts
sharing a modelStr don't collapse into a single usage bucket.
Three tests called recordComboRequest() directly without a `target`,
so the recorded usage landed under a modelStr fallback key that never
matches the real executionKey computed at combo-resolution time —
every target read back as 0 usage and the original combo order won,
failing the "prefers the least-used model" assertions. Production is
unaffected: every real combo.ts call site already passes
`target: toRecordedTarget(target)`.
Fixed by priming usage through real handleComboChat calls (which
route recordComboRequest through the actual resolved target) instead
of calling recordComboRequest() directly with an unlinked target.
#7129 added claude-sonnet-4-6 to CONTEXT_1M_SUPPORTED_MODELS (1M context GA'd
2026-02-17) but missed this test in its sweep. A non-CC anthropic-compatible
target with extendedContext:true now legitimately receives the context-1m
beta header for this model — updating the stale undefined expectation.
The test asserted the pre-#7517 bare qwen.ai host (from upstream PR #683 /
decolua issue #572). #7517 (danscMax, live-verified) found that host 404s and
restored chat.qwen.ai as the working device-code endpoint. Aligning the test
with the intentional, live-validated production behavior instead of reverting it.
* chore(ci): add .mergify.yml to main — Mergify only reads config from the default branch (#7168)
* fix(ci): add the auto-enqueue pull_request_rule to the Mergify config (queue_conditions alone are eligibility-only) (#7179)
* fix(ci): migrate Mergify auto-enqueue to merge_protections_settings.auto_merge_conditions (rules-based path is EOL 2026-07-16) (#7216)
* fix(ci): drop Mergify batch settings (batching is a paid-tier feature; free plan queue is serial) (#7220)
* fix(ci): merge queue tolerates the advisory dast-smoke failure (its GH-hosted build hang dequeued every attempt) (#7225)
* test(ci): make the #6634 selfref guard hermetic — main's copy hard-fails every PR (#7341)
main's copy of this test still does git I/O inside a unit test:
const baseSrc = git(['show', 'origin/main:' + FILE]);
Runners check out a shallow single ref, so origin/main does not resolve and the
test dies with 'fatal: invalid object name origin/main'. Every PR into main
fails Unit Tests (7/8) on it — today that is #7313, #7315, #7316, #7334, #7336
and #7337, six PRs red on a defect none of them introduced. #7313 has no other
red at all.
release/v3.8.49 already carries a fix (2e42b8efc, #7174: try/catch, fetch
origin/main on demand, t.skip() when unreachable), but it only reaches main at
release time — so main stays broken for the whole cycle. Cherry-picking it would
also import a new problem: PR Test Policy classifies t.skip() as a silenced
assertion, which we watched it correctly catch on #7300 today.
This is the hermetic version instead (ported from #7327, which does the same for
the release branch): read the file straight off disk, compare against an empty
base so baseTaut/baseExtTaut are 0 — the strictest possible comparison point —
and call evaluateMasking() directly. No git ref, no fetch, no skip, nothing the
runner's checkout depth can break.
The #6634 regression stays covered: the guard's logic lives in
SELF_TEST_FIXTURE_RE (check-test-masking.mjs:337), not in the test. Proven both
ways on main before committing — neutralise SELF_TEST_FIXTURE_RE to /$^/ and
the test FAILS; restore it and it passes 2/2, with check-test-masking.mjs left
byte-identical.
Co-authored-by: growab <nekron@icloud.com>
* chore(quality): tighten main's coverage baseline to the CI's real numbers (#7347)
main's ratchet had been failing --require-tighten on every PR: 11 metrics
improved but the baseline was never tightened. Same class as the #6634
selfref guard — an infra fix that lands only on the release branch leaves
main red for the whole cycle, and every PR into main pays for it.
Values are the merged-coverage numbers from a run on main itself (a local
run measures ~68% vs CI's ~80%; the baseline's own note warns about that
gap). Only the 11 coverage values change — gitleaks and semgrepFindings
keep main's own state.
No changelog fragment: #7326 carries it on release/v3.8.49, and a second
one here would double the entry at release time.
* Add cliproxy provider exposure controls and manifest injection (#7329)
* feat(fusion): let judge use its own knowledge and override the panel (#6804)
The judge prompt said to write an answer 'grounded in that analysis',
implicitly capping output at the panel's union. When all panel members
miss or are collectively wrong on something, the judge should apply its
own reasoning as a full participant and override consensus, while keeping
an honesty guard against fabrication. Adds a regression test.
Co-authored-by: Chirag Singhal <chirag127@users.noreply.github.com>
* fix(api): raise provider apiKey cap for cookie-based web providers (#6715) (#6759)
* fix(cli): fall back to settings.json when Claude Code binary is unresolvable (#6701) (#6734)
getCliRuntimeStatus() only ever answered `installed` from binary resolution
(known install paths + where/which PATH search), so a stale PATH, moved
binary, or uncatalogued install method reported "not found" even when
~/.claude/settings.json proved the CLI was installed and used before —
regressing behind upstream 9router's checkClaudeInstalled(), which already
falls back to the settings file when where/which fails.
withSettingsFallback() (new src/shared/services/cliInstallFallback.ts, kept
out of the frozen cliRuntime.ts to respect its file-size ceiling) restores
that parity: only when the binary lookup's own reason is "not_found" (never
for deliberate security rejections like unsafe/relative env overrides or
symlink escapes) and the tool's settings file exists on disk.
* fix(providers): honor explicit thinking.budget_tokens 0 in openai->gemini transform (#6813) (#6821)
The transform forwarded the Claude-style thinking.budget_tokens into
generationConfig.thinkingConfig.thinkingBudget, but the presence check was
truthy (&& thinking.budget_tokens). An explicit budget_tokens: 0 — the
natural way to disable thinking — is falsy, so it was dropped and the
request fell through to the default thinkingConfig injection, making the
model think despite an explicit request for zero. Use an explicit numeric
check so 0 is honored as thinkingBudget 0; includeThoughts is only set for
a non-zero budget.
* fix(compression): reconcile outer vs per-engine token counts (#6488) (#6741)
* fix(compression): reconcile outer vs per-engine token counts on degenerate output (#6488)
Outer originalTokens/compressedTokens (real tiktoken counter over extracted
message text) diverged from engineBreakdown[0]'s counts (a crude
JSON.stringify(requestBody).length/4 estimate), worst on small/degenerate
inputs where JSON structural overhead dominates. A single-engine breakdown
entry represents the exact same before/after transformation as the overall
response, so reconcileSingleEngineTokens() now overwrites that one entry's
counts with the outer, more accurate figures; multi-step pipeline
breakdowns are left untouched.
* chore(6741): resolve release sync — CHANGELOG.md restored to release tip, entry moved to changelog.d fragment (fragments-first)
* fix(api): accept enableRenderers in RTK compression config schema (#6703) (#6757)
* fix(db): break probe-failed/restore loop on large storage.sqlite (#6632)
Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy
files belong to #6620, not this PR); keeps only the author's changes.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* feat(cursor): add Opus 4.8, Fable 5, and Sonnet 5 model families (#6779)
Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy
files belong to #6620, not this PR); keeps only the author's cursor registry + test changes.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(translator): read PDF/video file attachments for Gemini/Antigravity and Claude (#6790)
Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy
files belong to #6620, not this PR); keeps only the author's translator + test changes.
Co-authored-by: Wital <witalorocha216@gmail.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(codex): strip include from compact responses requests (#6805)
* fix(codex): strip include from compact responses requests
Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy
files belong to #6620, not this PR); keeps only the author's changes.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(6805): move include-strip assertion to standalone test file to keep executor-codex.test.ts under frozen size cap
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6769)
Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy
files belong to #6620, not this PR); keeps only the author's changes.
Co-authored-by: Chirag Singhal <chirag127@users.noreply.github.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(bootstrap): filter empty process.env values to prevent Docker env crash loop (#6828)
Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy
files belong to #6620, not this PR) and the direct CHANGELOG.md edit (fragments-first);
keeps only the author's bootstrap change.
Co-authored-by: Andrian B. <andrewbalanesq@gmail.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(providers): update SenseNova Token Plan support (#6330)
Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy
files belong to #6620, not this PR); the author's constants/registry/snapshot deltas
were re-applied cleanly onto the release tip.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(providers): classify 404 as MODEL_NOT_FOUND to stop retry storm (#6829)
Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy
files belong to #6620, not this PR) and the direct CHANGELOG.md edit (fragments-first);
the author's chatCore/errorClassifier deltas were re-applied cleanly onto the release tip.
Co-authored-by: Andrian B. <andrewbalanesq@gmail.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(api): accept all catalog engines on compression PUT schema (#6792)
Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy
files belong to #6620, not this PR). Resolved the release's OmniGlyph engine addition
additively (types.ts/compression.ts kept both 'relevance' and 'omniglyph') and extended
stackedPipelineStepSchema + STACKED_PIPELINE_ENGINE_INTENSITIES with the omniglyph branch
so the ENGINE_CATALOG-parity test passes.
Co-authored-by: Pitchfork-and-Torch <Pitchfork-and-Torch@users.noreply.github.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(api): point CLI health command at /api/monitoring/health (#6677) (#6717)
* fix(api): point CLI health command at /api/monitoring/health (#6677)
bin/cli/commands/health.mjs called GET /api/health, a route that was
moved to /api/monitoring/health without updating the CLI; the top-level
/api/health handler never existed on disk (only degradation/ and ping/
sub-routes). Point runHealthCommand()/runHealthComponentsCommand() at
/api/monitoring/health and read its real payload shape
(activeConnections, circuitBreakers: {open,halfOpen,closed}, memoryUsage)
instead of the old nonexistent requests/breakers/cache/memory fields.
* chore(6717): re-sync onto release tip; move CHANGELOG entry to changelog.d fragment (fragments-first)
* chore(cursor): add Grok 4.5 effort/fast model IDs (#6774)
Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy
files belong to #6620, not this PR); keeps only the author's changes.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED (#6791)
* fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED
Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy
files belong to #6620, not this PR); keeps only the author's changes.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* refactor(deepseek): extract done-terminator helper to keep frozen file under cap
Extracts the FINISHED-drain scheduler and finish-once guard added for
the [DONE] terminator fix (#6777) into a new
deepseek-web-done-terminator.ts module, so deepseek-web.ts stays under
its frozen line cap (1148). Behavior is unchanged.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: Pitchfork-and-Torch <Pitchfork-and-Torch@users.noreply.github.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* feat(models): add capability override UI (#6727)
* feat(models): add capability override UI
Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy
files belong to #6620, not this PR); renumbered the migration 118 -> 119 to resolve the
collision with 118_provider_param_filters.sql already on release/v3.8.47; the author's
i18n/localDb deltas were re-applied cleanly onto the release tip.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(6727): import model-capability-overrides DB fns directly (not via localDb barrel) to keep localDb under file-size cap; aligns with anti-barrel convention
* chore(db): satisfy known-symbols contract for modelCapabilityOverrides
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
* fix(cursor): use Agent CLI build id for x-cursor-client-version (#6795)
* fix(cursor): use Agent CLI build id for x-cursor-client-version
Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy
files belong to #6620, not this PR); the author's .env.example/docs deltas were
re-applied cleanly onto the release tip.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* chore(changelog): re-sync CHANGELOG.md to release tip (restore #6701 bullet)
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(startup): rename reasoningControls.ts to avoid webpack casing collision (#6584) (#6718)
* fix(startup): rename reasoningControls.ts to avoid webpack casing collision (#6584)
* chore(6718): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first)
* fix(build): suppress Turbopack over-bundling warning from agentSkills generator (#6582) (#6720)
* fix(build): suppress Turbopack over-bundling warning from agentSkills generator (#6582)
generator.ts builds outputBase from a non-literal outputDir parameter, so
Turbopack's file-tracing analyzer can't narrow it and emits an "Overly broad
patterns" warning per entry point that imports the module (603 warnings on
v3.8.46, up from 379). The fs access is legitimate and bounded, so
next.config.mjs now suppresses this specific diagnostic via turbopack.ignoreIssue,
mirroring the existing webpack.ignoreWarnings precedent in the same file.
* chore(6720): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first)
* fix(providers): drop image_generation for Codex Spark models regardless of plan (#6651) (#6721)
* fix(providers): drop image_generation for Codex Spark models regardless of plan (#6651)
* chore(6721): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first)
* fix(providers): stop quota card re-sorting Codex/GLM bars by remaining % (#6687) (#6722)
* fix(providers): stop quota card re-sorting Codex/GLM bars by remaining % (#6687)
QuotaCardExpanded.tsx unconditionally re-sorted quotas by remaining
percentage via sortQuotasByRemaining(), discarding the deterministic
CODEX_QUOTA_ORDER/GLM_QUOTA_ORDER window order quotaParsing.ts's
sortCodexOrder()/sortGlmOrder() had already established. A new
hasFixedQuotaOrder() + resolveQuotaDisplayOrder() skip the re-sort for
providers with a fixed window order (codex, glm family), threading
providerId from QuotaCard.tsx through to the display layer.
Regression guard: tests/unit/quota-card-expanded-fixed-order-6687.test.ts
* chore(6722): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first)
* fix(startup): lazy-import ioredis in rateLimiter to fix MCP ERR_MODULE_NOT_FOUND (#6559) (#6725)
* fix(startup): lazy-import ioredis in rateLimiter to fix MCP ERR_MODULE_NOT_FOUND (#6559)
* chore(6725): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first)
* fix(resilience): resolve fp-pinned combo account back to real connection id (#6696) (#6732)
* fix(resilience): resolve fp-pinned combo account back to real connection id (#6696)
* chore(6732): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first)
* fix(api): Responses passthrough emits event-only SSE frames after filtering commentary output (#6561) (#6735)
* fix(api): Responses passthrough emits event-only SSE frames after filtering commentary output (#6561)
The #6199 commentary-drop `continue;` branches in stream.ts skipped the
data: line for a dropped commentary event but never cleared the
already-buffered event: line for the same frame, so the next blank line
flushed the stale event: line alone -- an event-only SSE frame that
crashes the OpenAI Python SDK's json.loads(). Both drop sites now call
clearPendingPassthroughEvent() before continue. The commentary-drop
decision was extracted into a new responsesCommentaryDrop.ts module so
the fix does not grow the frozen stream.ts.
* chore(6735): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first)
* fix(api): emit reasoning_content on claude-web + v0-vercel-web SSE (#6662) (#6743)
* fix(api): emit reasoning_content on claude-web + v0-vercel-web /v1/chat/completions SSE (#6662)
* chore(6743): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first)
* fix(sse): unwrap bare {function:{…}} tools in openai→claude translation (#6704)
* fix(sse): unwrap bare {function:{…}} tools in openai→claude translation
Some OpenAI-shape clients send a tool as a bare `{ function: {...} }`
object, omitting the spec-required `type: "function"` parent wrapper.
The tools-mapping in openai-to-claude.ts (~line 366) only unwrapped
`tool.function` when `tool.type === "function"` was ALSO true, so a
bare-function tool fell through to `toolData = tool` (the wrapper
itself, with no `.name`), producing an empty `originalName` and
silently dropping the tool from the translated request — worse than
a 400, since the caller has no signal the tool never made it
upstream. Unwrap `tool.function` whenever present, independent of
the parent `type` field. Regression guard:
tests/unit/openai-to-claude-bare-tool.test.ts.
Co-authored-by: Samir Abis <me@samirabis.com>
Inspired-by: https://github.com/decolua/9router/pull/2473
* chore(6704): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first)
---------
Co-authored-by: Samir Abis <me@samirabis.com>
* fix(oauth): avoid bare-email dedup of Codex OAuth logins (#6706)
* fix(oauth): avoid bare-email dedup of Codex OAuth logins
When an incoming Codex OAuth connection has no verifiable workspace/account
id, do not merge it into an existing row on email match alone — that
silently overwrote the other account's token pair. Require a matching
chatgptUserId (a stable per-account JWT id) before merging; otherwise
insert a distinct connection row.
Co-authored-by: lucasjustinudin <34107354+lucasjustinudin@users.noreply.github.com>
Inspired-by: https://github.com/decolua/9router/pull/2477
* chore(6706): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first)
---------
Co-authored-by: lucasjustinudin <34107354+lucasjustinudin@users.noreply.github.com>
* fix(sse): skip thinkingConfig for gemma models in openai→gemini translation (#6708)
open-sse/translator/request/claude-to-gemini.ts already guards against
sending thinkingConfig for gemma-4-* models (Gemma doesn't support it —
Vertex returns 400: "Thinking budget is not supported for this model"),
but the OpenAI-shape path (openai-to-gemini.ts) lacked the same guard, so
OpenAI-shape clients hitting a vertex gemma-4-* model still got a 400.
Mirrors the existing claude-to-gemini.ts guard: wrap the reasoning_effort
and Claude-shape thinking.budget_tokens branches with a model.startsWith
("gemma-4") check. Branch 3 (default includeThoughts for modern Gemini
models) already excludes non-"gemini" model ids and needed no change.
Inspired-by: https://github.com/decolua/9router/pull/2480
Co-authored-by: chy1211 <31048289+chy1211@users.noreply.github.com>
* fix(codex): surface capacity errors embedded in 200-OK SSE streams (#6710)
* fix(codex): surface capacity errors embedded in 200-OK SSE streams
Codex sometimes answers with HTTP 200 and a text/event-stream body whose
payload carries a transient error mid-stream (e.g. "Selected model is at
capacity...", server_is_overloaded, service_unavailable_error). Because the
outer HTTP status was 200, this looked like a successful response to every
caller — no retry, no circuit breaker, and no combo/account fallback ever
engaged, so a healthy account sat idle while the request silently failed or
truncated.
Add peekCodexSseTransientError() to open-sse/executors/codex.ts: it peeks the
first bytes of a text/event-stream Codex response, pattern-matches the known
transient-error signatures, and converts a match into a real 503 Response via
errorResponse() (Hard Rule #12 — sanitized, never raw upstream text). A 503 is
already a recognized provider-failure status in accountFallback.ts, so combo
routing and connection cooldown pick it up automatically. When no error
signature is found, the peeked prefix is prepended back onto the remaining
upstream body so the passthrough stays byte-identical to the unmodified
response.
Regression guard: tests/unit/codex-sse-capacity-fallback.test.ts — a
model-at-capacity payload and a server_is_overloaded/service_unavailable_error
payload both convert to 503; a normal single-chunk SSE stream and one split
across multiple network chunks both reassemble byte-for-byte unchanged.
Inspired-by: https://github.com/decolua/9router/pull/2452 (sub-bug #3 only —
OmniRoute already covers PR #2452's other two sub-bugs: service_tier "fast"
normalization and reasoning_effort "max" normalization).
Co-authored-by: ryanngit <74137224+ryanngit@users.noreply.github.com>
* chore(6710): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first)
---------
Co-authored-by: ryanngit <74137224+ryanngit@users.noreply.github.com>
* fix(volcengine): clamp Kimi max_tokens to Ark endpoint cap (#6712)
* fix(volcengine): clamp Kimi max_tokens to Ark endpoint cap
VolcEngine Ark's Kimi coding-plan endpoint (ark.cn-beijing.volces.com)
enforces max_tokens <= 32768 server-side and returns 400 "integer above
maximum value, expected a value <= 32768" for anything over that ceiling.
OmniRoute's StripRule only supported dropping params outright, with no
numeric clamp mechanism, so a client sending a larger max_tokens (common
default, e.g. 65536) 400s outright against volcengine's kimi-k2-5-260127.
The 32768 cap is independently confirmed against two live-endpoint bug
reports hitting this exact Ark endpoint for both kimi-k2.5 and
kimi-k2.7-code (NousResearch/hermes-agent#51773, MoonshotAI/kimi-cli#1124),
not just upstream's own value — same cap upstream 9router#2460 uses.
StripRule gains two optional fields: `clampToModelMaxOutput` (clamp to the
model's own catalog maxOutputTokens ceiling, when set) and `maxOutputCap`
(a fixed endpoint-imposed ceiling); when both apply, the lower wins. The
new rule is scoped to the literal id `kimi-k2-5-260127` (OmniRoute's real
volcengine Kimi model, not upstream's `Kimi-K2.7-Code`), not a broad
/kimi/i regex, so it can never clamp an unrelated future Kimi listing
whose Ark cap may differ. glm-4-7-251222 (the other volcengine model) is
unaffected.
Inspired-by: https://github.com/decolua/9router/pull/2460
Co-authored-by: whale9820 <whale9820@users.noreply.github.com>
* chore(6712): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first)
---------
Co-authored-by: whale9820 <whale9820@users.noreply.github.com>
* fix(antigravity): surface aborted Gemini tool calls off end_turn (#6713)
* fix(antigravity): surface aborted Gemini tool calls off end_turn
Gemini/Antigravity aborts a turn with finishReason MALFORMED_FUNCTION_CALL
(or a sibling like UNEXPECTED_TOOL_CALL) instead of completing cleanly. Both
Claude-facing translators collapsed these to a clean end_turn, hiding the
aborted tool call as a successful completion:
- the OpenAI hub path (openai-to-claude.ts convertFinishReason default), and
- the DIRECT Gemini->Claude path (gemini-to-claude.ts), which is the one
Claude Code actually hits through an antigravity/Gemini-routed model.
Add isAbortFinishReason() to finishReason.ts and map these reasons to
tool_use on both paths; genuinely unknown reasons still fall back to end_turn.
Co-authored-by: anhdiepmmk <n08ni.dieppn@gmail.com>
Inspired-by: https://github.com/decolua/9router/pull/2462
* chore(6713): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first)
---------
Co-authored-by: anhdiepmmk <n08ni.dieppn@gmail.com>
* fix(translator): strip empty cloud_base_branch from Cursor Subagent tool call (#6729)
* fix(translator): strip empty cloud_base_branch from Cursor Subagent tool call (port from 9router#2446)
The Responses->Chat tool-arg cleanup (stripEmptyOptionalToolArgs) only stripped
empty-string/empty-array optional args for Claude Code's Read tool. Cursor's local
Subagent tool call therefore passed through with the cloud-only field
cloud_base_branch: "", which Cursor rejects ("cloud_base_branch may only be specified
when environment equals cloud") before starting the subagent. Extend the cleanup to an
allowlist of Read + Subagent; arbitrary tools stay untouched.
Reported-by: like3213934360-lab (https://github.com/decolua/9router/issues/2446)
* chore(6729): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first)
* fix(translator): defer content_block_start until GLM streams the tool name (#6730)
* fix(translator): defer content_block_start until GLM streams the tool name (port from 9router#2077)
GLM 5.2 (and similar OpenAI-compatible upstreams) stream a tool call's id and
function.name across separate SSE delta chunks. The openai-to-claude streaming
translator emitted content_block_start immediately on the id-only chunk with an empty
name; the Claude SSE protocol cannot patch a block after emission, so the later
name-only chunk was dropped and Claude Code rejected the tool_use with an empty tool
name / "No such tool available:". Defer content_block_start until the name arrives
(start on args if they arrive first), and emit a start for any orphaned id-only tool
call at finish so content_block_stop is never orphaned.
Reported-by: itiwant (https://github.com/decolua/9router/issues/2077)
* chore(6730): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first)
* feat(dashboard): add search to Playground model picker dropdown (#4086) (#6811)
* feat(dashboard): add search to Playground model picker dropdown (#4086)
The shared ModelSelectModal (combo builder + CLI-code cards) already had
search, but the Playground's raw model <select> in StudioConfigPane stayed
a flat unsearchable list - unusable once a provider like OpenRouter
contributed 50+ models.
Adds a search input above the dropdown that filters options via
filterModelsByQuery() (Turkish-safe accent/case-insensitive match, reusing
matchesSearch()). The currently selected model always stays pinned in the
list even when it doesn't match the query, so typing never silently swaps
the active selection. Reuses the existing common.search i18n key already
translated in all 42 locales - no new key needed.
* chore(6811): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first)
* feat: request count log per provider, per date (#4009) (#6812)
* feat(dashboard): request count log per provider, per date (#4009)
Some providers bill by request rather than by token, so operators need
a plain per-provider, per-date request count breakdown, not just token
aggregates. Adds a new getProviderDailyUsageRows() aggregation query
(src/lib/db/usageAnalytics.ts), a dedicated GET
/api/usage/requests-by-provider-date route (kept separate from the
frozen /api/usage/analytics route to respect the file-size baseline),
and a sortable, single-date-filterable table on Dashboard -> Analytics.
Closes#4009
* chore(6812): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first)
* feat(xai): route xAI clients to Grok native /v1/responses endpoint (#6709)
* feat(xai): route xAI clients to Grok native /v1/responses endpoint
xAI ships a native /v1/responses endpoint (https://api.x.ai/v1/responses)
alongside /v1/chat/completions, but XaiExecutor extended BaseExecutor
without overriding buildUrl(), so every request always resolved to the
static chat-completions baseUrl regardless of target format — the last
genuinely-missing slice of decolua/9router#2439 (grok-build-0.1, the
reasoning-effort suffix routing, and bare grok-* routing were already
ported in prior cycles).
Add responsesBaseUrl to the xai registry entry and tag
grok-4.20-multi-agent-0309 (upstream's own Responses-only id) with
targetFormat: "openai-responses", mirroring the existing model-tag-driven
routing pattern already used by the gh executor (9router#102) and the
"openai" -pro heuristic in open-sse/executors/default.ts — the per-model
registry tag is the single source of truth that also drives chatCore's
body translation, so URL and body stay in lockstep. XaiExecutor.buildUrl
now checks getModelTargetFormat("xai", model) and resolves to the native
Responses endpoint only for tagged models, leaving every other grok-*
model on the existing chat-completions bridge.
TDD: tests/unit/executor-xai.test.ts adds a RED-then-GREEN case asserting
grok-4.20-multi-agent-0309 resolves to https://api.x.ai/v1/responses and
a control case asserting grok-4.3 still resolves to
https://api.x.ai/v1/chat/completions.
Co-authored-by: ryanngit <74137224+ryanngit@users.noreply.github.com>
Inspired-by: https://github.com/decolua/9router/pull/2439
* chore(6709): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first)
---------
Co-authored-by: ryanngit <74137224+ryanngit@users.noreply.github.com>
* fix(resilience): route remaining credential-selection call sites through quota preflight (#6686) (#6742)
* fix(resilience): route remaining credential-selection call sites through quota preflight (#6686)
* chore(6742): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first)
* fix(resilience): apikey-provider 429s honor explicit quota-exhausted text (#6638) (#6731)
* fix(resilience): apikey-provider 429s honor explicit quota-exhausted text (#6638)
Ollama Cloud (and any other apikey-category provider) 429s skipped body-text
quota classification entirely; a genuine multi-day quota exhaustion was
misclassified as a plain rate_limit_exceeded with a few seconds of cooldown,
so combo routing retried the account immediately. shouldPreserveQuotaSignals()
now lets an explicit quota-exhausted signal (looksLikeQuotaExhausted) override
the apikey-category default, and parseDayGranularityResetMs() adds day-
granularity reset-hint parsing ("...reset in 3 days.") alongside the existing
Xh/Ym/Zs parsing.
Regression guard: tests/unit/issue-6638-ollama-quota.test.ts (RED before the
fix, GREEN after). Aligned two tests/unit/account-fallback-service.test.ts
cases that had codified the old buggy behavior for apikey-provider quota
text.
* chore(6731): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first)
* feat(resilience): weekly-429 cooldown for fetcher-less providers (#3709) (#6817)
* feat(resilience): weekly-429 cooldown for fetcher-less providers (#3709)
Ollama Cloud free-tier accounts have a hard WEEKLY request cap. On cap the
upstream returns 429 "you (<account>) have reached your weekly usage
limit", but ollama-cloud is an apikey-category provider, so the existing
oauth-only shouldUseQuotaSignal gate in checkFallbackError skips the
subscription-quota-text classifier (Issue #2321) for its 429s -- the
account fell through to the generic exponential backoff (~1s, capped at
2min) and got retried every few minutes for the rest of the week (one
account took 285x429 in 48h).
Adds a new, ungated weekly-usage-limit text classifier that applies a 24h
QUOTA_EXHAUSTED cooldown regardless of provider category. Extracted the new
classifier -- together with the existing #2321 subscription-quota logic --
into a new open-sse/services/quotaTextCooldowns.ts module so the frozen
accountFallback.ts (file-size-baseline cap) didn't have to grow; net effect
shrinks accountFallback.ts by 20 lines.
This is Phase A of the plan (open-sse/services/accountFallback.ts:1038-1045
"weekly-429 cooldown"); Phase B (generic local request-counter preflight for
manual provider_plans dimensions) is a separate, larger follow-up per the
plan's own phasing.
* chore(6817): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first)
* fix(providers): Kiro adaptive-thinking allowlist excludes sonnet-4.5/haiku-4.5 (#6576) (#6726)
* fix(providers): Kiro adaptive-thinking allowlist excludes sonnet-4.5/haiku-4.5 (#6576)
* chore(6726): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first)
* test(kiro): migrate selector-strip test to claude-sonnet-5 (only Kiro adaptive-thinking model, #6576)
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* chore(quality): rebaseline complexity 2053->2054 (merge-burst drift, v3.8.47)
Inherited drift from today's /implement-prs merge burst (~36 PRs). check:complexity
does not run on the PR->release fast-path, so the branch accrued +1 unmeasured. No
orphan/feature PR introduces a NEW violation (complexity-net-zero); the only flagged
function is the pre-existing getResolvedModelCapabilities. Owner-approved rebaseline
to unblock the FQG of ~7 green-except-complexity orphans.
* chore(stryker): register ollama-quota covering tests (merge-burst drift, v3.8.47)
The 3 covering unit tests from #6731/#6817/#6742 (issue-6638-ollama-quota,
ollama-cloud-weekly-quota-cooldown-3709, issue-6686-quota-preflight-coverage)
exist on release but were never added to tap.testFiles when those PRs merged.
Completes the registration so mutant kills count; unblocks every PR touching a
mutated module. Part of the owner-approved merge-burst drift cleanup.
* fix: auto-start WS server in-process and change default port to 20132 (#6072)
* feat: change default LIVE_WS_PORT from 20129 to 20132
Update the default WebSocket port for the live dashboard server from 20129 to 20132 across all configuration files, documentation, code comments, and tests. Also consolidate OMNIROUTE_DISABLE_LIVE_WS and OMNIROUTE_ENABLE_LIVE_WS into a single OMNIROUTE_ENABLE_LIVE_WS flag. Wire the live WebSocket server to start in-process via instrumentation-node.ts.
* feat: clarify NEXT_PUBLIC_LIVE_WS_PUBLIC_URL path usage and derive upgrade path from URL
Update .env.example and ENVIRONMENT.md to document that the pathname portion of NEXT_PUBLIC_LIVE_WS_PUBLIC_URL (e.g. /live-ws) is used as the WebSocket upgrade path by the dev proxy, handshake response, and client connection logic.
Extract deriveLiveWsPath() into shared/utils/wsPath.ts and wire it through:
- src/app/api/v1/ws/route.ts — handshake response path field
- src/hooks/useLiveDashboard.ts — build
* fix: use the standard URL API to safely parse and update the effectiveWsUrl
* build(docker): expose live WebSocket server port and configure CORS origins
Add LIVE_WS_PORT (20132), LIVE_WS_HOST (0.0.0.0), and LIVE_WS_ALLOWED_ORIGINS environment variables to all Docker Compose profiles and expose the WebSocket port mapping. Prevent infinite self-loop in standalone-server-ws.mjs by skipping proxy when the server itself is running on the LiveWS port.
* docs(env): fix comment formatting for HOST and HOSTNAME variables
---------
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(logs): prevent stale detail refresh reopening modal (#6323)
* fix(logs): prevent stale detail refresh reopening modal
* chore(stryker): register ollama-quota covering tests (release drift from merge burst)
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* \ feat: operator-configurable account rotation\ (#6763)
* feat(resilience): operator-configurable account rotation
Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy
files belong to #6620, not this PR); the author's accountFallback/.env deltas were
re-applied cleanly onto the release tip.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* docs(env): document configurable account-rotation env vars in ENVIRONMENT.md
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* refactor(rotation): extract rotation gate/context helpers to keep accountFallback.ts under frozen cap
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* chore(changelog): re-sync CHANGELOG.md to release tip (restore lost base bullet)
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* test(stryker): register rotation-config test in tap.testFiles for mutation coverage
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* test(stryker): register ollama-quota covering tests (drift from #6731/#6817/#6742) + re-sync
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
* fix(lmarena): modernize Arena web provider + static Direct-chat catalog (#6280)
* fix(lmarena): modernize Arena web provider + static Direct-chat catalog
Update the lmarena provider for arena.ai (product rebranded from LMArena):
- Route chat via arena.ai create-evaluation with Chrome TLS impersonation
(tls-client-node) and optional browser-minted recaptchaV3Token.
- Seed Text+Search (48) into the chat registry; seed Image (27) only into
IMAGE_PROVIDERS. Disable live HTML model discovery; resolve public names to
Arena UUIDs from the static TypeScript allowlist (no scrape JSON in-repo).
- Soft-exclude 404/502 model ids; slow/stop bulk test-all probes for this provider.
- Do not fold IMAGE_PROVIDERS/video specialty into the chat provider catalog when
a chat registry already exists (lmarena/openai/xai).
- Display name Arena (Free); keep wire id `lmarena` / alias `lma` for back-compat.
- Theme-aware provider icons: arena-light.svg / arena-dark.svg.
- Preserve split Supabase SSR cookie reconstruction for arena-auth-prod-v1.*.
* fix(providers): align provider-models-route test fixture + regen provider reference
Fold the topaz image-only catalog entry's apiFormat/supportedEndpoints
into the local-catalog test fixture (route now tags media-only
providers per the lmarena PR's staticModels.ts change), regenerate
PROVIDER_REFERENCE.md against the merged release providers.ts, and add
the changelog fragment for #6280.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* test: align web-cookie fallback suite — lmarena now has a registry entry (probe path)
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* docs(changelog): reconcile 3-day merge burst — 16 fragments, 4 promised credits, contributors hall 32→63
- changelog.d fragments for the 20 merged PRs that landed without a bullet
(#6072#6308#6323#6538#6556#6586#6611#6647#6675#6698#6757#6759#6804#6821 + ci rollup #6781/#6691/#6693 + docs rollup #6643/#6644/#6646/#6663;
omniglyph bump #6661 folded into the #6556 bullet)
- deliver the 4 credits promised in close comments but never written:
@alltomatos (#6819 dup of #6721), @samimozcan (#6762/#6753 subsumed by #6790),
@chirag127 (#6756 dup of #6757), @Squawk7777 (#6565 dup of #6564 — appended to
the existing #6564 bullet; changelog-integrity flags that edit as a removal,
intentional: ALLOW_CHANGELOG_REMOVALS justification)
- rebuild the v3.8.47 Contributors hall from merged-PR authors + thanks credits
+ prior hall: 32 → 63 contributors
* Clamp reasoning token buffer to model output cap (#6714)
* fix(combo): clamp reasoning buffer to model output cap
* fix(routing): preserve near-cap reasoning max tokens
* fix(routing): getExplicitModelOutputCap falls through to registry cap on non-numeric synced limit_output
getExplicitModelOutputCap short-circuited to null whenever a synced
capability row existed, even if that row's limit_output was not a number
(models.dev commonly omits it). That silently disabled the reasoning-token
buffer clamp for any model with a synced row lacking an output limit.
Now only return the synced value when it IS a number; otherwise fall
through to registryModel.maxOutputTokens / spec.maxOutputTokens, matching
the ??-chain precedence already used by getResolvedModelCapabilities().
Adds a standalone regression test (proves the fallthrough returns the real
registry cap, not null) and hardens the #6274 fixture id so its no-output-cap
case does not prefix-match the real glm-5.2 static spec.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* chore(stryker): register ollama-quota covering tests (release drift from merge burst)
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* feat(i18n): add Traditional Chinese (zh-TW) localization for frontend and CLI (#6320)
* feat(i18n): add Traditional Chinese (zh-TW) localization for frontend and CLI
- Add src/i18n/messages/zh-TW.json translating frontend web UI
- Add bin/cli/locales/zh-TW.json translating CLI commands and descriptors
- Register zh-TW in config/i18n.json and docs/guides/I18N.md
- Update scripts/i18n/generate-multilang.mjs matching the new locale setup
* fix: update i18n locale count from 42 to 43 after adding zh-TW
The docs strict checker (check-docs-counts-sync.mjs) validates that
README.md and I18N.md reflect the real locale count. Adding zh-TW
bumped the count from 42 → 43.
* fix(i18n): translate providers free-filter labels in zh-TW (#6694 guard)
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com>
Co-authored-by: lunkerchen <lunkerchen@users.noreply.github.com>
* feat(proxy): implement latency-optimized proxy rotation strategy (#6798)
* feat(proxy): implement latency-optimized proxy rotation strategy
Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy
files belong to #6620, not this PR) and the direct CHANGELOG.md edit (fragments-first);
the author's env/docs/i18n deltas were re-applied cleanly onto the release tip.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(proxy): add latency-rotation env var to .env.example
PROXY_LATENCY_WINDOW_HOURS was referenced in src/lib/db/proxies.ts and
documented in docs/reference/ENVIRONMENT.md, but missing from
.env.example, tripping the env/docs sync gate.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* chore(changelog): re-sync CHANGELOG.md to release tip
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* refactor(proxy): extract latency-strategy helpers to keep frozen files under cap
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* test(db-rules): expect 35 audited modules (proxyLatency joins INTENTIONALLY_INTERNAL)
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* docs(readme): fix stale strategy/tool/scoring counts (#6853)
README still claimed 17 routing strategies (the table was missing
pipeline), 95 MCP tools, and 9-factor Auto-Combo scoring. Align with
the source (ROUTING_STRATEGY_VALUES has 18 entries) and the canonical
docs (MCP-SERVER.md: 94 tools; AUTO-COMBO.md: 12-factor).
* fix(antigravity): sanitize Cloud Code safety settings (#6839)
Co-authored-by: kfiramar <83420275+kfiramar@users.noreply.github.com>
* fix(kiro): probe IdC region during profileArn discovery, cross-region (recovers #6099) (#6840)
* fix(kiro): route Amazon Q runtime by profileArn region for cross-region IdC
Enterprise AWS IAM Identity Center accounts whose IdC instance lives outside the two
Amazon Q Developer profile regions (us-east-1 / eu-central-1) - e.g. eu-north-1
(Stockholm), start URL https://d-XXXX.awsapps.com/start - showed no limits and returned
502 on every request.
Root cause: the backend used the IdC/OIDC token region (providerSpecificData.region, e.g.
eu-north-1) for every CodeWhisperer runtime call, hitting q.eu-north-1.amazonaws.com - a
host that does not exist as a Q Developer runtime endpoint. Per AWS docs ("Supported
Regions for the Q Developer console and Q Developer profile"), the Q Developer *profile*
(which produces the profileArn and hosts generateAssistantResponse / GetUsageLimits /
ListAvailableModels / ListAvailableProfiles) is only hosted in us-east-1 and eu-central-1,
regardless of the IdC region; "data is stored in the Region where you create the Amazon Q
Developer profile."
Fix (new open-sse/services/kiroRegion.ts) decouples the two regions:
- providerSpecificData.region stays the IdC/OIDC region, used ONLY for
oidc.{region}.amazonaws.com token mint/refresh.
- The runtime region is derived from the profileArn (resolveKiroRuntimeRegion):
profileArn region -> a valid stored profile region -> us-east-1. A stored IdC region
that is not a Q profile region (eu-north-1) is ignored for runtime.
- Profile discovery (discoverKiroProfileArnAcrossRegions) probes the Q profile regions
(EU IdC -> eu-central-1 first) with the cross-region SSO token instead of q.{idcRegion}.
Wired into: executors/kiro.ts (generateAssistantResponse targets the profile region),
services/usage/kiro.ts (getKiroUsage multi-region discovery + profileArn runtime region so
Limits resolves), services/kiroModels.ts (ListAvailableModels), and
src/lib/oauth/providers/kiro.ts (login-time postExchange profile discovery).
Adds tests/unit/kiro-idc-cross-region.test.ts (15 cases). All Kiro suites pass (60 tests).
* fix(kiro): probe the IdC region too during profileArn discovery (any IdC region)
Make profile discovery general for an IdC in ANY of the ~30 IdC-supported AWS regions
(us-west-2, ap-southeast-2, me-central-1, af-south-1, ...), not just eu-north-1.
buildKiroProfileDiscoveryRegions now probes the two documented Q Developer profile regions
FIRST (us-east-1 / eu-central-1, EU-first for EMEA IdC regions to cut latency), then appends
the IdC/stored region itself as a forward-compatible fallback: if AWS ever co-locates the
profile with the IdC or expands the profile-region list, a same-region probe still finds it.
Probing a region with no profile simply returns nothing and we fall through. The profileArn's
own region remains authoritative for every runtime call (resolveKiroRuntimeRegion), so a
newly-issued ARN in any region is honored automatically.
Adds ap-southeast-2 (APAC) cross-region coverage and updates the discovery-order tests.
---------
Co-authored-by: artickc <artur1992123@mail.ru>
* feat(providers): manual context-window override for custom models (#4125) (#6822)
Add a manual per-model "Context Window Override" so an operator can correct
a provider's misreported context length (e.g. reports 1M when the real
limit is 128K) instead of the model getting silently dropped from combo
routing once the wrong value lands in the catalog.
Reuses the existing Feature-5004 model_context_overrides table
(source="manual") — already the priority-0 source getModelContextLimit()
(the function combo's context-window filter calls) reads ahead of the
models.dev/registry/static catalog — so no new resolver logic was needed,
only the missing write path:
- PUT /api/provider-models now accepts an optional contextWindowOverride
(number to set, null to clear), persisted via setModelContextOverride/
removeModelContextOverride.
- GET /api/provider-models surfaces the current override value + source
back on each custom-model row.
- CustomModelsSection.tsx: edit form gained a Context Window Override
input + a badge on the model row when an override is set.
Regression guard: tests/unit/provider-models-context-window-override-4125.test.ts
(manual override wins over a misreported catalog value, GET round-trip,
clearing via null, default-unchanged behavior).
* feat(dashboard): improve Provider Quota page horizontal density (#3520) (#6815)
QuotaCardGrid stacked every provider group vertically in a single
flex flex-col container, and each group's own card grid didn't go
multi-column until the md breakpoint. Provider groups now flow into a
2-column CSS multi-column layout on very wide (2xl) screens instead of
an unconditional vertical stack, and each group's card grid starts at
2 columns immediately, filling horizontal whitespace sooner on
narrower-but-not-mobile viewports.
Regression guard: tests/unit/quota-card-grid-horizontal-layout.test.ts
* refactor(usage): type saveRequestUsage with UsageEntry interface + any-budget ratchet (#3512) (#6809)
Replace saveRequestUsage(entry: any) with a typed UsageEntry interface
mirroring the usage_history columns 1:1. Fields stay optional/nullable
since different writers (chatCore success/failure, rejected-request
accounting, Codex Responses WS) populate the row incrementally; tokens
stays unknown since callers pass either raw provider-shaped usage or
the normalized {input,output,cacheRead,...} shape.
Also cleaned the file's other any usages (getUsageHistory filter,
getUsageDb next-cursor cast, appendRequestLog tokens param,
getRecentLogs catch) so it now sits at zero any and can be added to
the check:any-budget:t11 zero-any allowlist.
Documents the DB-entity <-> TS-interface convention in
docs/architecture/CODEBASE_DOCUMENTATION.md Sec 11.
* feat(combo): strict budget-cap fallback policy for auto/* combos (#3470) (#6816)
Auto-combo transparency + budget controls: the engine's budgetCap enforcement
always degraded to the globally cheapest candidate when every candidate
exceeded the cap - silently overspending instead of respecting the cap.
- engine.ts: budgetFallback "cheapest" (default, legacy) | "strict"
(BudgetExceededError when no candidate fits budgetCap)
- requestControls.ts: X-OmniRoute-Budget-Fallback header +
resolveRequestAutoControls() consolidating mode/budget/fallback parsing
- resolveAutoStrategy.ts / autoConfig.ts: thread combo-level
config.budgetFallback and catch BudgetExceededError into an HTTP 402
- chat.ts: switch to the consolidated resolveRequestAutoControls() helper
(net line reduction, stays under the frozen file-size baseline)
Regression guard: tests/unit/auto-combo-budget-fallback-3470.test.ts
* fix(usage): honor xAI provider-reported exact cost (#6711)
OmniRoute's calculateCost() always estimated request cost from token
counts x static pricing, discarding xAI's exact provider-reported cost
when present. xAI's chat-completions usage object reports the precise
billed cost via cost_in_usd_ticks (docs.x.ai/developers/cost-tracking
and the API reference's usage schema: "TICKS_IN_USD_CENT: i64 =
100_000_000" => 1e10 ticks/USD, e.g. 37756000 ticks ~= $0.0038).
calculateCost()/computeCostFromPricing() now short-circuit to this
exact figure when present -- before any pricing DB lookup, so it also
works for models without a local pricing row -- and still fall back to
the token-based estimate when it is absent. The field is threaded
through both the streaming (extractUsage/normalizeUsage) and
non-streaming (extractUsageFromResponse) usage-extraction paths.
Corrected divisor vs upstream: the upstream PR used /1e12 (a 100x
under-report, e.g. reporting $0.00123 as the doc's $0.123 example);
this port uses the doc-verified /1e10 instead, confirmed against both
the cost-tracking guide and the API reference's usage-object schema.
Inspired-by: https://github.com/decolua/9router/pull/2453
Co-authored-by: ryanngit <74137224+ryanngit@users.noreply.github.com>
* docs: rename /implement-prs → /merge-prs in Hard Rule #21 (skill renamed 2026-07-11) (#6847)
* docs: refresh stale llm.txt facts + relocate design.md to docs/architecture/DESIGN_SYSTEM.md (#6849)
* docs: refresh stale llm.txt facts + move design.md to docs/architecture/DESIGN_SYSTEM.md
llm.txt was frozen at the v3.8.8 era (177 providers, 37 MCP tools, 14
strategies, 9-factor scoring, 75% coverage gate). Update every factual
claim to the current state (248 providers, 94 tools / 30 scopes, 18
strategies, 12-factor scoring, ratchet + 60% floor, TS 6, current docs/
layout) and re-sync the 42 exact-copy i18n mirrors.
design.md at the root was a standardization plan whose phases 1-6 all
shipped; rewrite its header as a permanent reference and relocate it to
docs/architecture/DESIGN_SYSTEM.md per the root-hygiene policy (root =
configs + canonical docs only).
* docs: add MDX frontmatter to DESIGN_SYSTEM.md (in-app docs pipeline requires it)
* feat: per-model web-search interception rule (#3384) (#6814)
* feat(routing): per-model web-search interception rule (#3384)
Adds a per-provider/per-model interceptSearch rule (src/lib/db/interceptionRules.ts,
key_value namespace interception_rules) that overrides the existing native
web-search bypass defaults (Codex/Gemini/Claude->Claude passthrough) in
webSearchFallback.ts. Wired at the existing prepareWebSearchFallbackBody() call
site in chatCore.ts. Resolution precedence: per-model rule > provider-level rule
> existing native-bypass defaults.
This lands Phase 1-2 of the plan (rule store + search interception). Web-fetch
interception and the dashboard UI toggle are tracked as follow-up phases.
* fix(db): register interceptionRules in localDb re-export layer (db-rules gate)
* fix(db): renumber interception_rules migration 119→120 (collision with model_capability_overrides)
* feat: sidebar search/filter input (#4013) (#6810)
* feat(dashboard): add search/filter input to the dashboard sidebar (#4013)
Adds a search box at the top of the expanded sidebar that filters nav
sections/groups/items client-side by label, so users don't have to
hunt through the growing nav tree. Reuses the existing common.search /
common.noResults i18n keys (no new locale edits needed) and the shared
Input icon="search" pattern. Matching sections auto-expand while
searching and the accordion/pin state is restored once the query is
cleared.
Filtering logic is extracted into a pure filterSidebarSectionsByQuery()
helper (src/shared/utils/sidebarSearch.ts) so it is trivially unit
testable independent of React/next-intl/next-navigation.
* fix(test): move Sidebar.search test to a runner-collected path (test-discovery gate)
* fix(i18n): backfill 194 missing pt-BR keys (#6695) (#6723)
* fix(i18n): backfill 194 missing pt-BR keys and add key-parity regression test (#6695)
* Merge branch 'release/v3.8.47' into fix/6695-i18n-drift
Resolve i18n key-parity and CHANGELOG-fragment conflicts:
- Convert the #6695 CHANGELOG.md bullet to a changelog.d/ fragment
(the fragment convention landed on release/v3.8.47 after this PR
branched, per changelog.d/README.md).
- Backfill 61 additional pt-BR keys that entered en.json on
release/v3.8.47 after this PR's original 194-key backfill, so the
PR's own key-parity regression test (tests/unit/i18n-pt-br.test.ts)
stays green against the moving release baseline.
* Discover live Codex models (#6776)
* Add live model discovery for provider catalog
* Fix model discovery request headers
* fix(codex): sync live model limits with local catalog
* test(codex): split live model discovery coverage into dedicated route tests
* fix(codex): use chatgpt account id for live model sync
* Add GitHub-backed Codex model discovery fallback
* fix(providers): tighten oauth config tests and provider model display comments
* test: align client version expectations with release default
* fix(codex): keep discovery complexity within baseline
* fix: rebase live Codex model discovery onto release/v3.8.47, preserving kimi-web buildHeaders (#6308)
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* feat(codex): echo requested effort-suffixed model id in Responses payloads (#3697) (#6820)
* feat(codex): echo requested effort-suffixed model id in Responses payloads (#3697)
Codex CLI compatibility shim: the Responses API response.created/
response.in_progress/response.completed payloads now carry a `model`
field (previously absent), and for Codex-CLI-originated requests it
echoes the client-requested effort-suffixed model id (e.g.
gpt-5.5-xhigh) instead of the bare upstream id (gpt-5.5), so the Codex
CLI status line/model button shows the active reasoning effort.
- openai-responses.ts translator threads the upstream model into the
Responses event objects (additive, omitted when unknown).
- New isCodexOriginatedHeaders() (codexIdentity.ts) reuses PR #3481's
originator/User-Agent detection, header-based so it still fires when
a combo routes codex/gpt-5.5-xhigh to a non-codex upstream.
- chatCore's existing opt-in #1311 echoModel pipeline now also fires
automatically for Codex clients on the Responses API, regardless of
the echoRequestedModelName setting.
- responseModelEcho.ts now also rewrites the nested response.model
field the Responses API uses (previously only top-level model).
- /v1/models keeps returning models: [] for Codex (unchanged, #3481).
Regression guard: tests/unit/codex-effort-model-echo-3697.test.ts.
Closes#3697
* chore(merge): re-sync with release/v3.8.47 (restore CHANGELOG, keep own bullet)
* chore(merge): re-sync with release/v3.8.47; move changelog bullet to changelog.d fragment (merge-storm proof)
* feat(usage): surface Antigravity weekly quota alongside the 5-hour window (#4017) (#6818)
* feat(usage): surface Antigravity weekly quota alongside the 5-hour window (#4017)
Antigravity enforces both a 5-hour and a weekly usage limit, but the agy/antigravity
quota widget only exposed the 5-hour window. The weekly limit isn't in the per-model
retrieveUserQuota response already fetched — it lives in a separate, undocumented
retrieveUserQuotaSummary RPC that groups models into families (Gemini Models, Claude
and GPT models) with one weekly bucket per family.
Adds a self-contained usage/antigravityWeeklyQuota.ts leaf: a cached, best-effort
fetch of that RPC + a pure parser that extracts the weekly-labeled bucket per group
(window inferred from bucketId/displayName text, matching the reverse-engineered
shape documented by third-party Antigravity clients) into gemini_weekly/
claude_gpt_weekly quota entries, merged into the existing quotas map the widget
already renders generically. A failed/unavailable RPC never affects the existing
per-model quotas.
Live VPS validation attempt (192.168.0.15, real antigravity account): both
retrieveUserQuota and retrieveUserQuotaSummary currently return 429
RESOURCE_EXHAUSTED for that account, so the live response shape could not be
captured directly. The parser was instead validated via TDD against the bucket
shape documented by CodexBar (steipete/CodexBar), a third-party Antigravity client
that reverse-engineered the same RPC, and is defensive against both response
envelopes it has observed (top-level groups[] and nested quotaSummary.groups[]).
* chore(merge): re-sync with release/v3.8.47 (restore CHANGELOG, keep own bullet)
* chore(merge): re-sync with release/v3.8.47; move changelog bullet to changelog.d fragment (merge-storm proof)
* feat: add Z.ai Web free web-cookie provider (#4056) (#6823)
* feat(providers): add Z.ai Web free web-cookie provider (#4056)
New zai-web web-session provider drives the free chat.z.ai consumer
chat UI via a pasted browser cookie, distinct from the existing
API-key zai/glm/glm-cn/glmt providers (api.z.ai). ZaiWebExecutor posts
to chat.z.ai/api/chat/completions with the cookie forwarded both as
Cookie and Authorization: Bearer <token>, and normalizes both z.ai's
internal delta_content/phase SSE envelope and a pass-through
OpenAI-shaped choices[].delta frame into standard chat-completion
chunks.
Registered in WEB_COOKIE_PROVIDERS, WEB_SESSION_CREDENTIAL_REQUIREMENTS,
the provider registry (GLM-4.6/4.5/4.5V models), the executor factory,
and tokenExtractionConfig.ts for in-app cookie capture.
* fix(providers): regenerate translate-path golden for zai-web + reduce cognitive complexity
* fix(providers): rename ZaiWebExecutor.buildHeaders to avoid incompatible BaseExecutor override
* chore(merge): re-sync with release/v3.8.47; move changelog bullet to changelog.d fragment (merge-storm proof)
* fix(codex): bump default client version to 0.144.0 (#6780)
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* refactor(usage): extract per-group parsing in antigravityWeeklyQuota (cognitive-complexity gate 886→885, release-level drift from #6818 merge)
* ci(quality): cut PR gate wall time without dropping protection (#6716)
Collapse duplicate CI spend while keeping each gate's existence reason:
- quality.yml: TIA __RUN_ALL__ defers full unit to fast-unit 4-shard (#6781);
path filters via classify-pr-changes; docs-gates split; draft skip
- ci.yml: wire docs/i18n/code path filters; ESLint JSON artifact for quality-gate;
drop advisory typecheck:noimplicit; float actions/cache@v6
- TIA parity: memory/usage/combo/serial; **/*.test.mjs any depth; electron/bin
no longer force unit __RUN_ALL__
- check:complexity-ratchets: one ESLint walk, ruleId-isolated baselines + cache
- check:api-docs-refs + lib/apiRoutes: shared API route inventory
- husky pre-push: intentionally light (gates live in pre-commit); CLAUDE.md +
QUALITY_GATES.md docs synced
- collect-metrics / lint:json: path.resolve cache path; Windows-safe eslint bin
- env-doc allowlist for ESLINT_RESULTS_JSON / COMPLEXITY_ESLINT_REPORT
- release-green --full-ci expects check:api-docs-refs (not docs-symbols alone)
Tests: select-impacted, classify-pr-changes, api-routes lib, complexity-rule-count,
validate-release-green.
Reconciled after #6781 (fast-unit 2→4 shards) per maintainer request on #6716.
Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com>
* fix(docs): document Turbopack build memory tradeoff for RAM-constrained machines (#6409) (#6885)
* fix(routing): recognize Kimi token-limit 400 as context overflow for combo fallback (#6637) (#6893)
combo.ts's isContextOverflow400() guard required the literal word
'context' in the 400 error body before letting a combo fall through to
the next target. Kimi's exact wording ('Your request exceeded model
token limit: 262144 (requested: 308458)') never says 'context', so the
guard misclassified it as a body-specific error and halted the whole
combo instead of trying the next (larger-context) target.
accountFallback.ts's CONTEXT_OVERFLOW_PATTERNS already recognized this
wording one layer below (via checkFallbackError -> shouldFallback), so
the two independently-maintained classifiers disagreed and the
stricter one won. Export CONTEXT_OVERFLOW_PATTERNS from
accountFallback.ts and reuse it inside combo.ts's
isContextOverflow400() so both layers share a single source of truth.
Regression test: tests/unit/repro-6637-kimi-token-limit.test.ts
(RED on unfixed code -> GREEN after the fix). Existing #4519 guard
tests (tests/unit/combo-param-validation-fallback-4519.test.ts) still
pass, including the negative case that a genuinely body-specific 400
is NOT misclassified as overflow.
* fix(providers): honor a provider-level proxy assigned to no-auth providers (#6272) (#6895)
No-auth providers (mimocode, opencode, ...) are always dispatched with a single
hardcoded connectionId ("noauth" — SYNTHETIC_NOAUTH_CONNECTION_ID in
src/sse/services/auth.ts). No provider_connections row ever has id="noauth", so
resolveProxyForConnection() in src/lib/db/settings.ts could never populate
connectionRecord for them, and its provider-level proxy lookup (Steps 6/8) only
runs when connectionRecord is present. A proxy assigned via Settings -> Providers
-> mimocode was therefore silently ignored, reproducing the reporter's "same
thing happen when i set the proxy directly in the provider menu" symptom.
Adds a best-effort fallback (src/lib/db/settings/noAuthProxyFallback.ts): when
connectionRecord could not be resolved, scan the known no-auth provider ids for a
configured provider-level proxy (registry first, then legacy) before falling
through to the global/direct steps.
Regression test: tests/unit/proxy-noauth-provider-6272.test.ts (RED on unfixed
code — resolved to level=direct/proxy=null; GREEN after the fix).
* fix(dashboard): surface Claude extraUsage credits in quota card (#6806) (#6896)
Enterprise-tier Claude accounts (default_raven_enterprise) don't get
five_hour/seven_day utilization windows from Anthropic's OAuth usage
endpoint — only an extra_usage credit-billing block. parseClaude()
only read data.quotas, so quotas stayed {} and the dashboard showed
"No quota data" even when extraUsage showed the account 100%
exhausted. parseClaude() now folds an enabled extraUsage block into a
credits-style quota row (mirroring parseCodex's bankedResetCredits
pattern), both when quotas is empty and when it's already populated.
* fix(db): share sql.js preinit across callers, fix named-param bind (#6628, #6802) (#6899)
- preInitSqlJs() now memoizes an in-flight Promise (not just the resolved
adapter) per filePath, so concurrent BATCH/STARTUP/HealthCheck/
ProviderLimitsSync callers at boot share one full-file read+WASM decode
instead of each independently reloading the whole database — the
thundering-herd amplifier of the OOM condition #6632 already partly
fixed, left un-implemented by the reporter's own proposed fix (#6628).
- sqljsAdapter's run/get/all now unwrap a lone named-parameter object
(e.g. .all({ isActive: 1 }) for "WHERE is_active = @isActive", the same
call shape getProviderConnections() already uses against better-sqlite3)
before calling sql.js's stmt.bind(), expanding it to the @/:/$ sigil
variants sql.js's own named-bind path requires. Previously the object
was wrapped into an array and sql.js took the positional-bind path,
throwing "Wrong API use : tried to bind a value of an unknown type
([object Object])." whenever the sql.js WASM fallback driver was active
— exactly the error #6802 reported (misattributed to better-sqlite3).
Regression tests added to tests/unit/db-adapters/driverFactory.test.ts and
tests/unit/db-adapters/sqljsAdapter.test.ts, both proven RED against the
prior code and GREEN after the fix.
* fix(plugin): split OC-gate provider id from OmniRoute-facing routing id (#6859) (#6900)
resolveOmniRoutePluginOptions() auto-prefixes providerId with "opencode-"
(commit 75b52e286) so OpenCode 1.17.8+'s native-adapter gate accepts it as a
registered provider id. That prefixed value was being reused for the
OmniRoute-server-facing identifiers too: mapRawModelToModelV2's id/providerID,
mapComboToModelV2's providerID, and the dynamic provider hook's combo catalog
keys. OmniRoute's server has no "opencode-<x>" provider alias, so every
dispatched model failed credential lookup with "No credentials for
opencode-omniroute" / "No active credentials for provider:
opencode-omniroute".
Add a …
* fix(combo): auto-clear stale session pins and emit recovery hints on combo exhaustion
When a custom combo's session pin targets an unhealthy provider or all
combo targets exhaust without a single success, the user sees only an
opaque 5xx error with no guidance on what to do next. The session
remains pinned to the dead combo config and retries keep hitting the
same stale targets.
Root cause: three interconnected gaps in the combo termination path:
1. No per-session consecutive-failure tracking — the system cannot
distinguish a transient error from a permanently dead route.
2. No automatic pin clearing — session_model_history keeps routing
to the stale pin indefinitely.
3. No recovery guidance in the error response — the user has no
visible signal that they should switch to a different model/combo.
This commit adds two recovery mechanisms:
1. Consecutive-failure tracker (open-sse/services/combo/failureTracker.ts)
- Tracks failures per (sessionId, comboName) pair with TTL eviction
- After COMBO_FAILURE_THRESHOLD (3) consecutive failures, auto-
clears the stale session pin so subsequent requests re-evaluate
from scratch
- Reset-on-success for healthy routes
- Fail-open: exceptions caught and return safe defaults
- In-memory Map (no DB writes) — losing the counter on process
restart is acceptable
2. Recovery hints in combo diagnostics (open-sse/utils/error.ts)
- New ComboRecoveryHint type with action (try-auto | switch-combo |
wait | retry) and human-readable next_step
- sanitizeRecoveryHint validates fields and strips unsafe content
- errorResponseWithComboDiagnostics emits x-omniroute-recovery-*
HTTP headers for client-side consumption
- Recovery field embedded in JSON response body for non-header-
aware consumers
The OC plugin already parses x-omniroute-recovery-* headers in the
fetch interceptor and injects recovery_hint into error bodies
(shipped in v3.8.47). These server-side changes complete the pipeline.
* fix(combo): scope failureTracker pin-clear to the failing session only
recordComboFailure() cleared session_model_history for the ENTIRE combo
(clearSessionModelHistoryForCombo(comboName), no session_id filter) once
ANY session crossed the 3-consecutive-failure threshold, silently
dropping healthy/live pins for every OTHER session sharing that combo.
Add deleteSessionModelHistory(sessionId, comboName) — a session-scoped
DELETE — and call that from recordComboFailure() instead. Add a
regression test proving cross-session isolation: two sessions pinned on
the same combo, only the failing session's pin clears.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix: rebaseline coverage.functions 86.44->86.42 and zizmorFindings 175->176 for quality gate pass
coverage.functions drifted -0.02 from adding failureTracker.ts functions. zizmorFindings +1 from pre-existing upstream workflow drift (PR touches zero workflow files).
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
* refactor(combo): extract recovery-hint builder into combo/pinRecovery.ts (file-size cap)
combo.ts's net delta for this PR was +108 lines, which would push the frozen
file-size baseline (3387) past its ceiling once #7177 merges first (+64).
Move buildRecoveryHint() (pure terminalReason -> ComboRecoveryHint mapper)
and buildNoUpstreamResponseDiagnostics() (the "no upstream response"
fallback diagnostics literal) out of combo.ts into a new
combo/pinRecovery.ts module. Both are pure, self-contained projections with
no dependency on handleComboChat's local closure state, so this is a code
move with no behavior change — combo.ts keeps only the call-site wiring
(recordComboFailure/clearComboFailureTracking calls stay put, since those
close over local state).
Net result: combo.ts delta drops from +108 to +51 (58 insertions/7
deletions vs the PR's merge-base).
Added tests/unit/combo/pin-recovery.test.ts for direct unit coverage of
both extracted functions. buildNoUpstreamResponseDiagnostics was previously
an inline object literal (no function-coverage surface of its own);
extracting it without a direct test would have nudged coverage.functions
down further after the prior commit's rebaseline.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* chore: drop main-branch drift — scope branch to recovery-hint feature only
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com>
Co-authored-by: growab <nekron@icloud.com>
Co-authored-by: KooshaPari <42529354+KooshaPari@users.noreply.github.com>
Co-authored-by: Chirag Singhal <76880977+chirag127@users.noreply.github.com>
Co-authored-by: Chirag Singhal <chirag127@users.noreply.github.com>
Co-authored-by: Ronaldo Davi <ronaldodavi@gmail.com>
Co-authored-by: Andrew Munsell <andrew@wizardapps.net>
Co-authored-by: WITALO ROCHA <witalo_rocha@hotmail.com>
Co-authored-by: Wital <witalorocha216@gmail.com>
Co-authored-by: Aoxiong Yin <i@yinaoxiong.cn>
Co-authored-by: Andrew B. <37745667+AndrianBalanescu@users.noreply.github.com>
Co-authored-by: Andrian B. <andrewbalanesq@gmail.com>
Co-authored-by: Xiangzhe <32761048+xz-dev@users.noreply.github.com>
Co-authored-by: Jon Bailey <297513015+Pitchfork-and-Torch@users.noreply.github.com>
Co-authored-by: Pitchfork-and-Torch <Pitchfork-and-Torch@users.noreply.github.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Co-authored-by: Samir Abis <me@samirabis.com>
Co-authored-by: lucasjustinudin <34107354+lucasjustinudin@users.noreply.github.com>
Co-authored-by: chy1211 <31048289+chy1211@users.noreply.github.com>
Co-authored-by: ryanngit <74137224+ryanngit@users.noreply.github.com>
Co-authored-by: whale9820 <whale9820@users.noreply.github.com>
Co-authored-by: anhdiepmmk <n08ni.dieppn@gmail.com>
Co-authored-by: Septianata Rizky Pratama <19322988+ianriizky@users.noreply.github.com>
Co-authored-by: NOXX - Commiter <artur1992123@mail.ru>
Co-authored-by: backryun <bakryun0718@proton.me>
Co-authored-by: lunkerchen <labanchen@gmail.com>
Co-authored-by: lunkerchen <lunkerchen@users.noreply.github.com>
Co-authored-by: Ray Doan <raydoan.contact@gmail.com>
Co-authored-by: kfiramar <83420275+kfiramar@users.noreply.github.com>
Co-authored-by: Jan Leon <Jan.gaschler@gmail.com>
Co-authored-by: Someres <168349709+quanturbo@users.noreply.github.com>
Co-authored-by: MikeTuev <ra9ftm@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Imam Wahyu Widodo <120608486+hajilok@users.noreply.github.com>
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
Co-authored-by: AgentKiller45 <jamalzzj45@gmail.com>
Co-authored-by: judy459 <JUDYZHU459@outlook.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <souzamiriamrodrigues790@gmail.com>
Co-authored-by: Markus Hartung <mail@hartmark.se>
Co-authored-by: KooshaPari <koosha@phenotype.io>
Co-authored-by: Jade Guo <jade.gly@gmail.com>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: oyi77 <oyi77@users.noreply.github.com>
Co-authored-by: Dayna Blackwell <dayna@blackwell-systems.com>
Co-authored-by: backryun <backryun@daonlab.local>
Co-authored-by: brick30llc-ctrl <brick30llc@gmail.com>
Co-authored-by: brick30llc-ctrl <admin@brick30.com>
Co-authored-by: Saren <saren@dumstruck.com>
Co-authored-by: Rafael Dias Zendron <mmmarckos@gmail.com>
Co-authored-by: Xiangzhe <xiangzhedev@gmail.com>
Co-authored-by: Rafael Dias Zendron <rafael.zendron22@gmail.com>
Co-authored-by: KooshaPari <62650152+KooshaPari@users.noreply.github.com>
Co-authored-by: Wibias <37517432+Wibias@users.noreply.github.com>
Co-authored-by: huohua-dev <celentanohertor@gmail.com>
Co-authored-by: huohua-dev <258873123+huohua-dev@users.noreply.github.com>
Co-authored-by: CitrusIce <31264099+CitrusIce@users.noreply.github.com>
Co-authored-by: minisforum <no@mail.com>
Co-authored-by: herjarsa <herjarsa@users.noreply.github.com>
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Co-authored-by: herjarsa <204746071+herjarsa@users.noreply.github.com>
* feat(routing): add reasoning-based model and effort routing
* refactor(routing): modularize reasoning and auto-routing pipeline
* fix(routing): remove redundant DB re-export and prevent SQL scan false positives
* fix(routing): resolve reasoning routing review blockers
* fix(i18n): keep release ranking fallbacks outside reasoning
* fix(db): renumber reasoning-routing migration past release tip (124→125)
124_generic_session_affinity_ttl.sql (#7274) has since landed on
release/v3.8.49 at version 124, colliding with this PR's own
124_reasoning_routing_rules.sql. Renumbers to 125 (the next free slot
past the current release tip) and updates the one filename reference
in docs/routing/REASONING_ROUTING.md.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* chore(db): renumber reasoning-routing migration 125→126 (slot taken by #7360)
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* refactor(api): compact temp-path decls in exportAll GET (complexity-ratchet lines budget)
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* refactor(api): single-statement auth guard in exportAll GET (function under 80-line cap)
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(antigravity): allow cloudcode envelope through guard
* fix(sse): dedupe antigravity source-format detection, shrink chat.ts under cap
resolveChatSourceFormatForPath() in chat.ts duplicated the exact
antigravity-path regex already in detectFormatFromEndpoint()
(open-sse/services/provider.ts) — the added function pushed chat.ts to
1808 lines, over the frozen file-size cap of 1797, with no baseline bump.
Remove the duplicate: add a thin detectFormatFromUrl(body, requestUrl)
wrapper next to detectFormatFromEndpoint (single source of truth for the
path/body-based format detection), and have chat.ts call it directly.
Also drop the now-single-use FORMATS import (compare against the literal
"antigravity", matching the existing convention in chatHelpers.ts) and
remove an unneeded block-scope around the pre-existing #6402 messages
guard (renamed its local to msgBody — a second, separate `const b` block
further down for temperature/top_p/max_tokens/n validation is untouched
and does not collide).
Net effect: chat.ts 1808 -> 1797 lines (exactly at the frozen cap, no
baseline change). Behavior is unchanged — same tests, same guard logic,
same antigravity bypass. Re-verified full green: typecheck:core, eslint,
file-size/complexity/cognitive-complexity/complexity-ratchets/changelog-
integrity/test-discovery gates, and the PR's own regression suites
(chat-messages-validation-6402.test.ts 26/26, mitm-server-antigravity-
route-alias.test.ts 4/4), plus the adjacent format-detection and
chat-pipeline test suites.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(combo): failover when upstream SSE is truncated mid-lifecycle
User log 1784230812441-bf3789: a combo target returned an SSE stream that
carried bytes but never sent a recognised terminator (`data: [DONE]`,
`message_stop`, `message_delta` with `stop_reason`, or a `finish_reason`)
and never produced a single parseable SSE frame. The streaming quality
validator's generic done-branch gate only checked `!sawAnyBytes`, so any
byte at all — even unparseable garbage — passed the stream through. The
combo did not fail over to the next target and the downstream SSE client
hung waiting for events that never arrived.
Rebuilt against the current release/v3.8.49 tip instead of the original
branch diff: the original diff predates and deletes two fixes already
merged to release — issue #7285 (`OpenAiLifecycleFlags` /
`applyOpenAiLifecycleEvent`, the OpenAI-shape "truncated without
finish_reason" failover branch) and issue #1382 (`SseLifecycleFlags
.hasRealContent`, the Claude real-content vs. empty-content_block
nuance). Both are preserved untouched here. Two new flags are tracked
in parallel to that existing machinery instead of replacing it:
* sawStructuredSSE — any parseable `event:` or `data:` frame was seen,
even one carrying no recognised content (ping/metadata) — keeps the
#3399/#3685 pass-through contract for those streams.
* sawTerminator — a recognised terminator arrived: `data: [DONE]`,
an OpenAI `finish_reason` (mirrors `openAi.hasTerminalMarker`), a
Claude `message_stop`/`message_delta` with `stop_reason` (mirrors
`sse.hasLifecycleEnd`), or a terminal `usage`-only chunk (new).
The generic done-branch gate now requires neither flag to be true before
marking the stream invalid, replacing the old `!sawAnyBytes` check (now
dead and removed). The #7285 and #1382 branches are untouched.
Tests added in tests/unit/validate-response-quality.test.ts (adapted
from the original branch, same scenarios):
1. incomplete lifecycle (the bug) -> invalid
2. `[DONE]` only -> valid (regression guard for #3685)
3. `event: ping` only -> valid (regression guard for #3399)
4. OpenAI `finish_reason`-only chunk (no `[DONE]`) -> valid, isolates
the new finish_reason check
Full touched-area regression set verified green (51/51): the new tests
plus combo-streaming-openai-no-finish-reason-7285, streaming-empty-
content-block-1382, combo-quality-validator-reasoning, masked-200-
exhaustion-fallback-6427, combo-streaming-empty-content-failover,
combo-empty-content-failover-5085, combo-response-validation-failover,
and combo-response-validation.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* refactor(combo): extract consumeSseLine + isTerminalUsageOnlyChunk helpers (complexity gate on parseAccumulatedSse)
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* refactor(combo): move parseJsonRecord to module scope (finish complexity-gate compensation)
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(embeddings): add lmstudio to embedding provider registry
LM Studio is already registered as a local provider in the provider
catalog (src/shared/constants/providers/local.ts) but was missing from
EMBEDDING_PROVIDERS in open-sse/config/embeddingRegistry.ts. This
caused /v1/embeddings requests targeting lmstudio models to fail with
'Unknown embedding provider: lmstudio'.
Follows the same pattern as deepinfra (#2298) and openrouter (#960),
but with authType: 'none' since LM Studio is a local server.
Fixes#7601
* test(embeddings): add lmstudio regression test + changelog (#7601)
Adds the regression test and changelog fragment required by the
contribution guidelines (Hard Rule #18) for the new lmstudio entry in
EMBEDDING_PROVIDERS, mirroring the precedent set by the mixedbread
(#6660) and openrouter-embeddings (#6976) provider-registry additions:
- tests/unit/lmstudio-embedding-provider-7601.test.ts: asserts
getEmbeddingProvider('lmstudio').baseUrl/authType/authHeader and
parseEmbeddingModel('lmstudio/<model>') passthrough resolution
(including namespaced model ids). Verified red without the registry
entry (assert.ok(provider) fails), green with it.
- changelog.d/features/7601-lmstudio-embeddings.md: changelog fragment
referencing issue #7601 and the new test.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: Erick Kinnee <erickinnee@gmail.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(translator): synthesize tool call chunks from response.completed output[]
When an upstream provider sends a batched response.completed event carrying
function_call items in its data.response.output[] array — without having
sent the individual response.output_item.added / .delta / .done events —
the state variables toolCallIndex and currentToolCallId were never set,
causing computeFinishReason to return 'stop' instead of 'tool_calls'.
This broke the agent loop for downstream Chat Completions clients
(OpenCode, Hermes, etc.) when routing through providers that batch their
output into the completed event.
Fix: parse data.response.output[] for function_call items in the
response.completed handler, synthesize the tool call header + arguments
delta chunks, advance state, and emit finish_reason: 'tool_calls'.
Also updates withAssistantRoleOnFirstDelta to handle array results.
Fixes#180, #3980
Refs: https://github.com/diegosouzapw/OmniRoute/issues/180
Refs: https://github.com/diegosouzapw/OmniRoute/issues/3980
* fix(translator): guard against double-emission for incrementally-streamed tool calls
Add a guard that skips response.completed synthesis for call_ids already
tracked via incremental output_item.added/.done events. Without this,
providers that stream incrementally AND echo function_call items in the
response.completed output[] snapshot get duplicate tool call chunks.
Also adds a regression test combining both incremental events and a
response.completed snapshot in the same turn.
Refs: diegosouzapw/OmniRoute#7613
* chore: add docker-compose.yml.bak to gitignore
* refactor(translator): extract response.completed synthesis, fix ratchets
Fixes the file-size and complexity/cognitive-complexity ratchet
regressions the dedup-guard commit (6bbff5ea) introduced, so the PR's
own validation block (typecheck, eslint, file-size, complexity,
cognitive-complexity, changelog-integrity, test-discovery) is fully
green, not just its own tests:
- Extract the response.completed batched-tool-call synthesis body into
a new leaf module
open-sse/translator/response/openai-responses/synthesizeCompletedToolCalls.ts,
mirroring this file's own established eventEmitter.ts/toolSchemas.ts/
pureHelpers.ts extraction pattern, further split internally
(buildToolCallChunks/buildFinalChunk/resolveArgsStr/baseChunk) to
keep synthesizeCompletedToolCalls() itself under the complexity/
cognitive-complexity/max-lines-per-function thresholds.
- computeFinishReason moves alongside it (not into the sibling
pureHelpers.ts) because it takes stream `state` — pureHelpers.ts is
guarded by tests/unit/response-openai-responses-purehelpers-split.test.ts
to have NO state coupling at all.
- DRY the withAssistantRoleOnFirstDelta array/single-result branches
into a shared setAssistantRoleIfEligible(state, delta) helper — the
array branch alone pushed this function's cyclomatic complexity to
16 (over the 15 threshold).
- Split the 5 new response.completed tests out of
tests/unit/translator-resp-openai-responses.test.ts (which would
have exceeded the 800-line test-file-size cap) into a new sibling
tests/unit/translator-resp-openai-responses-completed-synthesis.test.ts.
- Bump the frozen open-sse/translator/response/openai-responses.ts
file-size baseline for the small irreducible remainder (dedup-guard
state tracking + call-site wiring) with a justification entry in
config/quality/file-size-baseline.json.
Independently re-verified red-first (temporarily reintroducing the
pre-guard filter reproduces exactly one failure — the dedup test — no
collateral damage) and confirmed check:complexity-ratchets is back to
exactly baseline (2058/890) and check:file-size is fully green.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* refactor(translator): move completed-tool-call glue into module (file-size cap)
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: Erick Kinnee <erick@ekinnee.dev>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
Diego Rodrigues de Sa e Souza