Adds enginesExplicit to the strict compression PUT schema so the panel can save without a 400. Kept only this commit; the Hub-render commit was superseded by Phase 2 (#4521) which rewrote CompressionHub.tsx. Does not reopen the Phase 1 gate (enginesExplicit is recomputed from stored engines, the persisted row is ignored). Tested.
Integrated into release/v3.8.33.
The omniroute_web_fetch input schema (#4510) used z.string().min(1, "URL is
required") for the url field, but .min() only fires for an empty string. A
MISSING url (webFetchInput.parse({})) fails the z.string() type check first and
emitted the default Zod v4 message ("expected string, received undefined"), so
the existing test 'webFetchInput rejects missing URL' (expecting /URL is
required/) failed on the full unit suite — a latent base red on release/v3.8.33.
Add the custom message to the type check: z.string({ error: "URL is required" }).
Now both the missing-field and empty-string cases emit 'URL is required'; a valid
url still passes. No other web_fetch behavior changes.
Co-authored-by: Diego Rodrigues de Sa e Souza <diego.souza@cdwasolutions.com.br>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds account/combo/latency/fallbackCount to telegram request.completed notifications; account UUID rendered via truncated display name (no sensitive data leak). Tested. Rebuilt onto release/v3.8.33.
Integrated into release/v3.8.33.
Adds authHint + enriched freeNote/apiHint on the existing bazaarlink entry (distinct from the closed-redundant #4497). Integrity test included.
Integrated into release/v3.8.33.
The combo.ts lockout call sites never forwarded mlSettings.maxCooldownMs to recordModelLockoutFailure, so the admin-configured cap fell back to BACKOFF_CONFIG.max. Passes it at all 3 sites. TDD included.
Integrated into release/v3.8.33.
Rebuilt onto release/v3.8.33; reconciled with the already-merged keepOpenOnSelect (#4496) — deselection now rides the existing keepOpenOnSelect + onDeselect wiring instead of a redundant closeOnSelect prop. Integrated into release/v3.8.33.
clampMaxTokens now uses the per-model maxOutputTokens from REGISTRY['command-code'] as the upper bound (falls back to MAX_COMMAND_CODE_TOKENS), so GLM-5.x stops being rejected for max_tokens > 131072. Rebuilt onto release/v3.8.33 (passthrough block from the PR base is already present via #2986); 3 tests added.
Integrated into release/v3.8.33.
Adds a scheduled SQLite VACUUM job that persists last-run state to key_value and fixes the hardcoded lastVacuumAt:null in getDatabaseSettings. Review fixes: corrected the key_value write (no updated_at column), dropped a dead/colliding migration, rewrote the test from Vitest to node:test against the real interface.
Integrated into release/v3.8.33.
Context-overflow and param-validation 400s now fall through to the next combo target (different targets have different context windows / output limits); normalizeUpstreamFailure keeps context_length_exceeded=400 and rate-limit=429. Pure predicates extracted + tested (Rule #18). The codex.ts compression seen in the raw diff was base-divergence noise, not in the feature commit.
Integrated into release/v3.8.33.
Adds USD usage percentages and reset hints to @@om-usage and 400 quota rejections, and cuts the weekly USD window at the real observed reset via quota_snapshots instead of resetAt-7d. Rebuilt onto release/v3.8.33 (squash-base-stale; delta = 5 files/+353).
Integrated into release/v3.8.33.
Removes dead exports DOCS_TARGET_LOCALES and getLanguage (zero callers, Knip-reported) and adds config-adapter coverage test.
Integrated into release/v3.8.33.
Disambiguates display names when the same model name appears across distinct provider prefixes. Pure, non-mutating; complementary to id-dedupe.
Integrated into release/v3.8.33.
Adds an MCP tool to extract URL content via the existing /v1/web/fetch endpoint (Firecrawl/Jina/Tavily). Mirrors omniroute_web_search; scope execute:search; mcp_audit logged.
Integrated into release/v3.8.33.
Thanks @megamen32! Rebased onto release/v3.8.32. On review (owner decision) the auto-routing quota cutoff was made OPT-IN behind QuotaPreflightSettings.enabled (default OFF, so current behavior is unchanged) and the ...eligibleTargets last-resort fallback was restored so a quota-blocked target survives as final fallback rather than vanishing. The 429-when-all-blocked guard stays for the enabled path. typecheck clean, 13/13 tests.
(cherry picked from commit 1831c6eca8)
The unified thinking adapter can set Claude/OpenAI-native thinking fields
(thinking, reasoning_effort, reasoning, enable_thinking, thinking_budget) at
the request body root. The Antigravity envelope spreads ...passthroughFields,
so these leaked into the Google Cloud Code envelope and Google rejected the
request with `400 Bad input: oneOf at '/' not met` (or `Unknown name
"thinking"`), breaking every reasoning/thinking model served via Antigravity
(e.g. claude-opus-4-x-thinking).
Extends the existing #1944 envelope strip (output_config/output_format) to
also drop the whole thinking family. Gemini's own generationConfig.thinkingConfig
travels inside the inner request and is unaffected, so thinking still works.
Reported-by: theseven99 (https://github.com/decolua/9router/issues/1926)
Co-authored-by: Arcfoz <62255009+Arcfoz@users.noreply.github.com>
(cherry picked from commit 5a7c1e1731)
Thanks @KooshaPari! Merged the core of this PR (provider-asset shrink + budget gate + usage-rollup same-day cutoff fix + test), rebuilt scoped on release/v3.8.32. On review we dropped the codeqlAlerts 0->1 baseline loosening and the off-topic changes (the codex/memory contract fixes already landed via #4474; getProviderNames removal + cognitive baseline left out). Asset gate passes, rollup 22/22.
(cherry picked from commit 911e1fb3cc)
Release v3.8.32 — see CHANGELOG.md [3.8.32] for the full list. Merged via --admin over documented non-blocking checks: CodeQL alerts ratchet (#665 fixed by #4457/#4462, auto-closes on main rescan), Integration Tests (env-flaky batch-upstream), SonarCloud/SonarQube (advisory new-code).
Release v3.8.31 — see CHANGELOG.md [3.8.31] for full notes and contributors.
Merged over known non-blocking reds (all correctness gates green): Integration Tests (2/2) is env/flaky (polls a real upstream batch that did not complete in the poll window); SonarQube/SonarCloud is the advisory server-side new-code quality gate. Unit (8 shards), Coverage, Node 22/24/26, Lint, PR Test Policy, Quality Ratchet, Docs-Strict, Quality-Extended and all 4 CodeQL analyses are green.
Use exact array-element membership (.some((h) => h === host)) instead of Array.prototype.includes() in the MITM hosts unit test, so CodeQL's js/incomplete-url-substring-sanitization heuristic does not misread an Array.includes membership check as a String.includes URL-substring test. Functionally identical. Mirrors #4386 (already merged into release/v3.8.31). Closes the only open code-scanning alert (#660).
