Integrated into release/v3.8.0 — allows optional-key providers (SearXNG, Petals, self-hosted chat, OpenAI/Anthropic-compatible) to pass connection test by centralizing the check in providerAllowsOptionalApiKey().
Integrated into release/v3.8.0 — removes .ts import extensions, replaces as any casts with proper types, and normalizes provider alias resolution in combo context_length calculation.
Update Pollinations request transformation to send the selected model
and stream flag so requests match the active endpoint behavior.
Align the ChatGPT TLS client with shared proxy resolution so dashboard
proxy context is honored before falling back to environment settings.
Also refresh provider display names across dashboard pages, correct the
Claude extra-usage toggle messaging and visual state, and mark
Pollinations as offering a free public endpoint.
prepareClaudeRequest already injects a synthetic thinking content block
when body.thinking is enabled, an assistant turn contains a tool_use,
and no precursor thinking block exists in content[]. The injection was
gated by `provider === "claude" || provider?.startsWith?.("anthropic-
compatible-")`, which excluded other Anthropic-shape upstreams:
- kimi-coding (api.kimi.com/coding/v1/messages)
- glmt (z.ai coding plan Anthropic endpoint)
- zai, agentrouter, and any future provider registered with format: "claude"
These providers enforce the same body-shape contract for thinking mode
and reject multi-turn requests with errors like:
kimi-coding: "thinking is enabled but reasoning_content is missing in
assistant tool call message at index N"
claude (cross-provider replay): "Invalid signature in thinking block"
prepareClaudeRequest is only invoked when targetFormat === FORMATS.CLAUDE
(translator/index.ts:165-168), so the outer provider gate is redundant:
any body reaching this function is destined for a Claude-shape upstream.
Drop the gate; the body of the block executes uniformly for all Claude-
shape targets.
Net effect:
- Single-turn requests unchanged (no tool_use in history yet)
- Multi-turn requests with assistant tool_use turns get a placeholder
thinking block ("." with DEFAULT_THINKING_CLAUDE_SIGNATURE) prepended
- Existing thinking blocks get their signature replaced with the default
(already the case for claude/anthropic-compatible-*; now applied to
kimi-coding and similar — same defensive cross-provider posture)
The `supportsPromptCaching` gate at line 152 (for cache_control insertion)
remains unchanged — that one still wants to be conservative about which
providers support prompt caching.
Includes 5 unit test cases covering: claude native injection (regression),
kimi-coding injection (new), existing-thinking signature replacement,
thinking-off pass-through, and single-turn no-inject.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Mandate direct PR fixes over cherry-picking in all cases where the maintainer has write access to the contributor's branch. Explicitly forbid using cherry-pick just to bypass conflict resolution.
Comment out the npm availability guard and unit test execution in the
pre-push hook so pushes are no longer blocked by local hook checks. This
shifts validation away from developer machines and avoids failures in
environments where npm is unavailable or hooks are undesired.
Hide admin password entry during setup, make doctor degrade to warnings
when source-only runtime checks are unavailable, and improve stop
behavior by attempting graceful shutdown before force killing ports.
Also use SQLite's backup API for safer snapshots under WAL, align CLI
key writes with the current provider_connections schema, and include
follow-on compatibility fixes for GLM provider detection, stream error
sanitization, and auth-aware test coverage.
Integrated into release/v3.8.0 — cloud agent provider exports and logger import fixes were already present in the release branch. Thank you for the quick response to the crash report!
Remove upstream provider headers from non-stream chatCore JSON responses to
prevent authorization and API key values from being exposed to clients.
Add coverage to verify sensitive provider request headers are omitted while
OmniRoute metadata headers remain present.
Tighten executor, usage, model-resolution, and state-management
code with explicit types and safer record handling to reduce runtime
edge cases across providers.
Also normalize management-token failures to 403 responses, require API
keys consistently on cloud agent task routes with CORS-safe errors,
refresh stale Gemini CLI project IDs, prioritize Gemini search tools
correctly, add new provider/model registry entries, and serialize
integration tests for more reliable CI.
- Update types in several files to reduce usage of `any`
- Fix `fetch` body type error in `AntigravityExecutor` by returning `ReadableStream`
- Add `CLOUD_AGENT_PROVIDERS` constants
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
When the /v1/models catalog builds entries for individual provider
chat models, context_length was previously only set when the
REGISTRY provider entry carried defaultContextLength. For providers
without that field (or when alias resolution fails to map to a
REGISTRY key), models shipped without any context_length, causing
OpenCode and other clients to fall back to a ~4000 token limit.
Now getDefaultContextFallback calls getTokenLimit() as the ultimate
fallback, which resolves through env overrides, models.dev DB,
name heuristics, and hardcoded defaults — always returning a value.
Fixes the same class of bug as 3dc7542e (combo context_length)
but for individual (non-combo) models.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Skip the superseded 041 session_account_affinity migration when
the canonical 050 file is present, and remap legacy migration
markers so upgraded databases do not replay the duplicate slot.
Also include the CLI entrypoints in packaged artifacts and extend
management-auth coverage across admin memory, pricing, routing,
provider validation, and usage endpoints to keep release bundles
runnable and sensitive operations protected.
- Fix OAuth expiry handling for ISO strings in virtualFactory.ts
- Move AutoRoutingBanner test from src/ to tests/unit/shared/components/
- Remove mock metrics from analytics endpoint, return only real data
- Fix error handling for bare 'auto' prefix in chat.ts (check isAutoRouting)
- Update vitest.config.ts to include tests/unit/**/*.test.tsx pattern
- Replaced hardcoded LINUX_CA_DIR with dynamic filesystem probing to support Debian, Arch, Fedora, and openSUSE system trust stores.
- Added updateNssDatabases helper to seamlessly inject root certificates directly into browser NSS databases (e.g., ~/.pki/nssdb, ~/.mozilla/firefox).
- Supported standard and snap-based Chrome/Chromium and Firefox installations.
- Made browser cert injection resilient, executing under the current user to prevent file ownership issues, and safely falling back if certutil is absent.
Root cause: v3.7.9 fix for #1966 removed the unconditional CLAUDE_SYSTEM_PROMPT
injection, which also removed the else branch that always set result.system.
When Claude Code sends system prompt as body.system (native Anthropic array)
through /v1/chat/completions, the translator only looked at role='system'
messages in body.messages — body.system was silently dropped.
Fix: The translator now checks for body.system and preserves it:
- If both body.system and role='system' messages exist, they are merged
- If only body.system exists, it passes through as-is
- If only role='system' messages exist, behavior unchanged
- If neither exists, result.system remains undefined (no forced injection)
Also removes the dead CLAUDE_SYSTEM_PROMPT import.
Includes 4 regression tests covering all combinations.
- Add kiro-cli SQLite auto-import for enterprise SSO + headless environments
- Add image support (OpenAI + Anthropic formats → Kiro native)
- Move long tool descriptions to system prompt to prevent 400 errors
- Sync model list with live API: add auto-kiro, claude-sonnet-4, deepseek-3.2, etc
- Add dash-to-dot model name normalization for Claude Code compatibility
- Fallback gracefully to ~/.aws/sso/cache for social auth
Co-authored-by: christlau <christlau@users.noreply.github.com>
- Replace legacy getCursorUsage with dashboard API (cursor.com/api/dashboard/get-current-period-usage)
- Use WorkOS session cookie auth instead of Bearer token
- Surface 3 quota windows: Total, Auto + Composer, API
- Register cursor in USAGE_SUPPORTED_PROVIDERS
- Add fetchUserInfo() to resolve real email on import
- Remove ~170 lines of dead code (old fetcher + helpers)
- Add 6 comprehensive tests with fetch mocking
Co-authored-by: payne0420 <baboialex95@gmail.com>
- Add exact-match guard for /dashboard/onboarding before the broad /dashboard prefix
- Add setup_wizard and client_api_mcp to ClassificationReason union type
- Update test to verify PUBLIC classification
Co-authored-by: HomerOff <homeroff76@gmail.com>
- Add formatCurrencyCost() for adaptive decimal precision on cost cards
- Add codex-auto-review pricing alias to GPT-5.5
- Add getPricingModelCandidates() with Codex effort suffix stripping
- Fix fallback stats to exclude combo-routed requests and use case-insensitive comparison
- Add 3 new unit tests for Codex pricing resolution
Co-authored-by: 05dunski <jan.gaschler@gmail.com>
