* fix(combo): failover when upstream SSE is truncated mid-lifecycle
User log 1784230812441-bf3789: a combo target returned an SSE stream that
carried bytes but never sent a recognised terminator (`data: [DONE]`,
`message_stop`, `message_delta` with `stop_reason`, or a `finish_reason`)
and never produced a single parseable SSE frame. The streaming quality
validator's generic done-branch gate only checked `!sawAnyBytes`, so any
byte at all — even unparseable garbage — passed the stream through. The
combo did not fail over to the next target and the downstream SSE client
hung waiting for events that never arrived.
Rebuilt against the current release/v3.8.49 tip instead of the original
branch diff: the original diff predates and deletes two fixes already
merged to release — issue #7285 (`OpenAiLifecycleFlags` /
`applyOpenAiLifecycleEvent`, the OpenAI-shape "truncated without
finish_reason" failover branch) and issue #1382 (`SseLifecycleFlags
.hasRealContent`, the Claude real-content vs. empty-content_block
nuance). Both are preserved untouched here. Two new flags are tracked
in parallel to that existing machinery instead of replacing it:
* sawStructuredSSE — any parseable `event:` or `data:` frame was seen,
even one carrying no recognised content (ping/metadata) — keeps the
#3399/#3685 pass-through contract for those streams.
* sawTerminator — a recognised terminator arrived: `data: [DONE]`,
an OpenAI `finish_reason` (mirrors `openAi.hasTerminalMarker`), a
Claude `message_stop`/`message_delta` with `stop_reason` (mirrors
`sse.hasLifecycleEnd`), or a terminal `usage`-only chunk (new).
The generic done-branch gate now requires neither flag to be true before
marking the stream invalid, replacing the old `!sawAnyBytes` check (now
dead and removed). The #7285 and #1382 branches are untouched.
Tests added in tests/unit/validate-response-quality.test.ts (adapted
from the original branch, same scenarios):
1. incomplete lifecycle (the bug) -> invalid
2. `[DONE]` only -> valid (regression guard for #3685)
3. `event: ping` only -> valid (regression guard for #3399)
4. OpenAI `finish_reason`-only chunk (no `[DONE]`) -> valid, isolates
the new finish_reason check
Full touched-area regression set verified green (51/51): the new tests
plus combo-streaming-openai-no-finish-reason-7285, streaming-empty-
content-block-1382, combo-quality-validator-reasoning, masked-200-
exhaustion-fallback-6427, combo-streaming-empty-content-failover,
combo-empty-content-failover-5085, combo-response-validation-failover,
and combo-response-validation.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* refactor(combo): extract consumeSseLine + isTerminalUsageOnlyChunk helpers (complexity gate on parseAccumulatedSse)
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* refactor(combo): move parseJsonRecord to module scope (finish complexity-gate compensation)
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(embeddings): add lmstudio to embedding provider registry
LM Studio is already registered as a local provider in the provider
catalog (src/shared/constants/providers/local.ts) but was missing from
EMBEDDING_PROVIDERS in open-sse/config/embeddingRegistry.ts. This
caused /v1/embeddings requests targeting lmstudio models to fail with
'Unknown embedding provider: lmstudio'.
Follows the same pattern as deepinfra (#2298) and openrouter (#960),
but with authType: 'none' since LM Studio is a local server.
Fixes#7601
* test(embeddings): add lmstudio regression test + changelog (#7601)
Adds the regression test and changelog fragment required by the
contribution guidelines (Hard Rule #18) for the new lmstudio entry in
EMBEDDING_PROVIDERS, mirroring the precedent set by the mixedbread
(#6660) and openrouter-embeddings (#6976) provider-registry additions:
- tests/unit/lmstudio-embedding-provider-7601.test.ts: asserts
getEmbeddingProvider('lmstudio').baseUrl/authType/authHeader and
parseEmbeddingModel('lmstudio/<model>') passthrough resolution
(including namespaced model ids). Verified red without the registry
entry (assert.ok(provider) fails), green with it.
- changelog.d/features/7601-lmstudio-embeddings.md: changelog fragment
referencing issue #7601 and the new test.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: Erick Kinnee <erickinnee@gmail.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(translator): synthesize tool call chunks from response.completed output[]
When an upstream provider sends a batched response.completed event carrying
function_call items in its data.response.output[] array — without having
sent the individual response.output_item.added / .delta / .done events —
the state variables toolCallIndex and currentToolCallId were never set,
causing computeFinishReason to return 'stop' instead of 'tool_calls'.
This broke the agent loop for downstream Chat Completions clients
(OpenCode, Hermes, etc.) when routing through providers that batch their
output into the completed event.
Fix: parse data.response.output[] for function_call items in the
response.completed handler, synthesize the tool call header + arguments
delta chunks, advance state, and emit finish_reason: 'tool_calls'.
Also updates withAssistantRoleOnFirstDelta to handle array results.
Fixes#180, #3980
Refs: https://github.com/diegosouzapw/OmniRoute/issues/180
Refs: https://github.com/diegosouzapw/OmniRoute/issues/3980
* fix(translator): guard against double-emission for incrementally-streamed tool calls
Add a guard that skips response.completed synthesis for call_ids already
tracked via incremental output_item.added/.done events. Without this,
providers that stream incrementally AND echo function_call items in the
response.completed output[] snapshot get duplicate tool call chunks.
Also adds a regression test combining both incremental events and a
response.completed snapshot in the same turn.
Refs: diegosouzapw/OmniRoute#7613
* chore: add docker-compose.yml.bak to gitignore
* refactor(translator): extract response.completed synthesis, fix ratchets
Fixes the file-size and complexity/cognitive-complexity ratchet
regressions the dedup-guard commit (6bbff5ea) introduced, so the PR's
own validation block (typecheck, eslint, file-size, complexity,
cognitive-complexity, changelog-integrity, test-discovery) is fully
green, not just its own tests:
- Extract the response.completed batched-tool-call synthesis body into
a new leaf module
open-sse/translator/response/openai-responses/synthesizeCompletedToolCalls.ts,
mirroring this file's own established eventEmitter.ts/toolSchemas.ts/
pureHelpers.ts extraction pattern, further split internally
(buildToolCallChunks/buildFinalChunk/resolveArgsStr/baseChunk) to
keep synthesizeCompletedToolCalls() itself under the complexity/
cognitive-complexity/max-lines-per-function thresholds.
- computeFinishReason moves alongside it (not into the sibling
pureHelpers.ts) because it takes stream `state` — pureHelpers.ts is
guarded by tests/unit/response-openai-responses-purehelpers-split.test.ts
to have NO state coupling at all.
- DRY the withAssistantRoleOnFirstDelta array/single-result branches
into a shared setAssistantRoleIfEligible(state, delta) helper — the
array branch alone pushed this function's cyclomatic complexity to
16 (over the 15 threshold).
- Split the 5 new response.completed tests out of
tests/unit/translator-resp-openai-responses.test.ts (which would
have exceeded the 800-line test-file-size cap) into a new sibling
tests/unit/translator-resp-openai-responses-completed-synthesis.test.ts.
- Bump the frozen open-sse/translator/response/openai-responses.ts
file-size baseline for the small irreducible remainder (dedup-guard
state tracking + call-site wiring) with a justification entry in
config/quality/file-size-baseline.json.
Independently re-verified red-first (temporarily reintroducing the
pre-guard filter reproduces exactly one failure — the dedup test — no
collateral damage) and confirmed check:complexity-ratchets is back to
exactly baseline (2058/890) and check:file-size is fully green.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* refactor(translator): move completed-tool-call glue into module (file-size cap)
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: Erick Kinnee <erick@ekinnee.dev>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* chore(ci): add .mergify.yml to main — Mergify only reads config from the default branch (#7168)
* fix(ci): add the auto-enqueue pull_request_rule to the Mergify config (queue_conditions alone are eligibility-only) (#7179)
* fix(ci): migrate Mergify auto-enqueue to merge_protections_settings.auto_merge_conditions (rules-based path is EOL 2026-07-16) (#7216)
* fix(ci): drop Mergify batch settings (batching is a paid-tier feature; free plan queue is serial) (#7220)
* fix(ci): merge queue tolerates the advisory dast-smoke failure (its GH-hosted build hang dequeued every attempt) (#7225)
* test(ci): make the #6634 selfref guard hermetic — main's copy hard-fails every PR (#7341)
main's copy of this test still does git I/O inside a unit test:
const baseSrc = git(['show', 'origin/main:' + FILE]);
Runners check out a shallow single ref, so origin/main does not resolve and the
test dies with 'fatal: invalid object name origin/main'. Every PR into main
fails Unit Tests (7/8) on it — today that is #7313, #7315, #7316, #7334, #7336
and #7337, six PRs red on a defect none of them introduced. #7313 has no other
red at all.
release/v3.8.49 already carries a fix (2e42b8efc, #7174: try/catch, fetch
origin/main on demand, t.skip() when unreachable), but it only reaches main at
release time — so main stays broken for the whole cycle. Cherry-picking it would
also import a new problem: PR Test Policy classifies t.skip() as a silenced
assertion, which we watched it correctly catch on #7300 today.
This is the hermetic version instead (ported from #7327, which does the same for
the release branch): read the file straight off disk, compare against an empty
base so baseTaut/baseExtTaut are 0 — the strictest possible comparison point —
and call evaluateMasking() directly. No git ref, no fetch, no skip, nothing the
runner's checkout depth can break.
The #6634 regression stays covered: the guard's logic lives in
SELF_TEST_FIXTURE_RE (check-test-masking.mjs:337), not in the test. Proven both
ways on main before committing — neutralise SELF_TEST_FIXTURE_RE to /$^/ and
the test FAILS; restore it and it passes 2/2, with check-test-masking.mjs left
byte-identical.
Co-authored-by: growab <nekron@icloud.com>
* chore(quality): tighten main's coverage baseline to the CI's real numbers (#7347)
main's ratchet had been failing --require-tighten on every PR: 11 metrics
improved but the baseline was never tightened. Same class as the #6634
selfref guard — an infra fix that lands only on the release branch leaves
main red for the whole cycle, and every PR into main pays for it.
Values are the merged-coverage numbers from a run on main itself (a local
run measures ~68% vs CI's ~80%; the baseline's own note warns about that
gap). Only the 11 coverage values change — gitleaks and semgrepFindings
keep main's own state.
No changelog fragment: #7326 carries it on release/v3.8.49, and a second
one here would double the entry at release time.
* feat(providers): add xAI OAuth PKCE
* docs(changelog): note xAI OAuth provider
* test(xai): assert OAuth refresh client id
* refactor(oauth): rebaseline OAuthModal wiring note (file-size cap)
Correct the file-size-baseline.json annotation for the xai-oauth PKCE
provider-switch branch in OAuthModal.tsx (993->998, +5) to match the
modal's existing historical-progression annotation style (969->989->
993->998; structural shrink tracked in #3501). The frozen value (998)
stays unchanged — only the annotation text is corrected.
tests/unit/oauth-providers-config.test.ts already sits exactly at its
frozen cap (845) after registering xai-oauth in the shared provider
enumerations (import, EXPECTED_PROVIDER_KEYS, EXPECTED_CONFIG_BY_PROVIDER,
REQUIRED_FIELDS_BY_PROVIDER). check:file-size reports 0 violations for
it, so no test move or baseline bump was needed.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* test(oauth): compact required-field arrays (file-size budget on frozen oauth-providers-config suite)
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com>
Co-authored-by: growab <nekron@icloud.com>
Co-authored-by: alexey.nazarov@softmg.ru <alexey.nazarov@softmg.ru>
Co-authored-by: Alex <4217955+fenix007@users.noreply.github.com>
* chore(ci): add .mergify.yml to main — Mergify only reads config from the default branch (#7168)
* fix(ci): add the auto-enqueue pull_request_rule to the Mergify config (queue_conditions alone are eligibility-only) (#7179)
* fix(guardrails/chat): stop Vision Bridge hijacking credentialed models to opencode-zen
OpenCode (and similar clients) often send image parts in long sessions.
Vision Bridge treated the request model as non-vision and whole-request-
rerouted to getBestVisionModel(), which preferred opencode-* (priority 0).
That landed on a noauth connection and returned 401 Missing API key —
while proxies/combos still logged the original target (zai/glm-5.2, grok-cli, …).
Also: after resolveRoutingModel(X-Route-Model), keep body.model aligned so the
post-guardrail "body.model !== modelStr" path cannot undo the routing header.
- visionBridge: skip whole-request reroute when original model has usable creds
- visionBridge: refuse reroute to targets known unusable (noauth without key)
- visionBridgeRouter: deprioritize opencode-* for auto vision pick
- chat: alignBodyModelWithRouting + only adopt true guardrail model mutations
- tests: VB-CRED-01/02 + alignBodyModelWithRouting coverage
* fix(guardrails/chat): keep chat.ts under the file-size ratchet and update stale vision-bridge tests for the credential-aware reroute skip
- Extract the routing-model reconciliation logic (X-Route-Model align,
post-guardrail reroute policy re-check, hook model override) into
RoutingModelOps helpers in resolveRoutingModel.ts, shrinking chat.ts back
under the frozen 1796-line file-size baseline (was 1837).
- Update tests/unit/guardrails/vision-bridge-callmodel.test.ts: the fallback
mock must match whichever API shape the selected fallback model actually
calls (OpenAI-compatible vs Anthropic), since the vision-bridge router
priority fix in this PR can now legitimately select an Anthropic fallback
model instead of always defaulting to an OpenAI-shaped opencode-* model.
- Update tests/unit/vision-bridge-policy-reroute-6640.test.ts: per this PR's
own VB-CRED-01 test, a credentialed original model is now intentionally
never whole-request-rerouted (it always falls through to describe-then-
forward) — so the pre-existing #6640 tests are updated to assert the
final, user-facing answer always comes from the original credentialed
model, matching the new intended behavior instead of the retired
whole-request-reroute path.
Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>
* fix(guardrails/chat): reduce isProviderConnectionUsable cyclomatic complexity to satisfy the project-wide complexity ratchet
The new isProviderConnectionUsable helper (complexity 21) regressed the
project-wide complexity ratchet from 2056 to 2057. Refactor it to use Set
membership checks and small extracted helpers (hasNonEmptyString,
hasOAuthCredential) instead of chained === / || comparisons — same behavior,
verified by the existing "isProviderConnectionUsable rejects noauth without
api key" test, with complexity back under the 15-per-function threshold and
the project-wide ratchet back at the 2056 baseline.
Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>
---------
Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
* fix(dashboard): prefer public endpoint URLs
* docs: add changelog fragment for #7547
* test(dashboard): cover onboarding public endpoint
* refactor(hooks): split display-URL predicates below complexity gate
Decompose isPrivateIpv4 and isPublicDisplayBaseUrl (both over the ESLint
complexity gate of 15) into small named predicates. Behavior is unchanged:
- isPrivateIpv4 now checks a PRIVATE_IPV4_RANGES table (RFC1918 +
special-use ranges) through isInIpv4Range instead of one long chain
of ||/&& comparisons.
- isPublicDisplayBaseUrl now delegates to isSupportedProtocol,
isLoopbackHostname, isMulticastDnsHostname and isNonPublicIpv6 (itself
split into isIpv6LoopbackOrUnspecified / isIpv6UniqueLocal /
isIpv6LinkLocal), preserving the isIpv6 gate so hostnames that merely
start with "fc"/"fd" (e.g. fdroid.example.com) are not misclassified
as IPv6 unique-local addresses.
Adds IPv4 range-boundary and IPv6-gate regression tests; all existing
assertions are unchanged.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: nguyenha935 <208228297+nguyenha935@users.noreply.github.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* docs(perf): add per-endpoint p50/p95/p99 latency + cost budgets
Adds canonical performance budgets (latency, throughput, cost) for
the v1 client API + management + relay surface, with monthly
re-evaluation cadence.
### Files (1 changed, +222 / -0)
- docs/PERF_BUDGETS.md — 222-line per-endpoint budget matrix
### Why this matters
- diegosouzapw/OmniRoute has zero performance budget doc as of 2026-06-23
- The 71-pillar framework (Performance domain, L13–L19) flags
performance budgets as P0 for any production-serving surface
- Sets SLO targets that downstream dashboards can alert against
### Budgets
- p50 / p95 / p99 latency per endpoint
- Sustained throughput (req/s) per replica
- Cost ceiling per request (USD)
- 30-day rolling window for review
### Compatibility
- Pure documentation — no code change, zero behavior change
- Single file, lands in one commit
- No new dependencies
Refs: 71-pillar framework L13–L19 (Performance domain), upstream
audit 2026-06-23 — no performance budget exists in
diegosouzapw/OmniRoute
* chore(ci): add .mergify.yml to main — Mergify only reads config from the default branch (#7168)
* fix(ci): add the auto-enqueue pull_request_rule to the Mergify config (queue_conditions alone are eligibility-only) (#7179)
* fix(ci): migrate Mergify auto-enqueue to merge_protections_settings.auto_merge_conditions (rules-based path is EOL 2026-07-16) (#7216)
* fix(ci): drop Mergify batch settings (batching is a paid-tier feature; free plan queue is serial) (#7220)
* fix(ci): merge queue tolerates the advisory dast-smoke failure (its GH-hosted build hang dequeued every attempt) (#7225)
* test(ci): make the #6634 selfref guard hermetic — main's copy hard-fails every PR (#7341)
main's copy of this test still does git I/O inside a unit test:
const baseSrc = git(['show', 'origin/main:' + FILE]);
Runners check out a shallow single ref, so origin/main does not resolve and the
test dies with 'fatal: invalid object name origin/main'. Every PR into main
fails Unit Tests (7/8) on it — today that is #7313, #7315, #7316, #7334, #7336
and #7337, six PRs red on a defect none of them introduced. #7313 has no other
red at all.
release/v3.8.49 already carries a fix (2e42b8efc, #7174: try/catch, fetch
origin/main on demand, t.skip() when unreachable), but it only reaches main at
release time — so main stays broken for the whole cycle. Cherry-picking it would
also import a new problem: PR Test Policy classifies t.skip() as a silenced
assertion, which we watched it correctly catch on #7300 today.
This is the hermetic version instead (ported from #7327, which does the same for
the release branch): read the file straight off disk, compare against an empty
base so baseTaut/baseExtTaut are 0 — the strictest possible comparison point —
and call evaluateMasking() directly. No git ref, no fetch, no skip, nothing the
runner's checkout depth can break.
The #6634 regression stays covered: the guard's logic lives in
SELF_TEST_FIXTURE_RE (check-test-masking.mjs:337), not in the test. Proven both
ways on main before committing — neutralise SELF_TEST_FIXTURE_RE to /$^/ and
the test FAILS; restore it and it passes 2/2, with check-test-masking.mjs left
byte-identical.
Co-authored-by: growab <nekron@icloud.com>
* chore(quality): tighten main's coverage baseline to the CI's real numbers (#7347)
main's ratchet had been failing --require-tighten on every PR: 11 metrics
improved but the baseline was never tightened. Same class as the #6634
selfref guard — an infra fix that lands only on the release branch leaves
main red for the whole cycle, and every PR into main pays for it.
Values are the merged-coverage numbers from a run on main itself (a local
run measures ~68% vs CI's ~80%; the baseline's own note warns about that
gap). Only the 11 coverage values change — gitleaks and semgrepFindings
keep main's own state.
No changelog fragment: #7326 carries it on release/v3.8.49, and a second
one here would double the entry at release time.
* docs(perf): correct false enforcement claims in latency budgets doc
Review on PR #7336 found this doc described a working CI perf gate that
does not exist: the title/body claimed "Adds ... budgets to the perf
gate so routes exceeding budget fail CI", but the diff is pure
documentation and `benches/perf-gate.k6.js` (and even the `bench/`/
`benches/` directory the doc claimed "already exists in the repo") do
not exist anywhere in the tree.
- Reworded the top "Enforcement" note and § 6 heading so the doc is
honest about shipping zero enforcement today — it is a target-setting
reference, with the k6 script as a design sketch for future work.
- Fixed the stale claim that `bin/cold-start-bench.sh` is "not yet
committed" — it has existed since Release v3.8.36.
- Added a review-log entry documenting this accuracy pass.
- Added a changelog.d/ fragment per CONTRIBUTING.md convention.
The PR title/description are being corrected separately via `gh pr edit`
to drop the "feat(perf): ... latency budgets" / working-gate framing.
Docs-only change; no production code touched.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: KooshaPari <kooshapari@users.noreply.github.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com>
Co-authored-by: growab <nekron@icloud.com>
Co-authored-by: KooshaPari <1000+KooshaPari@users.noreply.github.com>
* docs(ops): add canonical incident response runbook
Adds a 5-level severity incident response runbook with role
assignments, communication templates, and post-mortem cadence.
### Files (1 changed, +X / -0)
- docs/INCIDENT_RESPONSE.md — incident classification, response
roles per severity (sev1/sev2/sev3/sev4/sev5), pager rotation,
status page templates, post-mortem schedule (within 5 business
days of sev1/sev2 resolution)
### Why this matters
- diegosouzapw/OmniRoute has no incident response runbook as of 2026-06-23
- The 71-pillar framework (Observability & Ops domain, L56–L63)
flags incident response as P0 for any production-serving surface
- Establishes the on-call rotation + escalation paths in writing
- Post-mortem template is the load-bearing artifact (no-blame
culture, 5-business-day deadline, action item tracking)
### Compatibility
- Pure documentation — no code change, zero behavior change
- Single file, lands in one commit
- No new dependencies
* chore(ci): add .mergify.yml to main — Mergify only reads config from the default branch (#7168)
* fix(ci): add the auto-enqueue pull_request_rule to the Mergify config (queue_conditions alone are eligibility-only) (#7179)
* fix(ci): migrate Mergify auto-enqueue to merge_protections_settings.auto_merge_conditions (rules-based path is EOL 2026-07-16) (#7216)
* fix(ci): drop Mergify batch settings (batching is a paid-tier feature; free plan queue is serial) (#7220)
* fix(ci): merge queue tolerates the advisory dast-smoke failure (its GH-hosted build hang dequeued every attempt) (#7225)
* test(ci): make the #6634 selfref guard hermetic — main's copy hard-fails every PR (#7341)
main's copy of this test still does git I/O inside a unit test:
const baseSrc = git(['show', 'origin/main:' + FILE]);
Runners check out a shallow single ref, so origin/main does not resolve and the
test dies with 'fatal: invalid object name origin/main'. Every PR into main
fails Unit Tests (7/8) on it — today that is #7313, #7315, #7316, #7334, #7336
and #7337, six PRs red on a defect none of them introduced. #7313 has no other
red at all.
release/v3.8.49 already carries a fix (2e42b8efc, #7174: try/catch, fetch
origin/main on demand, t.skip() when unreachable), but it only reaches main at
release time — so main stays broken for the whole cycle. Cherry-picking it would
also import a new problem: PR Test Policy classifies t.skip() as a silenced
assertion, which we watched it correctly catch on #7300 today.
This is the hermetic version instead (ported from #7327, which does the same for
the release branch): read the file straight off disk, compare against an empty
base so baseTaut/baseExtTaut are 0 — the strictest possible comparison point —
and call evaluateMasking() directly. No git ref, no fetch, no skip, nothing the
runner's checkout depth can break.
The #6634 regression stays covered: the guard's logic lives in
SELF_TEST_FIXTURE_RE (check-test-masking.mjs:337), not in the test. Proven both
ways on main before committing — neutralise SELF_TEST_FIXTURE_RE to /$^/ and
the test FAILS; restore it and it passes 2/2, with check-test-masking.mjs left
byte-identical.
Co-authored-by: growab <nekron@icloud.com>
* chore(quality): tighten main's coverage baseline to the CI's real numbers (#7347)
main's ratchet had been failing --require-tighten on every PR: 11 metrics
improved but the baseline was never tightened. Same class as the #6634
selfref guard — an infra fix that lands only on the release branch leaves
main red for the whole cycle, and every PR into main pays for it.
Values are the merged-coverage numbers from a run on main itself (a local
run measures ~68% vs CI's ~80%; the baseline's own note warns about that
gap). Only the 11 coverage values change — gitleaks and semgrepFindings
keep main's own state.
No changelog fragment: #7326 carries it on release/v3.8.49, and a second
one here would double the entry at release time.
* docs(ops): fix incident-response runbook factual accuracy issues
Review on PR #7334 found several fabricated/foreign-template references in
docs/INCIDENT_RESPONSE.md that would misdirect an on-call engineer during a
real incident:
- Sec 3 and 4.1 cited a nonexistent `POST /api/providers/{id}/disable`
endpoint. The real mechanism is per-connection:
`PUT /api/providers/{connectionId}` with `{ "isActive": false }`
(src/app/api/providers/[id]/route.ts). There is no single whole-provider
kill switch, so the steps now say to repeat per connection/key, or rely
on the automatic provider circuit breaker / Model Lockout described in
docs/architecture/RESILIENCE_GUIDE.md. Also drops the equally fabricated
"disable path" pointer at src/lib/a2a/skills/providerDiscovery.ts, which
has no such function.
- Sec 4.3 cited a `policies_active` field on GET /api/settings/authz-inventory
that does not exist; the route actually returns a route-tier inventory
(tiers/bypassEnabled/bypassPrefixes/spawnCapablePrefixes/cors). Rewrote
the check against the real shape and added a fallback signal
(JWT_SECRET/API_KEY_SECRET + isValidApiKey's DB reachability) for a
genuine all-keys auth outage.
- Stripped leftover "phenotype" branding (phenotype.slack.com,
grafana.phenotype.internal, status.phenotype.dev, announce@phenotype.dev)
copy-pasted from another org's template, replacing with explicit TBD
placeholders rather than inventing new unverified URLs.
- Fixed the fabricated ADR-024/ADR-029 citations — this repo has no ADR
directory; pointed at the real convention in
docs/architecture/cluster-decisions.md (ADR-041) instead.
- Fixed the #omnirouse-ops-handoff typo -> #omniroute-ops-handoff.
- Added a changelog.d/ fragment per CONTRIBUTING.md convention.
Docs-only change; no production code touched.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: KooshaPari <kooshapari@users.noreply.github.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com>
Co-authored-by: growab <nekron@icloud.com>
Co-authored-by: KooshaPari <1000+KooshaPari@users.noreply.github.com>
* feat(eval): add router-eval harness (AIQ scoring, regression gate, Pareto search)
Extracts a standalone router-eval evaluation tool that replays routing
decisions (from NDJSON corpora or the usage_history/call_logs SQLite
tables) into an AIQ (success/latency/cost) score, compares baseline vs.
candidate router configs with a retained-run regression gate, and ranks
Pareto-optimal candidates across a search space — a sibling to the
existing eval:compression harness.
New scripts: scripts/router-eval/{index,compare,patch-compare,search,
trends}.ts, scripts/check/check-router-eval-regression.ts, and
src/lib/routerEval/index.ts, wired via 6 new package.json entries
(eval:router, eval:router:compare, eval:router:patch-compare,
eval:router:search, eval:router:trends, check:router-eval).
Reconstructed onto current release/v3.8.49 from the original ~142-commit
stale PR branch: only the genuinely new router-eval payload (17 files)
was extracted — the other ~560 changed files in the original diff were
base-drift already present on release in newer form. The new package.json
scripts now invoke `node --import tsx` instead of `bun`, matching the
`eval:compression` precedent (Bun is reserved for a closed 5-script
allowlist). The runtime-detection shim (`"Bun" in globalThis`) already
present in the harness gracefully falls back to better-sqlite3 under
Node, so no logic changes were needed there; the retained-run manifest's
previously-hardcoded `runtime: "bun"` field and matching CLI help text
were corrected to reflect the actual invocation.
All 27 existing router-eval unit tests pass unchanged.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* refactor(router-eval): decompose toRouterObservation below complexity gate
toRouterObservation had cyclomatic complexity 18 (gate max is 15). Extract
the per-field parsing/normalization into pure helpers (sampleId, model
fields, latency, cost derivation, success) so the entry point is a plain
sequential assembly of a RouterObservation. Behavior is unchanged — same
tests pass, same fallbacks, same precedence between input aliases.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* feat(dashboard): add Provider Quota visibility toggle per connection
* refactor(dashboard): extract provider quota visibility controls
Move quota visibility UI and update logic into reusable components, add Portuguese translations, and remove the stale migration gap allowlist entry.
* Hide quota visibility controls for unsupported providers
* chore(ci): retrigger GitHub checks
* fix(db): renumber quota-visibility migration past release tip (121→125)
122_free_proxy_sync_errors.sql, 123_quota_auto_ping.sql, and
124_generic_session_affinity_ttl.sql have since landed on
release/v3.8.49, so 121 is now out-of-sequence and would not apply on
databases already past 122+. Renumbers to 125 (the next free slot past
the current release tip) and restores "121" in check-migration-numbering's
KNOWN_GAPS allowlist, since 121 remains a genuine unfilled gap once this
migration moves off that number.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* chore(quality): rebaseline file-size + complexity for resync merge
The release-resync merge unions two already-compliant features in the
same god-component (ConnectionRow.tsx/ConnectionsListPanel.tsx): this
PR's per-connection quota-visibility wiring and release's confirm-
delete-account wiring (#7361). Both were individually within budget
(785/786 lines); combined they land at 791. Complexity count moves
2058->2059 for the same reason (2 previously-compliant .map() render
callbacks in ConnectionsListPanel.tsx now marginally exceed the
80-line function cap). No new logic was written — see the
_rebaseline_2026_07_18_pr7360_quota_visibility_resync justification
entries in both baseline files for the full accounting. Verified via
a byte-for-byte diff of the violation lists between origin/release/
v3.8.49 tip and this merge. Structural shrink stays tracked in #3501.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* refactor(db): split _updateConnectionRow update assembly (complexity gate)
_updateConnectionRow grew past the 80-line max-lines-per-function ceiling
after this branch added quota_visible column handling. Extract the
`.run()` params assembly (field mapping/normalization, unchanged) into a
module-private `_buildUpdateConnectionRowParams` helper in the same file
so the SQL statement + call site stay in `_updateConnectionRow` while the
function itself drops back under the gate. No behavior change.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* fix(auggie): update model registry to match v0.32.0 CLI model IDs
All previous model IDs (claude-sonnet-4.6, claude-opus-4.6, gpt-5.5-high,
etc.) were synthetic — the actual IDs use a different
naming scheme (sonnet4.6, opus4.6, gpt5.5, etc.).
Replaced the static best-guess registry with the 31 real model IDs
from on v0.32.0, including:
- All Claude variants (fable-5, haiku4.5, sonnet4.x/5, opus4.x/5)
- Gemini 3.1 Pro Preview
- Full GPT-5.x family (gpt5 ~ gpt5.6-terra)
- GLM 5.2, Kimi K2.6/K2.7
- Prism composite routers (prism-a, prism-b)
Removed unused entries that don't exist in v0.32.0 (gemini-3.0-flash,
thinking variants, high/medium split IDs).
Updated unit tests to reference valid model IDs (haiku4.5, sonnet4.6, opus4.6).
* feat(auggie): auto-fetch model IDs on first execute()
* fix(auggie): move sonnet4.6 first in model list, remove duplicate
* fix(tests): update old claude-sonnet-4.6 model ID to sonnet4.6 in auggie test
The registry was updated to use sonnet4.6 but the test at line 352
still referenced the old model ID claude-sonnet-4.6, causing
resolveAuggieModel to reject it.
* test(autoCombo): account for auggie's new glm-5.2 model in auto/glm family test
The v0.32.0 auggie registry update in this PR adds a literal "glm-5.2"
model id. auggie is a no-auth candidate (always in the auto/<family>
pool per open-sse/services/autoCombo/virtualFactory.ts), and the family
filter matches by model-id pattern (open-sse/services/autoCombo/modelFamily.ts),
so it now legitimately joins auto/glm alongside the glm/zai connections —
same documented behavior the "degrades gracefully" test below already
covers for opencode/minimax. Updates the strict-equality assertion to
include it instead of narrowing the pool in production code.
Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>
* fix(auggie): add backward-compat alias map for v0.32.0 model IDs
Saved combos may reference old model IDs (claude-sonnet-4.6 → sonnet4.6,
gemini-3.1-pro → gemini-3.1-pro-preview, gpt-5.5-high → gpt5.5, etc).
The alias map in resolveAuggieModel() resolves these before the allowlist
check so existing combos continue working after the registry rename.
Refs: #7032
* fix(auggie): use Map.get() for the pre-v0.32.0 alias lookup + changelog
resolveAuggieModel() indexed AUGGIE_MODEL_ALIASES (a Map) with bracket
notation (AUGGIE_MODEL_ALIASES[requested]), which always returns undefined
for a Map instance — the alias branch never actually fired, so every
pre-v0.32.0 saved model id still hit "Unknown Auggie model" after the
v0.32.0 registry rename. Switch to .get(requested), the Map accessor.
Adds a red-first regression test (fails on the old bracket access, passes
with .get()) covering every old->new id pair in the alias map, and a
changelog.d fragment documenting the breaking model-id rename + the
alias fallback that keeps existing combos working.
Refs: #7032
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: oyi77 <oyi77@users.noreply.github.com>
Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
Base-red unblock (CI Unit shard 2/4 red on EVERY PR since #7653). Validated locally: test 6/6 under the exact shard harness; persist module proven to load without the UI chain; full static-gate set green (complexity 2056≤2058, cognitive 889≤890, file-size/test-discovery/dashboard-typecheck/changelog OK).
Validated in merge-train 2026-07-18 @ 9084b408b: 12198/12201 pass; single red = earlyStreamKeepalive timer test, confirmed load-flake (6/6 green isolated on release tip AND the merged tree; no boarded PR touches keepalive)
Validated in merge-train 2026-07-18 @ 9084b408b: 12198/12201 pass; single red = earlyStreamKeepalive timer test, confirmed load-flake (6/6 green isolated on release tip AND the merged tree; no boarded PR touches keepalive)
Validated in merge-train 2026-07-18 @ 9084b408b: 12198/12201 pass; single red = earlyStreamKeepalive timer test, confirmed load-flake (6/6 green isolated on release tip AND the merged tree; no boarded PR touches keepalive)
Validated in merge-train 2026-07-18 @ 9084b408b: 12198/12201 pass; single red = earlyStreamKeepalive timer test, confirmed load-flake (6/6 green isolated on release tip AND the merged tree; no boarded PR touches keepalive)
* docs(readme): standardize all tables to full content width
Add a 1px transparent spacer.svg and per-table header spacers so every
markdown table renders at the same ~890px full content width on GitHub
instead of collapsing to its own content width. No table text changed.
* chore(changelog): fragment for #7666
* docs(readme): replace free-tier budget mockup with animated SMIL card
Single detailed card (1200x872, 10s loop, SMIL only — plays inside GitHub's
img sandbox): ~1.6B/mo hero + honest-math panel (struck-through ~10B, 15
providers ToS-flagged), animated budget bar of the 21 countable free pools,
full per-model grid (Mistral Large 3 1.00B -> Auto 25K), ~616M first-month
signup-credit chips, permanently-free no-cap providers + $10 OpenRouter
top-up, and a live used/remaining footer.
The generated mockup docs/screenshots/free-tier-budget-card.svg stays in
place — it is produced by scripts/research/gen-budget-card-svg.mjs and still
referenced by the i18n READMEs (zh-CN/zh-TW); only the root README embed
changes. Registered in the hand-authored table in docs/diagrams/README.md.
* chore(changelog): fragment for #7665
* docs(readme): animate CLI command list + compression flow as SMIL SVGs
Two more README ASCII/text blocks become hand-authored animated SVGs
(SMIL only, GitHub <img>-sandbox safe, DESIGN_SYSTEM.md palette),
following the tier-cascade / pool / combo pattern:
- cli-terminal.svg — compact terminal window (640x500) cycling three
real CLI screens (providers list / combo list / health) with
character-by-character typing, output formats copied from the actual
bin/cli printers (headings, column layout, status colors, circuit
breaker block), plus a scrolling ticker carrying the full 30-subcommand
list the image replaces (also preserved in the img alt).
- compression-pipeline.svg — the 'Client -> 10 engines -> Provider'
flow line as an animated funnel: 10,000 tok in, ~1,080 tok out, token
dots evaporating engine by engine behind the cells, RTK -> Caveman
default stack highlighted, a code token passing through untouched
(always preserved byte-perfect) and the stacked savings math badge.
Registered both in docs/diagrams/README.md (hand-authored table).
* docs(changelog): add fragment for #7637 (CLI terminal + compression SVGs)
* docs(readme): enlarge CLI terminal diagram (full-width, 1200x700)
Per review: the mini 640x500 terminal read too small. Rebuild it as a
full-width widescreen terminal (viewBox 1200x700, embedded at width=100%)
with larger type, wider aligned columns, 6 provider rows and 4 combo rows
so each screen fills the frame. Same 3 real CLI screens, same SMIL, same
DESIGN_SYSTEM.md palette, same command-ticker footer.
* docs(readme): animate pool + combo blocks as SMIL SVG diagrams
Replace the two remaining ASCII blocks in the README with hand-authored
animated SVGs (16s loops, SMIL only — play inside GitHub's <img> sandbox,
DESIGN_SYSTEM.md palette), following the tier-cascade.svg pattern:
- pool-fair-share.svg — key pool "team-codex" fair-share quota: weights
50/30/20, generous mode lending idle shares, 50% threshold crossing,
strict mode holding each key to its cap (verbatim README copy).
- combo-always-on.svg — combo "always-on" priority strategy: 4 fallback
layers with coral hand-off on failure and an uptime bar that never
drops (zero downtime).
Both blocks keep their full flow text in the img alt. Registered in
docs/diagrams/README.md (hand-authored table).
* docs(changelog): add fragment for #7626 (pool + combo SVG diagrams)
* docs: sync provider count to 259 (docs-counts strict gate)
The auto-generated catalog (docs/reference/PROVIDER_REFERENCE.md) is at
259 providers; README.md, AGENTS.md and CLAUDE.md still said 253 —
tripping the strict Provider-count check in check:docs-counts for every
PR targeting the release branch (surfaced red on #7615's Docs Gates
fast-path run). Updates the 8 provider-count mentions across the three
files (marketing badges and AES-256-GCM strings untouched).
* docs(changelog): add fragment for #7616 (provider-count sync)
* docs(readme): replace tier-cascade ASCII diagram with animated SMIL SVG
The 4-tier auto-fallback block in the README becomes a self-contained
animated SVG (docs/diagrams/tier-cascade.svg, 16 KB): a 16s loop in 4
acts where requests flow from the IDE through the smart router into the
active tier, and each quota-out/budget-hit transition hands the traffic
down to the next tier, ending on the always-on free tier. SMIL only — no
JS, no external fonts — so it animates inside GitHub's camo/<img>
sandbox. Content is verbatim from the previous ASCII art; the full flow
is preserved in the img alt text. docs/diagrams/README.md gains a
hand-authored-diagrams section documenting it.
* docs(changelog): add fragment for #7615 (animated tier-cascade SVG)
* docs(readme): align tier-cascade SVG palette with DESIGN_SYSTEM.md
Retrofit to the canonical tokens (docs/architecture/DESIGN_SYSTEM.md §3.1):
dark bg #0b0e14 + the 32px graph-paper grid wallpaper (the product/site
signature), surface #161b22, borders rgba(255,255,255,.08), radius 14,
text-muted #a1a1aa. Brand semantics fixed: the router hub glyph + glow now
use primary #e54d5e (matching the favicon hub mark) and the title carries
the --grad-brand gradient (primary → accent-3); exhaustion states
(quota out / budget hit flashes, spent-tier status dots, hand-off dots)
move from brand coral to the semantic error token #ef4444; topology paths
use accent #6366f1 with accent-2 #8b5cf6 request dots; success stays
#22c55e. Re-validated (0 warnings) and re-verified frame-by-frame.
* feat(providers): add Segmind image+video provider (#6656)
Segmind exposes 200+ hosted image/video models under a single
`POST https://api.segmind.com/v1/{model}` REST shape: x-api-key auth,
JSON request body, raw media bytes response (no JSON envelope).
- New IMAGE_PROVIDERS + VIDEO_PROVIDERS registry entries (format:
"segmind") with a curated starter model list (Flux, SDXL, SD3.5,
Kandinsky for image; Wan, Hunyuan, LTX, Kling for video).
- New connection-metadata entry in specialty-media.ts; segmind added
to IMAGE_ONLY_PROVIDER_IDS and VIDEO_PROVIDER_IDS.
- Dedicated handlers (imageGeneration/providers/segmind.ts,
videoGeneration/providers/segmind.ts) built on a shared REST client
(utils/segmindClient.ts) that centralizes the fetch/error/log path
so both stay under the complexity/max-lines ratchets.
- Extracted the pre-existing Alibaba DashScope video handler out of
the frozen videoGeneration.ts into videoGeneration/providers/
dashscope.ts (no behavior change) to make room for the new Segmind
dispatch branch under the frozen file-size baseline.
- Error responses route through sanitizeErrorMessage() (Hard Rule
#12) — verified by dedicated no-leak tests.
- Regenerated docs/reference/PROVIDER_REFERENCE.md (250 -> 251
providers) and synced the plain-text provider counts in README.md/
AGENTS.md/CLAUDE.md (anchors/badges left untouched).
Tests: tests/unit/segmind-image-video-provider-6656.test.ts (11
cases — registry shape, connection metadata, IMAGE_ONLY/VIDEO_
PROVIDER_IDS membership, mocked-fetch request mapping for both
image and video, and sanitized-error-path assertions for both
upstream error bodies and network exceptions). No live Segmind key
required; response shape (raw media bytes, x-api-key auth) is
sourced from https://docs.segmind.com/ and corroborated against
https://www.segmind.com/models/flux-schnell/api,
https://www.segmind.com/models/sdxl1.0-txt2img/api, and
https://www.segmind.com/models/wan2.1-t2v/api.
Gates run clean: check-file-size, check:complexity-ratchets
(2055/889, both under baseline), typecheck:core,
typecheck:noimplicit:core (no new errors), lint (targeted files),
check:cycles, check:docs-counts (STRICT provider-count drift
resolved), check:docs-sync, check:any-budget:t11,
check:tracked-artifacts, check:provider-consistency,
check:known-symbols.
* test(providers): align APIKEY_PROVIDERS count 167→168 for the new segmind provider (#6656)
Adding segmind to specialty-media.ts grows APIKEY_PROVIDERS by one;
providers-constants-split.test.ts hardcodes the family-partition total.
Legitimate count alignment, not a weakened assertion — all 4 partition/
dedup checks still enforced.
* feat(sse): add Microsoft Designer as image provider (#6672)
Adds `microsoft-designer-web` — an unofficial, reverse-engineered
Bearer-token web-session image provider, modeled on the existing
`chatgpt-web`/`copilot-m365-web` "-web" provider category.
- Registers the provider in WEB_COOKIE_PROVIDERS (src/shared/constants/
providers/web-cookie.ts) and IMAGE_PROVIDERS (open-sse/config/
imageRegistry.ts, new "designer-web" format).
- New handler open-sse/handlers/imageGeneration/providers/designerWeb.ts
implements the submit-then-poll DallE.ashx flow (Bearer access_token +
ClientId/SessionId/UserId headers -> form POST -> poll for
image_urls_thumbnail), wired into handleImageGeneration()'s dispatch.
- The upstream ClientId header is a fixed, publicly-shared value (not a
secret) — routed through resolvePublicCred() per Hard Rule #11, never
as a string literal.
- Registers the token-based credential requirement in
webSessionCredentials.ts so the provider-connect UI asks for the
right field; connection validation falls back to the existing generic
web-cookie session-ping validator (no dedicated validator needed).
- Extracted the KIE image-model catalog into a co-located
open-sse/config/providers/registry/kie/models.ts module (mirrors the
existing lmarena/directModels.ts pattern) to keep imageRegistry.ts
under the file-size cap while adding the new provider entry.
- Regenerated docs/reference/PROVIDER_REFERENCE.md (250 -> 251
providers) and updated the plain-text counts in README.md, AGENTS.md,
CLAUDE.md.
Tests (tests/unit/microsoft-designer-web-6672.test.ts, 16 cases):
registry-entry shape assertions, the resolvePublicCred() shape
assertion (Hard Rule #11), and the pure header/form-body/response-
parsing helpers plus the handler's submit/poll/error/timeout paths
against a mocked fetch — no live Designer session required.
Reverse-engineered from the g4f MicrosoftDesigner.py provider reference
(researched during #6672 triage); the exact upstream response shape has
not been validated against a live Designer session, so the poll-loop
implementation follows the documented g4f contract as closely as
possible without a live capture.
* fix(providers): satisfy web-cookie executor contract + document designer-web env vars (#6672)
Registers `deepinfra` in the video-gen registry, reusing the DeepInfra
native /v1/inference/{model} endpoint already proven for reranking in
this codebase (same host, Bearer auth, non-OpenAI response shape).
Confirmed synchronous against DeepInfra's own docs (POST {prompt} ->
{video_url, seed, request_id, inference_status}), so no polling loop
is needed. Reuses the already-registered `deepinfra` API-key provider
credential (chat) — no new credential/OAuth flow.
To keep the frozen videoGeneration.ts file-size ratchet from growing,
the new deepinfra-video adapter lives in its own co-located module
(open-sse/handlers/videoGeneration/deepinfraHandler.ts, following the
existing googleFlowHandler.ts pattern), and the pre-existing Leonardo
handler was extracted into videoGeneration/leonardoHandler.ts (pure
code move, no behavior change) to make room.
Adds Novita AI to the video-generation subsystem (VIDEO_PROVIDERS), alongside
its existing text/chat gateway registration. Novita's async video APIs are
per-model (POST /v3/async/<model-slug>, e.g. wan-t2v, kling-v1.6-t2v) sharing
one poll endpoint (GET /v3/async/task-result?task_id=...) — confirmed against
Novita's published API reference. Seeds Wan 2.1 T2V and Kling V1.6 T2V models;
reuses the stored novita provider Bearer apiKey (no separate credential flow).
To stay under the frozen videoGeneration.ts file-size cap, extracted the
existing Alibaba/DashScope handler into a co-located sibling module
(videoGeneration/dashscopeHandler.ts) alongside the new Novita handler
(videoGeneration/novitaHandler.ts) and its pure helpers (videoGeneration/novita.ts).
Also tags novita in VIDEO_PROVIDER_IDS (src/shared/constants/providers.ts) so
it surfaces as a video-capable provider in PROVIDER_REFERENCE.md and A2A
provider-discovery, and regenerates the provider reference doc.
Tests: tests/unit/video-novita-6658.test.ts (18 cases) covering registry
shape, pure helpers (URL building, param normalization, task-id/result
parsing), and full handler wiring (submit->poll->mp4, missing credentials,
missing task_id, task FAILED, task timeout).
* feat(providers): add Freepik (Magnific Mystic) image generation provider (#6654)
Adds an official, API-key-based Freepik image-gen provider using the Mystic
endpoint (POST /v1/ai/mystic -> async task_id -> GET /v1/ai/mystic/{id}
polling), modeled on the existing leonardo.ts generationId adapter pattern.
- open-sse/config/providers/registry/freepik/index.ts: new registry module
(kept separate to avoid pushing the frozen imageRegistry.ts over the
file-size cap) with the 6 real Mystic style models (realism, fluid, zen,
flexible, super_real, editorial_portraits) — not the "Flux/Imagen3" list
from the original feature request, which independent research showed was
stale.
- open-sse/handlers/imageGeneration/providers/freepik.ts: submit+poll
adapter; all error paths route through sanitizeErrorMessage() (Hard Rule
#12), configurable poll interval/timeout via body.poll_interval_ms /
poll_timeout_ms for fast, deterministic tests.
- Registered in providers.ts (IMAGE_ONLY_PROVIDER_IDS) and
apikey/specialty-media.ts (catalog metadata), with the corrected free-tier
note (one-time ~€5 credit, not a recurring "100/month" allotment).
Drops the "100 free credits/month" and "Flux/Imagen3 selectable models"
claims from the original issue - verification showed the free tier is a
one-time ~€5 API credit and Imagen 3 only underlies the `fluid` style, not a
separately selectable model. Domain: api.freepik.com is still live as of
this writing despite Freepik's April-2026 API-docs rebrand to Magnific
(docs.freepik.com -> docs.magnific.com); noted inline for future
re-verification.
Closes#6654
* test: align APIKEY_PROVIDERS count to 171 after freepik + release merge (#7597)
* feat(providers): add Gladia as an async speech-to-text provider (#6657)
Adds Gladia's async pre-recorded transcription API (upload → POST
/v2/pre-recorded → poll result_url) following the existing
AssemblyAI/Kie.ai async-STT pattern:
- New `gladia` entry in AUDIO_TRANSCRIPTION_PROVIDERS
(open-sse/config/audioRegistry.ts), authenticated via the
`x-gladia-key` custom header.
- New `handleGladiaTranscription()` handler
(open-sse/handlers/audioTranscription.ts) wired into the
format dispatch table.
- New `x-gladia-key` case in `buildAuthHeaders()`
(open-sse/config/registryUtils.ts).
- Registered `gladia` in AUDIO_ONLY_PROVIDERS
(src/shared/constants/providers/audio.ts) so it appears in the
auto-generated provider catalog; regenerated
docs/reference/PROVIDER_REFERENCE.md (250 -> 251 providers) and
synced the plain-text provider counts in README.md, AGENTS.md,
and CLAUDE.md.
Real-time/streaming transcription is explicitly out of scope for
this change — OmniRoute has no WebSocket audio-ingestion layer
today; only the async/pre-recorded path (which covers every other
async STT provider already wired in) is implemented.
Tests: 5 new node:test cases in
tests/unit/audio-transcription-handler.test.ts covering the
upload→submit→poll happy path, a terminal Gladia error, and a
missing result_url guard, plus a buildAuthHeaders case in
tests/unit/registry-utils.test.ts for the new x-gladia-key header.
* chore(providers): sync provider counts to 253 + fix base-red APIKEY partition count 168→169 (#6657)
Rebasing gladia onto the advanced release surfaced two count drifts the
RUN_ALL suite trips on: (1) docs provider count is now 253 (multiple
providers merged since this branch was cut); (2) providers-constants-split
already expects 168 but the release has 169 APIKEY entries — a pre-existing
base-red from an earlier provider merge that didn't update the test. Gladia
is STT (adds no APIKEY entry), so 169 is the correct value; aligning it here
also un-reds the release. All 4 partition/dedup checks still enforced.
* feat(providers): add FreeTheAi as an OpenAI-compatible gateway provider (#6670)
FreeTheAi is a free-tier, Discord-signup gateway aggregator — same shape
as hackclub/chutes: OpenAI-compatible chat/completions + /v1/models
discovery, no custom executor/translator needed.
- Registry entry: open-sse/config/providers/registry/freetheai/index.ts
(format: openai, executor: default, apikey/bearer auth, passthroughModels)
- Provider metadata: src/shared/constants/providers/apikey/gateways.ts
- Listed in AGGREGATOR_PROVIDER_IDS (src/shared/constants/providers.ts)
- Unit test verifying registry entry, getExecutor() resolution, aggregator
classification, and provider metadata (tests/unit/provider-registry-freetheai.test.ts)
* chore(providers): sync counts (APIKEY 170, providers 253) after rebase onto advanced release (#6670)
The release advanced heavily since this branch was cut; realign the
family-partition count to the true post-rebase value (170) and the doc
provider totals to 253. freetheai adds exactly one gateway; the rest of
the delta is pre-existing release drift. All partition/dedup checks enforced.
* feat(sse): add EdgeTTS audio-tts provider (#6668)
Registers Microsoft Edge "Read Aloud" as a new no-API-key AUDIO_SPEECH_PROVIDERS
entry — the first WebSocket-transport TTS provider in the registry. Reverse-
engineered/unofficial endpoint, same class of integration already accepted for
other "-web" style providers (chatgpt-web.ts, copilot-web.ts).
- open-sse/executors/edgeTts.ts: pure Sec-MS-GEC token construction (SHA-256
over a public trusted-client-token + rounded Windows file-time ticks, ported
from rany2/edge-tts drm.py), WS message framing (speech.config/ssml),
binary-chunk demuxing, SSML building/escaping, and the WS synth call itself
(injectable WebSocket ctor for tests, lazy `import("ws")` in production so
it never enters esbuild's top-level CJS bundle graph). Per-client-IP
sliding-window throttle (SlidingWindowLimiter) since there's no per-user key
— one abusive deployment could otherwise get the shared trusted token
rate-limited for everyone.
- open-sse/utils/publicCreds.ts: embeds the trusted-client-token via
resolvePublicCred() (Hard Rule #11) — it's a constant hardcoded in every
Edge build and every open-source edge-tts port, not a per-user secret.
- Extracted open-sse/utils/audioResponse.ts (shared response helpers) and
open-sse/executors/awsPollyTts.ts (AWS Polly handler) out of
open-sse/handlers/audioSpeech.ts to stay under its frozen file-size ratchet
baseline while making room for the new branch — no behavior change to
either extracted piece.
- src/app/api/v1/audio/speech/route.ts: thread the caller's IP through to the
handler for the new throttle.
Tests: tests/unit/edgetts-provider.test.ts (23 cases) — Sec-MS-GEC determinism
and cross-check against a hand-derived reference vector, message framing,
binary demux, SSML escaping/injection-safety, registry lookup, publicCreds
shape, and the error path via an injected fake WebSocket (upstream failure ->
sanitized 502, no stack/path leak; Hard Rule #12), plus the per-IP rate limit.
No live upstream is required or used — the reverse-engineered protocol can't
be validated against real credentials, but every pure/testable seam is
covered per the TDD path in the bug/feature validation gate.
* test(mutation): register edgetts-provider.test.ts in stryker tap.testFiles (#6668)
The new provider's unit test covers a mutated module, so the strict
mutation-test-coverage gate requires it in stryker.conf.json's
tap.testFiles. Single-line addition (kept the file's existing formatting).
