mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-04 14:22:09 +03:00
f31f3c081e39cedfe4db9ae9c39cf67fa5ebd5c4
2343 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Adam
|
f31f3c081e |
feat(proxy): operator-level proxy subscriptions (Karing-style) — hardened, ready for review (#7299)
* feat(proxy-subscriptions): src/lib/proxySubscription/parse.ts * feat(proxy-subscriptions): src/lib/proxySubscription/subscriptionService.ts * feat(proxy-subscriptions): src/lib/proxySubscription/index.ts * feat(proxy-subscriptions): src/lib/db/migrations/123_proxy_subscriptions.sql * feat(proxy-subscriptions): src/app/api/v1/management/proxy-subscriptions/route.ts * feat(proxy-subscriptions): src/app/api/v1/management/proxy-subscriptions/[id]/route.ts * feat(proxy-subscriptions): src/app/api/v1/management/proxy-subscriptions/[id]/refresh/route.ts * feat(proxy-subscriptions): src/app/api/v1/management/proxy-subscriptions/[id]/nodes/route.ts * feat(proxy-subscriptions): src/app/(dashboard)/dashboard/settings/components/proxy/SubscriptionTab.tsx * feat(proxy-subscriptions): tests/unit/proxySubscription.parse.test.ts * feat(proxy-subscriptions): tests/unit/proxySubscription.service.test.ts * feat(proxy-subscriptions): docs/proxy-subscriptions.md * feat(proxy-subscriptions): src/lib/db/proxies/types.ts * feat(proxy-subscriptions): src/lib/db/proxies/mappers.ts * feat(proxy-subscriptions): src/lib/db/proxies.ts * feat(proxy-subscriptions): src/app/(dashboard)/dashboard/settings/components/ProxyTab.tsx * i18n(proxy-subscriptions): add proxySubscriptionsTab key + use in ProxyTab * i18n(proxy-subscriptions): add proxySubscriptionsTab key + use in ProxyTab * i18n(proxy-subscriptions): add proxySubscriptionsTab key + use in ProxyTab * i18n(proxy-subscriptions): add proxySubscriptionsTab key + use in ProxyTab * test(proxy-subscriptions): extract isSubscriptionDue + unit tests * test(proxy-subscriptions): extract isSubscriptionDue + unit tests * test(proxy-subscriptions): extract isSubscriptionDue + unit tests * test(proxy-subscriptions): add global->rule switch re-bind integration test * feat(proxy-subscriptions): inline needs-local-core guidance in SubscriptionTab * i18n: add proxySubscriptionsTab to en (rebased on current main) * i18n: add proxySubscriptionsTab to zh-CN (rebased on current main) * i18n: add proxySubscriptionsTab to pt-BR (rebased on current main) * test(proxy-subscriptions): extract needsCore detection into pure module + unit tests * test(proxy-subscriptions): extract needsCore detection into pure module + unit tests * test(proxy-subscriptions): extract needsCore detection into pure module + unit tests * refactor(proxy-subscriptions): extract scopes.ts into pure module + unit tests (#65) * refactor(proxy-subscriptions): extract coreEndpoint.ts into pure module + unit tests (#65) * refactor(proxy-subscriptions): extract subscriptionService.ts into pure module + unit tests (#65) * refactor(proxy-subscriptions): extract proxySubscription.scopes.test.ts into pure module + unit tests (#65) * refactor(proxy-subscriptions): extract proxySubscription.coreEndpoint.test.ts into pure module + unit tests (#65) * security(proxy-subscriptions): fetchGuard.ts — SSRF guard + core scheme (#P0) * security(proxy-subscriptions): coreEndpoint.ts — SSRF guard + core scheme (#P0) * security(proxy-subscriptions): subscriptionService.ts — SSRF guard + core scheme (#P0) * security(proxy-subscriptions): proxySubscription.fetchGuard.test.ts — SSRF guard + core scheme (#P0) * security(proxy-subscriptions): proxySubscription.coreEndpoint.test.ts — SSRF guard + core scheme (#P0) * refactor(proxy-subscriptions): subscriptionService.ts — concurrency lock / resilience / url redaction (#P1) * refactor(proxy-subscriptions): url.ts — concurrency lock / resilience / url redaction (#P1) * refactor(proxy-subscriptions): index.ts — concurrency lock / resilience / url redaction (#P1) * refactor(proxy-subscriptions): route.ts — concurrency lock / resilience / url redaction (#P1) * refactor(proxy-subscriptions): route.ts — concurrency lock / resilience / url redaction (#P1) * refactor(proxy-subscriptions): proxySubscription.url.test.ts — concurrency lock / resilience / url redaction (#P1) * i18n(proxy-subscriptions): subscriptionService.ts — stable error codes + locale keys (#P2-6) * i18n(proxy-subscriptions): SubscriptionTab.tsx — stable error codes + locale keys (#P2-6) * i18n(proxy-subscriptions): en.json — stable error codes + locale keys (#P2-6) * i18n(proxy-subscriptions): zh-CN.json — stable error codes + locale keys (#P2-6) * i18n(proxy-subscriptions): pt-BR.json — stable error codes + locale keys (#P2-6) * i18n(proxy-subscriptions): en.json — normalize to LF line endings (#P2-6) * i18n(proxy-subscriptions): zh-CN.json — normalize to LF line endings (#P2-6) * i18n(proxy-subscriptions): pt-BR.json — normalize to LF line endings (#P2-6) * enhance(proxy-subscriptions): reject subscription fetch if ANY resolved DNS address is blocked (P3-1) * enhance(proxy-subscriptions): add withRetry() exponential-backoff helper (P3-2) * enhance(proxy-subscriptions): DNS multi-record guard + retry/backoff fetch + batch scope writes + observability (P3-1..P3-4) * enhance(proxy-subscriptions): batch addProxiesToScopePool() to drop N+1 writes (P3-3) * enhance(proxy-subscriptions): add last_error_at + consecutive_failures observability columns (P3-4) * enhance(proxy-subscriptions): surface consecutive failures + last error time in subscription cards (P3-4) * test(proxy-subscriptions): cover multi-record DNS SSRF (block if ANY address internal) (P3-1) * test(proxy-subscriptions): cover withRetry() first-success / retries / backoff / non-retryable stop (P3-2) * fix(proxy-subscriptions): resolve js-yaml import + missing backup/generation-bump imports Two bugs made the feature non-functional and its own test suite false: 1. parse.ts used `import yaml from "js-yaml"` (default import), but js-yaml@^5 is ESM-only with no default export — this threw a SyntaxError at module load, crashing every caller (index.ts re-exports parse.ts, so every API route hit this too). Switch to `import * as yaml`, matching how the rest of the codebase already imports js-yaml (hermes-agent.ts, openapiParser.ts, openapi/spec route.ts, guide-settings route.ts). 2. subscriptionService.ts's unapplySubscription() called backupDbFile() and bumpProxyRegistryGeneration() without importing either — backupDbFile exists but wasn't imported; bumpProxyRegistryGeneration was a private, non-exported function in db/proxies.ts. This threw a ReferenceError whenever a subscription with bound proxies was disabled/deleted (the normal path). Import backupDbFile from ../db/backup and export+import bumpProxyRegistryGeneration from ../db/proxies, matching the identical backup+bump pattern already used by deleteProxyById for the same proxy_assignments/proxy_registry mutation shape. Fixing both unmasked a third, previously-unreachable bug (both crashes happened before any test assertion could run): recomputeProxyEnabled() checked `proxy_subscriptions.enabled = 1` alone, which stays true across an unapply/disable cycle since unapplySubscription() never touches that column — the proxyEnabled flag would get stuck on `true` even after the subscription's proxies were fully detached. Changed the check to require an actually-bound proxy_assignments row for an enabled subscription, matching hasNonSubscriptionGlobalProxy()'s existing bound-check pattern. Traced all 3 production call sites (mode/rule switch, disable, delete) to confirm this doesn't change their outcome — only the previously-wrong "unapply in isolation" case. Also fixed the test file's own pre-existing bug: its provider_connections inserts omitted created_at/updated_at (NOT NULL, no default in the schema since 001_initial_schema.sql), which 0 assertions had ever reached before because the SyntaxError always crashed the file first. All 9 proxySubscription test files now run clean: 49/49 pass (previously 2 files crashed outright at import time, 0 assertions ever ran). Separately confirmed via testing against the pristine PR head: this PR has 3 more pre-existing gate failures unrelated to the above (file-size on db/proxies.ts, cognitive-complexity, complexity, changelog-integrity vs the current release tip) plus 3 pre-existing TS2345 errors in parse.ts (lines 228/233/263, unrelated to the yaml import). All are the PR's own scope/base-drift, out of scope for this fix — the PR has never had a real CI run (base=main), so no gate has ever surfaced them; they need the base retarget + a full CI pass called out in the plan file's own remaining mandatory items. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(db): renumber proxy-subscriptions migrations to avoid version collision release/v3.8.49 already ships 123_quota_auto_ping.sql and 124_generic_session_affinity_ttl.sql; this PR's 123/124 files collided, tripping migrationRunner's version-collision guard and failing all proxySubscription.service tests. Renumber to 127/128 (next free slots after 126_reasoning_routing_rules.sql). Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouzapw@users.noreply.github.com> * refactor(db): extract proxySubscriptions + registryGeneration to keep proxies.ts under file-size cap Moves addProxiesToScopePool to ./proxySubscriptions.ts and the registry-generation helpers to ./proxies/registryGeneration.ts (re-exported from proxies.ts), keeping the module under its frozen 1177-line cap after the operator-proxy-subscriptions feature. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(db): renumber proxy-subscriptions migrations past release collision Rebasing onto release/v3.8.49 surfaced a migration version collision: this branch's 127_proxy_subscriptions.sql and 128_proxy_subscriptions_meta.sql now collide with 127_usage_history_account_identity.sql and 128_auto_candidate_overrides.sql that landed on release since this branch last synced. Renumbered to 131/132 (next free prefixes after the current 130_remove_unregistered_qwen_data.sql) and updated the in-file header comments to match. No schema/behavior change. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouzapw@users.noreply.github.com> Co-authored-by: xier2012 <xier2012@users.noreply.github.com> |
||
|
backryun
|
2d1801985c |
feat(cline): align ClinePass catalog and request protocol (#7914)
* feat(cline): align catalogs and official protocol * fix(models): clean imports after final connection removal * fix(quality): extract Cline/ClinePass auth-header wiring to shrink default.ts open-sse/executors/default.ts grew to 894 lines against the frozen 890-line cap after adding the ClinePass official-protocol import plus two Object.assign header-merge blocks. Extract the merge logic into a new applyClineAuthHeaders() helper in src/shared/utils/clineAuth.ts so the executor's case "clinepass" / case "cline" branches shrink to a single call each, dropping default.ts back to 875 lines. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> |
||
|
Diego Rodrigues de Sa e Souza
|
11b5ce1f0e |
feat(providers): add 5 free-tier providers (ainative, aion, sealion, routeway, nara) (#7887)
Five OpenAI-compatible free-tier aggregators OmniRoute did not cover yet, added
as a registry entry plus a canonical provider each.
ainative api.ainative.studio/api/v1 — 84-model public catalog, passthrough
aion api.aionlabs.ai/v1 — 5 models, public catalog w/ pricing
sealion api.sea-lion.ai/v1 — AI Singapore, pinned models (10 RPM)
routeway api.routeway.ai/v1 — 236-model catalog; browser UA pinned
because Cloudflare 1010s non-browser UAs
nara router.bynara.id/v1 — shared 5M/day pool, pinned free models
All five /models endpoints were probed live 2026-07-20 (200 for the public ones;
sealion/nara 401 without a key, as expected) and every pinned model id was
confirmed to exist upstream.
Free-catalog honesty: ainative ("~10M tok/mo claimed"), aion (20k tok/day),
sealion (10 RPM) and routeway (200 RPD) have no verifiable monthly TOKEN quota,
so they are recurring-uncapped — real access, never summed into the headline.
Only nara publishes a token figure (5M tokens/day shared = 150M/month), recorded
as one deduped pool. Net: 484 -> 514 models, 1.376B -> 1.526B tokens, the +150M
coming solely from nara.
|
||
|
Innokentiy Solntsev
|
f909b1d45e |
fix(resilience): don't cool down accounts or trip the breaker on client aborts (#7908)
* fix(resilience): don't cool down accounts or trip the breaker on client aborts When the caller drops the connection mid-stream, the in-flight request surfaces request_signal_aborted, "Client disconnected", or a DOM AbortError with no upstream status code. These shapes were counted as provider failures: the serving connection went into cooldown, the provider circuit breaker accrued failures, and healthy accounts ended up marked unavailable from client-side cancellations alone. Treat client aborts as local stream lifecycle events (#4602 policy): extend isLocalStreamLifecycleError() to recognize abort shapes and skip connection disable and breaker accounting for them. Genuine upstream failures (5xx/429/401) are still counted. Fixes #7907. * fix(resilience): guard the two remaining breaker-trip call sites against client aborts (#7907) PR #7908 correctly wired isLocalStreamLifecycleError() into shouldSkipConnDisable() and chatHelpers.ts's onStreamFailure, but two separate breaker._onFailure()-triggering call sites were purely status-code gated and never checked it, so a client-side abort (no upstream status, defaults to 502, error='request_signal_aborted') still tripped the whole-provider circuit breaker — the highest blast-radius of the 3 resilience mechanisms: - src/sse/handlers/chat.ts: the single-model, non-combo terminal-failure path called breaker._onFailure() directly, bypassing the isFailure option (which only applies inside breaker.execute()). Extracted the predicate into shouldTripProviderBreakerForResult() and added the missing isLocalStreamLifecycleError guard. - open-sse/services/combo/comboPredicates.ts::shouldRecordProviderBreakerFailure(), used by handleComboChat's executeTarget (open-sse/services/combo.ts), gained the same guard via a new optional `error` field. Added tests/unit/circuit-breaker-abort-provider-trip-7907.test.ts exercising both real predicates directly (not just the isolated isLocalStreamLifecycleError() helper) — confirmed red on the unfixed code (missing export) and green after the fix, alongside the existing #4602/#7908/combo-breaker-429 suites (24/24 pass, no regressions). file-size-baseline.json: +1 combo.ts (irreducible call-site wiring for the new `error` field) and +1 chatHelpers.ts (own growth from the PR's already-verified onStreamFailure guard, surfaced only now since fast-gates PR->release skip check:file-size). Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouzapw@users.noreply.github.com> Co-authored-by: insoln <insoln@ya.ru> * test(quality): register circuit-breaker abort tests in stryker tap.testFiles The two new tests (circuit-breaker-abort-provider-trip-7907, circuit-breaker-client-abort) import mutated modules (circuitBreaker.ts, comboPredicates.ts) but were not listed in stryker.conf.json tap.testFiles, tripping check:mutation-test-coverage --strict. Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> --------- Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouzapw@users.noreply.github.com> |
||
|
Paijo
|
3238df3204 |
perf: lazy provider init, P2C quota cache, structuredClone elimination, getSettings→getCachedSettings (batch 2) (#7893)
* perf: startup parallelization, stream TextEncoder lift, auth middleware bottlenecks
Startup (~100-300ms faster cold start):
- Parallelize 4 early imports via Promise.all() in registerNodejs()
- Parallelize 10 independent background services via Promise.allSettled()
- Each service has independent try/catch — no failure domino effect
Streaming pipeline (8 fewer TextEncoder GC allocations per SSE event):
- Lift new TextEncoder() from per-chunk inside buildClaudeStreamingResponse
to function scope alongside existing decoder singleton
Auth middleware bottlenecks (from PerfBottleneckAnalysis):
- Backoff decay loop: replace updateProviderConnection (full CRUD:
SELECT+encrypt+cache-invalidate+backup) with resetConnectionBackoff
(targeted UPDATE of backoff/error columns only)
- Dual .filter() for quota: replace two passes calling
isQuotaExhaustedForRequest per connection with a single for loop
partitioning into withQuota/exhaustedQuota
- Debug-log filter recomputation: capture connectionFilterStatus Map
during the filter pass; debug loop reads 6 string comparisons instead
of 6 function calls per connection
Supporting:
- Add resetConnectionBackoff to src/lib/db/providers.ts (patterned after
clearConnectionErrorIfUnchanged, no CAS check)
- Re-export resetConnectionBackoff from src/lib/localDb.ts
- Update integration-wiring.test.ts regex for parallelized dynamic import
* perf: P2C quota cache, lazy provider init, structuredClone elimination, getSettings→getCachedSettings
- **auth.ts: P2C quota re-evaluation cache** — quotaResults Map threaded
through selectPoolSubset → compareP2CConnections → getP2CConnectionScore.
Populated during filter + partition passes, eliminating redundant
evaluateQuotaLimitPolicy / isQuotaExhaustedForRequest calls when the
P2C comparator re-evaluates previously-scored connections.
- **constants.ts: lazy PROVIDERS via Proxy** — replaces eager
generateLegacyProviders() + loadProviderCredentials() at module load
with Proxy delegating to deferred init on first property access.
- **providerModels.ts: lazy PROVIDER_MODELS + PROVIDER_ID_TO_ALIAS** —
same Proxy pattern for both exports; generateModels()/generateAliasMap()
deferred until first read.
- **stream.ts: structuredClone → minimal object spread** — replaces
O(n) deep clone of SSE response chunks with targeted reconstruction
of only mutated fields (usage, delta.content, finish_reason).
- **progressTracker.ts: TextDecoder lift** — module-level decoder
instead of per-chunk new TextDecoder().
- **Route files: getSettings() → getCachedSettings()** — 13 API route
files converted from uncached per-request DB reads to TTL-cached
wrapper (5s default), eliminating redundant queries on every request.
- **settings.ts: re-export getCachedSettings** from readCache for
non-localDb consumers.
- **Remove settingsCache.ts** — dead file, no imports reference it.
TS compile: 0 errors. Auth tests: 225/225 pass. Services: 269/269 pass.
* perf: Phase 1 tangible wins — egressCache eviction, mmap_size PRAGMA, composite indexes, proxyFallback lazy import
- egressCache: lazy TTL eviction on getCachedEgressIp access (bounds memory
leak to distinct proxy URLs, typically <100)
- mmap_size: apply stored PRAGMA from key_value table (256MiB default) after
applyStoredDatabaseOptimizationSettings — setting was stored but never applied
- schemaColumns: add idx_uh_provider_model_timestamp (covers getModelLatencyStats)
and idx_pc_provider_auth_type (covers 6+ provider_connections queries)
- proxyFallback: convert static import to dynamic import() inside error handler
(defers 210ms module load from startup to first proxy-retry scenario)
* perf: add dedup expression index, unref() sweep timers
- Add COALESCE expression index idx_uh_dedup on usage_history
matching the exact dedup query pattern. Eliminates FULL TABLE
SCAN on every saveRequestUsage insert.
- Add composite idx_uh_provider_model_timestamp on usage_history.
- Add composite idx_pc_provider_auth_type on provider_connections.
- Add .unref() to setInterval in batchProcessor.ts (polling loop).
- Add .unref() to setInterval in runtimeHeartbeat.ts (heartbeat).
* perf: bump SQLite cache_size default from 16MB to 64MB
New installs now start with 64MB page cache (was 16MB). Existing
users' stored settings are unchanged. Reduces disk reads for the
typical ~250MB database by keeping ~25% of pages in memory.
Also resolved pre-existing merge conflict in webhooks.ts.
* docs: add Redis production config guide and proxy port clash investigation report
- docs/redis-production-config.md: comprehensive Redis tuning guide
covering client options, server config, Docker settings, scaling,
and monitoring for all three Redis workloads (rate limiting,
auth cache, quota store)
- docs/proxy-port-clash-report.md: investigation confirming proxy
subsystem has no port binding issues; real EADDRINUSE history
traced to process supervisor crash-loop restart race (#4425) and
live-dashboard port clash (#6324), both already fixed
* fix: address PR #7893 review — add Proxy traps, extract migrations to reduce providers.ts size
- Add set trap to PROVIDER_ID_TO_ALIAS Proxy (providerModels.ts)
- Add deleteProperty traps to all three lazy Proxies (PROVIDERS,
PROVIDER_MODELS, PROVIDER_ID_TO_ALIAS)
- Extract autoMigrateLegacyEncryptedConnections and getGheCopilotHosts
from providers.ts (1129→1036 lines, -93) into providers/migrations.ts
- Both functions re-exported via providers.ts for backward compat
File-size ratchet resolved: src/lib/db/providers.ts now 1036 lines.
* fix: resolve merge conflict markers in 3 route/test files
- model-combo-mappings/route.ts: kept upstream version (Zod pagination
via validateBody + isValidationFailure), restored missing return
statement for GET handler
- playground/presets/route.ts: kept stashed version details (satisfies
type-narrowing + inlined Response) — functionally identical
- error-sanitization.test.ts: matches upstream exactly (no diff)
Test verification: same 7 pre-existing failures confirmed on upstream
baseline (
|
||
|
Sulistyo Fajar Pratama
|
246b87f739 |
fix(mitm): gate Agent Bridge DNS and Trust Cert on sudo password (#7938) (#7939)
* fix(mitm): gate Agent Bridge DNS and Trust Cert on sudo password (#7938) Extend the #7865 sudo gate to setup wizard DNS, Start DNS, and Trust Cert. Start server still runs without a password but skips privileged cert/DNS steps instead of spawning sudo -S with an empty string. Add a shared sudo password modal on the Agent Bridge page for DNS and trust-cert actions. Fixes #7938 * fix(mitm): use .tsx extension for MitmSudoPasswordModal hook JSX in a .ts file broke dashboard typecheck and ESLint on CI. * fix(mitm): skip DNS teardown on stop when sudo password missing (#7938) stopMitm() no longer invokes removeDNSEntry with an empty password when the server was started in skip mode. The MITM process is still killed. * refactor(mitm): extract privileged step helpers to satisfy file-size cap manager.ts exceeded the 800-line cap after #7938 gates. Move DNS teardown and the shared sudo skip runner into dedicated modules; behavior unchanged. |
||
|
Erick Kinnee
|
62d46ba37c |
fix(api): resolve local provider models via dashboard catalog fallback (#7927)
The /api/v1/providers/{id}/models endpoint returns invalid_provider for
local self-hosted providers (Ollama, LM Studio, vLLM, etc.) because it
only resolves providers via getRegistryEntry() from the open-sse
registry, which does not include LOCAL_PROVIDERS.
After getRegistryEntry() misses, fall back to the dashboard-facing
provider catalog (getProviderById / getProviderByAlias from
@/shared/constants/providers), which covers LOCAL_PROVIDERS and all
other dashboard provider categories. Registry hits retain existing
precedence.
Closes #7910
Co-authored-by: Erick Kinnee <erick@ekinnee.dev>
|
||
|
Diego Rodrigues de Sa e Souza
|
4eea1cd14f |
fix(auth): restore configurable HEALTHCHECK_BATCH_SIZE dropped by #7719 (#7875) (#7970)
* fix(auth): restore configurable HEALTHCHECK_BATCH_SIZE dropped by #7719 (#7875) * docs(env): document HEALTHCHECK_BATCH_SIZE in .env.example (#7875) * docs(env): document HEALTHCHECK_BATCH_SIZE in .env.example + ENVIRONMENT.md (#7875) |
||
|
Diego Rodrigues de Sa e Souza
|
a47ce51d4c |
fix(api): classify /api/acp/agents as loopback-only (#7948) (#7966)
* fix(api): classify /api/acp/agents as loopback-only (#7948) /api/acp/agents is spawn-capable (POST registers a client-chosen `binary` via src/lib/acp/registry.ts; GET / POST {action:"refresh"} runs detectInstalledAgents() -> execFileSync(probe.command, probe.args, { shell }) transitively) but was never added to LOCAL_ONLY_API_PREFIXES in src/server/authz/routeGuard.ts, unlike every sibling spawn-capable route (Hard Rules #15/#17). A leaked JWT via tunnel could reach the version-probe execFileSync path. Adds the prefix to the loopback gate plus a direct regression test (tests/unit/route-guard-acp-agents-local-only.test.ts) and an assertion in tests/unit/check-route-guard-membership.test.ts documenting why the existing source-scan subcheck cannot catch this class of gap (the spawn call is transitive via registry.ts, not in the route file itself). * chore(quality): register route-guard-acp-agents-local-only test in stryker tap.testFiles |
||
|
Diego Rodrigues de Sa e Souza
|
ce80af6c3d | fix(dashboard): correct block-extra-Claude-usage toggle copy to match quarantine behavior (#7918) (#7965) | ||
|
Diego Rodrigues de Sa e Souza
|
5996acdcc7 | fix(providers): treat unreliable web-cookie /models probe status as unsupported, not valid (#7857) (#7959) | ||
|
Diego Rodrigues de Sa e Souza
|
fe94529306 | fix(api): add amazon-q to the static model catalog (#7820) (#7960) | ||
|
Diego Rodrigues de Sa e Souza
|
387ebc3e41 | fix(dashboard): safely render structured error objects in Request Logs detail (#7845) (#7920) | ||
|
Diego Rodrigues de Sa e Souza
|
b15f343e67 | fix(providers): treat public-host 302 as valid in Gemini Web connection test (#7859) (#7917) | ||
|
Nathan
|
62cbbcd2c0 |
fix(dashboard): preserve quota cutoff drafts (#7909)
Co-authored-by: Bryan Nathan <bryan@users.noreply.github.com> |
||
|
Diego Rodrigues de Sa e Souza
|
10823bcf83 |
fix(dashboard): repair monaco deep import broken by 0.56 exports map (#7897) (#7922)
monaco-editor 0.56.0 (bumped in #7897) ships a restrictive `exports` map ("./*.js" -> "./esm/vs/*.js", "./*" -> "./esm/vs/*.js") that rewrites every subpath by prepending esm/vs/. The pre-0.56 deep import `monaco-editor/esm/vs/editor/editor.api` therefore resolved to the doubled, non-existent `esm/vs/esm/vs/editor/editor.api.js` and broke the production Turbopack build (Module not found in MonacoEditor.tsx). Switch to the 0.56-compatible specifier `monaco-editor/editor/editor.api.js`, which resolves to the same file (esm/vs/editor/editor.api.js) as before. Adds tests/unit/monaco-editor-import-path.test.ts as a regression guard: asserts the specifier has no esm/vs/ prefix and resolves to editor.api.js against the installed monaco 0.56. |
||
|
backryun
|
0df0ff2ddb |
feat(grok-cli): align with official Grok Build client (#7358)
Rebuilt clean on release/v3.8.49 (branch forked from old main, ~drift). Resolved 2 real conflicts against the current tip: providerModelsConfig.ts keeps BOTH the tip's DashScope text-model helpers (#7882) and this PR's ProviderModelsHeaderContext type; OAuthModal.tsx takes this PR's DEVICE_CODE_PROVIDERS set (superset of the tip's hardcoded chain + grok-cli), dropping the now-dead qwen entry (#7866 removed qwen OAuth). Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> |
||
|
backryun
|
00677044be |
[Part 3/3] feat(qwen): add regional Alibaba and Qwen Cloud providers (#7882)
* feat(qwen): add Qwen3.8 Max Preview catalogs [Part 2/3] Rebuilt clean on release/v3.8.49 after Part 1 (#7866) squash-merged — applies only the Part-2 delta (Qwen Web / Qoder qwen3.8-max-preview registration + required-thinking allowlist + Qoder client rework) onto the current tip. No migration in this part (that was Part 1). Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * feat(qwen): add regional Alibaba and Qwen Cloud providers [Part 3/3] Rebuilt clean on top of Part 2 (#7874) over the current release tip — applies only the Part-3 delta (alibaba Model Studio, Alibaba Token Plan, qwen-cloud, qwen-cloud-token-plan with region selector). No migration in this part. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> |
||
|
backryun
|
ccdbc89290 |
feat(qwen): add Qwen3.8 Max Preview catalogs [Part 2/3] (#7874)
Rebuilt clean on release/v3.8.49 after Part 1 (#7866) squash-merged — applies only the Part-2 delta (Qwen Web / Qoder qwen3.8-max-preview registration + required-thinking allowlist + Qoder client rework) onto the current tip. No migration in this part (that was Part 1). Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> |
||
|
backryun
|
65e0aeda79 |
[Part 1/3]refactor(qwen): replace legacy Qwen Code and remove OAuth provider (#7866)
* refactor(cli): remove legacy Qwen Code integration * refactor(qwen): remove deprecated Qwen OAuth provider * feat(cli): rebuild Qwen Code integration for upstream V4 * fix(qwen): clear stale CLI auth on reset * test(qwen): align retired provider coverage * fix(db): renumber qwen-cleanup migration 129 -> 130 release/v3.8.49 tip took slot 129 via #7843 (usage_history_codex_strong_identity, itself renumbered from 128 during the #7838/#7840 base-red cleanup) after this branch forked; renumber remove_unregistered_qwen_data to 130. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> |
||
|
Diego Rodrigues de Sa e Souza
|
470e0811fd |
fix(i18n): backfill usage.* quota-visibility keys into vi.json (#7251 base-red)
#7251 added four usage.* quota-visibility keys to en.json without the Vietnamese counterparts, leaving __MISSING__ markers that fail i18n-vi-completeness on the release tip for every fresh PR run. Translated with the locale's existing quota vocabulary (hạn mức). |
||
|
Diego Rodrigues de Sa e Souza
|
bf943e0a7c |
[needs-vps] feat(dashboard): add per-operator quota row visibility on usage tab (#7251)
* feat(dashboard): add per-operator quota row visibility on usage tab
Adds a "hide this quota row" action (visibility_off icon button) to
each model-quota row on the provider limits card, and a "Hidden: …"
strip at the bottom of the card to restore any hidden row. The
visibility preference is keyed per-provider (settings.quotaVisibility)
and persisted via PATCH /api/settings, so it survives refresh/reload.
Distinct from the existing model-catalog isHidden/isDeleted mechanism
(collectHiddenQuotaModelIds/filterHiddenModelQuotas in
ProviderLimits/utils.tsx), which hides rows the ADMIN marked hidden in
the model catalog. This is a personal dashboard preference an operator
can toggle without touching the catalog — e.g. temporarily decluttering
a quota card with many low-signal rows.
New pure helpers (getQuotaVisibilityKey, filterQuotasByVisibility,
getHiddenQuotaRows) live in ProviderLimits/utils.tsx and are unit
tested directly; the settings key is added to DEFAULT_SETTINGS and
validated via updateSettingsSchema like the existing
providerStrategies field. New UI strings are filled in en.json and
synced to the other 42 locales as `__MISSING__` placeholders.
Co-authored-by: nguyenha935 <208228297+nguyenha935@users.noreply.github.com>
Inspired-by: https://github.com/decolua/9router/pull/2371
* chore(changelog): fragment for #7251
* refactor(usage): extract useQuotaVisibility hook (file-size budget)
ProviderLimits/index.tsx grew past its frozen 1127-line budget with the
quota-visibility wiring; extract the state + persistence + hide/show handlers
into a dedicated hook (same pattern as useCodexResetCreditRedemption).
No behavior change — the live validation evidence on the PR covers this flow
end-to-end.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
* refactor(dashboard): shed QuotaCard complexity to baseline + type useQuotaVisibility settings fetch (#7251 CI green)
* test(dashboard): rename quota-row visibility test (path claimed by #7360)
* fix(dashboard): restore providerTierField case-collision fix dropped by merge auto-resolve
The git merge of origin/release/v3.8.49 auto-resolved providerTierFieldApi.ts
(added post-merge-base by commit
|
||
|
Ravi Tharuma
|
8b78bc361e |
fix: reserve chat admission before body parsing (#7853)
* fix: reserve chat admission before parsing * fix: release admission on handler failure * fix: reconcile chat admission with the #7862 parse-once route Post-#7862 rebase: the admission-rebuilt request is json()-parsed directly over the already-buffered bytes — the clone()+json() pair is gone, and the parse-once regression tests now pin the post-admission contract (original request: zero json() calls, zero clone() calls; the single materialization is admitChatRequest()'s bounded byte reader). Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> |
||
|
Diego Rodrigues de Sa e Souza
|
d78740bcb0 |
feat: add live gRPC-web quota fetcher for grok-cli (#6844) (#7714)
* feat(sse): add live gRPC-web quota fetcher for grok-cli (#6844) * fix(sse): send gRPC-web request frame + decode real GetGrokCreditsConfig schema Live validation against grok.com (real bearer token, tier-4 account) proved the #6844 grok-cli quota fetcher was a silent no-op: - The POST to GetGrokCreditsConfig had no body. gRPC-web requires a request frame even for a no-argument RPC; without one the upstream returns `grpc-status: 13 "Missing request message."` with a 0-byte response. Fixed by sending the empty gRPC-web frame (flag 0x00 + 4-byte length 0). - The decoder's field mapping (top-level field 1 = double percent, field 2 = string resetAt) was reverse-engineered from a third-party doc and never matched the real response. The real shape is: top-level field 1 is a NESTED message whose subfield 1 is a fixed32 float usage ratio (0..1) and subfield 5 is a Timestamp{seconds,nanos} reset time. grokCliQuotaFrame.ts now decodes that nested shape; grokCliQuotaFetcher.ts's buildQuota() rescales the decoder's 0-100 percentUsed back to the 0-1 fraction the rest of the quota pipeline expects (quotaPreflight.ts::remainingPercentFrom). - The response's 2nd gRPC-web frame (trailer, flag 0x80) is now explicitly walked-and-skipped instead of relying on incidental length-bounding. Test fixtures in both files now encode the real captured wire structure (nested message, fixed32 ratio, Timestamp reset, trailer frame) instead of the old synthetic fixed64-double buffers, and the stale "Cloudflare non-blocking is an assumption" comment is corrected to reflect that it is now live-validated. |
||
|
Sulistyo Fajar Pratama
|
21fcb19f96 |
fix(mitm): gate Agent Bridge Repair on sudo password (#7836) (#7865)
Reject repair and Remove CA when no sudo password is supplied or cached, instead of spawning sudo -S with an empty string. Add a password modal to AgentBridgeMaintenanceCard and regression tests for the 400 gate. Address PR review feedback: reject whitespace-only sudoPassword values, avoid caching unusable passwords, extract closePasswordModal helper, and replace the route test that invoked real sudo with pure gate assertions. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> |
||
|
enjoyer-hub
|
3fe61cdea7 |
fix(compression): enable OmniGlyph for Claude Fable 5 (#7863)
Rebuilt clean on release/v3.8.49 (branch forked from an old main and carried ~68 files of base drift). Reconciled with #7237 on the tip: supportsVision keeps the authoritative getResolvedModelCapabilities() resolution (the PR's isVisionModelId heuristic predates that fix); the PR's real change lands — OAuth 'claude' now counts as a direct Anthropic transport for OmniGlyph, and claude-fable-5 joins the vision model ids. Plumbing test now pins the '|| provider === "claude"' invariant instead of exact formatting. Co-authored-by: quanturbo <168349709+quanturbo@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> |
||
|
Hernan Javier Ardila Sanchez
|
6fa748e321 |
fix(vision-bridge): reroute auto/ prefix to vision model when images present (#7871)
* fix(vision-bridge): reroute auto/ prefix to vision model when images present Rebuilt clean on release/v3.8.49 (the original branch forked from an old main and dragged ~70 unrelated files of base drift). Reconciled with the newer VibeProxy credential guards on the tip: the reroute now also fires for auto/ models, the keep-credentialed-model skip does not apply to auto (keeping auto would land on a text-only candidate), and the reroute-target credential guard is preserved. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * test(guardrails): compact image_url literals to fit the 800-line test cap Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: herjarsa <204746071+herjarsa@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> |
||
|
Xiangzhe
|
74204911c7 |
fix(usage): harden account identity reconciliation (#7843)
* fix(usage): harden account identity reconciliation * fix(db): renumber codex strong-identity migration 128 -> 129 release/v3.8.49 tip took slot 128 via #7839 (auto_candidate_overrides) after this branch forked; renumber the new migration and its test references. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> |
||
|
Marcus Bearden
|
a6dafa0ff7 |
feat(providers): add OpenRouter speech-to-text (audio transcription) provider (#7861)
* feat(providers): add OpenRouter speech-to-text (audio transcription) provider Adds OpenRouter as a speech-to-text provider for POST /v1/audio/transcriptions. Transcription requests route to OpenRouter's dedicated STT endpoint (https://openrouter.ai/api/v1/audio/transcriptions), converting the multipart audio upload into OpenRouter's JSON input_audio { data, format } shape and forwarding optional language, temperature, and response_format fields. OpenRouter STT reuses your existing OpenRouter connection, so no separate credential is required. Eleven transcription models are available (Deepgram Nova-3, Microsoft MAI-Transcribe 1.5, NVIDIA Parakeet, Mistral Voxtral, Qwen3 ASR, Google Chirp 3, and the OpenAI Whisper / GPT-4o transcribe family). The media-providers STT playground card now narrows its model picker to transcription-only models, so the OpenRouter chat catalog is not shown for speech-to-text, and the provider page shows an existing-connection note for OpenRouter STT. * fix(providers): address OpenRouter STT review feedback - Extract the OpenRouter transcription handler into open-sse/handlers/openrouterTranscription.ts to keep audioTranscription.ts under the file-size cap. - Qualify the STT card's submitted model id with the connection's provider prefix so OpenRouter models route to OpenRouter rather than the model's own vendor (the transcription route resolves the provider from the leading segment of the model id). - Coerce temperature to a number and forward timestamp_granularities on the JSON input_audio payload; match the base MIME type when resolving the audio format so codec parameters (e.g. audio/webm;codecs=opus) do not fall back to wav. - Split the OpenRouter cases into tests/unit/audio-transcription-openrouter.test.ts and add coverage for temperature, timestamp granularities, MIME codec params, and qualified-id routing. |
||
|
ToastedPatatas
|
286628a8c4 |
fix: avoid cmd.exe spawn on Windows by using os.hostname() before execSync fallback (#7841)
* fix: avoid cmd.exe spawn on Windows by using os.hostname() before execSync fallback
On Windows, execSync() wraps the command in cmd.exe /d /s /c,
spawning a new cmd.exe process. getMachineIdRaw() called
execSync("hostname") as Strategy 4 before trying os.hostname()
as Strategy 5 -- meaning every dashboard API call spawned an
unnecessary cmd.exe process.
This commit:
- Moves os.hostname() to Strategy 4 (no child process, native binding)
- Keeps execSync("hostname") as Strategy 5 fallback
- Adds module-level caching so getMachineIdRaw() only runs once per
process lifetime since the machine ID never changes at runtime
- Caches all strategy results at the first successful return
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
* fix: avoid cmd.exe spawn on Windows by using os.hostname() before execSync fallback
Prioritize os.hostname() (sync, no subprocess) over execSync hostname fallback. Cache the result so subsequent calls never spawn. Export resetMachineIdCache() for test isolation.
Tests: 10 tests covering cache behavior, strategy fallback order, and consistent machine ID hashing. The 2 tests that mock os.hostname() now also stub fs.readFileSync for /etc/machine-id to throw, so Strategy 3 (Linux machine-id file) does not preempt Strategy 4 on real Linux runners.
---------
Co-authored-by: tientien17 <tientien17@users.noreply.github.com>
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
|
||
|
Ravi Tharuma
|
ee3546a6ce |
perf: reduce long-context request copies (#7862)
Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> |
||
|
Ravi Tharuma
|
916ccddfd8 |
fix: add native lifecycle-aware health endpoint (#7852)
* fix: add native health endpoint * fix: keep health endpoint dynamic --------- Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> |
||
|
Diego Rodrigues de Sa e Souza
|
8fbb1519ea |
fix(i18n): backfill providers.tierOverride* keys into vi.json (#7838 base-red)
#7838 added six providers.tierOverride* keys to en.json without the Vietnamese counterparts; i18n-vi-completeness (key parity + both ICU checks) fails on the release tip for every fresh PR run. Translated using the locale's existing tier vocabulary and inserted at the mirrored position. |
||
|
Diego Rodrigues de Sa e Souza
|
3ba3cd145e |
chore(quality): fix release-tip base-reds — providerTierField case collision + stryker 7806 registration
(1) #7838 added providerTierField.ts next to ProviderTierField.tsx in the same directory — a case-only collision that breaks webpack on case-insensitive filesystems; the #6584 guard fails Unit shard 4/4 on every fresh PR run. Rename the helper to providerTierFieldApi.ts (import + test path adjusted). (2) check:mutation-test-coverage --strict fails on the tip because merged #7806's combo-skip-conn-disable-plugin-block test was never registered in stryker tap.testFiles. Register it. |
||
|
Diego Rodrigues de Sa e Souza
|
9c40e481e1 |
fix(rerank): honor the connection's pinned proxy on rerank calls (#7350) (#7867)
Rerank egressed directly while chat and embeddings on the SAME connection went through the connection's proxy, so a provider that geo-blocks the host IP (Voyage AI) failed on a connection that was otherwise working. handleRerank now takes a connectionId, resolves that connection's proxy and wraps the upstream fetch in runWithProxyContext; a failed lookup is logged and skipped rather than turned into a request error. Also threads connectionId into the embeddings path of runSingleModelTest, which had the same gap. The change is lifted from #7420 by @kamenkadmitry. That PR could not be updated in place: its head lives on an organization-owned fork, where GitHub's 'allow edits from maintainers' does not grant push access, and its branch had drifted ~3 weeks (343 files of formatting churn once merged with the tip). Only the proxy layer is taken here — #7420's voyage format adapter is superseded by #7813 and was factually wrong about the Voyage response shape. Refs #7350 Refs #7420 Co-authored-by: kamenkadmitry <kamenkadmitry@users.noreply.github.com> |
||
|
Diego Rodrigues de Sa e Souza
|
d2ab1893ed |
feat(catalog): map unmapped free tiers, add navy + aihorde, surface keyless providers (#7840)
* feat(catalog): map unmapped free tiers, add navy + aihorde, surface keyless
Seven providers whose free tier was documented upstream but never reached our
catalog. Five of them we could already route — only the quota was missing.
Providers already routable, quota now mapped:
- requesty (200 req/day), ovhcloud (2 req/min per IP, anonymous), agnes
(permanently free), glm (GLM-4.7/4.5-Flash are Free on the official pricing
table). All registered as recurring-uncapped: their free tier is capped in
REQUESTS, not tokens, so inventing a token figure would inflate the headline.
The "~30M/month" that circulates for GLM belongs to BigModel.cn (a separate
Chinese offering) and is deliberately not recorded.
New providers:
- navy: one shared 150K tokens/day pool (~4.5M/month) drained by a per-model
token_multiplier. Registered as a SINGLE pooled row — summing its ~149 free
models would overcount ~149x.
- aihorde: crowdsourced volunteer GPUs, keyless via the documented anonymous
key. No tool calling and a 120s timeout, because requests queue for minutes.
Also:
- kilo-gateway reconciled against its live /models list (7 -> 13 models) and
flagged with the new trainsOnPrompts field: every free Kilo model reports
mayTrainOnYourPrompts: true, so the privacy cost now sits next to the quota.
- Free-tier page gains search, provider/keyless filters, per-row type badges,
a "no API key required" section and a curation-date freshness indicator.
- catalogUpdatedAt comes from an explicit FREE_CATALOG_CURATED_AT constant
rather than the data file's mtime: a standalone build rewrites timestamps on
deploy, which would advertise a months-old catalog as updated today.
Net effect on the headline: 462 -> 484 models but 1.371B -> 1.376B tokens,
because only navy publishes a token quota. That is the point — coverage grows
without the number lying.
* refactor(providers): derive one answer for "does this need an API key?"
"Works without a credential" lived in three registries that disagreed, and only
three providers were classified the same way in all of them:
- NOAUTH_PROVIDERS.noAuth -> whether the connect form hides the field
- RegistryEntry.authType / anonymousApiKey -> what the executor really sends
- FreeModelBudget.freeType === "keyless" -> how the catalog labels it
getCredentialRequirement() now derives the answer from the two sources that
describe real behaviour, returning none | optional | oauth | required. It adds
no list to maintain: registering a provider the usual way is enough. oauth is
deliberately NOT "works without a credential" — there is no key to paste, but
signing in is still a barrier, and calling it keyless would mislead.
anonymousApiKey outranks noAuth: AI Horde ships a documented anonymous key AND
honours a real one for higher queue priority, so it is "optional" rather than
"none" even though the form hides the field.
Fixes one real inconsistency this branch introduced: ovhcloud was catalogued as
keyless while its registry demanded a key. Verified live — the anonymous tier
answers /chat/completions with no Authorization header, and a BAD key returns
403 instead of degrading, so authType is now "optional" and the executor
attaches the header only when a real credential exists.
The 10 pre-existing divergences (agy, blackbox, pollinations, puter, qwen-web,
…) are frozen in KEYLESS_CATALOG_DRIFT with a stale-entry check: the gate blocks
new drift, and fails if a frozen entry stops drifting so the debt list cannot
outlive the debt. Resolving each one means confirming upstream behaviour, not
editing a list.
* fix(dashboard): build "no API key required" from routing, not freeType
Probing all ten providers the catalog labels `keyless` (2026-07-20) showed the
label answers a different question than the UI was asking:
blackbox 401 "No api key passed in."
friendliai 401 "no authorization info provided"
iflytek 401 Unauthorized
sparkdesk 401 Unauthorized
puter 401 "Missing authentication token"
muse-spark-web 403 (authHeader is a session cookie, not a key)
qwen-web 200 but serves the WAF HTML page, not the API
liquid 404 — endpoint moved; needs its own audit
pollinations 200 with real choices <- genuinely key-free
ovhcloud 200, and 403 on a BAD key <- fixed earlier in this branch
`freeType: "keyless"` means "free access not quantifiable in tokens" — it sits
beside `oauth` in FREE_TIERS.md for exactly that reason. The new section was
listing those rows under "No API key required", which would have sent users to
providers that reject them. It now derives from getCredentialRequirement().
pollinations was the one real find: it answers with no credential at all, so its
registry entry moves from apikey to optional and it leaves the recorded list.
The list is computed in the route handler, not the component: deriving it
client-side pulled the whole 201-entry provider REGISTRY into the browser
bundle. The component takes `noCredentialProviders` from the payload and stays
dumb — which is also why the vitest run could not resolve REGISTRY through the
`@omniroute/*` alias and silently classified every provider as credentialed.
* fix(test,providers): resolve open-sse in vitest; point liquid at its live host
vitest.config.ts / vitest.mcp.config.ts had no `@omniroute/open-sse` alias, so
imports from open-sse resolved to undefined instead of throwing. Tests stayed
green while every lookup silently returned a default — that is how the free-tier
card asserted on provider credentials with REGISTRY never loaded. Both configs
now mirror the tsconfig paths, and tests/unit/ui/open-sse-alias.test.tsx pins it
by asserting on values only reachable through REGISTRY (aihorde's anonymous key,
pollinations' optional auth), so a future regression fails loudly.
liquid pointed at api.liquid.ai, which stopped serving the API — every path now
returns a Vercel 404 HTML page, so routing failed with an unparseable body
instead of a clean error. The live OpenAI-compatible host is inference.liquid.ai
(403 {"detail":"Not authenticated"} without a key). Both verified 2026-07-20.
Swept every free-catalog provider for the same failure. Five more looked dead on
a /models probe (agentrouter, coze, kiro, nlpcloud, puter) but answer their chat
endpoint with real API JSON — a 404 on /models only means the path is not
exposed. They are untouched: liquid was the only genuine casualty.
* test(providers): move the APIKEY_PROVIDERS partition count to 180
This PR adds one gateway provider (navy), so the frozen entry-count and the
family-partition sum both shift by one. The assertions are moving targets by
design — they exist to catch a provider silently landing in two families or in
none, not to freeze the catalog size.
|
||
|
Diego Rodrigues de Sa e Souza
|
51b118c2d3 |
feat(routing): read-only auto/* candidate transparency + per-API-key exclusions (#7819) (#7839)
Level 1: GET /v1/auto-combo/{channel}/candidates lists an auto/* channel's
candidate pool with live reachability (provider circuit breaker via
getStatus()/canExecute(), connection cooldown, model lockout).
Level 2: per-API-key candidate exclusions, persisted in a new
auto_candidate_overrides table and enforced at the virtualFactory.ts
candidate-pool chokepoint via a pure, fail-open filter — mirrors the #7622/
#7646 precedent exactly (zero touches to the frozen combo.ts god-file).
Levels 3 (weights/ordering) and 4 (policy pin) are deferred to a follow-up
issue, as is the dashboard UI (Step 4) and its i18n strings.
|
||
|
Diego Rodrigues de Sa e Souza
|
6770a57131 |
feat(providers): expose an explicit tier override for any provider connection (#7818) (#7838)
classifyTier() already honored a DB-backed providerOverrides list keyed by an arbitrary provider-id string (built-in or custom), but nothing exposed it through the UI or API. Adds GET/PUT /api/settings/tier-config, a generic Advanced Settings tier selector wired into EditConnectionModal, and makes TierCoverageWidget consult the same override before falling back to registry-membership classification. Owner decision: scope is the 3 real ProviderTier machine values (free/cheap/premium) — the enum is not extended to 4. |
||
|
Rafael Dias Zendron
|
bf9202de0c |
fix(antigravity): attempt onboarding when projectId is empty (#5193 regression of #2541) (#7815)
* fix(antigravity): attempt onboarding when projectId is empty (#5193 regression of #2541) PR #5193 changed onboarding from inline await to fire-and-forget gated by if (projectId), which never fires when projectId is empty — the exact case that needs onboarding. This re-introduced the #2541 catch-22. Add an else-if branch that attempts onboarding inline (bounded by AbortSignal.timeout) when projectId is empty, then retries loadCodeAssist to discover the newly created project. - Existing accounts with projectId: unchanged (fire-and-forget) - New accounts without projectId: now onboarded within login flow - Timeout bounded: +8s worst case (onboardUser + retry loadCodeAssist) - Graceful degradation: if onboarding fails, lazy retry handles it Tests: - 3 new tests covering empty-projectId onboarding path (RED→GREEN) - Existing 2 tests preserved and passing - Adjusted timeout assertion for the stall test (now includes onboardUser stall) - 5/5 passing on Node 24 Fixes #7814 Related: #5193, #2569, #2541, #2219 * docs(changelog): add fragment for antigravity onboarding empty-projectId fix (#7814) Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouzapw@users.noreply.github.com> Co-authored-by: Rafael Dias Zendron <rafaumeu@users.noreply.github.com> |
||
|
backryun
|
34aefcf4e2 | fix(ci): repair release regressions exposed by clean runs (#7812) | ||
|
Andrew B.
|
adbcd2c8bc |
fix(auth): gate invalid-key check on isRequireApiKeyEnabled for embeddings and web-fetch (#7785) (#7810)
* fix(auth): gate invalid-key check on isRequireApiKeyEnabled for embeddings and web-fetch (#7785) When REQUIRE_API_KEY=false, /v1/embeddings and /v1/web/fetch still returned 401 for invalid presented keys while all other client APIs allowed anonymous access. The route-local invalid-key check was not gated on isRequireApiKeyEnabled(), unlike the /v1/combos pattern. Gate the invalid-key check on isRequireApiKeyEnabled() in both route files so anonymous access works consistently across all client APIs. Refs: https://github.com/diegosouzapw/OmniRoute/issues/7785 * fix(tests): set REQUIRE_API_KEY=true in embeddings-auth invalid-key subtest The "should return 401 when an invalid API key is provided" test now correctly sets REQUIRE_API_KEY="true" so the route-level gated check is exercised. Before, the test asserted 401 when REQUIRE_API_KEY was not set, which after #7785 fix now returns 400 (model validation fails) instead of 401. * test(auth): assert anonymous-passthrough in embeddings-auth legacy suite (#7785) Per #7785's acceptance criteria, the pre-existing embeddings regression test must assert BOTH enforcement states, not just the enforced-401 case. Add the missing REQUIRE_API_KEY=false + invalid-key subtest alongside the already-fixed REQUIRE_API_KEY=true + invalid-key subtest, matching the coverage already present in the dedicated auth-policy-embeddings-webfetch-7785.test.ts suite. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> |
||
|
Tmone Nguyen
|
e18dfa9899 |
fix(plugins): 5 bugs on the plugin path (3 Windows-only, 2 all-platform) (#7806)
* chore(ci): add .mergify.yml to main — Mergify only reads config from the default branch (#7168) * fix(ci): add the auto-enqueue pull_request_rule to the Mergify config (queue_conditions alone are eligibility-only) (#7179) * fix(ci): migrate Mergify auto-enqueue to merge_protections_settings.auto_merge_conditions (rules-based path is EOL 2026-07-16) (#7216) * fix(ci): drop Mergify batch settings (batching is a paid-tier feature; free plan queue is serial) (#7220) * fix(ci): merge queue tolerates the advisory dast-smoke failure (its GH-hosted build hang dequeued every attempt) (#7225) * test(ci): make the #6634 selfref guard hermetic — main's copy hard-fails every PR (#7341) main's copy of this test still does git I/O inside a unit test: const baseSrc = git(['show', 'origin/main:' + FILE]); Runners check out a shallow single ref, so origin/main does not resolve and the test dies with 'fatal: invalid object name origin/main'. Every PR into main fails Unit Tests (7/8) on it — today that is #7313, #7315, #7316, #7334, #7336 and #7337, six PRs red on a defect none of them introduced. #7313 has no other red at all. release/v3.8.49 already carries a fix ( |
||
|
Paijo
|
4b06761ad5 |
feat(api): add pagination params to 8 DB modules + recharts code-split (#7046)
* perf: extract recharts into dynamic import wrappers
Bundle recharts behind next/dynamic boundaries to prevent its
large module graph from being included in the initial JS payload.
- CostOverviewTab.tsx → dynamic(() => import('./components/CostCharts'))
- ProviderUtilizationTab.tsx → dynamic(() => import('./components/ProviderCharts'))
- BurnRateChart.tsx → dynamic(() => import('./components/BurnRateChartInner'))
- Created 3 wrapper files with 'use client' and all recharts imports
Reduces initial bundle by ~35 kB (recharts + dependencies).
* perf: add pagination (limit/offset) to apiKeys, combos, providers, provider-nodes
Add optional limit/offset parameters to DB list functions and their
API route handlers. All list functions now return { items, total } when
called with parameters; backward compatible when called without args.
Affected modules:
- lib/db/apiKeys.ts - listApiKeys, getApiKeysByGroup
- lib/db/combos.ts - listCombos
- lib/db/providers.ts - listProviders, getProvidersByGroup
- lib/db/providers/nodes.ts - listProviderNodes, getProviderNodesByGroup
- Corresponding API routes pass through query params
Reduces memory pressure on large datasets by returning one page at a time.
* perf: add pagination (limit/offset) to webhooks, proxies, modelComboMappings, playgroundPresets
Add optional limit/offset parameters to DB list functions and their
API route handlers for the remaining data modules.
Affected modules:
- lib/db/webhooks.ts - getWebhooks returns { webhooks, total }
- lib/db/proxies.ts - listProxies
- lib/db/modelComboMappings.ts - listMappings
- lib/db/playgroundPresets.ts - listPresets
- Corresponding API routes pass through query params
- Re-exports updated: lib/localDb.ts, models/index.ts
Backward compatible: calling without args returns all rows.
* perf: batch pool building and add pagination to quotaPools
Replace per-pool N+1 queries with batch-loading pattern.
- Added batchBuildPools(rows) — collects all pool IDs, does 2 batch
queries (allocations + connections) instead of 2N individual queries
- getPoolsByGroup and listPools now use batchBuildPools
- Added optional limit/offset pagination params
- Fixed SQLite OFFSET-syntax bug: only emit OFFSET when LIMIT also present
- Added quota-pools.test.ts with 10 tests covering pagination edge cases,
batch loading, and the offset-without-limit guard
Reduces pool-page query count from 2N+1 to 3 (constant).
* perf: replace manual offset/limit parsing with Zod paginationSchema in combos GET handler
* fix: replace manual Number()/parseInt pagination with paginationSchema
Endpoints: model-combo-mappings, playground/presets, provider-nodes.
Uses existing Zod schema with z.coerce.number() for proper validation.
* chore: bump proxies.ts frozen baseline 1177->1208 for perf/api-pagination
PR #7046 backward-compatible pagination refactor grew proxies.ts
by +31 lines (1177->1208). Entries return plain array when no
pagination params provided, {items,total} when pagination requested.
* fix(db): finish listProxies()/getWebhooks() pagination shape migration
The pagination refactor changed listProxies(), listPools(),
getModelComboMappings(), listPlaygroundPresets() and getWebhooks() to
return a paginated envelope ({ items, total } / { webhooks, total })
instead of a bare array, but left three real production callers and
several tests on the old array-shaped API:
- src/lib/proxyEgress.ts (validateProxyPool default listProxies impl)
iterated the envelope directly -> "is not iterable" at runtime, hit
by /api/settings/proxies/egress (no injected deps).
- src/lib/proxyHealth/scheduler.ts (sweep()) read proxies.length on the
envelope (undefined), so the health-check sweep silently processed
zero proxies every run.
- open-sse/utils/proxyFallback.ts (getProxyCandidates()) iterated the
envelope inside a try/catch that swallowed the resulting TypeError,
so every user-configured proxy silently vanished from the fallback
candidate list.
Also fixes two TS2558/TS2339 typecheck errors in proxies.ts/webhooks.ts
(db.prepare<T>() generic not supported by this DB wrapper — cast the
query result instead, matching the existing pattern in both files) and
trims one blank re-export separator line in localDb.ts to stay within
the frozen file-size ratchet after 4 new *Count() exports.
Updates the pre-existing unit tests that called the changed functions
directly (db-quota-pools, quota-groups-migration, quota-pool-connections,
quota-pool-delete-prune, db-webhooks, model-combo-mappings-db,
db-playground-presets, db-proxies-crud, proxy-batch-routes-5918,
proxy-registry, error-message-sanitization) to destructure the new
envelope shape instead of treating the result as an array.
Implements the small, well-scoped performance-mark/measure
instrumentation ("omni-pipeline-start"/"omni-pipeline-end"/"omni-pipeline")
that tests/unit/chatcore-streaming-pipeline.test.ts already asserted for
assembleStreamingPipeline() but that had no corresponding source change.
Adds three new regression tests (TDD: each reproduces its bug against
the pre-fix code before the corresponding fix, then passes) covering
the three real production callers above:
tests/unit/proxy-egress-validate-pool-default.test.ts,
tests/unit/proxy-health-scheduler-listproxies-shape.test.ts,
tests/unit/proxy-fallback-candidates-listproxies-shape.test.ts.
Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>
* fix: resolve rebase conflict in proxies.ts — keep hasBlockingProxyAssignment but drop duplicate extraction leftovers
- Removed duplicate resolveScopePoolInternal, resolveProxyForConnectionFromRegistry,
resolveProxyForScopeFromRegistry already extracted to proxies/rotation.ts
- Removed duplicate hasBlockingProxyAssignment function body already re-exported from proxies/guards.ts
- Removed duplicate PROXY_ALIVE_PREDICATE import
- All typechecks and 45 affected tests pass
* fix(test): account for _reorderConnections in pagination test expectedOrder
createProviderConnection calls _reorderConnections after every insert
which reassigns priorities sequentially. The test was assuming creation
order determines priority order, leading to incorrect expected results.
Fix: query the DB after all inserts and use the actual priority order.
Also removes debug console.log from getRawProviderConnections.
* chore: remove debug tmp-*.mjs files left in PR branch
* test(proxy): migrate the dedup test to the paginated listProxies() shape
#7046 changed listProxies() to return { items, total }, and updated every
production caller plus three of the four test files — tests/unit/proxy-bulk-import-dedup-7594.test.ts
was missed, so its four `listed.length` assertions read `undefined` and the
file went red on the merge train (it passes on the pure release tip).
Test-only: destructure `{ items: listed }` at the four callsites. Verified
proxyEgress.ts needs no change — its local deps shim already unwraps .items,
and tests/unit/proxy-egress-validate-pool-default.test.ts guards exactly that.
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
---------
Co-authored-by: oyi77 <oyi77@users.noreply.github.com>
Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
|
||
|
Xiangzhe
|
601470b894 |
fix(dashboard): make quota cards container responsive (#7027)
* fix(dashboard): make quota cards container responsive * test(dashboard): assert #7072 mobile guard behaviorally, not by literal token The #7072 regression guard asserted the literal `grid-cols-1` class token, which only fits a breakpoint-driven grid. This PR switched the per-group card grid to a container-driven `auto-fit`/`minmax()` template, which the guard doesn't recognize even though it also guarantees a single column on mobile-width viewports. Rewrite the guard to assert the underlying behavior — single column on mobile — accepting either the breakpoint model (unprefixed grid-cols-1) or the auto-fit model (a minmax() track wide enough that two columns can't fit on a phone viewport). Reverting to the pre-#7072 forced grid-cols-2 still fails the guard. * fix(dashboard): keep stale quota rows during refresh Refreshing a quota card replaced its entire quota section with a loading placeholder. The card height collapsed and then grew back when data arrived, and each height change rebalanced the outer 2xl CSS multi-column layout, making provider groups visibly jump between columns (flash). Show the loading placeholder only on the initial load (nothing to display yet). During a refresh the stale rows stay rendered while the refresh button icon spins, and the UI swaps in new data once it arrives. Also keep the expand/collapse button visible during refresh so its row does not add another height change. |
||
|
Diego Rodrigues de Sa e Souza
|
2cd22633d9 |
fix(auth): restore TICK_MS in tokenHealthCheck (ReferenceError on startup) (#7830)
* fix(auth): restore TICK_MS in tokenHealthCheck dropped by #7719 * fix(docs): sync .env.example + ENVIRONMENT.md with two undocumented env vars |
||
|
Diego Rodrigues de Sa e Souza
|
662b2ba84d |
fix(dashboard): clear the two ghe-copilot typecheck regressions from #7546
AgentEmoji's AGENT_COLORS is a Record<AgentId, …>; #7546 widened AgentId with 'ghe-copilot' without adding the entry (TS2741). GheConfigStep typed its error prop as `unknown` and rendered it directly, which is not a ReactNode (TS2322). Both are counted by check:dashboard-typecheck, which was failing on the pure release tip (261 live vs 259 frozen) and reddening Fast Quality Gates for every open PR. Now back to the frozen 259. |
||
|
Diego Rodrigues de Sa e Souza
|
764d91fdfa |
fix(oauth): mirror ghe-copilot into the OAuth id map and MITM host list
#7546 registered the ghe-copilot provider in src/lib/oauth/providers/index.ts but left it out of two mirrors that are asserted to stay in lock-step: - PROVIDERS in src/lib/oauth/constants/oauth.ts (the canonical id map), which made oauth-providers-config.test.ts fail three assertions at once; - MITM_TOOL_HOSTS, the client-safe projection of ALL_TARGETS, which made mitm-tool-hosts.test.ts fail its drift guard. Both reds reproduce on the pure release tip and turned every open PR's unit shards red, so this unblocks the whole queue. The test expectations are extended (not weakened) to cover the new provider. |
||
|
Diego Rodrigues de Sa e Souza
|
48f6dea893 |
fix(dashboard): fix collapsed quota card session/weekly order (#7764) (#7834)
topQuotas() (the sole row-order decider for the COLLAPSED provider-quota card in QuotaCardBody.tsx) sorted rows purely by status then remaining percentage and never consulted hasFixedQuotaOrder()/CODEX_QUOTA_ORDER/ GLM_QUOTA_ORDER. Session and Weekly therefore swapped position per card depending on headroom. This is the same defect class as #6687/PR #6722, which fixed only the EXPANDED card path (QuotaCardExpanded.tsx via resolveQuotaDisplayOrder()). The collapsed path never got that fix. Fix: topQuotas() now accepts an optional providerId and, when hasFixedQuotaOrder(providerId) is true, skips the status/remaining-% sort and keeps the order parseQuotaData() already established (mirrors resolveQuotaDisplayOrder() in QuotaCardExpanded.tsx), only truncating to n. Threaded providerId through QuotaCardBody's props to the topQuotas() call site. Providers without a fixed order are unaffected — they keep sorting worst-status-first. Regression test: tests/unit/repro-7764-collapsed-quota-order.test.ts (reused from the triage-fix-bugs repro probe, RED confirmed on unfixed code, GREEN after the fix; also asserts non-fixed-order providers still sort worst-first). |
||
|
Diego Rodrigues de Sa e Souza
|
b58ad0f200 |
fix(dashboard): mirror connection-row action-icon spacing under RTL (#7680) (#7835)
Convert the confirmed instance (ConnectionRow.tsx:884, ml-1 -> ms-1) to Tailwind's logical spacing utility so it mirrors correctly under dir="rtl" for ar/fa/he/ur locales. Physical utilities never mirror in Tailwind v4; only logical ones (ms-/me-/ps-/pe-/start-/end-) compile to CSS logical properties that follow the browser's native dir handling. This is the first phased conversion of the broader ~150-file physical- utility sweep tracked in #7680; the regression test pins this exact instance so it cannot silently regress. |
||
|
Diego Rodrigues de Sa e Souza
|
70e46f0471 |
fix(cli): fix Windows CLI detection false negatives (#7753, #7774) (#7831)
checkKnownPath() only validated the RESOLVED realpath target against EXPECTED_PARENT_PATHS, never crediting that the candidate path itself was already constructed from a trusted root by getKnownToolPaths(). Version managers that install via symlinks/junctions (nvm-windows and more broadly nvm/asdf/pyenv-style tools) place the shim inside a trusted root but its resolved target lives in a private per-version store outside the allowlist, so it was misreported as symlink_escape (#7753). Fix: trust a candidate location if EITHER its original path OR its resolved target falls within EXPECTED_PARENT_PATHS. Separately, locateCommandCandidate() short-circuited on the FIRST known-path candidate that returned any non-not_found failure reason, without trying the remaining candidates or ever falling back to a real PATH search. A single stray artifact at one guessed Windows install location for claude therefore poisoned detection entirely even when the real binary was resolvable via PATH (#7774). Fix: remember non-fatal known-path failures but keep walking every candidate, and always fall through to the PATH-based search before giving up. Extracted both helpers into a new cliRuntimeKnownPath.ts module (dependency injected, no circular import) to keep cliRuntime.ts under its frozen file-size budget. |