Skip the superseded 041 session_account_affinity migration when
the canonical 050 file is present, and remap legacy migration
markers so upgraded databases do not replay the duplicate slot.
Also include the CLI entrypoints in packaged artifacts and extend
management-auth coverage across admin memory, pricing, routing,
provider validation, and usage endpoints to keep release bundles
runnable and sensitive operations protected.
Align runtime behavior with test and stream expectations across the app.
Use `globalThis` timer APIs for SSE heartbeats, set the Playwright
server `NODE_ENV` explicitly by mode, and fall back to Codex pricing
lookups after stripping effort suffixes when a direct model match is
missing.
Refresh affected unit and e2e coverage to use deterministic timers and
updated settings navigation so timeout- and stream-related assertions are
stable on release builds.
Update the AgentRouter provider registry to use the Claude-compatible
messages API and required Anthropic-style authentication headers. This
bypasses unauthorized_client_error responses and exposes the supported
model list through passthrough configuration.
Also update the changelog and release PR notes to document the fix for
#1921
* chore(rtk): initialize compression roadmap branch
* feat(compression): add RTK engine and compression combos
Introduce RTK command-aware tool-output compression alongside
stacked RTK -> Caveman pipelines for mixed prompt contexts.
Add engine registration, declarative RTK filter packs, language-aware
Caveman rule loading, compression combo persistence and assignments,
analytics grouped by engine/combo, and new MCP/API endpoints for
configuration, previews, filters, and combo management.
Expose the new capabilities in the dashboard with dedicated Context &
Cache pages for Caveman, RTK, and compression combos, and update docs,
i18n strings, migrations, and tests to cover the expanded compression
surface.
* feat(compression): expand RTK DSL, filter catalog, and recovery APIs
Add RTK parity features across the compression pipeline, dashboard,
and management APIs. This expands the built-in filter catalog, adds
trust-gated custom filter loading, inline filter verification, code
stripping, smarter detection, and optional redacted raw-output
retention for authenticated recovery.
Also extend Caveman with file-based multilingual rule packs, localized
output-mode instructions, stricter preview/config schemas, engine
registry metadata, analytics fields, and broad unit test coverage for
RTK, rule loading, and stacked compression behavior.
* fix(auth): protect oauth routes and health reset operations
Require authenticated dashboard access for OAuth endpoints that can
create or import provider connections when login enforcement is
enabled.
Move `/api/monitoring/health` to the readonly public route list so
safe methods remain public while DELETE now returns 401 for anonymous
requests.
Also update Next.js native `.node` handling to avoid webpack parse
failures from external packages such as ngrok and keytar, and add
coverage for the new auth behavior.
* build(compression): ship RTK rule and filter assets with app bundles
Include compression JSON assets in Next output tracing, prepublish copies,
and pack artifact policy checks so standalone and packaged builds can
load RTK filters and caveman rule packs at runtime.
Also harden compression runtime behavior by resolving alternate asset
directories, scoping rule cache entries by source path, carrying RTK raw
output pointers through stacked runs, degrading oversized preview diffs,
and applying combo language/output mode defaults during chat routing.
Add coverage for packaging rules, provider-scoped model parsing, smart
truncate edge cases, raw output retention, and combo-driven compression
behavior.
* docs(workflows): update local repo paths to OmniRoute
Replace outdated `/home/diegosouzapw/dev/proxys/9router` references
with the current `OmniRoute` directory across deploy, release, and
version bump workflow guides so local command examples match the
renamed repository layout
* feat(compression): complete RTK parity coverage
* test(build): align next config assertions
---------
Co-authored-by: diegosouzapw <diego.souza.pw@gmail.com>
Add caveman intensity levels, output mode instructions, validation, and
preview diffs across the compression pipeline.
Extend MCP and dashboard settings to support auto-trigger mode, system
prompt preservation, MCP description compression, and caveman rule
metadata. Record richer compression analytics with receipt fields,
validation fallbacks, output mode data, and add the related database
migration.
Improve preservation handling for code, URLs, markdown, math, and other
protected content while adding broad unit, integration, and golden-set
coverage for caveman parity and compression behavior.
Update ecosystem and Playwright test environments to boot in open mode
with CLI tools enabled and empty auth defaults when local credentials
are not required.
Refresh A2A, provider, token-count, and circuit-breaker expectations to
match current response semantics and profile-driven thresholds. Remove
obsolete migration regression coverage tied to retired upgrade paths and
add a scratch migration probe for manual verification.
Allow the prepublish script to choose between webpack and turbopack
using the OMNIROUTE_USE_TURBOPACK environment variable.
This keeps the default build path explicit while making it possible to
switch bundlers for packaging and release workflows without editing the
script.
Windows smoke test exits code=0 because requestSingleInstanceLock()
fails silently when the APPDATA/<productName> directory doesn't exist.
Pre-create the directory so the lock file can be written.
Also enables ELECTRON_SMOKE_STREAM_LOGS=1 in CI for better debugging.
Integrated into release/v3.7.1 — fixes Electron installer shipping empty node_modules. Adds separate extraResources FileSet, CI smoke test job, and cross-platform packaged app validation script. Closes#1636.
- sync-env.mjs: add hasEncryptedCredentials() guard before generating
STORAGE_ENCRYPTION_KEY, matching the existing guard in bootstrap-env.mjs
- bootstrap-env.mjs: add decrypt-probe diagnostic on startup to detect
key mismatch and log actionable recovery instructions
- bin/omniroute.mjs: add 'reset-encrypted-columns' CLI recovery command
that nulls encrypted credential columns while preserving provider config
- tests/unit/sync-env.test.ts: isolate tests with DATA_DIR override
Root cause: postinstall → syncEnv() generated fresh crypto secrets into
the package-local .env on every 'npm install -g' upgrade, since the
package directory is wiped and recreated. The bootstrap-env guard never
triggered because sync-env already filled in the new keys. The DB still
contained credentials encrypted under the previous key, making them
permanently unrecoverable (AES-GCM auth-tag mismatch → silent 401s).
Populate newly introduced dashboard and provider UI message keys in all
locale bundles to prevent missing translation lookups after the v3.7.0
changes.
Also fix quota reset handling so expired limits are only marked stale
when usage is still pending, adjust combo form dark-mode backgrounds,
and expand the prepublish hash rewrite to handle nested package paths.
Register AgentRouter across the provider registry, pricing, docs, and
dashboard metadata so it appears as a first-class OpenAI-compatible
passthrough option.
Add a dedicated `/api/models/test` endpoint and provider-page controls
for on-demand single-model diagnostics, including latency feedback and
success/error status, to help verify mappings without triggering broader
connection tests or rate limits.
Align header casing expectations in provider validation tests with the
current registry contract.
Compile MITM utilities as NodeNext ESM for prepublish builds, copy the
CommonJS MITM server into standalone artifacts, and resolve MITM data
paths without relying on Next.js aliases at runtime.
Replace shell-interpolated setup and elevated command flows with
argument-based spawn and execFile helpers for database setup, DNS edits,
certificate install flows, and Tailscale sudo execution. Also tighten
the Electron production CSP, update provider icon loading to use direct
@lobehub/icons imports with local fallbacks, and pin dependency
configuration to avoid unused peer installs and known audit findings.
Add the Codex Auto Review model to the provider registry and prefer
Codex when resolving unprefixed `codex-auto-review` and `gpt-5.5`
requests.
Broaden provider icon mappings and bundled PNG assets so more providers
render correctly in the shared UI. Also tighten chatCore stream cleanup
behavior so streaming responses return immediately while semaphore slots
and model locks are released on completion or failure, with tests and
artifact policy coverage updated accordingly.
* test: resolve typescript strictness complaints in unit tests
* Update Claude Code obfuscation to version 2.1.114 (#1403)
* fix(cloud-code): scope thinking stripping to executor boundaries (#1401)
* fix(cloud-code): scope thinking stripping to executors
* fix(cloud-code): guard antigravity normalized body
* Update Claude Code obfuscation to version 2.1.114
- Update Claude Code version from 2.1.87 to 2.1.114
- Update X-Stainless-Package-Version from 0.80.0 to 0.81.0
- Add new beta flags: redact-thinking-2026-02-12, advisor-tool-2026-03-01, advanced-tool-use-2025-11-20
- Add missing headers: anthropic-version, anthropic-dangerous-direct-browser-access, x-app, X-Stainless-Timeout
- Add all X-Stainless-* headers (Arch, Lang, OS, Runtime, Runtime-Version, Retry-Count)
- Fix accept-encoding header: identity -> gzip, deflate, br, zstd
- Add connection: keep-alive header
- Update tool name mapping: add lsp, apply_patch, websearch
These changes ensure that requests from OpenCode through Omniroute are indistinguishable from genuine Claude Code 2.1.114 requests, allowing proper authentication with Anthropic's API without triggering extra credits errors.
* fix: resolve CodeQL password hash alert and TruffleHog CI failure
---------
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com>
Co-authored-by: Nikolay Popov <ekklesio.dev@gmail.com>
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
* fix(claude-code): scope obfuscation to cli clients and fix tests
* docs(workflows): enforce PR merge instead of manual close
* docs(changelog): update 3.6.9 notes with missing PR 1403 and fixes
* docs(workflows): update generate-release to use full changelog for PR body
* fix(tsc): silence baseUrl deprecation warnings for TS 5.5+
* fix(chatcore): apply proactive compression before provider translation (#1406)
Integrated into release/v3.6.9
* docs(changelog): add PR 1406
* Makes text visible in dark-mode (#1409)
Integrated into release/v3.6.9
* docs(changelog): add PR 1409
* chore: save local work
* chore(release): sync version references to 3.6.9
* fix(codex): prevent proactive token refresh consumption and strip background parameter
* ci: shard long-running suites and relax timeouts
* ci: allow manual CI dispatch for release branches
* feat(skills): provider-aware marketplace UX, scored AUTO injection, and memory pipeline hardening (#1411)
* fix/400 for GeminiCLI(add "ref" in GEMINI_UNSUPPORTED_SCHEMA_KEYS)
* feat(cc-compatible): align request shape with Claude CLI
* fix(cc-compatible): add Claude CLI system skeleton for OpenAI input
* preserve reasoning when translating chat to responses (#1414)
Integrated into release/v3.6.9
* fix(skills): optimize AUTO scoring and include Responses input context (#1418)
Integrated into release/v3.6.9
* chore: fix TS errors and update review-prs workflow
* fix(api): stop sending unsupported Gemini and Codex parameters
Prevent Gemini request translation from injecting default
thoughtSignature values that the upstream API strictly validates and
rejects. Only preserve real signatures resolved from prior upstream
responses, and strip additionalProperties from Gemini function schemas
to avoid 400 "Unknown name" errors.
Also remove fallback-injected session_id and conversation_id fields
before sending Codex requests, and restore compatibility with the
legacy OUTBOUND_SSRF_GUARD_ENABLED flag when determining whether
private provider URLs are allowed.
Updates the Gemini translator and regression tests for issue #1410
and related 400 error cases.
* fix(core): stabilization fixes for token refresh, usage translation, and testing
- Update Codex token refresh detection logic
- Mark provider connections invalid on unrecoverable refresh error
- Fix Claude usage translation under-reporting cached tokens
- Update test expectations
- Update CHANGELOG.md for v3.6.9
* fix(auth): reload fresh token state and unify expiry persistence
Refresh checks now re-read the latest stored provider connection before
attempting rotation so they do not use stale refresh tokens captured by
an earlier sweep.
Token updates also persist both expiresAt and tokenExpiresAt across the
health check, usage-limit refresh path, and SSE refresh flow. This keeps
known token expiry metadata in sync and avoids interval-based refreshes
for connections whose tokens are still valid well into the future.
* fix: resolve SSRF environment static evaluation bug (#1427)
Fix import aliases and strict TS typings for tests and ACP agents.
* test: resolve remaining strict type errors in test files
* test: fix provider service assertion for anthropic-compatible header
* fix(codex): respect openaiStoreEnabled setting during native passthrough (#1432)
* fix(codex): fix token refresh unrecoverable detection for expired tokens
* fix(ci): restore release v3.6.9 build and flaky tests
* fix(cc-compatible): trim default OpenAI system skeleton (#1433)
Integrated into release/v3.6.9
* fix: prevent masked API keys from being written to CLI tool configs (#1435)
* feat: mark Qwen provider as deprecated and add deprecation warning to CLI tool (#1437)
* docs(changelog): comprehensive v3.6.9 update with all 59 commits since v3.6.8
* test(ci): align qwen guide settings assertions
* fix(security): resolve CodeQL alert 163 for incomplete URL sanitization in Qwen CLI settings
---------
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
Co-authored-by: Nikolay Popov <74762779+nikolay-popov-ideogram@users.noreply.github.com>
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Nikolay Popov <ekklesio.dev@gmail.com>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: Tim Massey <tim-massey@users.noreply.github.com>
Co-authored-by: Paijo <oyi77@users.noreply.github.com>
Co-authored-by: dail45 <dail45@yandex.ru>
Co-authored-by: R.D. <rogerproself@gmail.com>
- Fix insecure randomness in usage service
- Add CodeQL suppression for intentional SHA-512 checksum in callLogArtifacts
- Replace URL string prefix matching with strict hostname validation in tests
- Remove scratch scripts with sensitive data logging
Add targeted TypeScript annotations and module declarations to reduce
type errors in open-sse services, executors, and shared utilities while
temporarily disabling checking in legacy files that still need migration.
Reset stale `.next/standalone` output before isolated builds so release
artifacts are generated from a clean state.
Update the dashboard proxy settings UI to bypass cached settings reads
and immediately roll back debug mode when the PATCH request fails, which
prevents stale data and inconsistent toggle state.
Require dashboard session cookies on protected management APIs and
reject bearer API keys with explicit 403 responses to prevent
privilege escalation across provider, settings, and model alias routes.
Add a dedicated payload rules management surface with dashboard UI,
OpenAPI documentation, route normalization, and tests for hot-reloaded
runtime updates.
Consolidate provider catalog metadata for dashboard pages, add
Perplexity web-cookie provider support, retire the legacy provider
creation page, and improve upstream proxy handling.
Harden startup and runtime behavior by moving cloud sync bootstrap to
server instrumentation, skipping background services during build/test,
making models.dev sync abortable, pruning isolated build artifacts, and
improving DB backup and recovery safeguards.
Expose client-visible Antigravity preview model aliases while resolving
them back to upstream IDs for execution and provider discovery. Refresh
the Antigravity user agent from cached latest release metadata so model
discovery and requests track current CLI versions more reliably.
Add configurable Gemini thought signature cache modes in settings to
allow validated client-provided signatures in bypass flows while
preserving the existing stored-signature behavior by default.
Also centralize Anthropics header/version constants, enrich image model
catalog metadata with input and output modalities, add dashboard image
input support for advanced image providers, and exclude task docs from
Next standalone tracing to keep isolated builds stable.
