No-auth / keyless providers (opencode, opencode-zen) returned synthetic
"noauth" credentials BEFORE honoring excludeConnectionIds, so the chat
account-fallback loop re-selected the same synthetic connection forever on
a persistent upstream error (e.g. the opencode public endpoint answering
401 "Model X is not supported"). The synthetic id has no DB row, so
markAccountUnavailable could not persist a cooldown to brake it — each
iteration wrote key-health + request logs immediately, growing the DB until
the disk filled (see @paraflu's "failure #320" trace in discussion #3038).
Honor the exclusion set in both synthetic-credential paths
(getProviderCredentials NOAUTH_PROVIDERS block + opencode-zen keyless
fallback): once "noauth" is already excluded, return null so the handler
stops after a single attempt. The happy path (nothing excluded -> synthetic
noauth) is preserved, so keyless access still works.
Closes#3061.
Tests (TDD): tests/unit/auth-noauth-fallback-loop-3061.test.ts — the two
exclusion cases failed before the fix and pass after; two happy-path guards
ensure first-selection synthetic noauth still resolves.
* fix(sse): defer enqueuing of event lines to align event names with data lines and prevent stop-signal event name misattribution
* fix(sse): preserve keep-alives and prevent pending event leakage on dropped chunks
* fix(sse): preserve pending event lines before other non-data lines and fix zero-window-size bypass
* fix(sse): defer lastEventLine update until after flush check to preserve previous event context on flush
* fix(sse): flush trailing pendingEventLine when stream closes
* fix(sse): preserve consecutive event lines without intervening data
---------
Co-authored-by: Ruslan Sivak <russ@ruslansivak.com>
Remove the Petals executor from registration and exports.
Improve type safety by replacing broad any usage in MCP tool registration
with inferred types and documenting dynamic handler type limitations.
Add request validation for the agent bridge cert route and expand tests to
ensure switch buttons explicitly declare type="button", preventing implicit
form submissions.
Bugs found while testing the Quota Share engine on the local VPS:
- B1 hidden/stuck pools: pools created while the page group filter was "all"
were persisted with group_id="all", matched no real group, and rendered
nowhere — so they could not be seen, edited or deleted. PoolWizard now resolves
the group id away from the "all" sentinel before POST/PATCH (falls back to the
first real group / seed group-demo), and QuotaSharePageClient renders an
"Ungrouped" recovery bucket so already-orphaned pools stay editable/deletable.
- B3 one-connection-per-pool made explicit: existingPoolConnectionIds now spans
every member connection (not just the primary), and the wizard shows which pool
an already-used connection belongs to instead of silently disabling it.
- B4 delete group: wired the missing UI control + handler (handleDeleteGroup,
409-aware) — the backend DELETE handler + deleteGroup already existed. Hidden for
"all" and the protected seed group-demo.
- B5a endpoints card now surfaces the native Anthropic POST /v1/messages line when
a claude*/anthropic provider is in scope (previously only /v1/chat/completions).
- B5b endpoints card gained a collapse/minimize toggle (the card was too tall).
Source-scan tests + en/pt-BR i18n parity in quota-share-bugfixes-v388.test.ts.
The larger quota-key redesign (key type bound to a group, default-restricted with
opt-in normal-model access, recoverable keys, api-keys page layout) is planned
separately in _tasks/features-v3.8.8/quota-share-key-redesign.plan.md.
#3054 ("remove 9 dead/unreachable free providers") removed the petals/nanobanana
configs, registry entries and validators but left dangling references that broke
the build and the unit suite on release/v3.8.8:
- open-sse/executors/petals.ts imported the deleted ../config/petals.ts
(webpack "Module not found" → `next build` failed). Removed the executor, its
registration + re-export in executors/index.ts, and the leftover
`providerId === "petals"` branch in providerAllowsOptionalApiKey.
- Removed tests for the now-deleted providers: executor-petals.test.ts and
poolside-provider.test.ts (REGISTRY.poolside was removed), and the petals /
nanobanana validator assertions in provider-validation-specialty.test.ts,
plus the stale petals catalog assertions in providers-page-utils.test.ts,
proxy-connection-test.test.ts and providers-route-managed-catalog.test.ts.
The image/video/embed registries for nanobanana/replicate/nomic are real and
untouched — only the dead chat/api-key surfaces were removed. 146/146 affected
tests pass; typecheck / build clean.
* chore: remove 9 dead/unreachable free providers
Verified via HTTP probe — API endpoints return 000/404/empty:
- freetheai, enally, replicate, lepton, poolside, nomic
- astraflow, petals, nanobanana (phantom: catalog but no registry)
Also removed from: providerRegistry.ts, validation.ts,
staticModels.ts, imageValidation.ts, open-sse/config/petals.ts
* chore: remove dead astraflow providers
Remove astraflow and astraflow-cn (UCloud) — API endpoints unreachable.
Remaining dead providers (enally, freetheai, nanobanana, replicate,
lepton, petals, poolside, nomic) have working main sites but dead API
endpoints — need API keys. Will remove in follow-up.
* chore: remove 9 dead/unreachable free providers
Removed: freetheai, enally, replicate, lepton, poolside, nomic,
astraflow, petals, nanobanana
All verified as dead via live API probes (000/404/empty responses).
Cleaned from providers.ts, providerRegistry.ts, validation.ts,
staticModels.ts, and imageValidation.ts.
---------
Co-authored-by: oyi77 <oyi77@users.noreply.github.com>
Audited all 687 commits / 60 release/v3.8.8 PRs since v3.8.7 against the CHANGELOG:
- Added 5 missing Fixed entries: #3052 (heap-pressure auto-calibration),
#3051/#3048 (proxy fail-closed + registry assignments, @terence71-glitch),
#3049/#3046 (session-pool fingerprint rotation + claude-web cf_clearance, @oyi77).
- Credited previously-uncredited contributors: @branben (#2958 scope fix, #2959
Notion context source) and @JxnLexn (per-API-key stream default mode).
- Added an Added entry for the per-API-key stream default mode feature.
- Added the "🏆 Contributors" hall (24 contributors), matching the v3.8.6 format.
Maintainer fix-PRs (#2966–#3030) are intentionally referenced by their original
issue numbers in the body rather than the fix-PR number; @diegosouzapw is in the hall.
Threshold now derives from the live V8 heap ceiling (85%, floor 400MB) instead of a fixed 200MB that sat below the ~260MB app baseline and 503'd every request. Tracks --max-old-space-size across 1GB/2GB/large VPS.
* fix(pollinations): wire session pool + add idle pruning
PollinationsExecutor.getPool() returned null because poolConfig was
never set. Now sets DEFAULT_POOL_CONFIG in constructor so anonymous
requests get fingerprint rotation and 429 cooldown management.
Also:
- Use acquireBlocking() instead of acquire() to wait for available session
- Add startAutoPrune() for periodic idle session cleanup (5min idle timeout)
- Improve execute() error handling with proper finally block
* fix(duckduckgo-web): wire session pool for fingerprint rotation
DuckDuckGoWebExecutor had poolConfig set but never called getPool()
in execute(). Added session acquisition via acquireBlocking() and
merges fingerprint headers into fetch calls for rate limit evasion.
* fix: address PR #3049 review comments
- duckduckgo-web: fix session leak (add finally release), fix race
condition (report status before release), remove duplicate sessionHeaders
- pollinations: fix race condition (move release to finally, report before)
* fix: address all PR #3049 review comments
- duckduckgo-web: add pool reporting on 429/500 early returns (was missing)
- duckduckgo-web: add sessionHeaders to retry fetch on 401/403
- sessionPool: add .unref() to setInterval to prevent keeping process alive
---------
Co-authored-by: oyi77 <oyi77@users.noreply.github.com>
Real fixes (alerts auto-close on next scan):
- agentSkills/generator: escape backslash before double-quote in YAML
frontmatter so a trailing backslash can't escape the closing quote
(js/incomplete-sanitization #297/#298)
- usage: replace /\s*\(RESTRICTED\)\s*$/ with a non-backtracking literal +
trim (js/polynomial-redos #275)
- i18n/request: skip __proto__/constructor/prototype in deepMergeFallback
(js/prototype-pollution-utility #274)
- scripts/ad-hoc/nvidia diag: log key presence only, never key chars
(js/clear-text-logging #273)
- tests: regression coverage for all three production fixes (YAML round-trip,
proto-pollution guard, RESTRICTED strip + ReDoS timing)
Docs:
- ARCHITECTURE.md: executor count 45->55, OAuth modules 15->16, agy.ts in list
Deploy skills (deploy-vps-*-cc/-cx/-ag): add --legacy-peer-deps (npm v11
peer-dep resolver crashes on the omniroute tree) and replace the
"; pm2 start" that masked a failed install with a proper && chain.
The execute() and testConnection() methods called
normalizeClaudeSessionCookie() which does NOT inject cf_clearance.
Cloudflare pins cf_clearance to TLS fingerprint — without it, requests
get challenged with 403 even with valid session cookies.
Changed both call sites to use normalizeClaudeSessionCookieWithAutoRefresh()
which auto-injects cf_clearance via Turnstile solver when missing.
Fixes: [403]: Claude Web API error:
Co-authored-by: oyi77 <oyi77@users.noreply.github.com>
Follow-up to the plugins framework (#3041): wires the plugin hooks end-to-end and adds full test coverage.
- Wires `onRequest` / `onResponse` / `onError` hooks into the chat pipeline (`chatCore` now imports from the unified `hooks` registry).
- Loads active plugins on server startup (`pluginManager.loadAll()` in `server-init`) so they survive restarts.
- Ships a `welcome-banner` example plugin (`examples/plugins/`) + test fixture.
- Adds a comprehensive plugin test suite (manifest, db, config, hooks, manager lifecycle, loader IPC, permissions, scanner, welcome-banner e2e).
Integration fixes applied during review:
- `manager.install` now removes an orphaned `destDir` (DB row gone but files left on disk) before the atomic rename, guarded by path containment — it previously failed with `ENOTEMPTY` (a regression surfaced by the new lifecycle test).
- `plugins-db` / `plugins-manager-lifecycle` tests now initialize the DB via the real migration `076` (`getDbInstance`) rather than relying on ambient state, so a missing/renumbered migration fails loudly instead of being masked.
348/348 plugin tests pass; typecheck / cycles clean.
Co-authored-by: oyi77 <14921983+oyi77@users.noreply.github.com>
Integrated into release/v3.8.8. Applied review fixes: moved the SELECT 1 into a pingDb() db helper (no raw SQL in route, Hard Rule #5) + the 503 catch no longer leaks err.message (Hard Rule #12). Thanks @herjarsa!
Integrated into release/v3.8.8. Docker /app/data permission check is now warn-only (no exit 1 crash-loop on first run) + UID hint uses $(id -u):$(id -g). The mcp-tools-43.svg part was already in the release. Thanks @wussh!
Integrated into release/v3.8.8. The DuckDuckGo noAuth bypass + OpenCode free-model refresh were already integrated earlier (you're credited in CHANGELOG); this squashes your branch in for the Merged badge. Thanks @NekoMonci12!
Integrated into release/v3.8.8. macOS Electron window-chrome: tray icon template + draggable header region (excludes interactive controls) with a safe fallback + MutationObserver cleanup. Squash-merged (drops the AI co-author trailers per repo policy). Thanks @bobbyunknown!
Integrated into release/v3.8.8. Drops the leaked empty chat.completion.chunk bootstrap frame before response.* SSE events so strict /v1/responses clients (OpenCode) don't fail on the first frame. Thanks @CitrusIce!
Integrated into release/v3.8.8. Applied your Ukrainian translations across the current uk-UA.json structure (709 keys improved from English/__MISSING__ to proper Ukrainian), preserving release's latest key set. Thanks @Lion-killer!
Integrated into release/v3.8.8. Fills the 7 apiManager.* self-service scope keys (managementAccessDesc, selfServiceVisibility(+Desc), ownUsageVisibility(+Desc), sharedAccountQuotaVisibility(+Desc)) across 41 locales + regression test. Resolved conflicts against the current release on your branch. Thanks @guanbear!
- PoolWizard: add editPoolExclusive prop; pre-fill uses editPoolExclusive ?? false so editing an exclusive pool keeps it exclusive instead of silently clearing the flag
- QuotaSharePageClient: wire editing state to a second <PoolWizard editPool=... editPoolExclusive=...>; compute editingExclusive from apiKeys.allowedQuotas; remove EditAllocationsModal import and handleSaveAllocations
- Delete EditAllocationsModal.tsx (fully subsumed by PoolWizard step 3)
- Tests: quota-email-privacy + quota-groups-ui + quota-pool-wizard updated to reflect retirement; new quota-edit-opens-wizard.test.ts (9 source-scan assertions)
- selectedGroupId defaults to "all" instead of "group-demo"
- <select> prepends <option value="all">{t("allGroups")}</option>
- Pool list replaced by groupsToRender map: one stacked section per group
(heading: group name + count via groupPools.length), each with a
grid-cols-1 md:grid-cols-2 xl:grid-cols-3 card grid
- Rename button guard changed from selectedGroupId !== "group-demo" to
selectedGroupId !== "all" (no single target when viewing all groups)
- i18n: allGroups added to en.json ("All groups") + pt-BR.json ("Todos os grupos")
- quota-share-layout-v2.test.ts: 10 source-scan + i18n parity assertions
- quota-groups-ui.test.ts: align group heading test to groupPools.length
POST /api/providers/[id]/refresh was the last unguarded proactive-refresh
entry point for rotating-refresh providers. The dashboard auto-refreshes every
expiring connection on a page load (and an old cached frontend bulk-calls this
endpoint), so each Codex account's single-use refresh_token got rotated; Auth0
then revoked the whole token family (openai/codex#9648) — every account but the
last died with [403] <!DOCTYPE. refreshAndUpdateCredentials (quota-sync) and the
connection-test route were already guarded; this closes the gap.
The route now skips proactive rotation when rotationGroupFor(provider) !== null
and returns {success,skipped,message}, deferring genuine expiry to the reactive,
serialized 401 path. Non-rotating providers keep refreshing on demand.
Test: codex-manual-refresh-rotating-guard (source-assertion, matches the
token-refresh-race-comprehensive #2941 style).
- Add `editPool?: QuotaPool` to PoolWizardProps; import QuotaPool type
- Open effect pre-fills state (connectionIds, name, groupId, allocations,
plan dims) from editPool; create-reset unchanged when editPool absent
- handleFinish branches on editPool: create path keeps POST→PUT→PATCH
unchanged; edit path sends a single PATCH (name+groupId+connectionIds+
allocations+exclusive) then optional PUT when dimensionsEdited
- Title uses t("editPoolTitle"), submit button uses t("saveChanges") in edit mode
- Add editPoolTitle/saveChanges to en.json and pt-BR.json (quotaShare namespace)
- New source-scan test: quota-pool-wizard-edit.test.ts (15 assertions, all pass)
release/v3.8.8 added notionTools.ts (6 tools) → MCP total is 43, not 37, but the
diagram asset (mcp-tools-43.svg) was never generated and MCP-SERVER.md/CLAUDE.md
still said 37. Create mcp-tools-43.{mmd,svg} (rendered via mermaid-cli), repoint
MCP-SERVER.md + docs/diagrams/README.md, update CLAUDE.md count to 43, and remove
the superseded mcp-tools-37 source/asset.
Note: full 'next build' OOM'd locally (session cgroup limit); the SVG ref resolves
(file present at path) and check:docs-sync passes — CI runs the authoritative build.
release/v3.8.8 referenced ../diagrams/exported/mcp-tools-43.svg (43 tools, after
notionTools added) but never generated the asset — only mcp-tools-37.svg exists,
so the merged tree failed 'next build' with Module not found. Point the image +
source back to the existing 37 asset with a note that the count of record is 43
(per the source-of-truth breakdown). Follow-up: regenerate mcp-tools-43.{mmd,svg}.
