- Connection tests now route through configured proxy (key → combo → provider → global → direct)
- Compatible providers show friendly labels (OAI-COMPAT, ANT-COMPAT) in request logger
- 26 new unit tests for error classification, token expiry, and display labels
- Version bump to 1.3.1
- Add modelsUrl field to RegistryEntry interface for custom models endpoints
- Configure kilocode provider with dedicated models URL (https://api.kilo.ai/api/openrouter/models)
- Expand kilocode model list from 8 to 26 models including free options:
- openrouter/free (Free Models Router)
- stepfun/step-3.5-flash:free
- arcee-ai/trinity-large-preview:free
- Additional Qwen, DeepSeek, Llama, Mistral, Grok, and Kimi models
- Update validateOpenAILikeProvider to accept custom modelsUrl parameter
- Fix models URL derivation for base URLs ending with /chat/completions
- Add kilocode config to PROVIDER_MODELS_CONFIG
The 'test' script was missing '--import tsx/esm', causing 25 failures
from Node ESM being unable to resolve extensionless TypeScript imports.
The 'test:unit' script already had the loader and passed 368/368.
The secretsValidator marks JWT_SECRET as required:false (auto-generated
at startup), but the test asserted valid:false when JWT_SECRET was missing.
This caused CI to fail with 367/368 tests passing.
- Fix API_KEY_SECRET undefined crash with deterministic fallback
- Add code_review_rate_limit parsing for Team/Plus/Pro plan support
- Move feature-81 doc to completed/
- Bump version to v1.1.1
- Parse JWT id_token to extract email in mapTokens function
- Allows database to distinguish between different Codex accounts
- Fixes issue where adding 3rd+ Codex account would update existing connection instead of creating new one
* fix: auto-generate JWT_SECRET at startup if not provided
- Add ensureJwtSecret() in instrumentation.ts to generate random 64-char secret
- Mark JWT_SECRET as non-required in secretsValidator
- Remove fatal error log for missing JWT_SECRET in proxy.ts
Fixes login failure when running via CLI without JWT_SECRET env var.
* feat: improve auth flow and login page UX
- Add setupComplete to settings validation schema for proper persistence
- Support ?tab= query param in settings page for direct tab navigation
- Redesign login page with professional two-column layout
- Add context-aware states for onboarding/password setup flows
- Smooth animations and refined visual hierarchy
* fix: 404 page to use primary color theme (coral red) instead of purple
- fix(chatCore): stream defaults to false per OpenAI spec (body.stream === true)
closes#89
- fix(models): custom OpenAI-compatible providers now appear in /v1/models
Added raw providerId check against activeAliases
closes#90
- fix(OAuthModal): Google OAuth providers force localhost redirect URI
Targeted amber warning + redirect_uri_mismatch error guidance for remote deployments
closes#91
- docs: Add 'OAuth em Servidor Remoto' tutorial in README with 7-step Google Cloud guide
- docs: .env.example prominent warning block for Google OAuth remote setup
- chore: bump version 1.0.6 → 1.0.7
- docs: CHANGELOG entry for v1.0.7
JWT session tokens now last 30 days instead of 24 hours. The middleware
silently refreshes the token when it has less than 7 days remaining,
so active users never get locked out of the dashboard.
Auto-refresh fires on any /dashboard request and sets a fresh 30-day
cookie via Set-Cookie header — completely transparent to the user.
1. Combos page: added Toggle to each ComboCard — disable/enable combos
with optimistic UI update. Disabled combos show opacity-50.
2. /v1/models: disabled combos (isActive=false) are excluded from the
model list.
3. Providers page: toggle is now always visible instead of hover-only.
Previously, if no connections existed in the database, ALL provider
models (378+) were shown as a fallback. Now only combos and custom
models appear when no provider connections are configured.
Models are strictly filtered by activeAliases — only providers with
at least one active (enabled) connection show their models. This
ensures /v1/models reflects exactly what the user has set up.
Root cause: after filtering disabled connections (isActive=false), the
connections array could be empty. The fallback 'connections.length > 0'
then treated it as 'no connections configured' and showed ALL models.
Fix: Track totalConnectionCount before filtering. Use it in all filter
conditions so disabled providers are properly excluded even when every
connection is toggled off.
Toggle appears on hover next to the chevron. Clicking it batch-toggles
all connections for that provider (enable/disable). Uses optimistic UI
update with parallel API calls. stopPropagation prevents navigation.
Google OAuth rejects private IPs (192.168.x.x, 10.x.x.x, 172.16-31.x.x)
with 'device_id and device_name are required' error. Now these are treated
the same as localhost, using http://localhost:{port}/callback as redirect URI.
Ensures the Docker volume mount at /app/data matches the app data directory.
Previously DATA_DIR was not set, causing the app to default to ~/.omniroute/
which is not backed by the volume — leading to empty database on redeploys.
