- Merge PR #275: fix(cursor): stabilize tool result handoff
- Merge PR #281: fix(validation): ElevenLabs + Inworld API key validation
- Merge PR #279: feat(kimi-coding): Kimi Coding plan quota display
- Merge PR #264: deps: bump dev group with 5 updates
- Merge PR #263: deps: bump prod group with 2 updates
- fix(ci): repair unit, e2e and i18n test failures
- fix(providers): Add Connection button for OpenAI-compatible providers (#272)
- docs: update CHANGELOG and bump openapi.yaml to 2.2.0
When a manually created OpenAI/Anthropic-compatible provider has 0 connections,
the Add Connection button was hidden behind !isCompatible guard, making it
impossible to add a key. Button now appears in the Connections card header
for compatible providers too, limited to 1 connection (single key per node).
- tests/unit/combo-circuit-breaker: use full model path keys
(combo:groq/llama-3.3-70b) matching combo.ts implementation
- tests/e2e/protocol-visibility: click Protocols tab before asserting
MCP/A2A links (they moved into tab panel, not header nav)
- src/i18n/messages/en.json: add missing header.mcp / header.a2a keys
that caused MISSING_MESSAGE runtime errors during E2E boot
- Replace O(n*k) chunks.some(includes) with emittedToolCallIds Set
- Replace O(n) toolCalls.find with finalizedIds Set (JSON + SSE paths)
- Add byte guard (0x7b check) before payload.toString on every frame
- Add escapeXml() to prevent tag injection in tool result blocks
- Reuse module-level TextDecoder in cursorProtobuf instead of per-call
- Replace [...Set].every() spread with for..of loop
## CI Fixes
- fix(lint): check:docs-sync — bump docs/openapi.yaml version to 2.1.2 + add [Unreleased] to CHANGELOG
- fix(ci): npm-publish.yml — use 'npm ci --ignore-scripts' to skip prepublishOnly during install, then run prepublish.mjs explicitly with JWT_SECRET; prevents double-build loop that caused all npm CI publishes to fail
- fix(ci): docker-publish.yml — replace two-job digest approach (required ubuntu-24.04-arm, unavailable on public repos) with single-job QEMU-based multi-arch build (linux/amd64 + linux/arm64 on standard ubuntu-latest)
- fix(ci): electron-release.yml — add .deb target to Linux electron-builder, collect .deb files in release-assets step, attach *.deb to GitHub release assets
## Documentation
- fix(docs): README.md language bar — fix 29 broken links (README.<lang>.md → docs/i18n/<lang>/README.md)
- fix(docs): docs/i18n/*/README.md — update back-links to ../../README.md and cross-links between languages
- fix(docs): electron/package.json — add deb target (x64+arm64) to linux build config
## Bug Fixes
- fix(lint): resolve 5 explicit 'any' violations in open-sse/services/usage.ts
- quotas: Record<string,any> → Record<string,UsageQuota>
- window: any → JsonRecord (hasUtilization + createQuotaObject)
- (error as any) → (error as Error) in 2 catch blocks
- valueRecord = toRecord(value) to safely pass unknown to JsonRecord fn
## Documentation
- docs: move 29 README.<lang>.md from root to docs/i18n/<lang>/README.md
(root now contains only English README.md)
- docs(i18n): sync all 11 docs/*.md to 30 language folders (319 updates)
Languages: ar bg da de es fi fr he hu id in it ja ko ms nl no phi pl pt pt-BR ro ru sk sv th uk-UA vi zh-CN
## Maintenance
- chore: delete all duplicate auto-generated draft GitHub releases (v2.0.17–v2.1.0)
docs: update CHANGELOG, README (EN + 29 translations), and docs/i18n/ FEATURES.md
- Add Ollama Cloud (ollamacloud alias) bullet to all 30 README files
- Sync docs/i18n/*/FEATURES.md with Ollama Cloud mention
- Bump version to 2.0.19
fix(cursor): add zlib inflate/inflateRaw fallback for GZIP_ALT/GZIP_BOTH frames (#250)
- GZIP_ALT (0x02) and GZIP_BOTH (0x03) frames may use zlib deflate instead of gzip
- Now tries gunzipSync → inflateSync → inflateRawSync with verbose error logging
fix(codex): override refreshCredentials to enable automatic token refresh on 401 (#251)
- CodexExecutor was inheriting base class null return, blocking 401 recovery
- Now calls refreshCodexToken() from tokenRefresh.ts on 401 upstream response
- Handles rotating token errors and surfaces re-auth warning clearly
fix(auth): allow dashboard access when no password is set after onboarding skip (#256)
- isAuthRequired() was blocking /dashboard/settings when setupComplete=true but no password
- Removed setupComplete guard: if there's no password, auth cannot be required
- Configure Password button on login page now navigates correctly to security settings
- fix(streaming): keep Gemini/Antigravity text block open across chunks (#253)
Resolves Claude Code rendering each streaming delta on a separate line.
The content_block is now kept open between chunks (openTextBlockIdx state)
and only closed at finishReason or on block-type switch.
- feat(agents): Download opencode.json button (discussion #162)
Dashboard › Agents shows a Download opencode.json button when opencode
is detected. Fetches /v1/models and generates a ready-to-use config.
- fix(electron-ci): use macos-15-intel runner (replaces deprecated macos-13)
- fix(electron-ci): sync electron/package.json version before build
- fix(electron-ci): remove duplicate arm64 pattern from release assets
✅ Approved — fixes confirmed.
- Fix#253: Antigravity/Gemini streaming chunks now render as continuous text in Claude Code (content_block kept open across chunks)
- Bonus: Download opencode.json button in Agents dashboard
Before this fix, geminiToClaudeResponse() called content_block_start +
content_block_stop on EVERY streaming chunk. Claude Code interprets each
content_block as a separate text element and renders them on separate
lines, making responses unreadable.
Fix: introduce state.openTextBlockIdx to track an open text block across
chunks. The block is opened on the first text chunk and only closed when:
- switching to a different block type (thinking, tool_use)
- the stream finishes (at finishReason)
All other block types (thinking, tool_use) are still opened+closed per
chunk as before since they are naturally atomic events.
Also: add 'Download opencode.json' button to the Agents dashboard.
The button appears when opencode is detected as installed and generates
a ready-to-use opencode.json config with the OmniRoute provider,
base URL and all models fetched from /v1/models.
- Add 'Sync version in electron/package.json' step before build so
electron-builder names binaries with the correct release version
(was generating OmniRoute-2.0.13.dmg for v2.0.16 release).
- Remove duplicate *-arm64.dmg pattern from release files (*.dmg
already matches arm64 dmg files), which was causing 404 on
overwrite-asset API call.
- Add fail_on_unmatched_files: false so missing .blockmap files
don't fail the release step.
GitHub retired all macos-13 variants. The new officially supported
Intel x64 runner is macos-15-intel (GA since April 2025, supported
until August 2027). This replaces the deprecated macos-13 runner.
macos-13 runner was retired by GitHub Actions infrastructure.
All other platforms (linux, macos-arm64, windows) built successfully.
Using macos-13-large which maintains x64 Intel architecture.
fix(electron-ci): add GH_TOKEN to Build Electron step
- electron-builder requires GH_TOKEN env when publish.provider is
'github'. Without it every build failed with 'GitHub Personal Access
Token is not set'. This was blocking Electron binary generation since
v2.0.11. Fixed by passing secrets.GITHUB_TOKEN to the build step.
fix(images): NanoBanana async task polling (PR #247 by @hijak)
- NanoBanana returns taskId requiring /record-info polling until
successFlag=1 instead of image payload on first response.
- Backward compatible: sync payload path preserved.
- Includes aspect ratio/resolution inference from size field.
fix(ci): security test import + route validation + deploy-vps
- inputSanitizer.js → .ts fix
- validateBody added to acp/agents POST (139 routes pass t06)
- deploy-vps continue-on-error + command_timeout
Version: 2.0.15 → 2.0.16
## Review
✅ **Aprovado** — implementação clara e bem estruturada.
**O que a PR faz:**
- Implementa o fluxo async correto da NanoBanana API: submit task → poll /record-info until successFlag=1
- Mantém backward compatibility para providers retornando payload síncrono
- Infere aspectRatio e resolution do campo size (padrão OpenAI)
- Permite tunagem via env vars (NANOBANANA_POLL_TIMEOUT_MS, NANOBANANA_POLL_INTERVAL_MS)
- Adiciona 2 arquivos de teste com cobertura específica
**Qualidade:**
- Código limpo e bem documentado
- Testes adicionados e passando localmente
- Não quebra implementações existentes (sync path preservado)
Obrigado pela contribuição @hijak! 🎉
fix(test): security-fase01.test.mjs imports inputSanitizer.js → .ts
- The file is TypeScript-only (no compiled .js). Node was failing with
ERR_MODULE_NOT_FOUND in CI because the import path pointed to a
non-existent .js file.
fix(acp): add validateBody(jsonObjectSchema) to POST /api/acp/agents
- Satisfies check:route-validation:t06 lint rule that requires all
routes using request.json() to go through validateBody().
- Uses jsonObjectSchema (passthrough) since body shape varies between
the 'refresh' action and the custom agent creation payload.
- Manual field validation below remains unchanged.
- All 139 routes now pass the route-validation lint check.
fix(deploy-vps): add continue-on-error on SSH step + command_timeout
- SSH connection failures (host unreachable / secrets not set) no
longer mark the workflow run as failed.
- The DEPLOY_ENABLED guard still prevents the job from running when
the variable is not set to 'true'.
The Gemini API rejects JSON schemas containing the "optional" field, returning
"400: Cannot find field: optional". Added "optional" to UNSUPPORTED_SCHEMA_CONSTRAINTS
in geminiHelper.ts so it is recursively stripped before sending to upstream.
Also: update star history section in README — embed replaced with live link
since api.star-history.com was suspended by GitHub in March 2025.
Closes#244
- Sync electron package.json version with root (2.0.13)
- Separate mac x64 and arm64 into dedicated runner jobs
- Use macos-13 (Intel) runner for x64 build
- Thanks @benzntech for the contribution!
- Changed model.split('/').pop() to model.split('/').slice(1).join('/')
- Preserves vendor namespace in model names (e.g. moonshotai/Kimi-K2-Instruct)
- Also fixes multimodal image_url → input_image conversion for Responses API (#242)
- image_url parts from Chat Completions are now properly converted to input_image format
- Sync electron package.json version with root to fix artifact collection
- Separate mac x64 and arm64 targets into dedicated runner jobs
- Use macos-13 (Intel) runner for x64 build to prevent cross-compilation timeouts
- Complete rewrite of llm.txt with current project structure
- Added ACP agents, CLI fingerprint, sidebar reorganization
- Added 30 languages, MCP/A2A servers, anti-ban features
- Updated project structure tree with all dashboard pages
