fix(dashboard): restore the 8 bulk-import state declarations deleted by #6625 hook extraction (ReferenceError: bulkImportOpen — release E2E)

.cbmignore

@@ -1,197 +0,0 @@
-# codebase-memory-mcp ignore list
-#
-# Padrão gitignore-style. Linhas começando com `#` são comentários.
-# Barra final (`/`) = só diretório. Sem barra = casa arquivo OU diretório.
-#
-# O CBM também lê `.gitignore` automaticamente — esta lista deixa explícito o que
-# os hooks do CBM vão pular. Se uma regra entrar em conflito entre os dois arquivos,
-# vale a união. Editar este arquivo é mais barato do que confiar na herança implícita.
-#
-# Última reconciliação: 2026-07-31, status `ready` (513k nodes / 689k edges),
-# `auto_index_limit=50000`, total indexável medido ≈11.546 arquivos (folga 4,3×).
-#
-# Fontes cruzadas:
-#   - `codebase-memory-mcp cli index_status --project home-diegosouzapw-dev-proxys-OmniRoute`
-#     → `not_indexed.dirs` (27) + `not_indexed.files` (336), todos `BY DESIGN`.
-#   - `.gitignore` deste repo (5.691 B) — fonte canônica secundária.
-#
-# Como auditar mudanças: depois de editar este arquivo, rodar `index_repository`
-# (ou esperar `auto_watch` re-indexar) e re-checar `cli index_status` → comparar
-# contagens em `not_indexed.dirs_count` e `not_indexed.files_count`.
-
-# ─────────────────────────────────────────────────────────────────────────────
-# 1. Diretorios de runtime / pacote — nao sao codigo-fonte
-# ─────────────────────────────────────────────────────────────────────────────
-node_modules/
-node_modules
-
-# Builds e artefatos reproduziveis (Layer 1 Next.js / Electron)
-.build/
-dist/
-.next/
-out/
-
-# Electron especifico
-electron/dist-electron/
-electron/node_modules/
-icon.iconset/
-
-# Workspaces internos que tem proprio node_modules
-@omniroute/opencode-plugin/dist/
-@omniroute/opencode-plugin/node_modules/
-@omniroute/opencode-provider/dist/
-@omniroute/opencode-provider/node_modules/
-
-# Recursos nativos compilados (C/JNI/wasm)
-src/mitm/tproxy/native/build/
-
-# Artefatos locais do Stryker / Playwright / coverage
-.stryker-tmp/
-reports/mutation/
-stryker-output-*.json
-.playwright-mcp/
-test-results/
-playwright-report/
-blob-report/
-
-# Analise / linters / caches
-.analysis/
-.sisyphus/
-.plans/
-.gitnexus
-.worktrees
-.codegraph/
-
-# Quality artifacts (gerados por npm run lint --cache etc)
-.eslintcache
-.eslintcache-complexity
-
-# Claude Code local state
-.claude/scheduled_tasks.lock
-.claude/scheduled_tasks/
-.claude/sessions/
-.claude/state.json
-.claude/settings.local.json
-
-# Serena / Antigravity / outras tools locais
-.serena/
-.antigravitycli/
-.gemini/
-.config/
-
-# ─────────────────────────────────────────────────────────────────────────────
-# 2. Diretorios com prefixo `_` — locais / privados (regra global do .gitignore)
-# ─────────────────────────────────────────────────────────────────────────────
-_*/
-_artifacts/
-_cache/
-_mono_repo/
-_references/
-_tasks/
-
-# ─────────────────────────────────────────────────────────────────────────────
-# 3. Diretorios de tooling IA (state local, nao codigo)
-# ─────────────────────────────────────────────────────────────────────────────
-.agents/
-.claude/
-.vscode/
-.idea/
-.junie/
-.omc/
-.data/
-.data-dev/
-.local-data/
-.logs/
-.artifacts/
-.source/
-.superpowers/
-.claude-flow/
-.omnivscodeagent/
-omnirouteCloud/
-omnirouteSite/
-.omniroute/
-.stent/
-
-# Subpaths especificos do Claude Code que nao estao em .claude/ (criados sob repo)
-.claude/worktrees/
-
-# ─────────────────────────────────────────────────────────────────────────────
-# 4. Diretorios de dados / runtime locais (storage, env, secrets, scratch)
-# ─────────────────────────────────────────────────────────────────────────────
-data/
-src/lib/env/
-src/app/api/agent-skills/coverage/
-src/app/api/cloud/
-src/app/api/sync/cloud/
-src/app/api/system/env/
-tests/golden-set/data/
-
-# Logs e saida de teste
-logs/*
-test_output.log
-home-diegosouzapw-dev-automacoes-*.txt
-
-# ─────────────────────────────────────────────────────────────────────────────
-# 5. Diretorios do monorepo por subprojeto (nao fazem parte do app principal)
-# ─────────────────────────────────────────────────────────────────────────────
-security-analysis/
-vscode-extension/
-obsidian-plugin/node_modules/
-
-# ─────────────────────────────────────────────────────────────────────────────
-# 6. Diretorios de documentacao interna / workflow
-# ─────────────────────────────────────────────────────────────────────────────
-docs/superpowers/
-
-# ─────────────────────────────────────────────────────────────────────────────
-# 7. Arquivos especificos (nao diretorios inteiros)
-# ─────────────────────────────────────────────────────────────────────────────
-
-# Segredos e env — NUNCA indexar
-.env
-.env.*
-!.env.example
-!.env.homolog.example
-
-# TypeScript build info e next env declaration
-*.tsbuildinfo
-next-env.d.ts
-typescript
-
-# SQLite transient files (WAL/SHM/journal)
-*.sqlite-shm
-*.sqlite-wal
-*.sqlite-journal
-
-# Mapas e source maps
-*.map
-
-# Bun / npm lockfiles ruidosos
-bun.lock
-
-# `cheaper-inference-gateway.svg` e arquivos de midia na raiz/asset ja cobertos
-# pelos `ignored-suffix` do indexador (svg/png/jpg/ico/etc >50kB ou >500linhas);
-# manter a regra explicita aqui ajuda a auditar:
-cheaper-inference-gateway.svg
-cheaper-inference-gateway-*.svg
-
-# Husky internals
-.husky/_/
-
-# CI / quality metric artifacts
-config/quality/quality-metrics.json
-config/quality/test-impact-map.json
-audit-report.json
-.gh-discussions.json
-
-# i18n audit (gerado por npm run scripts)
-scripts/i18n/_audit.json
-scripts/i18n/_pending-keys.json
-
-# Cli binario local (scratch)
-bin/omniroute.mjs
-
-# Deploy / docker backups
-deploy.sh
-docker-compose.yml.bak
-docker-compose.minimal.yml

.env.example

@@ -40,11 +40,6 @@ INITIAL_PASSWORD=CHANGEME
 #       also if you want to share the same database as "npm run dev" use "./data"
 # DATA_DIR=/var/lib/omniroute
 
-# Fallback alias for DATA_DIR, checked only when DATA_DIR is unset.
-# Used by: open-sse/executors/promptql/threadSticky.ts — locates the PromptQL
-# executor's on-disk thread-sticky session cache. Leave unset to rely on DATA_DIR.
-# OMNIROUTE_DATA_DIR=/var/lib/omniroute
-
 # Encryption key for SQLite database encryption at rest.
 # Used by: src/lib/db/encryption.ts — encrypts the entire SQLite database.
 # Generate: openssl rand -hex 32  |  Leave empty to disable DB encryption.
@@ -80,26 +75,8 @@ PORT=20128
 
 # Base path (URL subpath) when serving OmniRoute behind a reverse proxy under a subpath.
 # Used by: next.config.mjs — sets Next.js `basePath`; auth redirects are basePath-aware.
-# Also mirrored to NEXT_PUBLIC_OMNIROUTE_BASE_PATH at build time so the dashboard
-# endpoint display (useDisplayBaseUrl) shows https://host/omniroute/v1 instead of
-# https://host/v1. Rebuild after changing this value (Next basePath is build-time).
 # Default: "" (served at the domain root). Example: /omniroute to serve under https://host/omniroute
-# Docker: baked at image build time via build-arg; root-path images can also apply this at
-# container start (see docs/guides/DOCKER_GUIDE.md).
 # OMNIROUTE_BASE_PATH=
-# Client fetch/EventSource under this path are rewritten via installBasePathFetch
-# (src/shared/utils/basePathFetch.ts) so absolute `/api/*` and `/v1/*` hits work
-# without a reverse-proxy rewrite. Rebuild after changing (Next basePath is build-time).
-#
-# Browser-visible mirror of OMNIROUTE_BASE_PATH, inlined at build time so the
-# dashboard endpoint display can read it client-side. Set it to the same value
-# as OMNIROUTE_BASE_PATH; when unset the hook falls back to OMNIROUTE_BASE_PATH.
-# Used by: src/shared/hooks/useDisplayBaseUrl.ts
-# NEXT_PUBLIC_OMNIROUTE_BASE_PATH=
-#
-# Optional: set the public origin *with* the same path so OAuth and display URLs
-# stay consistent without relying on window.location.origin alone:
-# NEXT_PUBLIC_BASE_URL=https://host/omniroute
 
 # Split-port mode: serve Dashboard and API on separate ports for network isolation.
 # Used by: src/lib/runtime/ports.ts — overrides PORT for each service.
@@ -111,14 +88,6 @@ PORT=20128
 # Used by: src/sse/utils/backpressure.ts — disabled when unset/0.
 # OMNI_MAX_CONCURRENT_CONNECTIONS=0
 
-# Optional OmniRoute-to-OmniRoute peer chaining guard. Give every instance a
-# unique ID and allowlist only the other OmniRoute base URLs it may call.
-# Requests to allowlisted peers carry X-OmniRoute-Peer-Trace; repeated instances
-# and exhausted hop budgets are rejected with HTTP 508 before provider routing.
-# OMNIROUTE_INSTANCE_ID=gateway-a
-# OMNIROUTE_PEER_URLS=http://gateway-b:20128/v1
-# OMNIROUTE_PEER_MAX_HOPS=4
-
 # Port for the real-time WebSocket live monitoring server.
 # Used by: src/server/ws/liveServer.ts, src/app/api/v1/ws/route.ts
 # Default: 20132
@@ -240,9 +209,8 @@ NODE_ENV=production
 
 # Container runtime — controls startup script behavior (permissions, advice).
 # Values: docker | podman  |  Default: docker
-# Set to "podman" for any Podman topology. The entrypoint cannot determine
-# whether the engine is local or reached through Podman Machine, so it prints
-# topology-neutral guidance and links contrib/podman/README.md.
+# Set to "podman" when running under rootless Podman so the entrypoint
+# gives the correct fix instructions (podman unshare chown vs sudo chown).
 CONTAINER_HOST=docker
 
 # Container runtime override for skill sandboxing.
@@ -254,7 +222,7 @@ CONTAINER_HOST=docker
 # - orbstack: OrbStack (high-perf Linux VM + docker shim on macOS)
 # - podman:  Podman (rootless, daemonless)
 # - docker:  Docker (default fallback)
-# (defined under SKILLS & SANDBOXING section below)
+SKILLS_SANDBOX_RUNTIME=auto
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # 4. SECURITY & AUTHENTICATION
@@ -320,25 +288,18 @@ ALLOW_API_KEY_REVEAL=false
 # Default: 10485760 (10 MB)
 # MAX_BODY_SIZE_BYTES=10485760
 
-# Atomic admission for POST /v1/chat/completions (#7846). Large request bodies
-# amplify into multiple transient representations during parsing, compression, and
-# provider dispatch. Heavyweight capacity is reserved before parsing; excess work
-# receives 503 + Retry-After instead of overlapping until the process OOMs.
+# Heap-pressure-aware admission for POST /v1/chat/completions (#5152). A large
+# coding-agent "compact" body amplifies into hundreds of MB of transient JS objects
+# on the combo path; concurrent compacts can stack past the V8 heap ceiling and OOM
+# the process. These shed a LARGE body with 503 (Retry-After) only while the heap is
+# already under pressure — healthy heap admits every body untouched.
 # Used by: src/shared/middleware/chatBodyAdmission.ts
-# Actual bodies at or above this size require a heavyweight lease. Default 262144 (256 KB).
+# Bodies below this size skip the guard entirely (heap not even sampled). Default 262144 (256 KB).
 # OMNIROUTE_CHAT_LARGE_BODY_BYTES=262144
-# Actual-byte hard cap enforced during bounded ingestion. Default 52428800 (50 MB).
+# Hard cap — bodies above this are rejected with 413 before any clone/parse. Default 52428800 (50 MB).
 # OMNIROUTE_CHAT_HARD_MAX_BODY_BYTES=52428800
-# Maximum heavyweight requests simultaneously admitted in one process. Default 1.
-# OMNIROUTE_CHAT_MAX_HEAVY_IN_FLIGHT=1
-# Message count that classifies an otherwise small body as heavyweight. Default 200.
-# OMNIROUTE_CHAT_HEAVY_MESSAGE_COUNT=200
-# Tool count that classifies an otherwise small body as heavyweight. Default 64.
-# OMNIROUTE_CHAT_HEAVY_TOOL_COUNT=64
-# Conservative string-size token estimate that classifies a request as heavyweight. Default 32000.
-# OMNIROUTE_CHAT_HEAVY_ESTIMATED_TOKENS=32000
-# Hard message-count cap; excess receives compact-required 413. Default 800.
-# OMNIROUTE_CHAT_HARD_MAX_MESSAGES=800
+# Shed large bodies once heapUsed/heap_size_limit reaches this ratio (0<r<1). Default 0.75.
+# OMNIROUTE_CHAT_HEAP_SHED_RATIO=0.75
 
 # Hard cap (bytes) for a non-streaming upstream response buffered fully into memory
 # (#5152). Past this the upstream reader is cancelled and the request fails fast
@@ -379,24 +340,16 @@ ALLOW_API_KEY_REVEAL=false
 # ── Request-Side: Prompt Injection Guard ──
 # Scans incoming messages for prompt injection patterns before routing.
 # Used by: src/middleware/promptInjectionGuard.ts
-# Default ON when unset. Set to false/0/no/off to disable. Truthy: true/1/yes/on.
-# INPUT_SANITIZER_ENABLED=false
-# INPUT_SANITIZER_MODE=warn    # warn = log only | block = reject request | redact = legacy (does NOT strip injection; use PII_REDACTION_ENABLED for request PII)
-# INPUT_SANITIZER_BLOCK_THRESHOLD=high  # high (default) | medium | low — severities at/above this are blocked in block mode
+# INPUT_SANITIZER_ENABLED=true
+# INPUT_SANITIZER_MODE=warn    # warn = log only | block = reject request | redact = strip patterns
 
-# Legacy aliases for INPUT_SANITIZER_MODE / INPUT_SANITIZER_BLOCK_THRESHOLD (same effect).
+# Legacy alias for INPUT_SANITIZER_MODE (same effect).
 # INJECTION_GUARD_MODE=warn
-# INJECTION_GUARD_BLOCK_THRESHOLD=high
 
 # PII detection in incoming requests (emails, phone numbers, SSNs, etc.).
 # Used by: src/middleware/promptInjectionGuard.ts — extends injection guard.
 # PII_REDACTION_ENABLED=false
 
-# Redacts well-known API-key / secret-token patterns (OpenAI, Anthropic, GitHub,
-# Slack, etc.) from request/response payloads before they reach providers/clients.
-# Opt-in; mirrors PII_REDACTION_ENABLED. Used by: src/lib/guardrails/credentialMasker.ts.
-# CREDENTIAL_REDACTION_ENABLED=false
-
 # Minimum streaming window size for PII detection (bytes). Default: 200.
 # Used by: src/lib/streamingPiiTransform.ts.
 # PII_WINDOW_SIZE=200
@@ -552,9 +505,7 @@ NEXT_PUBLIC_CLOUD_URL=
 #OMNIROUTE_CROF_USAGE_URL=https://crof.ai/usage_api/
 #OMNIROUTE_CODEWHISPERER_BASE_URL=https://codewhisperer.us-east-1.amazonaws.com
 #OMNIROUTE_OPENCODE_QUOTA_URL=https://opencode.ai/zen/go/v1/quota
-# OpenCode Go has no public quota API — this has no default and stays
-# unset unless you explicitly opt in to a self-hosted/mirrored endpoint:
-#OMNIROUTE_OPENCODE_GO_QUOTA_URL=
+#OMNIROUTE_OPENCODE_GO_QUOTA_URL=https://api.z.ai/api/monitor/usage/quota/limit
 #OMNIROUTE_OPENCODE_GO_DASHBOARD_URL=https://opencode.ai/workspace
 #OMNIROUTE_OLLAMA_CLOUD_USAGE_URL=https://ollama.com/settings
 
@@ -696,15 +647,6 @@ NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
 # Legacy alias for OMNIROUTE_API_KEY.
 # ROUTER_API_KEY=
 
-# Enable the offline/local Issue Agent recorded-triage endpoint.
-# Used by: src/app/api/issue-agent/runs/route.ts. Default: disabled.
-# OMNIROUTE_ISSUE_AGENT_ENABLED=false
-
-# Timeout (ms) for a single Issue Agent recorded-triage run. Clamped to an internal
-# maximum; falls back to the built-in default when unset or invalid.
-# Used by: src/lib/issueAgent/execution.ts.
-# OMNIROUTE_ISSUE_AGENT_TIMEOUT_MS=
-
 # CLI remote-mode context/profile for `omniroute` commands (overrides the active
 # context in the local contexts store). Equivalent to the `--context <name>` flag.
 # Used by: bin/cli/program.mjs, bin/cli/api.mjs (remote mode).
@@ -811,15 +753,6 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # Default: <repo>/src/lib/db/migrations.
 #OMNIROUTE_MIGRATIONS_DIR=
 
-# Additional migration directories, as `namespace=dir` entries separated by the
-# platform path delimiter (`:` on POSIX, `;` on Windows). Files found there are
-# recorded as `<namespace>-<number>` (e.g. `ee-134`), a version space that cannot
-# collide with the upstream numeric slots — so a distribution shipping its own
-# migrations never silently loses one to a number the upstream set also claimed.
-# A malformed entry, an invalid namespace or a missing directory aborts startup
-# rather than skipping the schema. Unset = no extra directories (the default).
-#OMNIROUTE_EXTRA_MIGRATIONS_DIRS=ee=/opt/app/enterprise/db/migrations
-
 # Mass-pending-migrations safety threshold (#3416). If more than this many
 # migrations are pending on an existing DB, startup aborts (a wiped tracking
 # table could cause data loss). Raise it to restore an older backup; set to 0
@@ -882,11 +815,10 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # Used by: open-sse/executors/antigravity.ts — escape hatch for multi-project setups.
 # OMNIROUTE_ALLOW_BODY_PROJECT_OVERRIDE=0
 
-# Control Antigravity Google One AI credit usage. Used by:
-# open-sse/services/antigravityCredits.ts — accepts off, retry, or always.
-# off (default): never use credits; retry: use credits once after eligible quota 429;
-# always: use credits on the first request (higher account and spend risk).
-#ANTIGRAVITY_CREDITS=off
+# Adjust how Antigravity advertises remaining credits.  Used by:
+# open-sse/services/antigravityCredits.ts — accepts forced override strings.
+# Default: empty (use upstream-reported credits).
+#ANTIGRAVITY_CREDITS=
 
 # Override the path to the Antigravity CLI (agy) token file read by the
 # "auto-detect local login" import. Used by:
@@ -940,17 +872,15 @@ CODEX_OAUTH_CLIENT_ID=app_EMoamEEZ73f0CkXaXp7hrann
 # ANTIGRAVITY_OAUTH_CLIENT_SECRET=
 # WINDSURF_FIREBASE_API_KEY=
 
+# ── Qwen (Alibaba) ──
+QWEN_OAUTH_CLIENT_ID=f0304373b74a44d2b584a3fb70ca9e56
+
 # ── Kimi Coding (Moonshot) ──
 KIMI_CODING_OAUTH_CLIENT_ID=17e5f671-d194-4dfb-9706-5516cb48c098
 
 # ── GitHub Copilot ──
 GITHUB_OAUTH_CLIENT_ID=Iv1.b507a08c87ecfe98
 
-# ── GitHub Enterprise (GHE) Copilot ──
-# Optional override for GHE Copilot's OAuth client id. Falls back to the public
-# GITHUB_OAUTH_CLIENT_ID default when unset. Used by: src/lib/oauth/constants/oauth.ts.
-# GHE_COPILOT_OAUTH_CLIENT_ID=
-
 # ── GitLab Duo ──
 # Register an OAuth app at: https://gitlab.com/-/profile/applications
 # Set redirect URI to: http://localhost:20128/callback (or your NEXT_PUBLIC_BASE_URL + /callback)
@@ -1055,7 +985,7 @@ GITHUB_OAUTH_CLIENT_ID=Iv1.b507a08c87ecfe98
 # Used by: open-sse/executors/base.ts — buildHeaders() dynamic lookup.
 # Update these when providers release new CLI versions to avoid blocks.
 
-CLAUDE_USER_AGENT="claude-cli/2.1.219 (external, cli)"
+CLAUDE_USER_AGENT="claude-cli/2.1.207 (external, cli)"
 
 # Disable the deterministic tool-name cloak applied on both Anthropic-bound paths
 # (executors/base.ts native OAuth + executors/cliproxyapi.ts CLIProxyAPI) —
@@ -1080,6 +1010,7 @@ KIRO_USER_AGENT="AWS-SDK-JS/3.0.0 kiro-ide/1.0.0"
 # Used by: open-sse/executors/kiro.ts
 # KIRO_VERIFY_FULL_CRC=false
 QODER_USER_AGENT="Qoder-Cli"
+QWEN_USER_AGENT="QwenCode/0.19.3 (linux; x64)"
 CURSOR_USER_AGENT="Cursor/3.4"
 
 # Override Codex client version sent in headers independently of the
@@ -1109,6 +1040,8 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # CLI_COMPAT_KIMI_CODING=1
 # CLI_COMPAT_KILOCODE=1
 # CLI_COMPAT_CLINE=1
+# CLI_COMPAT_QWEN=1
+
 # Or enable for all providers at once:
 # CLI_COMPAT_ALL=1
 
@@ -1204,20 +1137,6 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # OMNIROUTE_GROK_TLS_TIMEOUT_MS=60000
 # OMNIROUTE_GROK_TLS_GRACE_MS=10000
 
-# ── Notion web TLS sidecar (Chrome-fingerprinted client) ──
-# Used by: open-sse/services/notionTlsClient.ts — wire-level timeout for the
-# bogdanfinn/tls-client koffi binding and the JS-side grace window layered on
-# top of it when the native library is wedged. The notion-web executor raises
-# the wire timeout per-request to 180000 for long generations.
-# OMNIROUTE_NOTION_TLS_TIMEOUT_MS=30000
-# OMNIROUTE_NOTION_TLS_GRACE_MS=10000
-
-# ── Grok web quota fetcher (auth.json override) ──
-# Used by: open-sse/services/grokQuotaFetcher.ts — path of the Grok CLI
-# auth.json used to fetch the grok-web weekly quota. Defaults to
-# ~/.grok/auth.json; override for tests or a non-standard CLI install.
-# GROK_AUTH_PATH=
-
 # ── Browser-backed web-cookie chat (Playwright shared pool) ──
 # Used by: open-sse/services/browserPool.ts + browserBackedChat.ts. The shared
 # browser pool warms a headless context for web-cookie providers (e.g. claude-web)
@@ -1248,13 +1167,6 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # PIN_DROP_BACKOFF_LEVEL=2
 # PIN_DROP_GRACE_MS=20000
 
-# Whether OmniRoute may emit SSE `:` comment lines (e.g. the `: keepalive` heartbeat).
-# Some strict OpenAI-compatible clients parse every SSE line as JSON and crash on `:`
-# comments. Set to `off` to suppress comment-shaped heartbeats (they become a no-op);
-# `data:` heartbeats are unaffected. Default: enabled.
-# Used by: open-sse/utils/sseHeartbeat.ts.
-# OMNIROUTE_SSE_COMMENTS=off
-
 # ── Stream idle detection ──
 # STREAM_IDLE_TIMEOUT_MS=600000      # Max silence between SSE chunks (default: 600000)
 #                                     # Extended-thinking models rarely pause >90s.
@@ -1414,6 +1326,10 @@ APP_LOG_TO_FILE=true
 # Default: ~/.omniroute/plugins/  Override in dev/CI to point at a local plugin tree.
 # OMNIROUTE_PLUGIN_PATH=
 
+# Allow plugins to request the 'exec' permission (spawn child processes from the
+# plugin worker sandbox). Disabled by default; set to 1 to enable (local operator only).
+# OMNIROUTE_PLUGINS_ALLOW_EXEC=0
+
 # ── Prompt cache (system prompt deduplication) ──
 # Used by: open-sse/services — caches identical system prompts across requests.
 # PROMPT_CACHE_MAX_SIZE=50              # Max cached entries (default: 50)
@@ -1507,12 +1423,6 @@ APP_LOG_TO_FILE=true
 # NANOBANANA_POLL_TIMEOUT_MS=120000    # Max wait for job completion (default: 120s)
 # NANOBANANA_POLL_INTERVAL_MS=2500     # Poll frequency (default: 2.5s)
 
-# ── Microsoft Designer Web (Image Generation) ──
-# Polling config for the microsoft-designer-web submit-then-poll image job.
-# Used by: open-sse/handlers/imageGeneration/providers/designerWeb.ts
-# DESIGNER_WEB_POLL_TIMEOUT_MS=60000   # Max wait for job completion (default: 60s)
-# DESIGNER_WEB_POLL_INTERVAL_MS=2000   # Poll frequency (default: 2s)
-
 # ── AWS Bedrock (Kiro / Audio) ──
 # Region used to construct AWS Bedrock endpoints. Used by:
 # src/lib/providers/validation.ts and open-sse/handlers/audioSpeech.ts.
@@ -1658,13 +1568,9 @@ APP_LOG_TO_FILE=true
 # Also configurable from Dashboard > Settings > Feature Flags.
 # OMNIROUTE_CONTROL_PLANE_PROXY_DIRECT_FALLBACK=false
 
-# Rate limit maximum wait time before failing a request (ms).  Default: 15000 (15s)
+# Rate limit maximum wait time before failing a request (ms).  Default: 120000 (2 min)
 # Used by: open-sse/services/rateLimitManager.ts
-# RATE_LIMIT_MAX_WAIT_MS=15000
-
-# Rate limit queue admission cap: reject with 429 queue_full once this many requests
-# are already queued (0 = disabled/unbounded, the default). Used by: open-sse/services/rateLimitManager.ts
-# RATE_LIMIT_MAX_QUEUE_DEPTH=0
+# RATE_LIMIT_MAX_WAIT_MS=120000
 
 # Force the auto-enable rate limit safety net on/off regardless of the persisted
 # Dashboard setting. Used by: open-sse/services/rateLimitManager.ts.
@@ -1713,17 +1619,6 @@ APP_LOG_TO_FILE=true
 # Used by: src/lib/tokenHealthCheck.ts.  Default: 3000.
 # HEALTHCHECK_STAGGER_MS=3000
 
-# Randomized jitter range (ms) added on top of HEALTHCHECK_STAGGER_MS between
-# provider token healthchecks, to prevent bursting (Issue #1220).
-# Used by: src/lib/tokenHealthCheck.ts.  Defaults: min=500, max=5000.
-# HEALTHCHECK_JITTER_MIN_MS=500
-# HEALTHCHECK_JITTER_MAX_MS=5000
-
-# Concurrent-check batch size for the startup token-healthcheck sweep. Larger
-# values check more connections in parallel; smaller values reduce burst load.
-# Used by: src/lib/tokenHealthCheck.ts.  Default: 20 (Issue #7875, regression of #7719).
-# HEALTHCHECK_BATCH_SIZE=20
-
 # ═══════════════════════════════════════════════════════════════════════════════
 # 22. DEBUGGING
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -1826,10 +1721,6 @@ APP_LOG_TO_FILE=true
 # Tokens reserved for completion output when computing prompt budgets.
 # Used by: open-sse/services/contextManager.ts. Default: 1024.
 # CONTEXT_RESERVE_TOKENS=1024
-# How many of the newest inline images to keep when pruning older ones to fit
-# the context window (#8560). Used by: open-sse/services/contextManager.ts.
-# Default: 2.
-# CONTEXT_KEEP_LATEST_IMAGES=2
 
 # ── Model alias rewriting (legacy compatibility) ──
 # Toggle the legacy model-alias compatibility layer used by older clients.
@@ -1866,22 +1757,6 @@ APP_LOG_TO_FILE=true
 # for root-less / user-namespaced deployments (e.g. rootless Docker/Podman)
 # where the operator trusts the CA manually (e.g. via Node's extra-CA-certs mechanism).
 # OMNIROUTE_NO_SUDO=0
-# Explicit opt-out: skip provisioning /etc/hosts DNS entries for the Antigravity
-# proxy hostnames entirely (containers with no sudo/root available).
-# Used by: src/mitm/dns/provision.ts.
-# SKIP_ANTIGRAVITY_DNS=true
-# Skip writing to the hosts file when adding/removing DNS entries (e.g. sandboxed
-# or read-only test environments). Used by: src/mitm/dns/dnsConfig.ts.
-# OMNIROUTE_SKIP_DNS_WRITE=1
-# Opt in to the root-CA + per-host-leaf cert model for the MITM proxy (#6684).
-# Fresh installs and installs with this set to "true" get a persisted root CA that
-# signs per-host leaves; installs with a pre-existing trusted legacy leaf keep the
-# legacy fixed-SAN cert unless opted in. Used by: src/mitm/manager.ts.
-# MITM_ROOT_CA_ENABLED=true
-# Set BY the MITM manager for the spawned proxy process ("root-ca" | "legacy") —
-# reflects the migration decision above; not meant to be set manually.
-# Read by: src/mitm/server.cjs.
-# MITM_CERT_MODE=legacy
 
 # ── Test/CI-only guards (never needed in production) ──
 # Set automatically by tests/_setup/isolateDataDir.ts and the CI workflows: the
@@ -1901,14 +1776,6 @@ APP_LOG_TO_FILE=true
 # ONEPROXY_MAX_PROXIES=500
 # ONEPROXY_MIN_QUALITY_THRESHOLD=50
 
-# ── Free Proxy Pool (auto-sync scheduler) ──
-# Background refresh of the free-proxy pool. Opt-in, OFF by default (parallels
-# Hard Rule #20's default-off posture for data-mutating background features).
-# Used by: src/lib/freeProxyProviders/scheduler.ts
-# FREE_PROXY_AUTO_SYNC_ENABLED=true
-# Sync interval in ms (default: 1800000 = 30 min).
-# FREE_PROXY_AUTO_SYNC_INTERVAL_MS=1800000
-
 # ── Free Proxy Pool (1proxy source) ──
 # Used by: src/lib/freeProxyProviders/oneproxy.ts
 # Set FREE_PROXY_1PROXY_ENABLED=false to disable this source.
@@ -1965,11 +1832,6 @@ APP_LOG_TO_FILE=true
 # Used by: src/lib/db/backup.ts.
 # DB_BACKUP_MAX_FILES=20
 # DB_BACKUP_RETENTION_DAYS=0
-# Tick interval (ms) of the server-side job that executes backup-schedule.json.
-# Must stay well under the 1-minute cron granularity; values below 5000 (or
-# unparseable) fall back to the 30000 default.
-# Used by: src/lib/jobs/backupScheduleJob.ts
-# OMNIROUTE_BACKUP_SCHEDULE_JOB_INTERVAL_MS=30000
 
 # ── TLS sidecar override ──
 # Used by: open-sse/services/chatgptTlsClient.ts tests. Production deployments
@@ -2132,15 +1994,6 @@ QUOTA_STORE_DRIVER=sqlite              # sqlite | redis
 # the full (unfiltered) pool with a warning. Source: open-sse/services/autoCombo/virtualFactory.ts
 # OMNIROUTE_AUTO_FREE_FALLBACK_TO_FULL_POOL=false
 
-# ─── Auto-Combo chaos panel (broadcast variant) ────────────────────────────
-# Tuning for the `auto/*:chaos` variant, which fans a single request out to a
-# panel of provider-diverse models. Panel size is clamped to 1..10 (default 5);
-# min-panel and the panel hard-timeout fall back to the engine defaults when
-# unset. Source: open-sse/services/autoCombo/virtualFactory.ts
-# OMNIROUTE_CHAOS_MAX_PANEL=5
-# OMNIROUTE_CHAOS_MIN_PANEL=
-# OMNIROUTE_CHAOS_PANEL_TIMEOUT_MS=
-
 # ─── OpenCode config regeneration (scripts/ad-hoc/regen-opencode-config.ts) ───
 # Base URL of the OmniRoute instance to query for /v1/models when regenerating
 # an opencode.json with accurate limit.context values. Used by:
@@ -2278,51 +2131,3 @@ QUOTA_STORE_DRIVER=sqlite              # sqlite | redis
 # OMNIROUTE_ROTATE_ON_400=false
 # OMNIROUTE_ROTATE_400_THRESHOLD=1
 # OMNIROUTE_ROTATE_400_WINDOW_SECONDS=120
-
-# ─────────────────────────────────────────────────────────────────────────────
-# PromptQL playground provider (Unofficial/Experimental — src/shared/constants/providers/web-cookie.ts)
-# Reverse-engineered GraphQL session bridge for prompt.ql.app. All optional —
-# defaults point at the public playground endpoints; override only for a
-# self-hosted/alternate PromptQL deployment.
-# Used by: open-sse/executors/promptql.ts, open-sse/services/usage/promptql.ts
-# ─────────────────────────────────────────────────────────────────────────────
-# PROMPTQL_GRAPHQL_ENDPOINT=https://data.prompt.ql.app/promptql/playground-v2-hge/v1/graphql
-# PROMPTQL_CREDITS_ENDPOINT=https://data.pro.ql.app/v1/graphql
-# PROMPTQL_TOKEN_REFRESH_URL=https://auth.pro.ql.app/ddn/project/token
-# PROMPTQL_POLL_TIMEOUT_MS=180000
-
-# ─────────────────────────────────────────────────────────────────────────────
-# HyperAgent web provider (Unofficial/Experimental — src/shared/constants/providers/web-cookie.ts)
-# Reverse-engineered session bridge for hyperagent.com. Optional — defaults
-# point at the public billing/usage endpoint; override only for a
-# self-hosted/alternate HyperAgent deployment.
-# Used by: open-sse/services/usage/hyperagent.ts
-# ─────────────────────────────────────────────────────────────────────────────
-# HYPERAGENT_USAGE_URL=https://hyperagent.com/api/settings/billing/usage
-
-# ─────────────────────────────────────────────────────────────────────────────
-# Browser-login VNC sessions (optional — src/lib/vncSession/manifest.ts)
-# Containerized Chromium+VNC used for interactive browser-login credential
-# capture via /api/vnc-session. All optional — defaults target the bundled
-# `omniroute-vnc-chromium:local` image; override only for a custom image, ports,
-# or lifecycle tuning.
-# ─────────────────────────────────────────────────────────────────────────────
-# OMNIROUTE_VNC_IMAGE=omniroute-vnc-chromium:local
-# OMNIROUTE_DOCKER_BIN=docker
-# OMNIROUTE_VNC_CONTAINER_VNC_PORT=3000
-# OMNIROUTE_VNC_CONTAINER_CDP_PORT=9223
-# OMNIROUTE_VNC_CONTAINER_PROFILE_DIR=/config
-# OMNIROUTE_VNC_PROFILE_DIR=
-# OMNIROUTE_VNC_IDLE_MS=600000
-# OMNIROUTE_VNC_MAX_MS=1800000
-# OMNIROUTE_VNC_MAX_SESSIONS=4
-# OMNIROUTE_VNC_READY_MS=45000
-# OMNIROUTE_VNC_HARVEST_MS=20000
-# OMNIROUTE_VNC_CHROMIUM_ARGS=--remote-debugging-port=9222 --no-first-run --no-default-browser-check
-
-# ─────────────────────────────────────────────────────────────────────────────
-# Data-dir alias (optional — open-sse/services/notionThreadSessions.ts)
-# Legacy fallback for DATA_DIR, checked only after DATA_DIR and
-# OMNIROUTE_DATA_DIR are both unset. Locates the Notion web-thread session cache.
-# ─────────────────────────────────────────────────────────────────────────────
-# VIBEPROXY_DATA_DIR=

.env.homolog.example

@@ -1,9 +0,0 @@
-# Homologação E2E real — copie para .env.homolog (NUNCA commitar o real)
-HOMOLOG_BASE_URL=http://192.168.0.15:20128
-# Senha de management do dashboard da VPS (a mesma do /login)
-HOMOLOG_ADMIN_PASSWORD=
-# Deixe vazio: a suíte cria uma API key efêmera via admin e revoga no fim.
-# Só preencha para depurar uma camada isolada com uma key fixa.
-HOMOLOG_API_KEY=
-# Tier crítico (chat real, max_tokens=5). Demais providers: só validação de catálogo.
-HOMOLOG_CRITICAL_PROVIDERS=openai,anthropic,gemini,codex,grok,glm,deepseek,openrouter

.github/dependabot.yml

@@ -24,15 +24,6 @@ updates:
         update-types: ["version-update:semver-major"]
       - dependency-name: "eslint-config-next"
         update-types: ["version-update:semver-major"]
-      # typescript majors are peer-blocked by typescript-eslint, which pins a hard
-      # upper bound (8.64.0 → peerDependencies.typescript ">=4.8.4 <6.1.0"). A TS 7
-      # bump therefore violates the peer and takes down the whole toolchain at once —
-      # #7068 grouped it with 6 harmless bumps and turned Build + Lint + Quality Ratchet
-      # + Unit (6/8, 8/8) + Integration (1/2, 2/2) + dast-smoke red in one shot, blocking
-      # the innocuous updates riding along with it. Un-ignore once typescript-eslint
-      # widens the peer, and migrate TS majors intentionally (own PR, own CI run).
-      - dependency-name: "typescript"
-        update-types: ["version-update:semver-major"]
       # jscpd v5 is a Rust rewrite (native binary, no Node.js programmatic API).
       # scripts/check/check-duplication.mjs is deliberately pinned to jscpd@4 (it
       # parses jscpd-report.json against a frozen baseline). A v5 major would break

.github/pull_request_template.md

@@ -9,15 +9,10 @@
 
 ## Validation
 
-Choose the change type and focused loop from the
-[Contribution Golden Path](../docs/dev/CONTRIBUTION_GOLDEN_PATH.md). The full unit suite,
-Vitest, the 60% coverage gate, and the production build all run in CI on this PR (#8329):
-
-- [ ] Change type: provider / routing / UI / i18n / CLI / DB / build-deploy / other
-- [ ] Focused tests and category gates from the golden path
 - [ ] `npm run lint`
-- [ ] Reconciled with the current active release base; focused checks rerun afterward
-- [ ] Production-code changes include a new or updated automated test in this PR
+- [ ] `npm run test:unit`
+- [ ] `npm run test:coverage`
+- [ ] Coverage is still `>= 60%` for statements, lines, functions, and branches
 - [ ] SonarQube PR analysis is green or any remaining issues are explicitly documented below
 
 ## Tests Added Or Updated
@@ -32,4 +27,4 @@ Vitest, the 60% coverage gate, and the production build all run in CI on this PR
 
 ## Reviewer Notes
 
-- Call out any risky areas, migrations, feature flags, or manual validation that reviewers should know about.
+- Call out any risky areas, migrations, feature flags, or manual validation that reviewers should know about.

.github/workflows/build-fork.yml

@@ -0,0 +1,71 @@
+name: Publish Fork Image to GHCR
+
+on:
+  push:
+    branches: [main]
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+# Least-privilege default: read-only at the top level; the build job that pushes to
+# GHCR grants packages: write itself (Scorecard TokenPermissions).
+permissions:
+  contents: read
+
+env:
+  IMAGE_NAME: ghcr.io/kang-heewon/omniroute
+
+jobs:
+  build:
+    name: Build and Push Fork Image
+    if: github.repository == 'kang-heewon/OmniRoute'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=sha,prefix=sha-
+            type=ref,event=tag
+          labels: |
+            org.opencontainers.image.title=omniroute
+            org.opencontainers.image.description=Unified AI proxy/router — fork image
+            org.opencontainers.image.url=https://github.com/kang-heewon/OmniRoute
+            org.opencontainers.image.source=https://github.com/kang-heewon/OmniRoute
+            org.opencontainers.image.licenses=MIT
+
+      - name: Build and push
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          target: runner-base
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/ci.yml

@@ -33,27 +33,14 @@ jobs:
       docs: ${{ steps.classify.outputs.docs }}
       i18n: ${{ steps.classify.outputs.i18n }}
       workflow: ${{ steps.classify.outputs.workflow }}
-      testsOnly: ${{ steps.classify.outputs.testsOnly }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
-      # Refuse a PR that targets its own head branch before spending anything on it. #8912 has
-      # head == base == release/v3.8.50: no diff, can never merge, and it sits in the queue with
-      # a full check board attached on every push to that branch. One field comparison.
-      - name: Reject a PR that targets its own branch
-        if: github.event_name == 'pull_request'
-        env:
-          HEAD_REF: ${{ github.head_ref }}
-          BASE_REF: ${{ github.base_ref }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-        run: node scripts/check/check-pr-self-target.mjs
-
       - id: classify
         env:
           EVENT_NAME: ${{ github.event_name }}
@@ -94,7 +81,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -137,34 +124,11 @@ jobs:
       - run: npm run check:route-guard-membership
       - run: npm run check:test-discovery
       - run: npm run check:tracked-artifacts
-      # (gap 30) Also lives in quality.yml's PR-only "Merge integrity" job — because the
-      # CHANGELOG half of that job needs a base to diff against. This half does NOT: the
-      # generator either reproduces the committed SKILL.md files or it does not.
-      #
-      # Keeping it PR-only left a real hole. This cycle's merge trains landed in batches with
-      # `--admin`, which bypasses required checks, so three SKILL.md files drifted from the route
-      # catalog, rode the release squash into `main`, and the next cycle's sync-back turned them
-      # into a base-red that blocked EVERY PR into release/v3.8.50 until #8954. Running it here
-      # means a push to `main` catches the drift at the source instead of the next cycle
-      # inheriting it.
-      - run: npm run check:agent-skills-sync
-      # WS1.7 (v3.8.49 plan): Dockerfile lint (hadolint, pinned by digest).
-      # failure-threshold=error keeps the 5 pre-existing warnings (DL3008/DL3003/
-      # DL3016 version pinning / WORKDIR) visible without blocking; any ERROR fails.
-      - name: hadolint (Dockerfile)
-        run: docker run --rm -i hadolint/hadolint@sha256:27086352fd5e1907ea2b934eb1023f217c5ae087992eb59fde121dce9c9ff21e hadolint --failure-threshold error - < Dockerfile
       - run: npm run check:lockfile
       - run: npm run check:licenses
       # check:docs-sync is run by the docs-sync-strict job (via check:docs-all) and the
       # husky pre-commit hook; the standalone copy here was redundant (ROI dedup).
       - run: npm run typecheck:core
-      # #7033: typecheck:core's curated file allowlist does not cover
-      # src/app/(dashboard) TSX (and next.config.mjs sets ignoreBuildErrors:
-      # true, so `next build` never type-checks it either) — orphaned
-      # identifiers there (see #6625/#6909) were invisible to CI. This gate
-      # runs tsc scoped to the dashboard tree against a frozen baseline of
-      # pre-existing errors; only NEW errors fail it.
-      - run: npm run check:dashboard-typecheck
       # typecheck:noimplicit:core dropped from this job (2026-07 optimize):
       # it was advisory (continue-on-error) and largely subsumed by the blocking
       # check:type-coverage ratchet in quality-gate. Local: npm run typecheck:noimplicit:core.
@@ -184,7 +148,7 @@ jobs:
     # The coverage.* metrics degrade gracefully: the download is continue-on-error and
     # the ratchet runs with --allow-missing, so absent coverage is skipped, not failed.
     # Path filter: code-only — pure docs/i18n PRs have nothing for these ratchets to guard.
-    if: ${{ !cancelled() && !contains(github.event.pull_request.labels.*.name, 'hotfix') && (github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true' && (needs.lint.result == 'success' || needs.lint.result == 'failure'))) }}
+    if: ${{ !cancelled() && (github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true' && (needs.lint.result == 'success' || needs.lint.result == 'failure'))) }}
     # security-events: read lets the CodeQL ratchet read open code-scanning alerts
     # via `gh api .../code-scanning/alerts`. contents: read keeps checkout working.
     permissions:
@@ -194,7 +158,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -294,7 +258,7 @@ jobs:
     # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
     # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
     # Path filter: code-only (scanners/ratchets target production surface).
-    if: ${{ !contains(github.event.pull_request.labels.*.name, 'hotfix') && (github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true')) }}
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
     steps:
       # fetch-depth: 0 — the OpenAPI breaking-change gate (oasdiff) reads the base
       # spec via `git show <base_ref>:docs/openapi.yaml`; a shallow clone
@@ -303,7 +267,7 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -353,16 +317,8 @@ jobs:
           install -m 0755 /tmp/osv/*linux_amd64 "$HOME/.local/bin/osv-scanner"
           # actionlint — official download script
           bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) latest "$HOME/.local/bin"
-          # zizmor — PyPI (pipx preferred, pip --user fallback); lands in ~/.local/bin.
-          # PINNED on purpose. Unpinned, the runner installed whatever PyPI served that day and
-          # measured 1 finding MORE than the devbox on the identical commit (190 vs 189) during
-          # the v3.8.49 cycle — which cost a second rebaseline push per release, chasing a
-          # number that was never the code's. The ratchet compares counts across machines, so
-          # the auditor version has to be the same on both. Bump this deliberately, and
-          # rebaseline in the same commit: check-workflows.mjs now prints `zizmorVersion=` next
-          # to the count so the new number is traceable to the tool that produced it.
-          ZIZMOR_VERSION=1.25.2
-          pipx install "zizmor==$ZIZMOR_VERSION" || pip install --user "zizmor==$ZIZMOR_VERSION"
+          # zizmor — PyPI (pipx preferred, pip --user fallback); lands in ~/.local/bin
+          pipx install zizmor || pip install --user zizmor
           # oasdiff — download latest linux amd64 tarball via gh (authed), extract binary
           rm -rf /tmp/oasd && mkdir -p /tmp/oasd
           gh release download --repo oasdiff/oasdiff --pattern '*linux_amd64.tar.gz' --dir /tmp/oasd
@@ -419,7 +375,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -455,7 +411,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -480,46 +436,15 @@ jobs:
     # UI keys move with dashboard code OR message catalogs.
     if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && (needs.changes.outputs.i18n == 'true' || needs.changes.outputs.code == 'true')) }}
     steps:
-      # fetch-depth: 0 — the value-drift gate diffs en.json against the merge base to
-      # find rewritten English strings. On a shallow clone the base ref is missing and
-      # the gate self-skips (base-unresolved), so it would never actually run.
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-          fetch-depth: 0
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
       - uses: ./.github/actions/npm-ci-retry
       - run: node scripts/i18n/check-ui-keys-coverage.mjs --threshold=65
-      # #8463: a rewritten English value used to leave its 39 translations behind
-      # silently (googleOAuthWarning shipped wrong copy in 39 locales for months).
-      # Key parity above cannot see it — a stale translation counts as covered.
-      - name: i18n UI value drift (stale translations)
-        env:
-          BASE_REF: ${{ github.base_ref && format('origin/{0}', github.base_ref) || '' }}
-        run: node scripts/i18n/check-ui-value-drift.mjs
-
-  # #8038: cheap single-locale glossary/protected-terms consistency gate —
-  # complements i18n-ui-coverage (key parity) and the ICU `i18n` job below
-  # without needing app-boot/Playwright infra. Same gating as i18n-ui-coverage.
-  i18n-glossary-zhcn:
-    name: i18n Glossary (zh-CN)
-    runs-on: ubuntu-latest
-    needs: changes
-    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && (needs.changes.outputs.i18n == 'true' || needs.changes.outputs.code == 'true')) }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.CI_NODE_VERSION }}
-          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
-      - run: node scripts/i18n/check-glossary-consistency.mjs --locale=zh-CN
-      - run: node scripts/i18n/check-glossary-consistency.mjs --locale=zh-TW
 
   # D4 (plano mestre testes+CI): a matrix de ~40 jobs de <1min por idioma saturava sozinha
   # a concorrência de jobs da conta (Free = 20 slots, compartilhados entre TODOS os repos)
@@ -539,7 +464,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
       - name: Validate all languages
@@ -577,11 +502,11 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
       - name: Fetch base branch
-        run: git fetch --no-tags origin "${GITHUB_BASE_REF}"
+        run: git fetch --no-tags origin "${GITHUB_BASE_REF}" --depth=1
       - name: Validate source changes include tests
         run: node scripts/check/check-pr-test-policy.mjs --summary-file .artifacts/pr-test-policy.md
       # Anti test-masking: flag net assert removal / new assert.ok(true) in changed tests.
@@ -616,7 +541,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -664,7 +589,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -684,26 +609,12 @@ jobs:
       - name: Assert dist/server.js exists
         run: test -f dist/server.js || (echo "dist/server.js missing — build:cli did not assemble correctly" && exit 1)
       - run: npm run check:pack-artifact
-      # WS1.2 (#7065 class): pack the real tarball, install it into a clean prefix and
-      # BOOT it to a healthy /api/monitoring/health — the gate that structure checks
-      # cannot provide (3 releases shipped boot-crashing tarballs with green lists).
-      - name: Boot-smoke the packed tarball
-        run: npm run check:pack-boot
 
   electron-package-smoke:
-    name: Electron Package Smoke (${{ matrix.os }})
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 30
+    name: Electron Package Smoke
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
     needs: build
-    # WS1.5 (v3.8.49 plan): the Electron rebuild/spawn path previously executed for
-    # the FIRST time on the release tag — the v3.8.48 Windows bug (npx.cmd spawned
-    # without shell, CVE-2024-27980 behavior change) could only surface at release.
-    # windows-latest runs prepare:bundle (the ABI rebuild + spawn plan) per release
-    # PR; ubuntu keeps the full pack + headless smoke.
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, windows-latest]
     env:
       JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
       CSC_IDENTITY_AUTO_DISCOVERY: "false"
@@ -711,7 +622,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -729,21 +640,9 @@ jobs:
         working-directory: electron
         run: npm install --no-audit --no-fund
       - name: Pack Electron app
-        if: runner.os == 'Linux'
         working-directory: electron
         run: npm run pack
-      # ADVISORY while the new Windows leg matures (repo convention, dast-smoke
-      # precedent): its first-ever real run (2026-07-15, run 29457533565) died in
-      # 0.7s with the error swallowed by pwsh — bash shell captures stderr and
-      # continue-on-error keeps the heavy gate green while we harden it (#7336).
-      - name: Prepare Electron standalone (Windows ABI rebuild + spawn path)
-        if: runner.os == 'Windows'
-        working-directory: electron
-        continue-on-error: true
-        shell: bash
-        run: npm run prepare:bundle 2>&1
       - name: Smoke packaged Electron app
-        if: runner.os == 'Linux'
         env:
           ELECTRON_SMOKE_TIMEOUT_MS: 60000
         run: xvfb-run -a npm run electron:smoke:packaged
@@ -751,13 +650,7 @@ jobs:
   test-unit:
     name: Unit Tests (${{ matrix.shard }}/8)
     # Same dynamic-runner rule as Build (own-origin only; fallback ubuntu-latest).
-    # PINNED to hosted, deliberately not on the USE_VPS_RUNNER switch (gap 19). One variable
-    # governed the build and the test jobs, which want OPPOSITE machines: the build needs the
-    # .113's RAM, the tests need the hosted runner's link. Measured on 2026-07-29 —
-    # actions/setup-node took 20m06s on .113 with 4 concurrent runners versus 16s hosted (npm
-    # cache restore saturating the link), while the tests themselves tied, 2m54 vs 2m31. So
-    # self-hosted is strictly worse here and there is nothing to configure.
-    runs-on: ubuntu-latest
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     timeout-minutes: 25
     # needs: changes (not build) — this job never downloads the next-build artifact;
     # gating it on Build only serialized ~20min of wall-clock for nothing. Jobs that
@@ -778,7 +671,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -809,33 +702,10 @@ jobs:
           path: coverage-shard/*.json
           if-no-files-found: error
 
-  test-bun-sqlite:
-    name: Bun SQLite Compatibility
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    needs: changes
-    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.CI_NODE_VERSION }}
-          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
-      - run: npm run test:bun:db
-
   test-vitest:
     name: Vitest (MCP / autoCombo / UI components)
     # Same dynamic-runner rule as Build (own-origin only; fallback ubuntu-latest).
-    # PINNED to hosted, deliberately not on the USE_VPS_RUNNER switch (gap 19). One variable
-    # governed the build and the test jobs, which want OPPOSITE machines: the build needs the
-    # .113's RAM, the tests need the hosted runner's link. Measured on 2026-07-29 —
-    # actions/setup-node took 20m06s on .113 with 4 concurrent runners versus 16s hosted (npm
-    # cache restore saturating the link), while the tests themselves tied, 2m54 vs 2m31. So
-    # self-hosted is strictly worse here and there is nothing to configure.
-    runs-on: ubuntu-latest
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     timeout-minutes: 15
     # needs: changes (not build) — no artifact consumed; see test-unit note.
     needs: changes
@@ -848,30 +718,19 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
       - uses: ./.github/actions/npm-ci-retry
       # The second test runner (CLAUDE.md: "Both test runners must pass") — was never
       # wired into CI until the 2026-06-09 quality audit (Fase 6A.2).
-      # WS5.2/5.3 (v3.8.49 plan): JUnit output feeds Trunk Flaky Tests (advisory upload
-      # below). node:test stays OUT of the first wave (fd1-sensitive reporter stream).
-      - run: npm run test:vitest -- --reporter=default --reporter=junit --outputFile.junit=trunk-junit/vitest-mcp.xml
-      # vitest:ui went back to 870/870 green in the v3.8.49 quality plan (WS6.1,
-      # PR #7127 — 69 fails triaged: matchMedia polyfill, node:test→vitest migration,
-      # CompareTab D22 cap). Promoted to BLOCKING per the plan's post-merge step.
-      - run: npm run test:vitest:ui -- --reporter=default --reporter=junit --outputFile.junit=trunk-junit/vitest-ui.xml
-      # Trunk Flaky Tests upload — advisory (never blocks), own-origin only (fork PRs
-      # have no TRUNK_TOKEN). Pinned by SHA (tag v2.1.2).
-      - name: Upload test results to Trunk (advisory)
-        if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
+      - run: npm run test:vitest
+      # vitest:ui is RED today (14 fails — UI component drift accumulated while the
+      # suite never ran in CI). Informational until the Fase 6A triage (2026-06-16+)
+      # fixes the components/tests; then drop continue-on-error to make it blocking.
+      - run: npm run test:vitest:ui
         continue-on-error: true
-        uses: trunk-io/analytics-uploader@385f1ccdf345b4532dc4b6c665dd432b702b8e28 # v2.1.2
-        with:
-          junit-paths: trunk-junit/**/*.xml
-          org-slug: omniroute
-          token: ${{ secrets.TRUNK_TOKEN }}
 
   # Node 24/26 compatibility matrices moved to .github/workflows/nightly-compat.yml
   # (plano mestre testes+CI, Eixo D2 — they cost ~28% of every heavy run to catch a
@@ -880,12 +739,9 @@ jobs:
   test-coverage:
     name: Coverage
     runs-on: ubuntu-latest
-    # 10min was sized before #7114 added the lcov reporter (Codecov/Sonar need it);
-    # merging 8 shard JSONs + text+json+lcov now takes ~10-12min — three consecutive
-    # release-tip runs died at exactly 10m as job-timeout "cancelled" (2026-07-15/16).
-    timeout-minutes: 20
+    timeout-minutes: 10
     needs: test-unit
-    if: ${{ !cancelled() && needs.test-unit.result == 'success' && !contains(github.event.pull_request.labels.*.name, 'hotfix') }}
+    if: ${{ !cancelled() && needs.test-unit.result == 'success' }}
     env:
       JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
       API_KEY_SECRET: ci-test-api-key-secret-long
@@ -893,7 +749,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -933,7 +789,6 @@ jobs:
             --merge-async \
             --reporter=text-summary \
             --reporter=json-summary \
-            --reporter=lcov \
             --exclude=tests/** \
             --exclude=**/*.test.* \
             --check-coverage \
@@ -955,18 +810,6 @@ jobs:
               > coverage/coverage-report.md
           fi
           cat coverage/coverage-report.md >> "$GITHUB_STEP_SUMMARY"
-      # WS5.6 (D7, v3.8.49 plan): patch coverage on the PR diff via Codecov —
-      # informational during calibration (codecov.yml sets informational: true);
-      # promote to blocking only after ~2 weeks without false blocks. The lcov
-      # reporter above also fixes coverage/lcov.info being silently absent
-      # (if-no-files-found: warn) — Sonar consumes the same file.
-      - name: Upload coverage to Codecov (informational)
-        if: always()
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
-        with:
-          files: coverage/lcov.info
-          token: ${{ secrets.CODECOV_TOKEN }}
-          fail_ci_if_error: false
       - name: Upload coverage artifacts
         if: always()
         uses: actions/upload-artifact@v7
@@ -991,14 +834,10 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0
-      # The upload strips the common `coverage/` prefix, so the artifact root holds
-      # lcov.info directly — download into coverage/ so it lands at coverage/lcov.info,
-      # where sonar.javascript.lcov.reportPaths expects it (path: . left the Sonar
-      # new-code coverage at 0% every scan).
       - uses: actions/download-artifact@v8
         with:
           name: coverage-report
-          path: coverage/
+          path: .
       - name: Explain SonarQube skip
         if: ${{ github.event_name != 'pull_request' || env.SONAR_TOKEN == '' || env.SONAR_HOST_URL == '' }}
         run: |
@@ -1117,12 +956,7 @@ jobs:
     # ~33%. Playwright browser is cached across runs (~1.5min saved per shard).
     # Heavy shard target: ≤20min (was ~40min). Timeout 45min to cover slow runners.
     timeout-minutes: 45
-    needs: [build, changes]
-    # WS3.1 hotfix fast-lane: the 9-shard E2E matrix is the CI critical path (~25min).
-    # It skips for (a) PRs labeled `hotfix` (entry policy in docs/ops/RELEASE_CHECKLIST.md:
-    # production-broken only, full-suite evidence from the previous green run linked in the
-    # PR) and (b) tests-only diffs outside tests/e2e/ (cannot change the served app).
-    if: ${{ needs.changes.outputs.testsOnly != 'true' && !contains(github.event.pull_request.labels.*.name, 'hotfix') }}
+    needs: build
     strategy:
       fail-fast: false
       matrix:
@@ -1136,7 +970,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -1157,34 +991,7 @@ jobs:
       - name: Extract Next.js build artifact
         run: |
           tar -xzf /tmp/e2e-build.tar.gz
-      # WS4.1: duration-balanced shards (LPT over config/quality/e2e-timings.json).
-      # Measured skew of plain --shard was 14× (24m47s vs 1m47s) — E2E was the CI
-      # critical path. The balancer self-verifies completeness and exits non-zero on
-      # any inconsistency, falling back to plain --shard (never fewer specs).
-      - name: Run E2E tests (duration-balanced shard)
-        env:
-          SHARD: ${{ matrix.shard }}
-          PLAYWRIGHT_JUNIT_OUTPUT_NAME: junit-e2e-results.xml
-        run: |
-          if FILES=$(node scripts/quality/balance-e2e-shards.mjs "$SHARD" 9); then
-            if [ -z "$FILES" ]; then echo "[e2e-balance] shard $SHARD has no files"; exit 0; fi
-            echo "[e2e-balance] shard $SHARD runs:"; echo "$FILES"
-            # FILES is our own newline-separated path list, so word-splitting is intended
-            # shellcheck disable=SC2086,SC2046
-            npx playwright test $(echo "$FILES" | tr '\n' ' ') --reporter=line,junit
-          else
-            echo "[e2e-balance] balancer unavailable — plain --shard fallback"
-            npx playwright test tests/e2e/*.spec.ts --shard="$SHARD"/9 --reporter=line,junit
-          fi
-      # WS5.2/5.3: Trunk Flaky Tests upload — advisory, own-origin only, SHA-pinned.
-      - name: Upload test results to Trunk (advisory)
-        if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
-        continue-on-error: true
-        uses: trunk-io/analytics-uploader@385f1ccdf345b4532dc4b6c665dd432b702b8e28 # v2.1.2
-        with:
-          junit-paths: junit-e2e-results.xml
-          org-slug: omniroute
-          token: ${{ secrets.TRUNK_TOKEN }}
+      - run: npx playwright test tests/e2e/*.spec.ts --shard=${{ matrix.shard }}/9
 
   test-integration:
     name: Integration Tests (${{ matrix.shard }}/2)
@@ -1207,7 +1014,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -1230,7 +1037,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -1247,7 +1054,6 @@ jobs:
       - lint
       - docs-sync-strict
       - i18n-ui-coverage
-      - i18n-glossary-zhcn
       - i18n
       - pr-test-policy
       - build
@@ -1272,8 +1078,6 @@ jobs:
       - name: Generate dashboard
         env:
           EVENT_NAME: ${{ github.event_name }}
-          # Workflow-controlled data (job results), not user input — safe to read here.
-          NEEDS_JSON: ${{ toJSON(needs) }}
         run: |
           status() {
             case "$1" in
@@ -1288,29 +1092,6 @@ jobs:
           echo "# 🚀 CI Dashboard" >> "$GITHUB_STEP_SUMMARY"
           echo "" >> "$GITHUB_STEP_SUMMARY"
 
-          # (gap 12) A cancelled job never reported a verdict, and in a long table that reads the
-          # same as a green one. `cancel-in-progress` plus incremental fixing cancels jobs on every
-          # push, and this cycle the Vitest job was cancelled in rounds 1, 2 and 3 — it only ran to
-          # completion in round 4, where it revealed a suite that had been broken the whole cycle
-          # plus two production bugs. A gate that never finishes is indistinguishable from one that
-          # passes, so name them at the TOP instead of leaving them to be spotted mid-table.
-          CANCELLED_JOBS=$(printf '%s' "$NEEDS_JSON" \
-            | jq -r 'to_entries | map(select(.value.result == "cancelled")) | .[].key' 2>/dev/null \
-            | sort | paste -sd", " -) || CANCELLED_JOBS=""
-          if [ -n "$CANCELLED_JOBS" ]; then
-            {
-              echo "> ### ⚫ Cancelled — no verdict was reported"
-              echo ">"
-              echo "> \`$CANCELLED_JOBS\`"
-              echo ">"
-              echo "> These did not fail; they never finished, so nothing was checked. Treat this"
-              echo "> run as INCOMPLETE for those gates. If the cancellation came from"
-              echo "> \`cancel-in-progress\` on a newer push, the newer run covers it — otherwise"
-              echo "> re-run them before reading this dashboard as green."
-              echo ""
-            } >> "$GITHUB_STEP_SUMMARY"
-          fi
-
           echo "## 🧱 Core Checks" >> "$GITHUB_STEP_SUMMARY"
           echo "| Job | Status |" >> "$GITHUB_STEP_SUMMARY"
           echo "|-----|--------|" >> "$GITHUB_STEP_SUMMARY"
@@ -1318,7 +1099,6 @@ jobs:
           echo "| Lint | $(status '${{ needs.lint.result }}') |" >> "$GITHUB_STEP_SUMMARY"
           echo "| Docs Sync (Strict) | $(status '${{ needs.docs-sync-strict.result }}') |" >> "$GITHUB_STEP_SUMMARY"
           echo "| i18n UI Coverage | $(status '${{ needs.i18n-ui-coverage.result }}') |" >> "$GITHUB_STEP_SUMMARY"
-          echo "| i18n Glossary (zh-CN) | $(status '${{ needs.i18n-glossary-zhcn.result }}') |" >> "$GITHUB_STEP_SUMMARY"
           echo "| PR Test Policy | $(status '${{ needs.pr-test-policy.result }}') |" >> "$GITHUB_STEP_SUMMARY"
           echo "| SonarQube | $(status '${{ needs.sonarqube.result }}') |" >> "$GITHUB_STEP_SUMMARY"
 

.github/workflows/codeql.yml

@@ -19,13 +19,13 @@ jobs:
       actions: read
       contents: read
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           languages: javascript-typescript
           queries: security-extended
-      - uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           category: "/language:javascript-typescript"

.github/workflows/dast-smoke.yml

@@ -2,45 +2,28 @@ name: DAST smoke (PR)
 on:
   pull_request:
     branches: ["main", "release/**"]
-    # Runner-cost guard (#8084): the CLI-bundle build alone is 6-11min; a docs-only PR
-    # cannot change DAST behavior, so skip the whole workflow for pure docs/markdown
-    # changes. Any code path in the diff still runs the full smoke.
-    paths-ignore:
-      - "docs/**"
-      - "**/*.md"
 permissions:
   contents: read
-
-# Superseded runs on the same PR must not stack 25-minute advisory builds
-# (force-push storms were holding 2-3 runners each). Same group rule as quality.yml.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
 jobs:
   dast-smoke:
     runs-on: ubuntu-latest
     # ADVISORY while this new gate matures (repo convention: advisory -> blocking).
     # Flip to blocking (remove continue-on-error) once it's proven stable across a few PRs.
     continue-on-error: true
-    # Build CLI bundle alone varies 6-11min on GitHub-hosted runners (3 consecutive
-    # timeouts observed on 2026-07-14 with the old 12min cap killing schemathesis
-    # mid-run) — 25min leaves real headroom for the actual DAST steps.
-    timeout-minutes: 25
+    timeout-minutes: 12
     env:
       JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
       API_KEY_SECRET: ci-api-key-secret-with-sufficient-length-aaaa
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "24"
           cache: npm
       - run: npm ci
       - name: Build CLI bundle
-        env:
-          OMNIROUTE_BUILD_BACKEND_ONLY: "1"
         run: npm run build:cli
       - name: Start OmniRoute
         env:
@@ -53,20 +36,14 @@ jobs:
             if curl -sf http://localhost:20128/api/monitoring/health >/dev/null; then echo up; break; fi
             sleep 2
           done
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.12"
       - run: pip install schemathesis
       - name: Schemathesis smoke (high-risk endpoints, blocking)
         run: |
-          # /api/auth/oidc/* is a BROWSER redirect flow (302 to the IdP, 302 back to
-          # /login?oidc_error=... on every failure), not a REST endpoint: Schemathesis reads
-          # those 302s as "the API accepted a schema-violating request" and the configured-off
-          # 400 as "rejected a schema-compliant request". Documenting the flow in the spec is
-          # still right (operators need it); fuzzing it is not what this smoke is for.
           schemathesis run docs/openapi.yaml --url http://localhost:20128 \
             --include-path-regex '^/v1/(chat/completions|models)$|^/api/(auth|keys)' \
-            --exclude-path-regex '^/api/auth/oidc/' \
             --max-examples 8 --workers 4 --checks all --max-response-time 30 \
             --request-timeout 20 --suppress-health-check all --no-color
       - name: promptfoo injection-guard (blocking)

.github/workflows/docker-publish.yml

@@ -155,13 +155,13 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v4.5.2
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4.5.2
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -255,13 +255,13 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v4.5.2
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4.5.2
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -390,7 +390,7 @@ jobs:
       - name: Upload Trivy SARIF to Security tab
         if: needs.prepare.outputs.version != 'main'
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@v4.37.3
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: trivy-results.sarif
           category: trivy-image

.github/workflows/electron-release.yml

@@ -88,7 +88,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v6
         with:
           node-version: 24
           cache: npm
@@ -120,18 +120,6 @@ jobs:
         env:
           JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
           NODE_OPTIONS: "--max_old_space_size=6144"
-          # Linux builds with webpack, not Turbopack. Turbopack's production build
-          # allocates natively (Rust, off the V8 heap), so --max_old_space_size does
-          # not bound it, and on this module graph it peaks above what the hosted
-          # runner can give — the VM is reclaimed mid-compile with "The runner has
-          # received a shutdown signal", no exit code. That is what silently took the
-          # whole desktop channel out of v3.8.49: the linux leg died, `release` was
-          # skipped, and the release shipped with ZERO assets. Measured on a 32 GB
-          # box the same build passes and peaks past 14 GB. The webpack fallback is
-          # the project's documented escape hatch for RAM-constrained machines
-          # (docs/reference/ENVIRONMENT.md, #6409) and is the same remedy already
-          # applied to nightly-compat's Node 26 build (#8090).
-          OMNIROUTE_USE_TURBOPACK: ${{ matrix.platform == 'linux' && '0' || '1' }}
         run: npm run build
 
       - name: Sync version in electron/package.json
@@ -229,16 +217,6 @@ jobs:
   release:
     name: Create Release
     needs: [validate, build]
-    # Fail-partial, not fail-closed. `build` is a 4-leg matrix with `fail-fast: false`,
-    # so the legs that succeed still upload their artifacts — but a default `needs:`
-    # gate skips this job the moment ANY leg fails, discarding all of them. That is
-    # exactly what happened to v3.8.49: the linux leg died and the release shipped with
-    # ZERO assets, throwing away 1.7 GB of good Windows/macOS installers **and** the
-    # source archives + SBOM, which do not depend on a build at all. The result was
-    # indistinguishable from "this version has no desktop channel".
-    # Now: attach everything that did build, then fail the job loudly (see the last
-    # step) so an incomplete channel is visible instead of silent.
-    if: ${{ !cancelled() && needs.validate.result == 'success' }}
     runs-on: ubuntu-latest
     permissions:
       contents: write # softprops/action-gh-release creates the GitHub Release
@@ -249,33 +227,11 @@ jobs:
           persist-credentials: false
           fetch-depth: 0
 
-      # `merge-multiple` is deliberately OFF. It resolves same-name collisions by ARRIVAL
-      # ORDER, and the two macOS jobs each emit their own `latest-mac.yml` listing only their
-      # own dmg (measured: 338 and 350 bytes, different content, identical name). One silently
-      # overwrote the other — arm64 won in the published v3.8.48, and since the Intel dmg
-      # carries no arch suffix in its name, electron-updater's
-      # `files.find(url includes process.arch) ?? files.shift()` sends every Intel Mac to the
-      # ARM dmg. Downloading into per-artifact subdirectories keeps both, so they can be
-      # merged on purpose instead of by luck.
       - name: Download all artifacts
         uses: actions/download-artifact@v8
         with:
-          path: artifacts
-
-      # Writes release-assets/latest-mac.yml with BOTH dmgs, un-suffixed entry first (that is
-      # the one electron-updater can only reach through its fallback). Refuses to write when the
-      # inputs disagree on version — a manifest stitched from two builds is worse than none.
-      - name: Merge the per-arch macOS updater manifests
-        run: node scripts/release/merge-mac-update-manifest.mjs artifacts release-assets
-
-      # Everything else moves across as-is. The partial latest-mac.yml files are excluded so
-      # they cannot clobber the merged one; -n is a second belt on the same braces.
-      - name: Collect the remaining artifacts
-        run: |
-          mkdir -p release-assets
-          find artifacts -type f ! -name latest-mac.yml -exec cp -n {} release-assets/ \;
-          echo "release-assets:"
-          ls -la release-assets/
+          path: release-assets
+          merge-multiple: true
 
       - name: Create source archives
         env:
@@ -319,47 +275,6 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-  verify-desktop-assets:
-    name: Verify desktop assets landed
-    needs: [validate, release]
-    # Deliberately a SEPARATE job, not a final step of `release`: failing inside
-    # `release` would cascade into `publish-npm` (which gates on `needs: release`) and
-    # block the npm channel over a desktop-only gap. Here the assets are attached, npm
-    # still publishes, and an incomplete desktop channel shows up as a red job instead
-    # of passing unnoticed — the v3.8.49 release had ZERO assets and every gate was
-    # green, because nothing ever asserted the release HAS binaries.
-    if: ${{ !cancelled() && needs.release.result == 'success' }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - name: Assert every platform is present on the release
-        env:
-          # Regex-validated (^v[0-9]+\.[0-9]+\.[0-9]+$) in the `validate` job, and
-          # passed via env rather than interpolated into the script body.
-          VERSION: ${{ needs.validate.outputs.version }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          names=$(gh release view "$VERSION" --repo "$GITHUB_REPOSITORY" \
-                    --json assets --jq '.assets[].name')
-          echo "Assets on $VERSION:"
-          echo "$names" | sed 's/^/  /'
-
-          missing=""
-          # `[ ... ] && missing=...` as the last command in a branch returns 1 and
-          # would abort the whole script under Actions' default `set -e`. Use if/fi.
-          for want in '\.exe$' '\.dmg$' '\.AppImage$' '\.deb$' '^latest.*\.yml$' '\.source\.tar\.gz$'; do
-            if ! echo "$names" | grep -qE "$want"; then
-              missing="$missing $want"
-            fi
-          done
-
-          if [ -n "$missing" ]; then
-            echo "::error::Desktop channel incomplete on $VERSION — no asset matching:$missing"
-            exit 1
-          fi
-          echo "✓ every platform present on $VERSION"
-
   publish-npm:
     name: Publish to npm
     needs: [validate, release]

.github/workflows/mutation-redundancy.yml

@@ -44,7 +44,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm

.github/workflows/nightly-compat.yml

@@ -66,25 +66,12 @@ jobs:
         with:
           ref: ${{ needs.resolve-branch.outputs.target }}
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "26"
           cache: npm
       - uses: ./.github/actions/npm-ci-retry
-      # #8090 — this is the ONLY Node 26 build in the whole CI matrix (ci.yml pins
-      # CI_NODE_VERSION=24). It failed every nightly with the runner-reclaimed
-      # signature ("The runner has received a shutdown signal" / "The operation was
-      # canceled", no exit code) always at the same Turbopack compile phase — a
-      # classic OOM kill on the memory-constrained ubuntu-latest runner. Turbopack's
-      # native (Rust, off-V8-heap) allocation is NOT bounded by --max-old-space-size
-      # and peaks far higher than webpack on this large module graph (#6409), and is
-      # heavier still under Node 26. Use the documented webpack fallback here: it still
-      # validates that the app *builds* on Node 26 (the point of this compat job) at a
-      # much lower memory peak. Turbopack-on-Node-24 stays covered by ci.yml's build
-      # job. See docs/reference/ENVIRONMENT.md (OMNIROUTE_USE_TURBOPACK) and #6409.
       - run: npm run build
-        env:
-          OMNIROUTE_USE_TURBOPACK: "0"
 
   compat-tests:
     name: Node ${{ matrix.node }} Compat Tests (${{ matrix.shard }}/4)
@@ -106,7 +93,7 @@ jobs:
         with:
           ref: ${{ needs.resolve-branch.outputs.target }}
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
           cache: npm

.github/workflows/nightly-llm-security.yml

@@ -15,13 +15,11 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with: { node-version: "24", cache: npm }
       - run: npm ci
       - name: Build CLI bundle
-        env:
-          JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
-          OMNIROUTE_BUILD_BACKEND_ONLY: "1"
+        env: { JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation }
         run: npm run build:cli
       - name: Start OmniRoute (block mode)
         env:
@@ -67,16 +65,14 @@ jobs:
         with:
           persist-credentials: false
         if: steps.gate.outputs.run == 'true'
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         if: steps.gate.outputs.run == 'true'
         with: { node-version: "24", cache: npm }
       - run: npm ci
         if: steps.gate.outputs.run == 'true'
       - name: Build CLI bundle
         if: steps.gate.outputs.run == 'true'
-        env:
-          JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
-          OMNIROUTE_BUILD_BACKEND_ONLY: "1"
+        env: { JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation }
         run: npm run build:cli
       - name: Start OmniRoute
         if: steps.gate.outputs.run == 'true'
@@ -90,7 +86,7 @@ jobs:
             if curl -sf http://localhost:20128/api/monitoring/health >/dev/null; then echo up; break; fi
             sleep 2
           done
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@v6
         if: steps.gate.outputs.run == 'true'
         with: { python-version: "3.12" }
       - run: pip install garak

.github/workflows/nightly-mutation.yml

@@ -107,7 +107,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm
@@ -148,10 +148,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
       - name: Download all mutation reports

.github/workflows/nightly-property.yml

@@ -13,7 +13,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm

.github/workflows/nightly-release-green.yml

@@ -1,18 +1,11 @@
-name: Release-Green (continuous)
+name: Nightly Release-Green
 
 # Solution D — continuous, NON-BLOCKING drift signal for the active release branch.
 #
 # WHY: the full gate (ci.yml) only runs on the release PR (PR → main), so reds
 # accrue silently on release/** and explode — in layers — at release time. This
-# workflow reproduces the release-equivalent validation on the release branch and,
-# when there are HARD failures, opens/updates a single tracking issue.
-#
-# WS5.1 (v3.8.49 quality plan) — two modes:
-#   push to release/v* (code paths) → --quick (fast HARD gates, ~5-8min). Catches the
-#     captain's direct pushes (sync-back — the one ungated write path) AND the merged
-#     COMBINATION right after every PR merge, attributing the offending push range in
-#     the issue. Base-red MTTD drops from ≤24h to ≤~15min after the offending push.
-#   schedule (3×/day) → full --with-build --full-ci (the deep sweep incl. build+suites).
+# nightly reproduces the release-equivalent validation on the active release branch
+# HEAD and, when there are HARD failures, opens/updates a single tracking issue.
 #
 # It is NOT a required status check and never touches a contributor PR — it only
 # reports. Ratchet drift (eslint warnings / cognitive-complexity / file-size) is
@@ -21,23 +14,8 @@ name: Release-Green (continuous)
 # package-artifact) flip the issue open.
 
 on:
-  push:
-    branches: ["release/v*", "main"]
-    paths:
-      - "src/**"
-      - "open-sse/**"
-      - "bin/**"
-      - "electron/**"
-      - "scripts/**"
-      - "tests/**"
-      - "config/**"
-      - "package.json"
-      - "package-lock.json"
-      - "tsconfig*.json"
   schedule:
-    - cron: "23 5 * * *" # full sweep — off-peak, distinct from other nightlies
-    - cron: "23 12 * * *" # full sweep — midday (WS5.1: 3×/day instead of 1×)
-    - cron: "23 18 * * *" # full sweep — evening
+    - cron: "23 5 * * *" # 05:23 UTC daily — off-peak, distinct from other nightlies
   workflow_dispatch:
     inputs:
       branch:
@@ -50,9 +28,7 @@ permissions:
   issues: write
 
 concurrency:
-  # push storms during merge campaigns collapse to the newest commit per branch;
-  # scheduled full sweeps keep their own single lane.
-  group: release-green-${{ github.event_name }}-${{ github.ref }}
+  group: nightly-release-green
   cancel-in-progress: true
 
 env:
@@ -61,9 +37,6 @@ env:
 jobs:
   release-green:
     name: Validate active release branch
-    # On a push, only run for release/* pushes — a push to main is handled by the
-    # main-green job below. Schedule/dispatch always run (they validate the highest release).
-    if: ${{ github.event_name != 'push' || startsWith(github.ref_name, 'release/') }}
     # Dynamic runner: with USE_VPS_RUNNER=true (release window / on-demand pre-flight)
     # this runs on the dedicated VPS runner — clean env (no operator OMNIROUTE_API_KEY,
     # no local noauth CLIs => zero machine-specific false positives) and no contention.
@@ -83,15 +56,10 @@ jobs:
         id: branch
         env:
           INPUT_BRANCH: ${{ github.event.inputs.branch }}
-          EVENT_NAME: ${{ github.event_name }}
-          PUSHED_REF: ${{ github.ref_name }}
         run: |
           set -euo pipefail
           if [ -n "${INPUT_BRANCH:-}" ]; then
             TARGET="$INPUT_BRANCH"
-          elif [ "$EVENT_NAME" = "push" ]; then
-            # validate exactly what was pushed, not the highest branch
-            TARGET="$PUSHED_REF"
           else
             # highest release/vX.Y.Z by semver among remote branches
             TARGET=$(git for-each-ref --format='%(refname:short)' 'refs/remotes/origin/release/v*' \
@@ -116,7 +84,7 @@ jobs:
           git checkout "$TARGET"
           git log -1 --oneline
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm
@@ -125,27 +93,16 @@ jobs:
 
       - name: Release-green validation (full)
         id: validate
-        env:
-          EVENT_NAME: ${{ github.event_name }}
         run: |
           set +e
           # --hermetic: scrub live-test trigger vars (self-hosted runner may carry
           # operator env; hosted ignores the unknown flag before #6300 lands).
-          # push → --quick: fast HARD gates only (~5-8min), per-merge signal.
-          # schedule/dispatch → --with-build --full-ci: ALSO run every static gate from
-          # ci.yml's gate jobs (lint, quality-gate, quality-extended, docs-sync-strict,
-          # pr-test-policy) + build + full suites. PRs into release/** only get the
-          # fast-gates, so these accrue silently and explode in layers on the release PR
-          # (v3.8.46: 11 static base-reds leaked).
-          if [ "$EVENT_NAME" = "push" ]; then
-            MODE="--quick"
-          else
-            MODE="--with-build --full-ci"
-          fi
-          echo "[release-green] mode: $MODE (event: $EVENT_NAME)"
-          # MODE is an intentional flag list, so word-splitting is wanted here
-          # shellcheck disable=SC2086
-          node scripts/quality/validate-release-green.mjs --json --hermetic $MODE \
+          # --full-ci: ALSO run every static gate from ci.yml's gate jobs (lint,
+          # quality-gate, quality-extended, docs-sync-strict, pr-test-policy). PRs into
+          # release/** only get the fast-gates, so these accrue silently and explode in
+          # layers on the release PR (v3.8.46: 11 static base-reds leaked). Running them
+          # nightly opens the tracking issue the moment one lands, not at release time.
+          node scripts/quality/validate-release-green.mjs --json --with-build --hermetic --full-ci \
             1> release-green.json 2> release-green.log
           echo "exit=$?" >> "$GITHUB_OUTPUT"
           echo "------- report -------"
@@ -157,28 +114,15 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           TARGET: ${{ steps.branch.outputs.target }}
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          EVENT_NAME: ${{ github.event_name }}
-          BEFORE_SHA: ${{ github.event.before }}
-          AFTER_SHA: ${{ github.event.after }}
         run: |
           set -euo pipefail
           TITLE="🔴 Release branch not green: ${TARGET}"
           {
-            echo "The **release-green** validation found HARD failures on \`${TARGET}\`."
+            echo "The nightly **release-green** validation found HARD failures on \`${TARGET}\`."
             echo "These are real defects that would block the release PR — fix them in the"
             echo "originating PR branch (via co-authorship), not by demanding it from contributors."
             echo ""
-            echo "**Run:** ${RUN_URL} (mode: ${EVENT_NAME})"
-            # WS5.1 attribution: on push events the offending change IS this push's range
-            # (one merge per push in the normal queue), so name it — no bisect needed.
-            if [ "$EVENT_NAME" = "push" ] && [ -n "${BEFORE_SHA:-}" ] && \
-               git cat-file -e "$BEFORE_SHA" 2>/dev/null; then
-              echo ""
-              echo "**Offending push range** (\`${BEFORE_SHA:0:9}..${AFTER_SHA:0:9}\`):"
-              echo '```'
-              git log --no-decorate --oneline "${BEFORE_SHA}..${AFTER_SHA}" | head -20
-              echo '```'
-            fi
+            echo "**Run:** ${RUN_URL}"
             echo ""
             echo '```'
             sed -n '/──────── verdict ────────/,$p' release-green.log || tail -40 release-green.log
@@ -205,243 +149,3 @@ jobs:
             release-green.json
             release-green.log
           if-no-files-found: ignore
-
-  # Companion arm for `main`. Under the parallel-cycle model, main only receives merged
-  # work at the release squash — so a gate/infra fix that lands only on release leaves
-  # main red the whole cycle, and repo-wide gates (CodeQL alert count, ratchet baselines)
-  # turn EVERY PR into main red on a check unrelated to its diff. This detects that and
-  # opens a "🔴 main not green" tracking issue. The PREVENTION is the companion-PR reflex
-  # (Hard Rule #21 area / _shared/merge-gates.md §8); this is the automated backstop.
-  main-green:
-    name: Validate main branch
-    # On a push, only run for a push to main — a push to release/* is handled by
-    # release-green above. Schedule/dispatch always run (they also sweep main).
-    if: ${{ github.event_name != 'push' || github.ref_name == 'main' }}
-    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && fromJSON('["self-hosted","omni-release"]')) || 'ubuntu-latest' }}
-    env:
-      JWT_SECRET: ci-nightly-secret-with-sufficient-length-for-validation
-      API_KEY_SECRET: ci-nightly-api-key-secret-long
-      DISABLE_SQLITE_AUTO_BACKUP: "true"
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: main # literal — no injection surface; scheduled runs default to the repo default branch (a release/v*), so pin main explicitly
-          fetch-depth: 0
-          persist-credentials: false
-
-      - uses: actions/setup-node@v7
-        with:
-          node-version: "24"
-          cache: npm
-
-      - uses: ./.github/actions/npm-ci-retry
-
-      - name: Main-green validation
-        id: validate
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-        run: |
-          set +e
-          # push (a merge into main) → --quick fast HARD gates; schedule/dispatch → full sweep.
-          if [ "$EVENT_NAME" = "push" ]; then
-            MODE="--quick"
-          else
-            MODE="--with-build --full-ci"
-          fi
-          echo "[main-green] mode: $MODE (event: $EVENT_NAME)"
-          # MODE is an intentional flag list, so word-splitting is wanted here
-          # shellcheck disable=SC2086
-          node scripts/quality/validate-release-green.mjs --json --hermetic $MODE \
-            1> main-green.json 2> main-green.log
-          echo "exit=$?" >> "$GITHUB_OUTPUT"
-          echo "------- report -------"
-          cat main-green.log
-
-      - name: Open / update tracking issue on HARD failure
-        if: steps.validate.outputs.exit != '0'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          EVENT_NAME: ${{ github.event_name }}
-        run: |
-          set -euo pipefail
-          TITLE="🔴 main branch not green"
-          {
-            echo "The **main-green** validation found HARD failures on \`main\`."
-            echo ""
-            echo "Because \`main\` only receives merged work at the release squash, a gate/infra"
-            echo "fix that landed only on the release branch leaves \`main\` broken for the whole"
-            echo "cycle — and repo-wide gates (CodeQL alert count, ratchet baselines) then turn"
-            echo "**every open PR into main** red on a check unrelated to its diff. The fix is a"
-            echo "companion PR \`--base main\` carrying the release-side fix (see"
-            echo "\`_shared/merge-gates.md\` §8), NOT chasing each contributor PR."
-            echo ""
-            echo "**Run:** ${RUN_URL} (mode: ${EVENT_NAME})"
-            echo ""
-            echo '```'
-            sed -n '/──────── verdict ────────/,$p' main-green.log || tail -40 main-green.log
-            echo '```'
-            echo ""
-            echo "_Ratchet drift (eslint warnings / cognitive-complexity / file-size) is expected mid-cycle and did NOT, on its own, open this issue._"
-          } > issue-body.md
-
-          EXISTING=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open \
-            --search "in:title $TITLE" --json number --jq '.[0].number' 2>/dev/null || echo "")
-          if [ -n "$EXISTING" ]; then
-            gh issue comment "$EXISTING" --repo "$GITHUB_REPOSITORY" --body-file issue-body.md
-            echo "Updated existing issue #$EXISTING"
-          else
-            gh issue create --repo "$GITHUB_REPOSITORY" --title "$TITLE" --body-file issue-body.md
-          fi
-
-      - name: Upload report artifact
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: main-green-report
-          path: |
-            main-green.json
-            main-green.log
-          if-no-files-found: ignore
-
-  # ── Banking lane (#8584) ──────────────────────────────────────────────────
-  # The ratchet is asymmetric: RAISING a cap is a ten-second manual JSON edit made
-  # under merge pressure, LOWERING one requires someone to run `--update` and commit
-  # — which no workflow does. Grep `.github/workflows/` for `--update`: only
-  # wiki-sync.yml (unrelated) and ci.yml's check-quality-ratchet.mjs --require-tighten
-  # (a different script, a different metric). So a cap outlives the code that earned
-  # it and every completed decomposition silently becomes a growth allowance for
-  # whoever touches the file next. Measured on 2026-07-25: 18 frozen files already at
-  # or under the 800-line new-file cap, up to 132x (schemas.ts, 19 lines / 2523 cap),
-  # and 31 unfulfilled "tighten via --update next cycle" notes honoured exactly once
-  # (-1 unit) in six weeks.
-  #
-  # This job closes that loop by making the DOWNWARD direction as automatic as the
-  # upward one is easy. It measures the active release branch, runs the shrink-only
-  # `--update` paths, and opens ONE always-current PR with the result. It never
-  # pushes to release/* — a human still merges, so a bad measurement cannot land
-  # unreviewed. verify-ratchet-bank.mjs is the hard guarantee that the automation can
-  # only ever write in the shrink direction; if anything was raised, added, or a
-  # rebaseline note was touched, the job aborts and opens nothing.
-  #
-  # Schedule/dispatch only, deliberately NOT on push: banking has no latency
-  # requirement (a shrink banked within 8h is fine) and a per-merge run would rebuild
-  # the PR branch repeatedly during merge campaigns while paying for a full ESLint
-  # walk each time. Detection stays on push (release-green above); banking is batched.
-  bank-ratchet-shrinks:
-    name: Bank ratchet shrinks
-    if: ${{ github.event_name != 'push' }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
-      - name: Resolve active release branch
-        id: branch
-        env:
-          INPUT_BRANCH: ${{ github.event.inputs.branch }}
-        run: |
-          set -euo pipefail
-          if [ -n "${INPUT_BRANCH:-}" ]; then
-            TARGET="$INPUT_BRANCH"
-          else
-            TARGET=$(git for-each-ref --format='%(refname:short)' 'refs/remotes/origin/release/v*' \
-              | sed 's#origin/##' \
-              | sort -t/ -k2 -V \
-              | tail -1)
-          fi
-          if [ -z "$TARGET" ]; then echo "No release/v* branch found"; exit 1; fi
-          # Same strict guard as the validation job — blocks ref/command injection
-          # through the workflow_dispatch input.
-          if ! printf '%s' "$TARGET" | grep -qE '^release/v[0-9]+\.[0-9]+\.[0-9]+$'; then
-            echo "Refusing non-canonical branch name: $TARGET"; exit 1
-          fi
-          echo "target=$TARGET" >> "$GITHUB_OUTPUT"
-          echo "bank_branch=chore/bank-ratchet-${TARGET#release/}" >> "$GITHUB_OUTPUT"
-
-      - name: Checkout the release branch
-        env:
-          TARGET: ${{ steps.branch.outputs.target }}
-        run: |
-          set -euo pipefail
-          git checkout "$TARGET"
-          git log -1 --oneline
-
-      - uses: actions/setup-node@v7
-        with:
-          node-version: "24"
-          cache: npm
-
-      - uses: ./.github/actions/npm-ci-retry
-
-      - name: Ratchet the baselines down
-        run: |
-          # Both --update paths are shrink-only by construction (file-size writes only
-          # on `improvements`, complexity-ratchets only when `.improved`), and both exit
-          # non-zero while the branch is over baseline — which is exactly when there is
-          # nothing to bank. Their exit code is not the signal; the verifier below is.
-          set +e
-          node scripts/check/check-file-size.mjs --update
-          node scripts/check/check-complexity-ratchets.mjs --update
-          exit 0
-
-      - name: Verify the write only went downward
-        id: verify
-        run: |
-          set -euo pipefail
-          # Exits 1 if ANYTHING was raised/added or a rebaseline note was touched.
-          # `set -e` then aborts the job before a commit exists — no PR is opened.
-          node scripts/quality/verify-ratchet-bank.mjs > bank-summary.md
-          if [ -n "$(git status --porcelain config/quality/)" ]; then
-            echo "changed=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "changed=false" >> "$GITHUB_OUTPUT"
-            echo "Nothing to bank — baselines already match the code."
-          fi
-
-      - name: Open / update the banking PR
-        if: steps.verify.outputs.changed == 'true'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          TARGET: ${{ steps.branch.outputs.target }}
-          BANK_BRANCH: ${{ steps.branch.outputs.bank_branch }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: |
-          set -euo pipefail
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git checkout -B "$BANK_BRANCH"
-          git add config/quality/
-          git commit -m "chore(quality): bank ratchet shrinks measured on ${TARGET}"
-          git push --force origin "$BANK_BRANCH"
-
-          {
-            echo "Automated banking of quality-ratchet **shrinks** already present in"
-            echo "\`${TARGET}\` — the downward half of the ratchet, which nothing else runs (#8584)."
-            echo ""
-            echo "Produced by \`check:file-size --update\` + \`check:complexity-ratchets --update\`,"
-            echo "then verified by \`scripts/quality/verify-ratchet-bank.mjs\`: **nothing was raised,"
-            echo "nothing was added, no rebaseline note was touched** — the job aborts without"
-            echo "opening a PR if any of those is violated."
-            echo ""
-            echo "No product code changes. Merging retires growth allowances that the code no"
-            echo "longer needs; not merging leaves them available to whoever edits those files next."
-            echo ""
-            cat bank-summary.md
-            echo ""
-            echo "**Run:** ${RUN_URL}"
-          } > pr-body.md
-
-          EXISTING=$(gh pr list --repo "$GITHUB_REPOSITORY" --head "$BANK_BRANCH" \
-            --state open --json number --jq '.[0].number' 2>/dev/null || echo "")
-          if [ -n "$EXISTING" ]; then
-            gh pr edit "$EXISTING" --repo "$GITHUB_REPOSITORY" --body-file pr-body.md
-            echo "Updated existing PR #$EXISTING"
-          else
-            gh pr create --repo "$GITHUB_REPOSITORY" --base "$TARGET" --head "$BANK_BRANCH" \
-              --title "chore(quality): bank ratchet shrinks (${TARGET})" --body-file pr-body.md
-          fi

.github/workflows/nightly-resilience.yml

@@ -15,7 +15,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm
@@ -29,7 +29,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm
@@ -43,7 +43,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm
@@ -51,7 +51,6 @@ jobs:
       - name: Build CLI bundle
         env:
           JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
-          OMNIROUTE_BUILD_BACKEND_ONLY: "1"
         run: npm run build:cli
       - name: Start OmniRoute (background)
         env:
@@ -95,7 +94,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm

.github/workflows/nightly-schemathesis.yml

@@ -16,13 +16,11 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with: { node-version: "24", cache: npm }
       - run: npm ci
       - name: Build CLI bundle
-        env:
-          JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
-          OMNIROUTE_BUILD_BACKEND_ONLY: "1"
+        env: { JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation }
         run: npm run build:cli
       - name: Start OmniRoute (background)
         env:
@@ -35,7 +33,7 @@ jobs:
             if curl -sf http://localhost:20128/api/monitoring/health >/dev/null; then echo "server up"; break; fi
             sleep 2
           done
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@v6
         with: { python-version: "3.12" }
       - name: Install schemathesis
         run: pip install schemathesis

.github/workflows/npm-publish.yml

@@ -22,14 +22,6 @@ on:
           - latest
           - next
           - historic
-      publish_mode:
-        description: "staged = npm stage publish (owner approves with 2FA after the staged boot-verify); direct = legacy immediate publish (emergency fallback only)"
-        required: false
-        default: "staged"
-        type: choice
-        options:
-          - staged
-          - direct
   workflow_call:
     inputs:
       version:
@@ -56,15 +48,8 @@ env:
 
 jobs:
   publish:
-    # Same dynamic-runner rule as ci.yml's `build`/`test-unit`: `build:cli` falls back to a
-    # full `next build`, whose working set outgrew the 16 GB hosted runner during the
-    # v3.8.49 cycle — the publish died with "The runner has received a shutdown signal"
-    # mid-"Creating an optimized production build" while v3.8.48 had still fit in 16min.
-    # This job never runs on `pull_request`, so the fork-safety clause is always true here;
-    # it is kept verbatim so the expression stays greppable against ci.yml.
-    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     permissions:
-      actions: read # find + download the CI run's next-build artifact for this SHA
       contents: write # gh release upload (attach SBOM to the GitHub Release)
       id-token: write # npm provenance
       packages: write # publish to npm.pkg.github.com
@@ -78,7 +63,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ env.NPM_PUBLISH_NODE_VERSION }}
           registry-url: https://registry.npmjs.org
@@ -152,74 +137,6 @@ jobs:
         run: |
           npm version "$VERSION" --no-git-tag-version --allow-same-version
 
-      # Fast path: CI already built the standalone tree for THIS commit and uploaded it as
-      # `next-build`. `build:cli` (scripts/build/prepublish.ts) only shells out to a full
-      # `next build` when `.build/next/standalone/server.js` is missing — restoring the
-      # artifact turns the heaviest step of the publish into a download. Matching on
-      # `head_sha` is the tree-equality guarantee: same commit, same tree.
-      # Best-effort by design (retention is 1 day): every miss falls through to the build
-      # step below, which is why the dynamic runner above matters as the backstop.
-      #
-      # The `head_repository.full_name == env.REPO` clause is a supply-chain guard, not a
-      # filter refinement. This artifact becomes the published npm tarball. `pull_request`
-      # runs from forks execute in THIS repository's context and upload their own
-      # `next-build` built from fork-controlled source, and the runs API returns them for a
-      # matching `head_sha` — 57 such runs exist in this repo today. Without the clause,
-      # anything that made a fork's head commit coincide with the publish commit could put
-      # attacker-built bytes on npm. Requiring the run to originate from this repository
-      # excludes every fork run while keeping the fast path intact (verified: the same
-      # single run is selected either way for the current tip).
-      # CodeQL: actions/artifact-poisoning/critical.
-      - name: Reuse CI's next-build artifact (skips the heavy rebuild)
-        if: steps.resolve.outputs.skip != 'true'
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          HEAD_SHA: ${{ github.sha }}
-          REPO: ${{ github.repository }}
-        run: |
-          set -uo pipefail
-          # The question is "which run HAS the artifact", not "which run passed" (gap 16).
-          # Requiring `conclusion == "success"` on the whole run discarded a perfectly good tree
-          # whenever any unrelated shard went red — one flaky test then pushed the publish into
-          # the 40-minute build this step exists to avoid. The artifact is only uploaded if the
-          # Build job itself succeeded, so its PRESENCE is the accurate signal; the run's overall
-          # conclusion is noise from jobs that have nothing to do with the tree.
-          #
-          # `head_repository.full_name == env.REPO` stays, and it is not a filter refinement:
-          # this tree becomes the published npm tarball, and fork `pull_request` runs execute in
-          # THIS repository's context uploading their own next-build. That clause is the
-          # supply-chain guard (CodeQL actions/artifact-poisoning).
-          CANDIDATES=$(gh api "repos/$REPO/actions/runs?head_sha=$HEAD_SHA&per_page=100" \
-            --jq '[.workflow_runs[]
-                   | select(.name == "CI"
-                            and .head_repository.full_name == env.REPO)]
-                  | sort_by(.run_started_at) | reverse | .[0:5] | .[].id') || CANDIDATES=""
-          if [ -z "$CANDIDATES" ]; then
-            echo "::notice::no CI run from this repository for $HEAD_SHA — falling back to a full build"
-            exit 0
-          fi
-          RUN=""
-          for candidate in $CANDIDATES; do
-            if gh run download "$candidate" --repo "$REPO" --name next-build --dir /tmp/next-build 2>/dev/null; then
-              RUN="$candidate"
-              break
-            fi
-            echo "  run $candidate carries no usable next-build — trying the next"
-          done
-          if [ -z "$RUN" ]; then
-            echo "::notice::none of the candidate runs still carries next-build (1-day retention) — falling back to a full build"
-            exit 0
-          fi
-          tar -xzf /tmp/next-build/e2e-build.tar.gz -C .
-          rm -rf /tmp/next-build
-          if [ -f .build/next/standalone/server.js ]; then
-            echo "✅ standalone tree restored from CI run $RUN — build:cli will skip next build"
-          else
-            echo "::notice::extract did not yield .build/next/standalone — falling back to a full build"
-            rm -rf .build
-          fi
-
       - name: Build CLI bundle (standalone app)
         if: steps.resolve.outputs.skip != 'true'
         env:
@@ -249,46 +166,8 @@ jobs:
           TAG: ${{ github.ref_name }}
         run: gh release upload "$TAG" sbom-npm.cdx.json --clobber
 
-      # WS1.2/WS1.3 (#7065 class): the artifact that is about to be published must
-      # BOOT. build:cli already assembled dist/ above; this packs+installs+boots the
-      # real tarball and fails the publish before anything reaches the registry.
-      - name: Boot-smoke the tarball before ANY publish
+      - name: Publish to npm
         if: steps.resolve.outputs.skip != 'true'
-        run: npm run check:pack-boot
-
-      # The boot-smoke above proves a CLEAN install boots. It does not prove the path that
-      # actually broke us: installing over an existing version, where ~110 SQLite migrations
-      # run against a populated database. v3.8.48 shipped as a hotfix because the published
-      # 3.8.47 crashed on boot, and the v3.8.49 upgrade path was first exercised end-to-end
-      # by hand on a real 3.8.48 box (VPS .16) — after publishing, which is exactly backwards.
-      # Runs BEFORE `npm stage publish` so a broken upgrade never reaches the registry at all;
-      # a staged package that is never approved simply expires, with no `npm deprecate` needed.
-      - name: Prove clean-install AND upgrade-over-previous both boot
-        if: steps.resolve.outputs.skip != 'true'
-        timeout-minutes: 30
-        run: npm run check:install-upgrade
-
-      # WS1.3 (D2, v3.8.49 plan): STAGED publishing by default — `npm stage publish`
-      # parks the exact bytes on the registry WITHOUT making them installable; the
-      # owner then verifies and approves with 2FA (`npm stage approve`), moving the
-      # human gate to AFTER the proof instead of before it. Requires npm >= 11.15
-      # (staged publishing GA 2026-05-22). publish_mode=direct is the emergency
-      # fallback (legacy immediate publish) via workflow_dispatch.
-      - name: Ensure npm supports staged publishing
-        if: steps.resolve.outputs.skip != 'true' && (github.event_name != 'workflow_dispatch' || inputs.publish_mode != 'direct')
-        run: |
-          set -euo pipefail
-          CUR=$(npm --version)
-          if ! node -e "const [a,b]='$(npm --version)'.split('.').map(Number); process.exit(a>11||(a===11&&b>=15)?0:1)"; then
-            # Pinned exact version (supply-chain: never float @latest in the publish
-            # job); bump deliberately when a newer npm is required.
-            echo "npm $CUR < 11.15 — installing pinned npm 11.15.0 for staged publishing"
-            npm install -g --ignore-scripts npm@11.15.0
-          fi
-          npm --version
-
-      - name: Publish to npm (staged — owner approves with 2FA)
-        if: steps.resolve.outputs.skip != 'true' && (github.event_name != 'workflow_dispatch' || inputs.publish_mode != 'direct')
         env:
           VERSION: ${{ steps.resolve.outputs.version }}
           TAG: ${{ steps.resolve.outputs.tag }}
@@ -296,32 +175,10 @@ jobs:
         run: |
           set -euo pipefail
           # Always pass --tag explicitly. Defense in depth: even if VERSION is
-          # accidentally an older release, the historic tag will NOT claim `@latest`.
-          npm stage publish --provenance --access public --tag "$TAG"
-          {
-            echo "## 📦 omniroute@$VERSION STAGED (not yet installable)"
-            echo ""
-            echo "The exact bytes are parked on the registry. To release them:"
-            echo '```'
-            echo "npm stage list omniroute            # find the stage id"
-            echo "npm stage approve <id>              # owner 2FA — THE publish"
-            echo '```'
-            echo "To verify the staged bytes first: npm stage download <id> → run"
-            echo "scripts/check/check-pack-boot.mjs against them (see RELEASE_CHECKLIST)."
-            echo "To discard: npm stage reject <id>."
-          } >> "$GITHUB_STEP_SUMMARY"
-          echo "✅ Staged omniroute@$VERSION (dist-tag=$TAG) — awaiting owner 'npm stage approve'"
-
-      - name: Publish to npm (DIRECT — emergency fallback)
-        if: steps.resolve.outputs.skip != 'true' && github.event_name == 'workflow_dispatch' && inputs.publish_mode == 'direct'
-        env:
-          VERSION: ${{ steps.resolve.outputs.version }}
-          TAG: ${{ steps.resolve.outputs.tag }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: |
-          set -euo pipefail
+          # accidentally an older release, `npm publish --tag historic` will
+          # NOT promote it to `@latest`.
           npm publish --provenance --access public --tag "$TAG"
-          echo "✅ Published omniroute@$VERSION (dist-tag=$TAG) [DIRECT mode]"
+          echo "✅ Published omniroute@$VERSION (dist-tag=$TAG)"
 
       - name: Publish to GitHub Packages
         if: steps.resolve.outputs.skip != 'true'
@@ -352,7 +209,7 @@ jobs:
           # Full history needed for auto-bump: git diff against previous release tag
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ env.NPM_PUBLISH_NODE_VERSION }}
           registry-url: https://registry.npmjs.org

.github/workflows/opencode-plugin-ci.yml

@@ -35,7 +35,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
           cache: npm
@@ -52,7 +52,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "22"
           cache: npm

.github/workflows/opencode-provider-ci.yml

@@ -35,7 +35,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
           cache: npm
@@ -51,7 +51,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "20"
           cache: npm

.github/workflows/quality.yml

@@ -36,7 +36,7 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
       - id: classify
@@ -57,43 +57,18 @@ jobs:
           git diff --name-only "$BASE_SHA" "$HEAD_SHA" > changed-files.txt
           node scripts/quality/classify-pr-changes.mjs changed-files.txt >> "$GITHUB_OUTPUT"
 
-  build:
-    name: Build (advisory)
-    needs: changes
-    if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true') }}
-    # Dynamic runner — same fork-safe rule as ci.yml / fast-gates.
-    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
-    # #7307: advisory for the first week of release-PR runs; remove
-    # continue-on-error after the production-build signal is stable.
-    continue-on-error: true
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: ${{ env.CI_NODE_VERSION }}
-          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
-      - run: npm run check:node-runtime
-      - run: npm run build
-        env:
-          OMNIROUTE_USE_TURBOPACK: "1"
-      # No artifact upload here: the PR-to-release quality workflow has no
-      # downstream package/e2e jobs that consume the Next.js build output.
-
   # Docs/OpenAPI contract gates only — existence reason is doc accuracy + route refs.
   # Split out of fast-gates so pure-docs PRs skip typecheck/unit while still validating docs.
   docs-gates:
     name: Docs Gates (fast-path)
     needs: changes
-    if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && (needs.changes.outputs.docs == 'true' || needs.changes.outputs.code == 'true')) }}
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && (needs.changes.outputs.docs == 'true' || needs.changes.outputs.code == 'true')) }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -107,25 +82,12 @@ jobs:
     name: Fast Quality Gates
     needs: changes
     # Code surface only — pure docs/i18n PRs skip this bag (docs-gates covers docs).
-    if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true') }}
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
     # Dynamic runner (same rule as ci.yml): use the self-hosted VPS pool only when the
     # release captain has USE_VPS_RUNNER=true AND this is not a fork PR (own-origin
     # branches only — a fork PR must never execute on the LAN runner). Var unset/false
     # or a fork PR falls back to ubuntu-latest, so this is inert until the flag flips.
-    # PINNED to hosted (gap 19). This job carried the USE_VPS_RUNNER expression, and that
-    # expression was DEAD CONFIGURATION: across 160 quality.yml runs the job never once landed on
-    # a self-hosted runner — every non-skipped sample is `GitHub Actions NNNN`. The classifier is
-    # not at fault: in the same window ci.yml's Build demonstrably ran on omniroute-113-7 and
-    # omniroute-113-6, so self-hosted runs are visible when they happen.
-    #
-    # And if it ever HAD fired it would have inherited the measured penalty, because this job's
-    # first two steps are exactly the bottleneck: actions/setup-node + npm ci took 20m06s on .113
-    # with 4 concurrent runners versus 16s hosted (npm cache restore saturating the link). Median
-    # here is 5.6 min hosted across 72 successful runs.
-    #
-    # With this pinned, USE_VPS_RUNNER governs ONLY build-like jobs — one variable, one coherent
-    # purpose. That is what gap 19 asked for; a second variable turned out to be unnecessary.
-    runs-on: ubuntu-latest
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     # tsx gates (known-symbols, route-guard-membership) import modules that open
     # SQLite on load; provide DB env so a fresh CI DB initializes cleanly.
     env:
@@ -137,7 +99,7 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -179,101 +141,8 @@ jobs:
       # Complexity + cognitive-complexity: ONE ESLint walk (both baselines still
       # enforced separately by ruleId). Avoids two cold tree walks on fast-path.
       - run: npm run check:complexity-ratchets
-      # ── G0 (trilho .50): gates do trilho A que faltavam no trilho B ──────────────
-      # The god-file refactor happens in PRs→release/**; without these, the release
-      # rail never sees a new import cycle, dead code, duplication or a security
-      # regression until the release PR to main. Deliberately NOT brought here:
-      # bundle-size (self-skips without a build — this rail's build job is advisory
-      # and uploads nothing, so it would be dead configuration) and the coverage
-      # run (fast-unit already runs the full suite; the coverage ratchet stays on
-      # the main rail via --allow-missing in lint-guard).
-      - run: npm run check:cycles
-      - run: npm run check:lockfile
-      - name: Duplication ratchet
-        run: npm run check:duplication
-      - name: Dead-code ratchet (knip)
-        run: npm run check:dead-code
-      - name: Type coverage ratchet
-        run: npm run check:type-coverage
-      - name: Compression budget ratchet
-        run: npm run check:compression-budget
-      # Security scanners — same hardened install as ci.yml quality-extended
-      # (gh release download = authenticated, 5000 req/hr; curl to api.github.com
-      # is rate-limited to 60/hr and silently no-ops when throttled). The blocking
-      # gates below SKIP (exit 0) when their binary is absent — only a measured
-      # regression vs config/quality/quality-baseline.json blocks.
-      - name: Install security scanners (gitleaks/osv/actionlint/zizmor/oasdiff)
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set +e
-          mkdir -p "$HOME/.local/bin"
-          # Ratchets compare scanner COUNTS across runs. Pin every auditor: a rule-set
-          # update must be an explicit PR that re-measures/rebaselines, never a random
-          # red (or green) caused by whatever "latest" served that morning.
-          GITLEAKS_VERSION=v8.30.1
-          OSV_SCANNER_VERSION=v2.3.8
-          ACTIONLINT_VERSION=v1.7.12
-          ZIZMOR_VERSION=1.25.2
-          OASDIFF_VERSION=v1.19.1
-          # gitleaks — pinned linux x64 tarball via gh (authed), extract binary
-          rm -rf /tmp/gl && mkdir -p /tmp/gl
-          gh release download "$GITLEAKS_VERSION" --repo gitleaks/gitleaks --pattern '*linux_x64.tar.gz' --dir /tmp/gl
-          tar -xzf /tmp/gl/*linux_x64.tar.gz -C "$HOME/.local/bin" gitleaks
-          # osv-scanner — pinned linux amd64 bare binary via gh (authed)
-          rm -rf /tmp/osv && mkdir -p /tmp/osv
-          gh release download "$OSV_SCANNER_VERSION" --repo google/osv-scanner --pattern '*linux_amd64' --dir /tmp/osv
-          install -m 0755 /tmp/osv/*linux_amd64 "$HOME/.local/bin/osv-scanner"
-          # actionlint — official installer from a pinned release tag (never main)
-          bash <(curl -fsSL "https://raw.githubusercontent.com/rhysd/actionlint/${ACTIONLINT_VERSION}/scripts/download-actionlint.bash") "$ACTIONLINT_VERSION" "$HOME/.local/bin"
-          # zizmor — pinned PyPI package (same version as ci.yml quality-extended)
-          pipx install "zizmor==$ZIZMOR_VERSION" || pip install --user "zizmor==$ZIZMOR_VERSION"
-          # oasdiff — pinned linux amd64 tarball via gh (authed), extract binary
-          rm -rf /tmp/oasd && mkdir -p /tmp/oasd
-          gh release download "$OASDIFF_VERSION" --repo Tufin/oasdiff --pattern '*linux_amd64.tar.gz' --dir /tmp/oasd
-          tar -xzf /tmp/oasd/*linux_amd64.tar.gz -C "$HOME/.local/bin" oasdiff
-          # ALWAYS export the bin dir (even if any step above failed)
-          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
-          "$HOME/.local/bin/gitleaks" version || true
-          "$HOME/.local/bin/actionlint" -version || true
-          "$HOME/.local/bin/osv-scanner" --version || true
-          "$HOME/.local/bin/oasdiff" --version || true
-          zizmor --version || true
-      - name: Secret scan (gitleaks, ratchet, blocking)
-        run: npm run check:secrets -- --ratchet
-      - name: Vulnerability ratchet (osv-scanner, ratchet, blocking)
-        run: npm run check:vuln-ratchet -- --ratchet
-      - name: Workflow lint (actionlint+zizmor, ratchet, blocking)
-        run: npm run check:workflows -- --ratchet
-      # BASE_REF is read by the script from the env (never interpolated into a
-      # shell body) — workflow-injection-safe. actions/checkout fetches remote
-      # refs, not a local branch named github.base_ref, so prefix origin/ or this
-      # gate self-skips every PR with reason=base-unresolved.
-      - name: OpenAPI breaking-change (oasdiff, ratchet, blocking)
-        env:
-          BASE_REF: ${{ github.base_ref && format('origin/{0}', github.base_ref) || '' }}
-        run: npm run check:openapi-breaking -- --ratchet
       - name: Typecheck (core)
         run: npm run typecheck:core
-      # #7033: dashboard-scoped typecheck gate — src/app/(dashboard) TSX is not
-      # covered by typecheck:core's curated allowlist. See check-dashboard-typecheck.mjs.
-      - name: Typecheck (dashboard)
-        run: npm run check:dashboard-typecheck
-      # WS4.2 (v3.8.49 plan): TypeScript 7 native-compiler SHADOW — advisory only.
-      # TS7 went GA 2026-07-08 with 8-12x type-check speedups; its Compiler API only
-      # arrives in 7.1, so typescript-eslint / type-coverage / Stryker stay on 6.x
-      # (the hybrid is the officially documented pattern). Isolated npx on purpose:
-      # installing an alias package could collide node_modules/.bin/tsc with 6.x.
-      # Promote to the blocking gate after ~1 week of parity with the step above.
-      - name: Typecheck (core) — TS7 native shadow (advisory)
-        continue-on-error: true
-        run: |
-          RC=0
-          START=$(date +%s)
-          npx -y -p typescript@7 tsc --pretty false -p tsconfig.typecheck-core.json || RC=$?
-          echo "[ts7-shadow] exit=$RC elapsed=$(( $(date +%s) - START ))s — the 6.x step above stays authoritative"
-          exit $RC
       # TIA: build the impact map at runtime (gitignored, ~21MB) and run only the
       # unit tests impacted by this PR's changed files. On hub/unmapped changes the
       # selector returns __RUN_ALL__ — full-suite authority is the parallel
@@ -290,26 +159,17 @@ jobs:
           git fetch --no-tags origin "$GITHUB_BASE_REF" || true
           node scripts/quality/build-test-impact-map.mjs
           SEL="$(node scripts/quality/select-impacted-tests.mjs)"
-          # Shadow evidence (#8084): persist every selection so TIA false negatives can
-          # be measured against fast-unit's full-suite verdict across releases BEFORE
-          # any gate authority moves off ordinary PRs. Artifact uploaded below.
-          printf '%s\n' "$SEL" > tia-selection.txt
-          if [ -z "$SEL" ]; then
-            echo "TIA selection: empty (no source/test changes)" >> "$GITHUB_STEP_SUMMARY"
-            echo "No source/test changes — skipping unit tests"; exit 0
-          fi
+          if [ -z "$SEL" ]; then echo "No source/test changes — skipping unit tests"; exit 0; fi
           # CI runners are 4-vCPU; run at --test-concurrency=4 (matching the ci.yml unit
           # job) rather than test:unit's local-tuned concurrency=20. Oversubscribing the
           # runner makes timing-sensitive tests (db-backup, upstream-timeout, ...) flake,
           # which must not happen on a blocking gate. DATA_DIR isolation keeps the parallel
           # run race-free regardless of concurrency.
           if echo "$SEL" | grep -q "__RUN_ALL__"; then
-            echo "TIA selection: __RUN_ALL__ (fail-safe) — full-suite authority stays with fast-unit" >> "$GITHUB_STEP_SUMMARY"
             echo "Fail-safe: __RUN_ALL__ — deferring FULL unit suite to fast-unit (4-shard)."
             echo "Not re-running unsharded test:unit:ci here (duplicate of fast-unit coverage)."
             exit 0
           fi
-          echo "TIA selection: $(grep -c . tia-selection.txt) impacted test file(s) — full suite still runs in fast-unit (shadow-evidence phase, #8084)" >> "$GITHUB_STEP_SUMMARY"
           echo "Running impacted tests:"; echo "$SEL"
           mapfile -t FILES <<< "$SEL"
           # Loader parity with test:unit:ci:shard (#6787): tests/unit/dashboard/** runs
@@ -332,29 +192,13 @@ jobs:
             node --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 "${DASH[@]}" || RC=$?
           fi
           exit $RC
-      # #8084 shadow evidence: keep the raw selection downloadable so TIA misses can be
-      # audited against fast-unit failures on the same run (gate moves need this data).
-      - name: Upload TIA selection (shadow evidence)
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: tia-selection
-          path: tia-selection.txt
-          if-no-files-found: ignore
-          retention-days: 30
 
   fast-vitest:
     name: Vitest (fast-path)
     needs: changes
-    if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true') }}
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
     # Dynamic runner — see fast-gates (own-origin + flag; fork/unset → ubuntu-latest).
-    # PINNED to hosted, deliberately not on the USE_VPS_RUNNER switch (gap 19). One variable
-    # governed the build and the test jobs, which want OPPOSITE machines: the build needs the
-    # .113's RAM, the tests need the hosted runner's link. Measured on 2026-07-29 —
-    # actions/setup-node took 20m06s on .113 with 4 concurrent runners versus 16s hosted (npm
-    # cache restore saturating the link), while the tests themselves tied, 2m54 vs 2m31. So
-    # self-hosted is strictly worse here and there is nothing to configure.
-    runs-on: ubuntu-latest
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     env:
       JWT_SECRET: ci-lint-secret-with-sufficient-length-for-validation
       API_KEY_SECRET: ci-lint-api-key-secret-long
@@ -363,40 +207,23 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
       - run: npm ci
-      # WS5.2/5.3: JUnit feeds Trunk Flaky Tests — the fast-path runs on EVERY PR,
-      # which is where flaky-detection volume actually comes from (ci.yml's heavy
-      # jobs only run on the release PR). Advisory upload, own-origin only.
-      - run: npm run test:vitest -- --reporter=default --reporter=junit --outputFile.junit=trunk-junit/vitest-fastpath.xml
-      - name: Upload test results to Trunk (advisory)
-        if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
-        continue-on-error: true
-        uses: trunk-io/analytics-uploader@385f1ccdf345b4532dc4b6c665dd432b702b8e28 # v2.1.2
-        with:
-          junit-paths: trunk-junit/**/*.xml
-          org-slug: omniroute
-          token: ${{ secrets.TRUNK_TOKEN }}
+      - run: npm run test:vitest
 
   fast-unit:
     name: Unit Tests fast-path (${{ matrix.shard }}/4)
     needs: changes
-    if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true') }}
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
     # Dynamic runner — see fast-gates (own-origin + flag; fork/unset → ubuntu-latest).
     # This is the heaviest fast-path job; 4-way sharding (was 2, #6781) halves the
     # critical path again (~8.5min → ~4.5min on ubuntu-latest; ~2min on the 8-slot
     # runner box). Node's native --test-shard=N/total takes any denominator — only
     # this matrix and the TEST_SHARD env below encode the shard count.
-    # PINNED to hosted, deliberately not on the USE_VPS_RUNNER switch (gap 19). One variable
-    # governed the build and the test jobs, which want OPPOSITE machines: the build needs the
-    # .113's RAM, the tests need the hosted runner's link. Measured on 2026-07-29 —
-    # actions/setup-node took 20m06s on .113 with 4 concurrent runners versus 16s hosted (npm
-    # cache restore saturating the link), while the tests themselves tied, 2m54 vs 2m31. So
-    # self-hosted is strictly worse here and there is nothing to configure.
-    runs-on: ubuntu-latest
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     strategy:
       fail-fast: false
       matrix:
@@ -409,7 +236,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -436,20 +263,14 @@ jobs:
   lint-guard:
     name: No new ESLint warnings
     needs: changes
-    if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true') }}
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
     runs-on: ubuntu-latest
     continue-on-error: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true }}
-    # G0 (trilho .50): security-events:read lets the CodeQL ratchet below read open
-    # code-scanning alerts via `gh api .../code-scanning/alerts` (same as ci.yml's
-    # quality-gate job). contents: read keeps checkout working.
-    permissions:
-      contents: read
-      security-events: read
     steps:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -466,29 +287,6 @@ jobs:
       - name: ESLint (baseline congelado — warning novo = vermelho)
         # lint:json writes the report; --max-warnings 0 keeps no-new-warnings policy.
         run: npm run lint:json -- --max-warnings 0
-      # ── G0 (trilho .50): motor de ratchet também no trilho B ─────────────────────
-      # This job just wrote .artifacts/eslint-results.json — collect-metrics prefers
-      # that file, so the ratchet engine lands here at ZERO extra ESLint cost (one
-      # inventory, two consumers; same reason ci.yml chains lint → quality-gate).
-      # The coverage-report artifact does not exist on this rail, so both ratchet
-      # invocations run --allow-missing: coverage.* metrics skip gracefully while
-      # the deterministic ones (eslint / openapi-coverage / i18n-ui) stay BLOCKING.
-      # Coverage authority remains on the main rail (ci.yml test-coverage → quality-gate).
-      - run: npm run quality:collect
-      - name: Ratchet check (blocking)
-        run: node scripts/quality/check-quality-ratchet.mjs --allow-missing --summary .artifacts/quality-ratchet.md
-      - name: Require-tighten (blocking)
-        run: node scripts/quality/check-quality-ratchet.mjs --allow-missing --require-tighten
-      # CodeQL alerts ratchet — same semantics as ci.yml quality-gate: exits 1 ONLY
-      # on a real regression (open alerts > baseline in quality-baseline.json);
-      # a measurement failure (gh/auth/api) self-skips with exit 0.
-      - name: CodeQL alerts ratchet (blocking)
-        run: npm run check:codeql-ratchet
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Append ratchet summary
-        if: always()
-        run: cat .artifacts/quality-ratchet.md >> "$GITHUB_STEP_SUMMARY" || true
 
   # Merge-integrity: pega no PR os dois vazamentos crônicos de merge que hoje só
   # explodem na release-PR. (1) CHANGELOG-eat — o auto-resolve do merge come
@@ -504,7 +302,7 @@ jobs:
   merge-integrity:
     name: Merge integrity (changelog + generated skills)
     # Always on non-draft PRs — CHANGELOG/skills can break on docs-only merges too.
-    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) }}
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
     continue-on-error: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true }}
     env:
@@ -512,11 +310,11 @@ jobs:
       API_KEY_SECRET: ci-lint-api-key-secret-long
       DISABLE_SQLITE_AUTO_BACKUP: "true"
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm

.github/workflows/scorecard.yml

@@ -26,7 +26,7 @@ jobs:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@v2.4.4
+        uses: ossf/scorecard-action@v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif

.github/workflows/semgrep.yml

@@ -6,19 +6,13 @@ on:
     branches: ["main"]
 permissions:
   contents: read
-
-# Cancel superseded PR runs (same rule as quality.yml). No paths filter on purpose:
-# p/secrets must keep scanning docs-only diffs too — credentials leak in .md files.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
 jobs:
   semgrep:
     runs-on: ubuntu-latest
     container:
       image: semgrep/semgrep
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Run semgrep (advisory)

.github/workflows/wiki-sync.yml

@@ -40,7 +40,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v6
         with:
           node-version: "24"
 

.gitignore

@@ -72,7 +72,6 @@ yarn-error.log*
 # env files (can opt-in for committing if needed)
 .env*
 !.env.example
-!.env.homolog.example
 # Provider API keys (never commit)
 *.api-key
 .nvidia-api-key
@@ -171,6 +170,7 @@ config/quality/test-impact-map.json
 # GitNexus local index
 .gitnexus
 .worktrees
+bin/omniroute.mjs
 
 # Consistent with .dockerignore / .npmignore
 .omc/
@@ -200,10 +200,7 @@ scripts/i18n/_pending-keys.json
 .codegraph/
 
 # Fumadocs generated source
-/.source/
-
-# Temporary local worktrees used to build unpublished npm tarballs
-/.deploy-build-*/
+.source/
 
 # AI agent local settings and configs
 .agents/
@@ -235,7 +232,7 @@ omniroute.md
 
 # mise configuration
 mise.toml
-_artifacts/          # release-green artifacts
+_artifacts/
 .claude-flow/
 
 # ESLint file cache (npm run lint --cache / complexity ratchets)
@@ -243,13 +240,5 @@ _artifacts/          # release-green artifacts
 .eslintcache-complexity
 
 
-# CI/local quality artifacts (eslint-results.json, quality-ratchet.md, etc.)
+# CI/local quality artifacts (eslint-results.json, etc.)
 .artifacts/
-
-# Homologation E2E suite (npm run homolog) — real-environment credentials + report output
-.env.homolog
-tests/homolog/.auth/
-tests/homolog/ui/.auth/
-homolog-report/
-docker-compose.yml.bak
-.playwright-cli/

.gitleaks.toml

@@ -74,22 +74,3 @@
 #       '''tests/unit/''',
 #     ]
 #
-
-[[rules]]
-  # Falsos-positivos comprovados do generic-api-key — zerados em 2026-07-13 (WS6/D3,
-  # plano v3.8.49). Revisar em v3.9.0. Nenhum é credencial: dois são NOMES DE CAMPO
-  # de métricas de latência; o terceiro é o valor PÚBLICO de um beta header da API
-  # da Anthropic (documentado publicamente, não é segredo).
-  id = "generic-api-key"
-  [rules.allowlist]
-    description = "Field names + public Anthropic beta-header value (não são segredos)"
-    regexes = [
-      '''latencyP\d{2}Ms''',
-      '''interleaved-thinking-2025-05-14''',
-      # v3.8.49 pre-flight (2026-07-28). Nenhum dos dois e credencial:
-      # - chave de localStorage do banner de patrocinio (#8723), so um identificador de UI;
-      # - x-api-key PUBLICO do Firefly web (documentado em open-sse/utils/publicCreds.ts:207);
-      #   as duas ocorrencias sinalizadas estao em COMENTARIOS JSDoc, o runtime le de resolvePublicCred().
-      '''omniroute-kimi-sponsor-banner-dismissed-v1''',
-      '''SunbreakWebUI1''',
-    ]

.mergify.yml

@@ -1,74 +0,0 @@
-# Mergify merge queue — WS3.4/D5 of the v3.8.49 quality/velocity master plan.
-#
-# WHY: ~85-100 active PR authors/month and 300+ PRs/week peaks, all merged by ONE
-# identity. The manual merge-train validated batches by hand; this queue automates
-# it with batching + automatic batch bisection (a red batch of N costs ~log2(N)
-# revalidations instead of N). Mergify Open Source plan: free, unlimited, public repo.
-#
-# GOVERNANCE (non-negotiable, mirrors CLAUDE.md Hard Rules #21/#22 + the owner's
-# pre-merge ⭐ gate):
-#   • A PR enters the queue ONLY via the `queue` label — applied by the owner (or a
-#     session acting for the owner) AFTER the pre-merge ⭐ report/decision. The label
-#     IS the merge approval; Mergify only executes it.
-#   • During a release-freeze (open issue labeled `release-freeze`), do NOT label PRs
-#     targeting the frozen branch — the freeze is a human-honored coordination signal
-#     the queue cannot see. Retarget to the active release/vX+1 first (Hard Rule #21).
-#   • Never label a PR another session is actively working (Hard Rule #22b).
-#   • Fallback path if Mergify misbehaves or the OSS plan changes: the manual
-#     merge-train runbook (docs/ops/MERGE_TRAIN.md) — remove labels, proceed by hand.
-
-# Auto-enqueue (current Mergify model, 2026): auto_merge_conditions in
-# merge_protections_settings — the rules-based queue action / autoqueue path is
-# deprecated (EOL 2026-07-16). The owner-applied `queue` label IS the approval.
-merge_protections_settings:
-  auto_merge_conditions:
-    - label = queue
-
-queue_rules:
-  - name: release
-    # Any current or future release branch — the reason GitHub's native queue was
-    # rejected (no wildcard support on personal-account repos).
-    queue_conditions:
-      - base~=^release/v\d+\.\d+\.\d+$
-      - label=queue
-      - -draft
-      - -conflict
-    # "Everything that ran is green, nothing still running, AND the always-on
-    # anchor check succeeded" — robust to the path-filtered fast-gates (docs-only
-    # PRs skip code jobs; matrix shard names vary) while never fail-open: a PR with
-    # zero checks cannot vacuously merge, because `Merge integrity` runs on EVERY
-    # non-draft PR (quality.yml) and must be an affirmative success. Review approval
-    # is intentionally NOT a condition here: the owner-applied `queue` label IS the
-    # approval in this repo's single-maintainer model (see governance header).
-    merge_conditions:
-      # "Zero failures" — EXCEPT the advisory "Build (advisory)" job (quality.yml):
-      # continue-on-error by design, and its GH-hosted Turbopack build hangs
-      # recurrently mid-"Creating an optimized production build" (100% failure rate
-      # across every sampled PR since the job was added 2026-07-27, always killed by
-      # a runner timeout/shutdown signal, never a real compile error). Any OTHER
-      # failure still blocks (anti-fail-open kept). The prior dast-smoke exception
-      # (#7225) was dropped here: dast-smoke's hang (#7226) has been dormant for
-      # weeks (0 failures in the last 30 runs; 2 all-time, none since 2026-07-13) —
-      # carrying its tolerance forward would mask problems it no longer causes.
-      - or:
-          - "#check-failure=0"
-          - and:
-              - "#check-failure=1"
-              - check-failure=Build (advisory)
-      - "#check-pending=0"
-      - "#check-success>=1"
-      - check-success=Merge integrity (changelog + generated skills)
-    # NO batching: 'Merge Queue Batch' requires a paid Mergify tier (live finding
-    # 2026-07-15 — the queue command fails with "Cannot use Merge Queue batch" on
-    # the free plan). Serial queue (1 PR at a time) still automates the train.
-    # Squash keeps the one-commit-per-PR history the CHANGELOG reconciliation expects.
-    merge_method: squash
-
-pull_request_rules:
-  - name: clean up the queue label after merge
-    conditions:
-      - merged
-    actions:
-      label:
-        remove:
-          - queue

.prettierignore

@@ -3,9 +3,3 @@ docs/reference/ENVIRONMENT.md
 
 # Dense auto-generated free-tier budget rows (one object per line) — prettier multi-line expand blows past file-size cap 800.
 open-sse/config/freeModelCatalog.data.ts
-
-# Generated by scripts/skills/generate-agent-skills.mjs; the generator is their
-# formatter of record and check:agent-skills-sync diffs its output byte-for-byte.
-# Prettier reformats the frontmatter (blank line after ---), which makes the gate
-# fail on any skill that happens to pass through lint-staged.
-skills/*/SKILL.md

.source/dynamic.ts

@@ -0,0 +1,8 @@
+// @ts-nocheck
+import { dynamic } from 'fumadocs-mdx/runtime/dynamic';
+import * as Config from '../source.config';
+
+const create = await dynamic<typeof Config, import("fumadocs-mdx/runtime/types").InternalTypeConfig & {
+  DocData: {
+  }
+}>(Config, {"configPath":"source.config.ts","environment":"next","outDir":".source"}, {"doc":{"passthroughs":["extractedReferences"]}});

.source/source.config.mjs

@@ -0,0 +1,22 @@
+// source.config.ts
+import { defineDocs, defineConfig } from "fumadocs-mdx/config";
+var docs = defineDocs({
+  dir: "docs",
+  docs: {
+    files: [
+      "./architecture/**/*.md",
+      "./guides/**/*.md",
+      "./reference/**/*.md",
+      "./frameworks/**/*.md",
+      "./routing/**/*.md",
+      "./security/**/*.md",
+      "./compression/**/*.md",
+      "./ops/**/*.md"
+    ]
+  }
+});
+var source_config_default = defineConfig();
+export {
+  source_config_default as default,
+  docs
+};

@omniroute/opencode-plugin/README.md

@@ -10,8 +10,7 @@ This plugin solves that by:
 
 - Fetching `/v1/models` and `/api/combos` **at OpenCode startup, in Node.js** — no CORS, no WebView restrictions
 - Emitting the provider block **dynamically** in the plugin's `config`/`provider` hook — so `opencode.json` only needs the plugin entry, not a static `provider.omniroute`
-- Re-fetching on a configurable TTL (default 5 min) **and** background auto-discovery while OpenCode is running (`autoSyncIntervalMs`, default 5 min), so new models / combo changes appear without restarting OpenCode
-- Exposing a force-refresh path (`omniroute_sync_models` tool + `/omni-sync` command template) equivalent to Pi `/omni sync`
+- Re-fetching on a configurable TTL (default 5 min), so new models / combo changes in the OmniRoute UI appear without restarting OpenCode
 - Computing `limit.context` for combos as `min(member.context_length)` from the live catalog (no more `null` values that cause 4K-token truncation)
 - **Auto-pickup of `interleaved` capability** for thinking models (merged via PR #3138)
 
@@ -74,9 +73,6 @@ Peer dep: `@opencode-ai/plugin` (managed by your OpenCode install).
       {
         "providerId": "omniroute",
         "baseURL": "https://or.example.com",
-        // Background re-discovery while OpenCode is running (Pi parity).
-        // Default 300000 (5 min). Minimum 60000. Set 0 to disable.
-        "autoSyncIntervalMs": 300000,
       },
     ],
   ],
@@ -92,27 +88,6 @@ opencode auth login --provider omniroute
 
 Restart OpenCode. `/models` lists the full live catalog. Variants (`-low`, `-medium`, `-high`, `-thinking`) and combos appear as first-class IDs — OmniRoute is the source of truth, no client-side synthesis.
 
-### Live catalog refresh (auto + force)
-
-While OpenCode is running, the plugin keeps the model catalog fresh in two ways:
-
-| Mechanism | Default | What it does |
-| --- | --- | --- |
-| `modelCacheTtl` | `300000` (5 min) | On-demand TTL: next provider/models hook after expiry re-fetches `/v1/models` |
-| `autoSyncIntervalMs` | `300000` (5 min) | Background timer: proactively invalidates + re-fetches while the harness is running. Min `60000`. Set `0` to disable background polling (TTL still applies) |
-
-**Force sync now** (Pi `/omni sync` equivalent) — OpenCode has no Pi-style slash-command registration API, so the plugin wires both a tool and command templates:
-
-1. **Tool:** `omniroute_sync_models` — invalidates in-memory + disk caches, re-fetches `GET /v1/models` (and combos/enrichment when enabled), returns `{ ok, count, ... }`.
-2. **Command templates** (type these in OpenCode):
-   - `/omni-sync` — asks the agent to call `omniroute_sync_models` and report the result
-   - `/omni-autosync` — asks the agent to report current `autoSyncIntervalMs` / `modelCacheTtl` status
-
-```text
-/omni-sync
-/omni-autosync
-```
-
 ## Multi-instance (prod + preprod side-by-side)
 
 > ⚠ OC ≤1.15.5 dedupes plugin loads by absolute module path. Two `plugin:` entries pointing at the same `dist/index.js` collapse into one (last-listed options win). Workaround: install the plugin twice into separate directories so each entry resolves to a distinct module file. v0.2.x will introduce an `instances: [...]` shape that registers N providers from a single load.
@@ -190,7 +165,7 @@ npm install --prefix ~/.config/opencode/plugins/omniroute-opencode-plugin-prepro
 | Dynamic `/v1/models`                        | Pulls live catalog (455+ entries on prod) on each refresh, TTL-cached                                                                                                                                                                                                                                                                                                                                       | `provider.models`            |
 | Variants pass-through                       | `-low`/`-medium`/`-high`/`-thinking` ship as first-class IDs from OmniRoute (no client synthesis)                                                                                                                                                                                                                                                                                                           | `provider.models`            |
 | Combo LCD aggregation                       | Combos appear with intersected capabilities + min context/output across members                                                                                                                                                                                                                                                                                                                             | `provider.models` + `config` |
-| `combo/<slug>` namespace + `Combo:` prefix | Combos surface under `combo/claude-primary` (not the upstream UUID) and the picker shows `Combo: claude-primary` so they stand apart from raw provider/model pairs                                                                                                                                                                                                                                          | both hooks                   |
+| `combo/<slug>` namespace + `Combo: ` prefix | Combos surface under `combo/claude-primary` (not the upstream UUID) and the picker shows `Combo: claude-primary` so they stand apart from raw provider/model pairs                                                                                                                                                                                                                                          | both hooks                   |
 | Nice names + cost                           | `/api/pricing/models` display names AND `/api/pricing` per-million-token cost overlaid onto the live catalog                                                                                                                                                                                                                                                                                                | both hooks                   |
 | Canonical-twin dedup + alias-fallback       | `/v1/models` exposes the same upstream model under both short alias (`cc/claude-opus-4-7`) and canonical name (`claude/claude-opus-4-7`); the plugin drops the canonical twin when an alias twin exists (no duplicate rows in the picker) and reverse-maps canonical → alias to pick up enrichment for short aliases (`dg/nova-3 → Deepgram - Nova 3`) that `/api/pricing/models` only indexes by canonical | both hooks                   |
 | Compression pipeline tags                   | Combo names get tagged with their compression pipeline (e.g. `Combo: claude-primary [rtk🟡 → caveman🟠]`) when `features.compressionMetadata: true`. Intensity tokens render as a traffic-light emoji: 🟢 lite/minimal · 🟡 standard · 🟠 aggressive/full · 🔴 ultra                                                                                                                                        | both hooks                   |
@@ -204,33 +179,30 @@ npm install --prefix ~/.config/opencode/plugins/omniroute-opencode-plugin-prepro
 
 ## Plugin options
 
-| Option                | Type     | Default                                    | Description                                                                                           |
-| --------------------- | -------- | ------------------------------------------ | ----------------------------------------------------------------------------------------------------- |
-| `providerId`          | `string` | `"omniroute"`                              | OpenCode provider id; must be unique across plugin entries                                            |
-| `displayName`         | `string` | `"OmniRoute"` or `OmniRoute (<id>)`        | Label in the OC UI                                                                                    |
-| `modelCacheTtl`       | `number` | `300000` (5 min)                           | `/v1/models` TTL in ms                                                                                |
-| `baseURL`             | `string` | resolved from `auth.json` after `/connect` | Override OmniRoute base URL                                                                           |
-| `managementReadToken` | `string` | falls back to `apiKey`                     | Optional read-only token for management catalog GETs; `/v1` inference stays on the connected `apiKey` |
-| `features`            | `object` | see below                                  | Feature toggles (all opt-in/out, defaults preserve v0.1.0)                                            |
-
-For least-privilege deployments, set top-level `managementReadToken` to a read-only management token. It is sent only to catalog reads (`/api/combos`, `/api/combos/auto`, `/api/pricing/models`, `/api/pricing`, `/api/context/combos`, and `/api/providers`). Inference requests under `/v1`, including chat, continue to use the `apiKey` stored by OpenCode. `features.mcpToken` remains independent. If `managementReadToken` is omitted, catalog reads retain the previous `apiKey` behavior.
+| Option          | Type     | Default                                    | Description                                                |
+| --------------- | -------- | ------------------------------------------ | ---------------------------------------------------------- |
+| `providerId`    | `string` | `"omniroute"`                              | OpenCode provider id; must be unique across plugin entries |
+| `displayName`   | `string` | `"OmniRoute"` or `OmniRoute (<id>)`        | Label in the OC UI                                         |
+| `modelCacheTtl` | `number` | `300000` (5 min)                           | `/v1/models` TTL in ms                                     |
+| `baseURL`       | `string` | resolved from `auth.json` after `/connect` | Override OmniRoute base URL                                |
+| `features`      | `object` | see below                                  | Feature toggles (all opt-in/out, defaults preserve v0.1.0) |
 
 ### `features` block
 
 Every field is optional. Defaults mirror v0.1.0 behaviour so existing `opencode.json` files do not need to change.
 
-| Feature               | Type      | Default | What it does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| --------------------- | --------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `combos`              | `boolean` | `true`  | Discover `/api/combos` and surface them as pseudo-models with LCD capabilities. Combos are keyed under the `combo/<slug>` namespace and labelled `Combo: <name>` in the model picker so they're distinguishable from raw provider/model pairs.                                                                                                                                                                                                                                                                                                                       |
-| `enrichment`          | `boolean` | `true`  | Pull display names from `/api/pricing/models` AND per-million-token pricing (`input`, `output`, `cached` → `cacheRead`, `cache_creation` → `cacheWrite`) from `/api/pricing`, then overlay both onto the live catalog (so the UI shows `Claude 4.7 Opus` with `cost.input: 5`, `cost.output: 25` instead of raw IDs and zeroed cost).                                                                                                                                                                                                                                |
-| `compressionMetadata` | `boolean` | `false` | Pull `/api/context/combos` so combo names get tagged with their compression pipeline, e.g. `Combo: claude-primary [rtk🟡 → caveman🟠]`. Intensity tokens render as traffic-light emoji (🟢 lite/minimal · 🟡 standard · 🟠 aggressive/full · 🔴 ultra) so the picker advertises "how compressed" each combo is at a glance.                                                                                                                                                                                                                                          |
-| `providerTag`         | `boolean` | `true`  | Prepend a short upstream-provider label to the enriched display name with `" - "` separator, so `cc/claude-opus-4-7 → Claude - Claude Opus 4.7` differs visibly from `kr/claude-opus-4-7 → Kiro - Claude Opus 4.7` in the OC TUI model picker. Label resolution: use `/api/pricing/models[<alias>].name` verbatim when ≤8 chars (e.g. `Claude`, `Kiro`, `Codex`, `Qwen`), otherwise fall back to `UPPER(alias)` (e.g. `GitHub Models` → `GHM`, `Gemini` → `GEMINI`). Idempotent. Combos intentionally skipped (the `Combo:` prefix already conveys multi-upstream). |
-| `usableOnly`          | `boolean` | `false` | Read `/api/providers` and filter the catalog to providers that have at least one connection with `isActive: true` AND `testStatus: 'active'`. Subtract-filter semantics: providers unknown to BOTH the pricing-models catalog AND the connection table pass through (so synthetic prefixes like `agentrouter/*` survive). On fetch failure the filter is disabled for the refresh — never hides the whole catalog.                                                                                                                                                   |
-| `diskCache`           | `boolean` | `true`  | Persist the last successful `/v1/models` + `/api/combos` + enrichment + connections + compression snapshot to `${OPENCODE_DATA_DIR ?? ~/.local/share/opencode}/plugins/omniroute-<providerId>.json`. On a subsequent cold start where `/v1/models` throws (network down / IP whitelist drop / 5xx) the static block hydrates from the snapshot so OC's model picker survives offline. Soft-fail on read/write — never blocks publishing.                                                                                                                             |
-| `geminiSanitization`  | `boolean` | `true`  | Strip `$schema`/`$ref`/`additionalProperties` from tool params when the model id matches `gemini`                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| `mcpAutoEmit`         | `boolean` | `false` | Auto-write an `mcp.<providerId>` remote entry into the OC config pointing at `<baseURL>/api/mcp/stream` with the resolved Bearer token                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| `mcpToken`            | `string`  | _unset_ | Optional separate Bearer for the auto-emitted MCP entry. Falls back to the provider's `apiKey` (from `auth.json`) when unset                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `fetchInterceptor`    | `boolean` | `true`  | Inject `Authorization: Bearer` + default `Content-Type` on every outbound request targeting `baseURL` (suffix-spoof guarded)                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| Feature               | Type      | Default | What it does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| --------------------- | --------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `combos`              | `boolean` | `true`  | Discover `/api/combos` and surface them as pseudo-models with LCD capabilities. Combos are keyed under the `combo/<slug>` namespace and labelled `Combo: <name>` in the model picker so they're distinguishable from raw provider/model pairs.                                                                                                                                                                                                                                                                                                                               |
+| `enrichment`          | `boolean` | `true`  | Pull display names from `/api/pricing/models` AND per-million-token pricing (`input`, `output`, `cached` → `cacheRead`, `cache_creation` → `cacheWrite`) from `/api/pricing`, then overlay both onto the live catalog (so the UI shows `Claude 4.7 Opus` with `cost.input: 5`, `cost.output: 25` instead of raw IDs and zeroed cost).                                                                                                                                                                                                                                        |
+| `compressionMetadata` | `boolean` | `false` | Pull `/api/context/combos` so combo names get tagged with their compression pipeline, e.g. `Combo: claude-primary [rtk🟡 → caveman🟠]`. Intensity tokens render as traffic-light emoji (🟢 lite/minimal · 🟡 standard · 🟠 aggressive/full · 🔴 ultra) so the picker advertises "how compressed" each combo is at a glance.                                                                                                                                                                                                                                                  |
+| `providerTag`         | `boolean` | `true`  | Prepend a short upstream-provider label to the enriched display name with `" - "` separator, so `cc/claude-opus-4-7 → Claude - Claude Opus 4.7` differs visibly from `kr/claude-opus-4-7 → Kiro - Claude Opus 4.7` in the OC TUI model picker. Label resolution: use `/api/pricing/models[<alias>].name` verbatim when ≤8 chars (e.g. `Claude`, `Kiro`, `Codex`, `Qwen`), otherwise fall back to `UPPER(alias)` (e.g. `GitHub Models` → `GHM`, `Gemini` → `GEMINI`). Idempotent. Combos intentionally skipped (the `Combo: ` prefix already conveys multi-upstream). |
+| `usableOnly`          | `boolean` | `false` | Read `/api/providers` and filter the catalog to providers that have at least one connection with `isActive: true` AND `testStatus: 'active'`. Subtract-filter semantics: providers unknown to BOTH the pricing-models catalog AND the connection table pass through (so synthetic prefixes like `agentrouter/*` survive). On fetch failure the filter is disabled for the refresh — never hides the whole catalog.                                                                                                                                                           |
+| `diskCache`           | `boolean` | `true`  | Persist the last successful `/v1/models` + `/api/combos` + enrichment + connections + compression snapshot to `${OPENCODE_DATA_DIR ?? ~/.local/share/opencode}/plugins/omniroute-<providerId>.json`. On a subsequent cold start where `/v1/models` throws (network down / IP whitelist drop / 5xx) the static block hydrates from the snapshot so OC's model picker survives offline. Soft-fail on read/write — never blocks publishing.                                                                                                                                     |
+| `geminiSanitization`  | `boolean` | `true`  | Strip `$schema`/`$ref`/`additionalProperties` from tool params when the model id matches `gemini`                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `mcpAutoEmit`         | `boolean` | `false` | Auto-write an `mcp.<providerId>` remote entry into the OC config pointing at `<baseURL>/api/mcp/stream` with the resolved Bearer token                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `mcpToken`            | `string`  | _unset_ | Optional separate Bearer for the auto-emitted MCP entry. Falls back to the provider's `apiKey` (from `auth.json`) when unset                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| `fetchInterceptor`    | `boolean` | `true`  | Inject `Authorization: Bearer` + default `Content-Type` on every outbound request targeting `baseURL` (suffix-spoof guarded)                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 
 #### Example — enrichment + compression tags + MCP auto-emit
 
@@ -242,7 +214,6 @@ Every field is optional. Defaults mirror v0.1.0 behaviour so existing `opencode.
       {
         "providerId": "omniroute",
         "baseURL": "https://or.example.com",
-        "managementReadToken": "<read-only-management-token>",
         "features": {
           "combos": true,
           "enrichment": true,

@omniroute/opencode-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@omniroute/opencode-plugin",
-  "version": "0.2.1",
+  "version": "0.2.0",
   "description": "OpenCode plugin for the OmniRoute AI Gateway. Drives dynamic model discovery, /connect auth flow, and multi-instance OmniRoute providers via the official @opencode-ai/plugin contract.",
   "type": "module",
   "main": "./dist/index.js",
@@ -23,7 +23,7 @@
   "scripts": {
     "build": "tsup",
     "clean": "rm -rf dist",
-    "test": "node --import tsx/esm --test tests/scaffold.test.ts tests/auth.test.ts tests/options-schema.test.ts tests/multi-instance.test.ts tests/fetch-interceptor.test.ts tests/provider.test.ts tests/gemini-sanitize.test.ts tests/combos.test.ts tests/config-shim.test.ts tests/features.test.ts tests/feature-defaults.test.ts tests/usable-combo.test.ts tests/disk-snapshot-perms.test.ts tests/fork-features.test.ts tests/auto-combo-context.test.ts tests/provider-id-routing.test.ts tests/management-read-token.test.ts tests/auto-sync.test.ts",
+    "test": "node --import tsx/esm --test tests/scaffold.test.ts tests/auth.test.ts tests/options-schema.test.ts tests/multi-instance.test.ts tests/fetch-interceptor.test.ts tests/provider.test.ts tests/gemini-sanitize.test.ts tests/combos.test.ts tests/config-shim.test.ts tests/features.test.ts tests/usable-combo.test.ts tests/disk-snapshot-perms.test.ts tests/fork-features.test.ts tests/auto-combo-context.test.ts tests/provider-id-routing.test.ts",
     "prepublishOnly": "npm run clean && npm run build && npm test"
   },
   "keywords": [

@omniroute/opencode-plugin/tests/auto-sync.test.ts

@@ -1,130 +0,0 @@
-/**
- * Auto-discovery + force-sync (OpenCode parity with Pi `/omni sync`).
- */
-import test from "node:test";
-import assert from "node:assert/strict";
-import {
-  sanitizeAutoSyncIntervalMs,
-  DEFAULT_AUTO_SYNC_INTERVAL_MS,
-  MIN_AUTO_SYNC_INTERVAL_MS,
-  parseOmniRoutePluginOptions,
-  resolveOmniRoutePluginOptions,
-  invalidateOmniRouteFetchCache,
-  forceSyncOmniRouteModels,
-  type OmniRouteFetchCache,
-} from "../src/index.js";
-
-test("sanitizeAutoSyncIntervalMs: unset → default 300000", () => {
-  assert.equal(sanitizeAutoSyncIntervalMs(undefined), DEFAULT_AUTO_SYNC_INTERVAL_MS);
-  assert.equal(sanitizeAutoSyncIntervalMs(null), DEFAULT_AUTO_SYNC_INTERVAL_MS);
-});
-
-test("sanitizeAutoSyncIntervalMs: 0 disables", () => {
-  assert.equal(sanitizeAutoSyncIntervalMs(0), 0);
-});
-
-test("sanitizeAutoSyncIntervalMs: clamps below min to 60000", () => {
-  assert.equal(sanitizeAutoSyncIntervalMs(1), MIN_AUTO_SYNC_INTERVAL_MS);
-  assert.equal(sanitizeAutoSyncIntervalMs(59_999), MIN_AUTO_SYNC_INTERVAL_MS);
-});
-
-test("sanitizeAutoSyncIntervalMs: keeps valid values", () => {
-  assert.equal(sanitizeAutoSyncIntervalMs(60_000), 60_000);
-  assert.equal(sanitizeAutoSyncIntervalMs(300_000), 300_000);
-});
-
-test("parseOmniRoutePluginOptions accepts autoSyncIntervalMs including 0", () => {
-  assert.equal(parseOmniRoutePluginOptions({ autoSyncIntervalMs: 0 }).autoSyncIntervalMs, 0);
-  assert.equal(parseOmniRoutePluginOptions({ autoSyncIntervalMs: 120_000 }).autoSyncIntervalMs, 120_000);
-});
-
-test("resolveOmniRoutePluginOptions defaults autoSyncIntervalMs to 300000", () => {
-  const r = resolveOmniRoutePluginOptions({});
-  assert.equal(r.autoSyncIntervalMs, DEFAULT_AUTO_SYNC_INTERVAL_MS);
-});
-
-test("resolveOmniRoutePluginOptions clamps low positive autoSyncIntervalMs", () => {
-  const r = resolveOmniRoutePluginOptions({ autoSyncIntervalMs: 5000 });
-  assert.equal(r.autoSyncIntervalMs, MIN_AUTO_SYNC_INTERVAL_MS);
-});
-
-test("invalidateOmniRouteFetchCache clears by baseURL prefix", () => {
-  const cache: OmniRouteFetchCache = new Map();
-  cache.set("https://a.example/v1::abc", {
-    rawModels: [],
-    rawCombos: [],
-    rawAutoCombos: [],
-    rawEnrichment: new Map(),
-    rawCompressionCombos: [],
-    rawConnections: [],
-    expiresAt: Date.now() + 1000,
-  });
-  cache.set("https://b.example/v1::def", {
-    rawModels: [],
-    rawCombos: [],
-    rawAutoCombos: [],
-    rawEnrichment: new Map(),
-    rawCompressionCombos: [],
-    rawConnections: [],
-    expiresAt: Date.now() + 1000,
-  });
-  const removed = invalidateOmniRouteFetchCache(cache, "https://a.example/v1");
-  assert.equal(removed, 1);
-  assert.equal(cache.size, 1);
-  assert.equal(cache.has("https://b.example/v1::def"), true);
-});
-
-test("forceSyncOmniRouteModels: fetches, populates cache, returns count", async () => {
-  const cache: OmniRouteFetchCache = new Map();
-  const resolved = resolveOmniRoutePluginOptions({
-    providerId: "omniroute",
-    baseURL: "https://omniroute.example/v1",
-    autoSyncIntervalMs: 0,
-    features: {
-      combos: false,
-      autoCombos: false,
-      enrichment: false,
-      compressionMetadata: false,
-      usableOnly: false,
-      diskCache: false,
-    },
-  });
-
-  const result = await forceSyncOmniRouteModels({
-    resolved,
-    cache,
-    readAuthJson: async () => ({
-      omniroute: { type: "api", key: "test-key" },
-    }),
-    fetcher: async () => [
-      { id: "model-a", object: "model" },
-      { id: "model-b", object: "model" },
-    ],
-    now: () => 1_000_000,
-  });
-
-  assert.equal(result.ok, true);
-  assert.equal(result.count, 2);
-  assert.equal(result.provider, "omniroute");
-  assert.equal(cache.size, 1);
-  const entry = [...cache.values()][0];
-  assert.equal(entry.rawModels.length, 2);
-  assert.equal(entry.expiresAt, 1_000_000 + resolved.modelCacheTtl);
-});
-
-test("forceSyncOmniRouteModels: missing auth returns error", async () => {
-  const cache: OmniRouteFetchCache = new Map();
-  const resolved = resolveOmniRoutePluginOptions({
-    providerId: "omniroute",
-    baseURL: "https://omniroute.example/v1",
-    autoSyncIntervalMs: 0,
-    features: { diskCache: false },
-  });
-  const result = await forceSyncOmniRouteModels({
-    resolved,
-    cache,
-    readAuthJson: async () => ({}),
-  });
-  assert.equal(result.ok, false);
-  assert.match(result.error ?? "", /credentials|baseURL|connect/i);
-});

@omniroute/opencode-plugin/tests/config-shim.test.ts

@@ -248,7 +248,7 @@ test("config: with valid auth.json + apiKey + baseURL → mutates input.provider
 
   // Combo surfaces under bare key + LCD'd
   // (gemini's reasoning=false → combo reasoning=false).
-  const combo = entry.models["omniroute/claude-tier"];
+  const combo = entry.models["opencode-omniroute/claude-tier"];
   assert.ok(combo, "combo surfaced under bare key");
   assert.equal(combo.name, "Claude Tier");
   assert.equal(combo.reasoning, false, "LCD: any member reasoning=false → combo reasoning=false");
@@ -474,7 +474,7 @@ test("config: combos fetcher throws → emit models-only catalog (no combos in m
     "opencode-omniroute/claude-sonnet-4-6",
     "opencode-omniroute/gemini-3-flash",
   ]);
-  assert.equal(entry.models["omniroute/claude-tier"], undefined, "no combo entry");
+  assert.equal(entry.models["opencode-omniroute/claude-tier"], undefined, "no combo entry");
   assert.ok(
     logger.entries.some((e) => String(e[0]).includes("/api/combos fetch failed")),
     "combos-fetch breadcrumb emitted"
@@ -748,7 +748,7 @@ test("buildStaticProviderEntry: hidden combos are excluded", () => {
     "https://or.example/v1",
     "sk-test"
   );
-  assert.equal(block.models["omniroute/claude-tier"], undefined);
+  assert.equal(block.models["opencode-omniroute/claude-tier"], undefined);
   assert.ok(block.models["opencode-omniroute/claude-sonnet-4-6"]);
 });
 
@@ -858,7 +858,7 @@ test("buildStaticProviderEntry: combo modalities = intersection of members (LCD)
     "https://or.example/v1",
     "sk-test"
   );
-  const combo = block.models["omniroute/mixed-tier"];
+  const combo = block.models["opencode-omniroute/mixed-tier"];
   assert.ok(combo, "combo emitted under slug key");
   // claude has text+image, text-only has text → intersection drops image.
   assert.deepEqual(combo.modalities?.input, ["text"]);
@@ -970,7 +970,7 @@ test("config: enrichment fetched + name overlaid on raw-model entries", async ()
   assert.equal(entry.models["opencode-omniroute/claude-sonnet-4-6"].name, "Claude Sonnet 4.6");
   assert.equal(entry.models["opencode-omniroute/gemini-3-flash"].name, "Gemini 3 Flash");
   // Combo names still come from /api/combos — enrichment overlay does NOT touch combos.
-  assert.equal(entry.models["omniroute/claude-tier"].name, "Claude Tier");
+  assert.equal(entry.models["opencode-omniroute/claude-tier"].name, "Claude Tier");
   assert.equal(enrichmentFetcher.callCount(), 1);
 });
 
@@ -1337,7 +1337,7 @@ test("config: providerTag (default-on) prepends '<provider> - ' to enriched raw-
   );
   assert.equal(entry.models["opencode-omniroute/gemini-3-flash"].name, "Gemini - Gemini 3 Flash");
   // Combos stay untouched — `Combo: ` prefix already conveys multi-upstream.
-  assert.equal(entry.models["omniroute/claude-tier"].name, "Claude Tier");
+  assert.equal(entry.models["opencode-omniroute/claude-tier"].name, "Claude Tier");
 });
 
 test("config: providerTag=false suppresses the suffix", async () => {
@@ -1516,7 +1516,7 @@ test("buildStaticProviderEntry: nested combo-ref context is the bottleneck acros
   );
   // Pre-fix: Parent would advertise 200_000 (only raw-big counted).
   // Post-fix: Parent should advertise 8_000 (TinyCombo bottleneck).
-  const parent = block.models["omniroute/parent"];
+  const parent = block.models["opencode-omniroute/parent"];
   assert.ok(parent, "Parent combo must be in the static catalog");
   assert.equal(parent.limit?.context, 8_000);
 });

@omniroute/opencode-plugin/tests/disk-snapshot-perms.test.ts

@@ -40,7 +40,7 @@ test("defaultDiskSnapshotWriter writes an owner-only (no group/other) snapshot",
   process.env.OPENCODE_DATA_DIR = tmp;
 
   try {
-    await defaultDiskSnapshotWriter("perm-test", makeEntry(), "test-snapshot-identity");
+    await defaultDiskSnapshotWriter("perm-test", makeEntry());
 
     const file = diskSnapshotPath("perm-test");
     assert.ok(fs.existsSync(file), "snapshot file should be written");

@omniroute/opencode-plugin/tests/feature-defaults.test.ts

@@ -1,95 +0,0 @@
-/**
- * #7624 — explicit feature-flag defaults.
- *
- * The `features` block in opencode.json marks every toggle `.optional()` with
- * no default. The effective value was previously only knowable by tracing the
- * implicit `features.X !== false` (default-ON) / `features.X === true`
- * (default-OFF) convention scattered across each read site, which left
- * operators unsure whether combos / autoCombos / enrichment were enabled when
- * they omitted the block.
- *
- * `OMNIROUTE_FEATURE_DEFAULTS` declares those defaults explicitly and
- * `resolveEffectiveFeatureFlags(features)` derives the effective state for any
- * (possibly-undefined) features object, mirroring the read-site conventions
- * exactly. These are purely derived — runtime routing behaviour is unchanged.
- */
-
-import test from "node:test";
-import assert from "node:assert/strict";
-
-import {
-  OMNIROUTE_FEATURE_DEFAULTS,
-  resolveEffectiveFeatureFlags,
-} from "../src/index.js";
-
-const DEFAULT_ON = [
-  "combos",
-  "autoCombos",
-  "enrichment",
-  "diskCache",
-  "providerTag",
-  "fetchInterceptor",
-  "geminiSanitization",
-] as const;
-
-const DEFAULT_OFF = [
-  "compressionMetadata",
-  "usableOnly",
-  "mcpAutoEmit",
-  "debugLog",
-  "startupDebug",
-] as const;
-
-test("OMNIROUTE_FEATURE_DEFAULTS: declares each flag with its documented default", () => {
-  for (const key of DEFAULT_ON) {
-    assert.equal(OMNIROUTE_FEATURE_DEFAULTS[key], true, `${key} defaults ON`);
-  }
-  for (const key of DEFAULT_OFF) {
-    assert.equal(OMNIROUTE_FEATURE_DEFAULTS[key], false, `${key} defaults OFF`);
-  }
-});
-
-test("resolveEffectiveFeatureFlags: undefined features → full declared default set", () => {
-  const flags = resolveEffectiveFeatureFlags(undefined);
-  for (const key of DEFAULT_ON) {
-    assert.equal(flags[key], true, `${key} effective ON when features omitted`);
-  }
-  for (const key of DEFAULT_OFF) {
-    assert.equal(flags[key], false, `${key} effective OFF when features omitted`);
-  }
-});
-
-test("resolveEffectiveFeatureFlags: empty features object → same as omitted", () => {
-  assert.deepEqual(
-    resolveEffectiveFeatureFlags({}),
-    resolveEffectiveFeatureFlags(undefined)
-  );
-});
-
-test("resolveEffectiveFeatureFlags: explicit false disables a default-ON flag", () => {
-  const flags = resolveEffectiveFeatureFlags({ autoCombos: false });
-  assert.equal(flags.autoCombos, false, "explicit autoCombos:false honoured");
-  // Untouched flags keep their declared defaults.
-  assert.equal(flags.combos, true);
-  assert.equal(flags.enrichment, true);
-});
-
-test("resolveEffectiveFeatureFlags: explicit true enables a default-OFF flag", () => {
-  const flags = resolveEffectiveFeatureFlags({ compressionMetadata: true });
-  assert.equal(flags.compressionMetadata, true, "explicit compressionMetadata:true honoured");
-  assert.equal(flags.usableOnly, false, "other opt-in flags stay OFF");
-});
-
-test("resolveEffectiveFeatureFlags: non-boolean sibling keys do not leak into flags", () => {
-  // features may also carry mcpToken/logLevel/apiFormat — the resolver must
-  // only ever return the boolean toggle keys.
-  const flags = resolveEffectiveFeatureFlags({
-    mcpAutoEmit: true,
-    mcpToken: "sk-mcp-token-abc",
-    logLevel: "debug",
-  });
-  assert.equal(flags.mcpAutoEmit, true);
-  assert.equal(Object.keys(flags).length, Object.keys(OMNIROUTE_FEATURE_DEFAULTS).length);
-  assert.equal("mcpToken" in flags, false);
-  assert.equal("logLevel" in flags, false);
-});

@omniroute/opencode-plugin/tests/fetch-interceptor.test.ts

@@ -50,52 +50,6 @@ test("createOmniRouteFetchInterceptor: targets baseURL → Authorization header
   }
 });
 
-test("createOmniRouteFetchInterceptor: path-prefixed baseURL scopes auth to its normalized inference paths", async () => {
-  const { calls, restore } = installFetchRecorder();
-  try {
-    const prefixedBase = "https://or.example.com/tenant-a/v1";
-    const f = createOmniRouteFetchInterceptor({
-      apiKey: KEY,
-      baseURL: `${prefixedBase}///`,
-    });
-    const streamingBody = '{"stream":true}';
-
-    await f(`${prefixedBase}/chat/completions?trace=1`, {
-      method: "POST",
-      body: streamingBody,
-      headers: { Accept: "text/event-stream" },
-    });
-    await f(`${prefixedBase}/models/?refresh=1`);
-    await f("https://or.example.com/v1/chat/completions", { method: "POST", body: "{}" });
-    await f("https://or.example.com/v1/models");
-    await f("https://or.example.com/tenant-b/v1/chat/completions", {
-      method: "POST",
-      body: "{}",
-    });
-    await f(`${prefixedBase}/chat/completions/batch`, { method: "POST", body: "{}" });
-
-    const headers = calls.map(({ init }) => new Headers(init?.headers));
-    assert.equal(headers[0]?.get("Authorization"), `Bearer ${KEY}`);
-    assert.equal(headers[1]?.get("Authorization"), `Bearer ${KEY}`);
-    for (const index of [2, 3, 4, 5]) {
-      assert.equal(headers[index]?.get("Authorization"), null);
-    }
-    assert.equal(calls[0]?.input, `${prefixedBase}/chat/completions?trace=1`);
-    assert.equal(calls[0]?.init?.body, streamingBody);
-    assert.equal(headers[0]?.get("Accept"), "text/event-stream");
-
-    const suffixingInterceptor = createOmniRouteFetchInterceptor({
-      apiKey: KEY,
-      baseURL: "https://or.example.com/tenant-a/",
-    });
-    await suffixingInterceptor(`${prefixedBase}/models`);
-    const suffixedHeaders = new Headers(calls[6]?.init?.headers);
-    assert.equal(suffixedHeaders.get("Authorization"), `Bearer ${KEY}`);
-  } finally {
-    restore();
-  }
-});
-
 test("createOmniRouteFetchInterceptor: targets baseURL → Authorization OVERRIDES caller-supplied Bearer", async () => {
   const { calls, restore } = installFetchRecorder();
   try {
@@ -305,7 +259,7 @@ test("loader integration: wired interceptor actually injects Bearer when invoked
       {} as never
     );
     const wiredFetch = (result as { fetch: typeof fetch }).fetch;
-    await wiredFetch(`${BASE}/models`, {});
+    await wiredFetch(`${BASE}/v1/models`, {});
     assert.equal(calls.length, 1);
     const sentHeaders = new Headers((calls[0]!.init as RequestInit).headers);
     assert.equal(sentHeaders.get("Authorization"), `Bearer ${KEY}`);

@omniroute/opencode-plugin/tests/management-read-token.test.ts

@@ -1,271 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-
-import {
-  createOmniRouteAuthHook,
-  createOmniRouteConfigHook,
-  createOmniRouteProviderHook,
-  parseOmniRoutePluginOptions,
-  type OmniRouteCompressionMetaFetcher,
-  type OmniRouteEnrichmentFetcher,
-  type OmniRouteProvidersFetcher,
-  type OmniRouteRawModelEntry,
-} from "../src/index.js";
-
-const BASE_URL = "https://or.example.com/v1";
-const API_KEY = "sk-inference-only";
-const MANAGEMENT_READ_TOKEN = "sk-management-read-only";
-
-const RAW_MODELS: OmniRouteRawModelEntry[] = [
-  {
-    id: "openai/gpt-test",
-    context_length: 16_000,
-    max_output_tokens: 4_000,
-    capabilities: {
-      tool_calling: true,
-      reasoning: false,
-      vision: false,
-      thinking: false,
-      temperature: true,
-    },
-    input_modalities: ["text"],
-    output_modalities: ["text"],
-  },
-];
-
-function apiAuth(key: string) {
-  return { type: "api" as const, key };
-}
-
-test("options: managementReadToken is accepted and preserved", () => {
-  const parsed = parseOmniRoutePluginOptions({ managementReadToken: MANAGEMENT_READ_TOKEN });
-  assert.equal(parsed.managementReadToken, MANAGEMENT_READ_TOKEN);
-});
-
-test("provider hook: management GET fetchers use managementReadToken while /v1 uses apiKey", async () => {
-  const calls: Array<[string, string]> = [];
-  const enrichmentFetcher: OmniRouteEnrichmentFetcher = async (_baseURL, token) => {
-    calls.push(["pricing", token]);
-    return new Map();
-  };
-  const compressionMetaFetcher: OmniRouteCompressionMetaFetcher = async (_baseURL, token) => {
-    calls.push(["context", token]);
-    return [];
-  };
-  const providersFetcher: OmniRouteProvidersFetcher = async (_baseURL, token) => {
-    calls.push(["providers", token]);
-    return [];
-  };
-
-  const hook = createOmniRouteProviderHook(
-    {
-      baseURL: BASE_URL,
-      managementReadToken: MANAGEMENT_READ_TOKEN,
-      features: { compressionMetadata: true, usableOnly: true },
-    },
-    {
-      fetcher: async (_baseURL, token) => {
-        calls.push(["models", token]);
-        return RAW_MODELS;
-      },
-      combosFetcher: async (_baseURL, token) => {
-        calls.push(["combos", token]);
-        return [];
-      },
-      autoCombosFetcher: async (_baseURL, token) => {
-        calls.push(["auto-combos", token]);
-        return [];
-      },
-      enrichmentFetcher,
-      compressionMetaFetcher,
-      providersFetcher,
-    }
-  );
-
-  await hook.models!({} as never, { auth: apiAuth(API_KEY) as never });
-
-  assert.deepEqual(calls, [
-    ["models", API_KEY],
-    ["combos", MANAGEMENT_READ_TOKEN],
-    ["auto-combos", MANAGEMENT_READ_TOKEN],
-    ["pricing", MANAGEMENT_READ_TOKEN],
-    ["context", MANAGEMENT_READ_TOKEN],
-    ["providers", MANAGEMENT_READ_TOKEN],
-  ]);
-});
-
-test("provider hook: absent managementReadToken preserves apiKey fallback", async () => {
-  const calls: Array<[string, string]> = [];
-  const hook = createOmniRouteProviderHook(
-    { baseURL: BASE_URL, features: { enrichment: false, autoCombos: false } },
-    {
-      fetcher: async (_baseURL, token) => {
-        calls.push(["models", token]);
-        return RAW_MODELS;
-      },
-      combosFetcher: async (_baseURL, token) => {
-        calls.push(["combos", token]);
-        return [];
-      },
-    }
-  );
-
-  await hook.models!({} as never, { auth: apiAuth(API_KEY) as never });
-
-  assert.deepEqual(calls, [
-    ["models", API_KEY],
-    ["combos", API_KEY],
-  ]);
-});
-
-test("config hook: managementReadToken stays out of provider inference and MCP config", async () => {
-  const calls: Array<[string, string]> = [];
-  const hook = createOmniRouteConfigHook(
-    {
-      baseURL: BASE_URL,
-      managementReadToken: MANAGEMENT_READ_TOKEN,
-      features: { enrichment: false, autoCombos: false, diskCache: false, mcpAutoEmit: true },
-    },
-    {
-      readAuthJson: async () => ({
-        "opencode-omniroute": { type: "api" as const, key: API_KEY },
-      }),
-      fetcher: async (_baseURL, token) => {
-        calls.push(["models", token]);
-        return RAW_MODELS;
-      },
-      combosFetcher: async (_baseURL, token) => {
-        calls.push(["combos", token]);
-        return [];
-      },
-      logger: { warn: () => {} },
-    }
-  );
-  const input: { provider?: Record<string, any>; mcp?: Record<string, any> } = {};
-
-  await hook(input as never);
-
-  assert.deepEqual(calls, [
-    ["models", API_KEY],
-    ["combos", MANAGEMENT_READ_TOKEN],
-  ]);
-  assert.equal(input.provider?.["opencode-omniroute"]?.options?.apiKey, API_KEY);
-  assert.equal(
-    input.mcp?.["opencode-omniroute"]?.headers?.Authorization,
-    `Bearer ${API_KEY}`,
-    "mcpAutoEmit remains independent of managementReadToken"
-  );
-});
-
-test("auth fetch: only intended same-origin inference paths receive apiKey", async () => {
-  const calls: Array<{ input: RequestInfo | URL; init?: RequestInit }> = [];
-  const originalFetch = globalThis.fetch;
-  globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
-    calls.push({ input, init });
-    return new Response("ok");
-  }) as typeof fetch;
-
-  try {
-    const hook = createOmniRouteAuthHook({
-      baseURL: `${BASE_URL}/`,
-      managementReadToken: MANAGEMENT_READ_TOKEN,
-    });
-    const loaded = await hook.loader!(async () => apiAuth(API_KEY) as never, {} as never);
-    const interceptedFetch = (loaded as { fetch: typeof fetch }).fetch;
-
-    const streamingBody = '{"stream":true}';
-    await interceptedFetch(`${BASE_URL}/chat/completions?trace=1`, {
-      method: "POST",
-      body: streamingBody,
-      headers: { Accept: "text/event-stream" },
-    });
-    await interceptedFetch(`${BASE_URL}/models/?refresh=1`);
-    await interceptedFetch("https://or.example.com/api/combos");
-    await interceptedFetch("https://or.example.com/api/mcp/stream");
-    await interceptedFetch("https://or.example.com/v1/embeddings");
-    await interceptedFetch("https://third-party.example/v1/chat/completions", {
-      method: "POST",
-      body: "{}",
-    });
-
-    const headers = calls.map(({ init }) => new Headers(init?.headers));
-    assert.equal(headers[0]?.get("Authorization"), `Bearer ${API_KEY}`);
-    assert.equal(headers[1]?.get("Authorization"), `Bearer ${API_KEY}`);
-    for (const index of [2, 3, 4, 5]) {
-      assert.equal(headers[index]?.get("Authorization"), null);
-    }
-    assert.equal(calls[0]?.input, `${BASE_URL}/chat/completions?trace=1`);
-    assert.equal(calls[0]?.init?.body, streamingBody);
-    assert.equal(headers[0]?.get("Accept"), "text/event-stream");
-    assert.equal(
-      calls.some(({ init }) =>
-        [...new Headers(init?.headers).values()].some((value) =>
-          value.includes(MANAGEMENT_READ_TOKEN)
-        )
-      ),
-      false,
-      "managementReadToken must never enter inference fetch headers"
-    );
-  } finally {
-    globalThis.fetch = originalFetch;
-  }
-});
-
-test("disk cache: snapshot written under management token A is rejected under token B", async () => {
-  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-token-snapshot-"));
-  const previousDataDir = process.env.OPENCODE_DATA_DIR;
-  process.env.OPENCODE_DATA_DIR = tmp;
-
-  try {
-    const commonDeps = {
-      readAuthJson: async () => ({
-        "opencode-omniroute": {
-          type: "api" as const,
-          key: API_KEY,
-          baseURL: BASE_URL,
-        },
-      }),
-      combosFetcher: async () => [],
-      logger: { warn: () => {} },
-    };
-    const features = {
-      enrichment: false,
-      autoCombos: false,
-      diskCache: true,
-    } as const;
-
-    const tokenAHook = createOmniRouteConfigHook(
-      { managementReadToken: "token-A", features },
-      {
-        ...commonDeps,
-        fetcher: async () => RAW_MODELS,
-      }
-    );
-    await tokenAHook({} as never);
-
-    const tokenBHook = createOmniRouteConfigHook(
-      { managementReadToken: "token-B", features },
-      {
-        ...commonDeps,
-        fetcher: async () => {
-          throw new Error("offline");
-        },
-      }
-    );
-    const input: { provider?: Record<string, { models: Record<string, unknown> }> } = {};
-    await tokenBHook(input as never);
-
-    assert.deepEqual(
-      input.provider?.["opencode-omniroute"]?.models,
-      {},
-      "catalog from token A must not hydrate after switching to token B"
-    );
-  } finally {
-    if (previousDataDir === undefined) delete process.env.OPENCODE_DATA_DIR;
-    else process.env.OPENCODE_DATA_DIR = previousDataDir;
-    fs.rmSync(tmp, { recursive: true, force: true });
-  }
-});

@omniroute/opencode-plugin/tests/provider-id-routing.test.ts

@@ -22,11 +22,9 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 import {
-  buildStaticProviderEntry,
   createOmniRouteProviderHook,
   mapRawModelToModelV2,
   resolveOmniRoutePluginOptions,
-  type OmniRouteRawCombo,
 } from "../src/index.js";
 
 /**
@@ -99,43 +97,3 @@ test("#6859: createOmniRouteProviderHook end-to-end — catalog keys/providerID
     "the OC-gate prefix must never leak into ModelV2.providerID"
   );
 });
-
-// #7976: buildStaticProviderEntry (the STATIC provider() config-hook path,
-// exercised when the plugin writes `opencode.json` up front rather than
-// registering the dynamic `provider.models()` hook) never received the
-// #6859 fix. OC dispatches a static-catalog `models` map key verbatim as
-// the `model` field of the outbound request — only the top-level
-// `provider["<id>"]` segment is stripped for routing — so a bare-slug combo
-// key built with the OC-gated `providerId` reaches OmniRoute's server
-// doubled and fails credential lookup for the nonexistent provider
-// `opencode-omniroute`. Confirmed against the issue's own curl repro
-// (`model: "opencode-omniroute/hermes-smart-stack"` → "No active
-// credentials for provider: opencode-omniroute").
-test("#7976: buildStaticProviderEntry keys bare-slug combo ids with the unprefixed omnirouteProviderId (no double OC-gate prefix)", () => {
-  const resolved = resolveOmniRoutePluginOptions({ providerId: "omniroute" });
-  assert.equal(resolved.providerId, "opencode-omniroute");
-  assert.equal(resolved.omnirouteProviderId, "omniroute");
-
-  const combo = {
-    id: "combo-abc123",
-    name: "Hermes Smart Stack",
-    isHidden: false,
-    models: [],
-  } as unknown as OmniRouteRawCombo;
-
-  const block = buildStaticProviderEntry(
-    [],
-    [combo],
-    resolved,
-    "https://or.example/v1",
-    "sk-test"
-  );
-
-  assert.deepEqual(Object.keys(block.models), ["omniroute/hermes-smart-stack"]);
-  assert.equal(
-    block.models["opencode-omniroute/hermes-smart-stack"],
-    undefined,
-    "combo key must not carry the OC-gate-prefixed providerId — it doubles up once " +
-      "OC dispatches it verbatim as the `model` field"
-  );
-});

AGENTS.md

@@ -1,117 +1,596 @@
-# OmniRoute agent guide
+# omniroute — Agent Guidelines
 
 ## Project
 
-OmniRoute is a unified AI proxy/router. The repository contains the Next.js application
-(`src/`), streaming engine workspace (`open-sse/`), Electron desktop app (`electron/`),
-CLI (`bin/`), and tests (`tests/`).
+Unified AI proxy/router — route any LLM through one endpoint. Multi-provider support
+with **250 provider entries** (OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Fireworks,
+Cohere, NVIDIA, Cerebras, Pollinations, Puter, Cloudflare AI, HuggingFace, DeepInfra,
+SambaNova, Meta Llama API, Moonshot AI, AI21 Labs, Databricks, Snowflake, and many more)
+with **MCP Server** (94 tools), **A2A v0.3 Protocol**, and **Electron desktop app**.
 
-## Setup and focused checks
+> **Live counts (v3.8.47)**: providers 250 · MCP tools 94 · MCP scopes 30 · A2A skills 6 ·
+> open-sse services 134 · routing strategies 17 · auto-combo scoring factors 12 ·
+> DB modules 95 · DB migrations 110 · base tables 17 · search providers 11 ·
+> i18n locales 42. **Refresh with `npm run check:docs-all`.**
 
-- Runtime: Node.js `>=22.22.3 <23` or `>=24.0.0 <27`; npm 10+.
-- Install dependencies: `npm install`.
-- Start development: `npm run dev`.
-- Build: `npm run build`; release build: `npm run build:release`.
-- Lint: `npm run lint`.
-- Core type check: `npm run typecheck:core`.
-- Run the most focused test for changed code first:
-  `node --import tsx/esm --test tests/unit/<file>.test.ts`.
-- Other suites: `npm run test:vitest`, `npm run test:e2e`,
-  `npm run test:protocols:e2e`, and `npm run test:ecosystem`.
-- Run `npm run check:docs-all` after changing documentation.
+## Doc Accuracy Discipline (read before writing any doc)
 
-For the complete test matrix, coverage requirements, and pull-request gates, read
-[`CONTRIBUTING.md`](CONTRIBUTING.md#running-tests).
+> **If `grep -rn "name" src/ open-sse/ bin/` returns nothing, the name does not exist. Do not document it.**
 
-## Documentation accuracy
+The recurring failure mode in AI-generated docs is _plausible-but-unverified specifics_.
+Every claim in a `.md` file under `docs/` should be verifiable against the source.
 
-Documentation must describe verified behavior, not plausible behavior.
+**Rules (enforced by `npm run check:fabricated-docs`):**
 
-1. Before documenting an API name, endpoint, path, CLI command, or environment variable,
-   search for it: `rg -n "name" src/ open-sse/ bin/`. If it has no source match, do not
-   document it.
-2. Measure mutable counts instead of writing them from memory: use `wc -l <file>` or a
-   directory-specific count command.
-3. Copy code examples from working usage or run them. Prefer a source link such as
-   `path/to/file.ts:line` to an invented signature.
-4. Run `npm run check:docs-all` for edits under `docs/`; it includes the fabricated-docs
-   validation.
+1. **Never state an API name, endpoint, path, CLI command, or env var without grepping for it first.**
+   ```bash
+   grep -rn "theName" src/ open-sse/ bin/
+   # 0 hits → do not document
+   ```
+2. **Never write a line count, file size, migration count, provider count, or strategy count from memory.**
+   ```bash
+   wc -l <file>           # exact line count
+   ls <dir>/*.ts | wc -l  # file count
+   ```
+3. **Every code example should be copy-pasted from real usage or actually run** — not synthesized.
+   Link to a real call site (`path:line`) instead of inventing a signature.
+4. **Prefer citing real source (`file.ts:line`) over paraphrasing behavior** — verifiable and self-correcting.
+5. **A shorter doc that is 100% accurate beats a comprehensive one with fabrications.**
+   Wrong docs cost more than missing docs, because people trust and act on them.
 
-## Code conventions
+The script `scripts/check/check-fabricated-docs.mjs` extracts every route path, env var, hook
+name, function name, and file reference from `docs/**/*.md` and verifies each one against the
+codebase. Run it locally before pushing docs; it runs in CI via `npm run check:docs-all`.
 
-- Format with Prettier: two spaces, semicolons, double quotes, 100-character line width,
-  and ES5 trailing commas. Run Prettier on changed files.
-- TypeScript target is ES2022 with bundler module resolution. Prefer explicit types.
-- Import order: external, internal (`@/` and `@omniroute/open-sse`), then relative.
-- Do not add logic to `src/lib/localDb.ts`; import from the owning `src/lib/db/` module.
-- Use specific errors and contextual logging. Do not silently swallow SSE-stream failures;
-  use abort signals for cleanup and return appropriate HTTP status codes.
+## Stack
 
-## Security requirements
+- **Runtime**: Next.js 16 (App Router), Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Language**: TypeScript 6.0 (`src/`) + JavaScript (`open-sse/`, `electron/`)
+- **Database**: better-sqlite3 (SQLite) — `DATA_DIR` configurable, default `~/.omniroute/`
+- **Streaming**: SSE via `open-sse` internal workspace package
+- **Styling**: Tailwind CSS v4
+- **i18n**: next-intl with 42 locales (`src/i18n/messages/`) — refresh with `ls src/i18n/messages/*.json | wc -l`
+- **Desktop**: Electron (cross-platform: Windows, macOS, Linux)
+- **Schemas**: Zod v4 for all API / MCP input validation
 
-- Never commit credentials or log SQLite encryption keys.
-- Validate API inputs with Zod and use the route's required authentication path.
-- Sanitize user HTML with DOMPurify.
-- Use `resolvePublicCred()` for public upstream OAuth identifiers; never add them as string
-  literals. See [`docs/security/PUBLIC_CREDS.md`](docs/security/PUBLIC_CREDS.md).
-- Use `buildErrorBody()` or `sanitizeErrorMessage()` for HTTP, SSE, executor, and MCP errors;
-  do not return raw `err.stack` or `err.message`. See
-  [`docs/security/ERROR_SANITIZATION.md`](docs/security/ERROR_SANITIZATION.md).
-- Pass runtime values to `exec()` or `spawn()` through `env`, not interpolation into a script.
+---
 
-## Repository map
+## Build, Lint, and Test Commands
 
-Read the nearest `AGENTS.md` and the linked deep-dive before making a non-trivial change.
+| Command                             | Description                                                        |
+| ----------------------------------- | ------------------------------------------------------------------ |
+| `npm run dev`                       | Start Next.js dev server                                           |
+| `npm run build`                     | Production build: `next build` → `.build/next/` + assemble `dist/` |
+| `npm run build:release`             | Clean rebuild + HEAD sentinel (`dist/BUILD_SHA`) — use for deploy  |
+| `npm run start`                     | Run production build                                               |
+| `npm run build:cli`                 | Build CLI package                                                  |
+| `npm run lint`                      | ESLint on all source files                                         |
+| `npm run typecheck:core`            | TypeScript core type checking                                      |
+| `npm run typecheck:noimplicit:core` | Strict checking (no implicit any)                                  |
+| `npm run check`                     | Run lint + test                                                    |
+| `npm run check:cycles`              | Check for circular dependencies                                    |
+| `npm run electron:dev`              | Run Electron app in dev mode                                       |
+| `npm run electron:build`            | Build Electron app for current OS                                  |
 
-| Area                               | Location                                                | Start here                                                                                                                                       |
-| ---------------------------------- | ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
-| API routes                         | `src/app/api/v1/`                                       | [`docs/architecture/ARCHITECTURE.md`](docs/architecture/ARCHITECTURE.md)                                                                         |
-| Streaming request handling         | `open-sse/handlers/`                                    | [`docs/architecture/ARCHITECTURE.md`](docs/architecture/ARCHITECTURE.md)                                                                         |
-| Provider execution and translation | `open-sse/executors/`, `open-sse/translator/`           | [`docs/architecture/CODEBASE_DOCUMENTATION.md`](docs/architecture/CODEBASE_DOCUMENTATION.md)                                                     |
-| Routing and resilience             | `open-sse/services/`                                    | [`open-sse/services/AGENTS.md`](open-sse/services/AGENTS.md), [`docs/routing/AUTO-COMBO.md`](docs/routing/AUTO-COMBO.md)                         |
-| Database and migrations            | `src/lib/db/`, `db/migrations/`                         | [`src/lib/db/AGENTS.md`](src/lib/db/AGENTS.md)                                                                                                   |
-| Domain policy                      | `src/domain/`                                           | [`docs/architecture/ARCHITECTURE.md`](docs/architecture/ARCHITECTURE.md)                                                                         |
-| MCP and A2A                        | `open-sse/mcp-server/`, `src/lib/a2a/`                  | [`docs/frameworks/MCP-SERVER.md`](docs/frameworks/MCP-SERVER.md), [`docs/frameworks/A2A-SERVER.md`](docs/frameworks/A2A-SERVER.md)               |
-| Agent features                     | `src/lib/{acp,memory,skills,cloudAgent}/`               | [`docs/frameworks/AGENT_PROTOCOLS_GUIDE.md`](docs/frameworks/AGENT_PROTOCOLS_GUIDE.md), [`docs/frameworks/SKILLS.md`](docs/frameworks/SKILLS.md) |
-| Safety and governance              | `src/lib/{guardrails,compliance}/`, `src/server/authz/` | [`docs/security/GUARDRAILS.md`](docs/security/GUARDRAILS.md), [`docs/architecture/AUTHZ_GUIDE.md`](docs/architecture/AUTHZ_GUIDE.md)             |
-| Operations                         | `src/mitm/`, tunnel modules, `electron/`                | [`docs/ops/TUNNELS_GUIDE.md`](docs/ops/TUNNELS_GUIDE.md), [`docs/guides/ELECTRON_GUIDE.md`](docs/guides/ELECTRON_GUIDE.md)                       |
+**Build output layout:**
 
-## Review focus
+| Directory | Purpose                                            | Gitignored |
+| --------- | -------------------------------------------------- | ---------- |
+| `src/`    | Application source (TypeScript / TSX)              | No         |
+| `.build/` | Build intermediates (`distDir = .build/next`)      | Yes        |
+| `dist/`   | Shippable bundle assembled by `assembleStandalone` | Yes        |
 
-- Keep database operations in `src/lib/db/`; do not issue raw SQL from routes.
-- Send provider requests through `open-sse/handlers/`.
-- Keep MCP and A2A pages as tabs inside `/dashboard/endpoint`.
-- Preserve SSE cleanup, rate-limit header parsing, Zod validation, and provider-schema
-  validation.
-- Treat Memory and Skills as cross-cutting changes that can affect MCP tools, the request
-  pipeline, and A2A skills.
-- Do not close a contributor pull request after using its code; merge it through GitHub so
-  the contributor receives credit.
+The pipeline is a single `next build` pass — intermediates land in `.build/next/`, the
+assembled bundle in `dist/`. VPS deploys rsync `dist/` into the remote
+`/usr/lib/node_modules/omniroute/app/` directory (VPS image path is unchanged).
 
-## Upstream contributions
+### Running Tests
 
-This checkout is a fork of `diegosouzapw/OmniRoute`. Keep fork-only deployment and personal
-automation changes out of upstream PRs.
+```bash
+# All tests (unit + vitest + ecosystem + e2e)
+npm run test:all
 
-Start upstream work from the active upstream default branch, not `main`:
+# Single test file (Node.js native test runner — most tests use this)
+node --import tsx/esm --test tests/unit/your-file.test.ts
+node --import tsx/esm --test tests/unit/plan3-p0.test.ts
+node --import tsx/esm --test tests/unit/fixes-p1.test.ts
+node --import tsx/esm --test tests/unit/security-fase01.test.ts
+
+# Integration tests
+node --import tsx/esm --test tests/integration/*.test.ts
+
+# Vitest (MCP server, autoCombo)
+npm run test:vitest
+
+# E2E with Playwright
+npm run test:e2e
+
+# Protocol clients E2E (MCP transports, A2A)
+npm run test:protocols:e2e
+
+# Ecosystem compatibility tests
+npm run test:ecosystem
+
+# Coverage (see CONTRIBUTING.md)
+npm run test:coverage
+```
+
+**For authoritative coverage requirements, test execution, and PR gates, see [`CONTRIBUTING.md`](CONTRIBUTING.md#running-tests).**
+
+---
+
+## Code Style Guidelines
+
+### Formatting (Prettier — enforced via lint-staged)
+
+2 spaces · semicolons required · double quotes (`"`) · 100 char width · es5 trailing commas.
+Always run `prettier --write` on changed files.
+
+### TypeScript
+
+- **Target**: ES2022 · **Module**: `esnext` · **Resolution**: `bundler`
+- `strict: false` — prefer explicit types, don't rely on inference
+- Path aliases: `@/*` → `src/`, `@omniroute/open-sse` → `open-sse/`, `@omniroute/open-sse/*` → `open-sse/*`
+
+### ESLint Rules
+
+- **Security (error, everywhere)**: `no-eval`, `no-implied-eval`, `no-new-func`
+- **Relaxed in `open-sse/` and `tests/`**: `@typescript-eslint/no-explicit-any` = warn
+- React hooks rules and `@next/next/no-assign-module-variable` disabled in `open-sse/` and `tests/`
+
+### Naming
+
+| Element             | Convention                       | Example                              |
+| ------------------- | -------------------------------- | ------------------------------------ |
+| Files               | camelCase / kebab-case           | `chatCore.ts`, `tokenHealthCheck.ts` |
+| React components    | PascalCase                       | `Dashboard.tsx`, `ProviderCard.tsx`  |
+| Functions/variables | camelCase                        | `getHealth()`, `switchCombo()`       |
+| Constants           | UPPER_SNAKE                      | `MAX_RETRIES`, `DEFAULT_TIMEOUT`     |
+| Interfaces          | PascalCase (`I` prefix optional) | `ProviderConfig`                     |
+| Enums               | PascalCase (members too)         | `LogLevel.Error`                     |
+
+### Imports
+
+- **Order**: external → internal (`@/`, `@omniroute/open-sse`) → relative (`./`, `../`)
+- **No barrel imports** from `localDb.ts` — import from the specific `db/` module instead
+
+### Error Handling
+
+- try/catch with specific error types; always log with context (pino logger)
+- Never silently swallow errors in SSE streams — use abort signals for cleanup
+- Return proper HTTP status codes (4xx client, 5xx server)
+
+### Security
+
+- **NEVER** commit API keys, secrets, or credentials
+- Validate all user inputs with Zod schemas
+- Auth middleware required on all API routes
+- Never log SQLite encryption keys
+- Sanitize user content (dompurify for HTML)
+- **Public upstream OAuth identifiers** (Gemini / Antigravity / Windsurf-style client_id/secret + Firebase Web keys extracted from public CLIs): use `resolvePublicCred()` from `open-sse/utils/publicCreds.ts`, **never** as string literals. Full pattern in `docs/security/PUBLIC_CREDS.md`.
+- **Error responses** (HTTP / SSE / executor / MCP): use `buildErrorBody()` or `sanitizeErrorMessage()` from `open-sse/utils/error.ts`, **never** put raw `err.stack` / `err.message` in a Response body. Full pattern in `docs/security/ERROR_SANITIZATION.md`.
+- **`exec()` / `spawn()` with runtime values**: pass via the `env` option, **never** string-interpolate paths/values into the script body. Reference: `src/mitm/cert/install.ts::updateNssDatabases`.
+- Prefer secure-by-default libraries when available — see [tldrsec/awesome-secure-defaults](https://github.com/tldrsec/awesome-secure-defaults) for the curated list (Helmet.js, DOMPurify, ssrf-req-filter, safe-regex, Google Tink, etc.).
+
+---
+
+## Architecture
+
+### Data Layer (`src/lib/db/`)
+
+All persistence uses SQLite through **95 domain-specific modules** in `src/lib/db/`. Top modules:
+
+- Core: `core.ts`, `migrationRunner.ts`, `encryption.ts`, `stateReset.ts`
+- Providers / catalog: `providers.ts`, `models.ts`, `providerLimits.ts`, `compressionAnalytics.ts`
+- Routing: `combos.ts`, `modelComboMappings.ts`, `domainState.ts`, `commandCodeAuth.ts`
+- Auth: `apiKeys.ts`, `secrets.ts`, `registeredKeys.ts`, `sessionAccountAffinity.ts`
+- Usage / billing: `quotaSnapshots.ts`, `creditBalance.ts`, `usage*.ts`, `compressionCacheStats.ts`
+- Storage: `backup.ts`, `cleanup.ts`, `jsonMigration.ts`, `healthCheck.ts`, `databaseSettings.ts`
+- Extension modules: `evals.ts`, `webhooks.ts`, `reasoningCache.ts`, `readCache.ts`, `tierConfig.ts`, `compressionCombos.ts`, `compressionScheduler.ts`, `batches.ts`, `files.ts`, `syncTokens.ts`, `proxies.ts`, `oneproxy.ts`, `upstreamProxy.ts`, `versionManager.ts`, `cliToolState.ts`, `prompts.ts`, `detailedLogs.ts`, `contextHandoffs.ts`, `compression.ts`, `stats.ts`
+
+Live count: `ls src/lib/db/*.ts | wc -l` (currently 95). Drift detection: `npm run check:docs-counts`.
+Schema migrations live in `db/migrations/` (**110 files** as of v3.8.43) and run via `migrationRunner.ts`.
+`src/lib/localDb.ts` is a **re-export layer only** — never add logic there.
+
+#### DB Internals
+
+- **`core.ts`**: `getDbInstance()` returns a singleton `better-sqlite3` instance with WAL
+  journaling. `SCHEMA_SQL` defines **17 base tables** (verify with `grep -c "CREATE TABLE" src/lib/db/core.ts` minus 1 for the bookkeeping `_omniroute_migrations` table). Helpers: `rowToCamel`, `encryptConnectionFields`.
+- **`migrationRunner.ts`**: Applies versioned SQL files from `db/migrations/` inside transactions.
+  Tracks applied migrations in `_omniroute_migrations` table.
+- **Migrations**: 110 files (`001_initial_schema.sql` → `110_*.sql`).
+  Each migration is idempotent and runs in a transaction. Live count: `ls src/lib/db/migrations/*.sql | wc -l`.
+- **Domain modules** import `getDbInstance()` from `core.ts` for all CRUD operations.
+  Each module owns a specific table/set of tables (e.g., `providers.ts` → `provider_connections`,
+  `combos.ts` → `combos`). Encryption helpers protect sensitive fields at rest.
+- **`localDb.ts`** re-exports all domain modules — consumers import from here for convenience.
+
+### API Route Layer (`src/app/api/v1/`)
+
+Next.js App Router routes — each follows a consistent pattern:
+
+```
+Route → CORS preflight → Body validation (Zod) → Optional auth (extractApiKey/isValidApiKey)
+  → API key policy enforcement (enforceApiKeyPolicy) → Handler delegation (open-sse)
+```
+
+| Route                           | Handler                   | Notes                                                         |
+| ------------------------------- | ------------------------- | ------------------------------------------------------------- |
+| `chat/completions/route.ts`     | `handleChat()`            | + prompt injection guard (clones request)                     |
+| `responses/route.ts`            | `handleChat()` (unified)  | Responses API format                                          |
+| `embeddings/route.ts`           | `handleEmbedding()`       | Model listing + creation                                      |
+| `images/generations/route.ts`   | `handleImageGeneration()` | Model listing + creation                                      |
+| `audio/transcriptions/route.ts` | audio handler             | Multipart form data                                           |
+| `audio/speech/route.ts`         | TTS handler               | Binary audio response                                         |
+| `videos/generations/route.ts`   | video handler             | ComfyUI/SD WebUI                                              |
+| `music/generations/route.ts`    | music handler             | ComfyUI workflows                                             |
+| `moderations/route.ts`          | moderation handler        | Content safety                                                |
+| `rerank/route.ts`               | rerank handler            | Document relevance                                            |
+| `search/route.ts`               | search handler            | Web search (12 providers per `open-sse/handlers/search.ts:6`) |
+
+**No global Next.js middleware file** — interception is route-specific. Auth is optional
+(controlled by `REQUIRE_API_KEY` env). Prompt injection guard is unique to chat completions.
+
+### Request Pipeline (`open-sse/`)
+
+The `open-sse/` workspace is the core streaming engine. Full request flow:
+
+```
+Client Request
+  → src/app/api/v1/.../route.ts (Next.js route)
+    → open-sse/handlers/chatCore.ts::handleChatCore()
+      → Semantic/signature cache check
+      → Rate limit check (rateLimitManager)
+      → Combo routing? → open-sse/services/combo.ts::handleComboChat()
+        → resolveComboTargets() → ordered ResolvedComboTarget[]
+        → For each target: handleSingleModel() (wraps chatCore)
+      → translateRequest() (open-sse/translator/)
+        → Convert source format (e.g., OpenAI) → target format (e.g., Claude)
+      → getExecutor() → provider-specific executor instance
+        → executor.execute() (BaseExecutor → DefaultExecutor or provider-specific)
+          → buildUrl() + buildHeaders() + transformRequest()
+          → fetch() to upstream provider
+          → Retry logic with exponential backoff
+      → Response translation back to client format
+      → If Responses API: responsesTransformer.ts TransformStream
+  → SSE stream or JSON response to client
+```
+
+**Handlers** (`open-sse/handlers/`): `chatCore.ts`, `responsesHandler.ts`, `embeddings.ts`,
+`imageGeneration.ts`, `videoGeneration.ts`, `musicGeneration.ts`, `audioSpeech.ts`,
+`audioTranscription.ts`, `moderations.ts`, `rerank.ts`, `search.ts`.
+
+**Upstream headers**: merged after default auth; same header name replaces executor value.
+**T5 intra-family fallback** recomputes headers using only the fallback model id.
+Forbidden header names: `src/shared/constants/upstreamHeaders.ts` — keep sanitize,
+Zod schemas, and unit tests aligned when editing.
+
+### Provider Categories
+
+- **Free** (3): Qoder AI, Qwen Code, Kiro AI
+- **OAuth** (14): Claude Code, Antigravity, Codex, GitHub Copilot, Cursor, Kimi Coding, Kilo Code, Cline, Qwen (⚠️ free tier discontinued 2026-04-15), Kiro, Qoder, Gemini, Windsurf (v3.8), GitLab Duo (v3.8)
+- **API Key** (120+): OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Perplexity,
+  Together, Fireworks, Cerebras, Cohere, NVIDIA, Nebius, SiliconFlow, Hyperbolic,
+  HuggingFace, OpenRouter, Vertex AI, Cloudflare AI, Scaleway, AI/ML API, Pollinations,
+  Puter, Longcat, Alibaba, Kimi, Minimax, Blackbox, Synthetic, Kilo Gateway,
+  Z.AI, GLM, Deepgram, AssemblyAI, ElevenLabs, Cartesia, PlayHT, Inworld,
+  NanoBanana, SD WebUI, ComfyUI, Ollama Cloud, Perplexity Search, Serper, Brave, Exa,
+  Tavily, OpenCode Zen/Go, Bailian Coding Plan, DeepInfra, Vercel AI Gateway,
+  Lambda AI, SambaNova, nScale, OVHcloud AI, Baseten, PublicAI, Moonshot AI,
+  Meta Llama API, v0 (Vercel), Morph, Featherless AI, FriendliAI, LlamaGate,
+  Galadriel, Weights & Biases Inference, Volcengine, AI21 Labs, Venice.ai,
+  Codestral, Upstage, Maritalk, Xiaomi MiMo, Inference.net, NanoGPT, Predibase,
+  Bytez, Heroku AI, Databricks, Snowflake Cortex, GigaChat (Sber), CrofAI,
+  AgentRouter, ChatGPT Web, Baidu Qianfan, AWS Polly, RunwayML, GitLab Duo,
+  Amazon Q, Empower, Poe, and many more.
+- **Self-Hosted** (8+): LM Studio, vLLM, Lemonade, Llamafile, Triton, Docker Model Runner, Xinference, Oobabooga
+- **Custom**: OpenAI-compatible (`openai-compatible-*`) and Anthropic-compatible (`anthropic-compatible-*`) prefixes
+
+Providers are registered in `src/shared/constants/providers.ts` with Zod validation at module load.
+
+### Executors (`open-sse/executors/`)
+
+Provider-specific request executors: `base.ts`, `default.ts`, `cursor.ts`, `codex.ts`,
+`antigravity.ts`, `github.ts`, `kiro.ts`, `qoder.ts`, `vertex.ts`,
+`cloudflare-ai.ts`, `opencode.ts`, `pollinations.ts`, `puter.ts`.
+
+#### Executor Internals
+
+- **`base.ts`** (`BaseExecutor`): Abstract base with `buildUrl()`, `buildHeaders()`,
+  `transformRequest()`, retry logic (exponential backoff), and `execute()`. Subclasses
+  override URL/header/transform methods for provider-specific behavior.
+- **`default.ts`** (`DefaultExecutor extends BaseExecutor`): Handles most OpenAI-compatible
+  providers. Reads provider config from `providerRegistry.ts` to resolve base URL, auth
+  header format, and request transformations.
+- **`getExecutor()`** (`executors/index.ts`): Factory that returns the correct executor
+  instance based on provider ID. Provider-specific executors (Cursor, Codex, Vertex, etc.)
+  override only what differs from the default.
+
+### Translator (`open-sse/translator/`)
+
+Translates between API formats (OpenAI-format ↔ Anthropic, Gemini, etc.).
+Includes request/response translators with helpers for image handling.
+
+#### Translator Internals
+
+- **`translator/index.ts`**: Exports `translateRequest()` and format constants. Called by
+  `chatCore.ts` before executor dispatch.
+- **Flow**: `translateRequest(body, sourceFormat, targetFormat)` → detects source format
+  (OpenAI, Anthropic, Gemini) → applies the matching translator module → returns
+  transformed body ready for the target provider.
+- **Response translation** runs in reverse after upstream response, converting back to
+  the client's expected format.
+
+### Transformer (`open-sse/transformer/`)
+
+`responsesTransformer.ts` — transforms Responses API format to/from Chat Completions format.
+
+#### Transformer Internals
+
+- **`createResponsesApiTransformStream()`**: Returns a `TransformStream` that converts
+  Chat Completions SSE chunks (`data: {"choices":[...]}`) into Responses API SSE events
+  (`response.output_item.added`, `response.output_text.delta`, etc.).
+- Used when the client sends a Responses API request: the request is internally converted
+  to Chat Completions format, dispatched normally, and the response is piped through this
+  transform stream before reaching the client.
+
+### Services (`open-sse/services/`)
+
+134 service modules in `open-sse/services/` (top-level only; more including sub-dirs like `autoCombo/` and `compression/`). Refresh: `ls open-sse/services/*.ts | wc -l`. Key modules:
+`combo.ts` (routing engine), `usage.ts`, `tokenRefresh.ts`,
+`rateLimitManager.ts`, `accountFallback.ts`, `sessionManager.ts`, `wildcardRouter.ts`,
+`autoCombo/`, `intentClassifier.ts`, `taskAwareRouter.ts`, `thinkingBudget.ts`,
+`contextManager.ts`, `modelDeprecation.ts`, `modelFamilyFallback.ts`,
+`emergencyFallback.ts`, `workflowFSM.ts`, `backgroundTaskDetector.ts`, `ipFilter.ts`,
+`signatureCache.ts`, `volumeDetector.ts`, `contextHandoff.ts`, `compression/` (prompt
+compression pipeline), and more.
+
+#### Prompt Compression Pipeline (`compression/`)
+
+Modular prompt compression that runs proactively before the existing reactive context manager.
+
+- **`strategySelector.ts`**: Selects compression mode based on config, compression combo assignments,
+  combo overrides, auto-trigger thresholds, and defaults. Priority: assigned compression combo >
+  combo override > auto-trigger > default mode > off.
+- **`lite.ts`**: 5 lite-mode techniques: `collapseWhitespace`, `dedupSystemPrompt`,
+  `compressToolResults`, `removeRedundantContent`, `replaceImageUrls`. Target: 10-15% savings at
+  <1ms latency.
+- **`caveman.ts` / `cavemanRules.ts`**: Caveman-style semantic condensation backed by built-in
+  rules plus file-loaded language packs under `compression/rules/`.
+- **`engines/rtk/`**: Rule-based terminal/tool-output compression inspired by RTK patterns. Detects
+  command output classes, applies JSON filter packs, deduplicates repeated lines, strips ANSI/code
+  noise, and preserves errors/actionable context. The RTK JSON DSL supports replace,
+  match-output short-circuit, strip/keep, per-line truncation, head/tail/max-line truncation,
+  inline tests, trust-gated project/global custom filters, and optional redacted raw-output
+  retention for authenticated recovery.
+- **`engines/registry.ts`**: Registers engines (`caveman`, `rtk`) and powers stacked pipelines.
+- **`stats.ts`**: Per-request compression stats tracking (original tokens, compressed tokens,
+  savings %, techniques used, engine breakdown, compression combo id).
+- **`types.ts`**: `CompressionMode` (off/lite/standard/aggressive/ultra/rtk/stacked),
+  `CompressionConfig`, `CompressionStats`, `CompressionResult`.
+- DB settings in `src/lib/db/compression.ts`, compression combos in
+  `src/lib/db/compressionCombos.ts`, API routes under `src/app/api/settings/compression/`,
+  `src/app/api/context/*`, and preview/language-pack routes under `src/app/api/compression/*`.
+
+#### Combo Routing Engine (`combo.ts`)
+
+- **`handleComboChat()`**: Entry point for combo-routed requests. Receives the combo config
+  and iterates through targets in order until one succeeds or all fail.
+- **`resolveComboTargets()`**: Expands a combo configuration into an ordered array of
+  `ResolvedComboTarget[]`, each specifying provider + model + account + credentials.
+- **Strategies** (17): priority, weighted, fill-first, round-robin, P2C, random, least-used, reset-aware (v3.8),
+  reset-window, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, headroom, fusion. Source: `ROUTING_STRATEGY_VALUES` in `src/shared/constants/routingStrategies.ts`.
+- Each target calls **`handleSingleModel()`** which wraps `handleChatCore()` with
+  per-target error handling and circuit breaker checks.
+
+### Domain Layer (`src/domain/`)
+
+Policy engine modules: `policyEngine.ts`, `comboResolver.ts`, `costRules.ts`,
+`degradation.ts`, `fallbackPolicy.ts`, `lockoutPolicy.ts`, `modelAvailability.ts`,
+`providerExpiration.ts`, `quotaCache.ts`, `responses.ts`, `configAudit.ts`.
+
+### MCP Server (`open-sse/mcp-server/`)
+
+**94 tools** total (`TOTAL_MCP_TOOL_COUNT`, `open-sse/mcp-server/server.ts`): a 34-entry base registry (`MCP_TOOLS` in `schemas/tools.ts`, bundling the core / cache / compression / 1proxy / advanced tools) **plus** standalone module sets — memory (3), skill (4), agentSkill (3), pool (6), gamification (8), plugin (8), notion (6), obsidian (22). 3 transports (stdio / SSE / Streamable HTTP). Scoped auth (30 scopes — see `OMNIROUTE_MCP_SCOPES`), Zod schemas. See [`docs/frameworks/MCP-SERVER.md`](docs/frameworks/MCP-SERVER.md).
+
+**Core tools** (20): get_health, list_combos, get_combo_metrics, switch_combo, check_quota,
+route_request, cost_report, list_models_catalog, web_search, simulate_route, set_budget_guard,
+set_routing_strategy, set_resilience_profile, test_combo, get_provider_metrics,
+best_combo_for_task, explain_route, get_session_snapshot, db_health_check, sync_pricing.
+
+**Cache tools** (2): cache_stats, cache_flush.
+
+**Compression tools** (5): compression_status, compression_configure, set_compression_engine,
+list_compression_combos, compression_combo_stats.
+
+**1proxy tools** (3): oneproxy_fetch, oneproxy_rotate, oneproxy_stats.
+
+**Memory tools** (3): memory_search, memory_add, memory_clear.
+
+**Skill tools** (4): skills_list, skills_enable, skills_execute, skills_executions.
+
+**Agent-skill tools** (3): A2A skill discovery / invocation bridges.
+
+**Gamification tools** (8): levels, badges, leaderboard, and community-federation queries.
+
+**Plugin tools** (8): plugin marketplace listing, install/enable/disable, and runtime inspection.
+
+**Notion tools** (6) + **Obsidian tools** (22): knowledge-base read/write integrations (the largest tool family — vault search, note CRUD, WebDAV-backed file ops).
+
+#### MCP Internals
+
+- **Tool registration**: Each tool is an object with `{ name, description, inputSchema: ZodSchema,
+handler: async (args) => {...} }`. Zod validates inputs before the handler fires.
+- **`createMcpServer()`** and **`startMcpStdio()`** exported from `mcp-server/index.ts`.
+  `createMcpServer()` wires all tool sets; `startMcpStdio()` launches the stdio transport.
+- **Transports**: stdio (CLI `omniroute --mcp`), SSE (`/api/mcp/sse`), Streamable HTTP
+  (`/api/mcp/stream`). All share the same tool/scope engine.
+- **Scopes** (30): Control which tool categories an API key can access. Enforcement happens
+  before handler dispatch.
+- **Audit**: Every tool invocation is logged to SQLite (`mcp_audit` table) with tool name,
+  args, success/failure, API key attribution, and timestamp.
+
+### A2A Server (`src/lib/a2a/`)
+
+JSON-RPC 2.0, SSE streaming, Task Manager with TTL cleanup.
+Agent Card at `/.well-known/agent.json`.
+Skills (6): `smartRouting.ts`, `quotaManagement.ts`, `providerDiscovery.ts`, `costAnalysis.ts`, `healthReport.ts`, `listCapabilities.ts`.
+
+#### A2A Internals
+
+- **`taskManager.ts`**: State machine lifecycle for tasks: `submitted → working →
+completed | failed | canceled`. Tasks have TTL and are cleaned up automatically.
+- **JSON-RPC methods**: `message/send` (sync), `message/stream` (SSE), `tasks/get`,
+  `tasks/cancel`. Dispatched via `POST /a2a`.
+- **Skills**: Registered in a DB-backed registry. Each skill receives task context
+  (messages, metadata) and returns structured results. `quotaManagement.ts` summarizes
+  quota; `smartRouting.ts` recommends routing decisions.
+- **Agent Card**: `/.well-known/agent.json` exposes capabilities, skills, and metadata
+  for client auto-discovery.
+
+### ACP Module (`src/lib/acp/`)
+
+Agent Communication Protocol registry and manager.
+
+### Memory System (`src/lib/memory/`)
+
+Extraction, injection, retrieval, summarization, and store modules for persistent
+conversational memory across sessions.
+
+### Skills System (`src/lib/skills/`)
+
+Extensible skill framework: registry, executor, sandbox, built-in skills,
+custom skill support, interception, and injection.
+
+#### Skills Internals
+
+- **`registry.ts`**: DB-backed skill registration and discovery. Skills have metadata
+  (name, description, version, enabled status) stored in SQLite.
+- **`executor.ts`**: Execution engine with configurable timeout and retry logic.
+  Receives skill name + input, looks up the skill, runs it in the sandbox.
+- **`sandbox.ts`**: Isolation layer for custom (user-provided) skills. Limits resource
+  access and execution time.
+- **Built-in skills**: Ship with OmniRoute (e.g., quota management, routing). Located
+  alongside the registry.
+- **Interception/Injection**: Skills can intercept requests in the pipeline (pre/post
+  processing) or inject context into prompts.
+
+### Compliance (`src/lib/compliance/`)
+
+Policy index for compliance enforcement.
+
+### MITM Proxy (`src/mitm/`)
+
+MITM proxy capability with certificate management, DNS handling, and target routing.
+
+### Middleware (`src/middleware/`)
+
+Request middleware including `promptInjectionGuard.ts`.
+
+### Guardrails (`src/lib/guardrails/`)
+
+Hot-reloadable guardrails framework (3 built-in: pii-masker, prompt-injection, vision-bridge). Fail-open. The `pii-masker` guardrail is registered and runs on every request, but its data-mutating logic is **opt-in** and OFF by default — it only redacts when `PII_REDACTION_ENABLED` (request) / `PII_RESPONSE_SANITIZATION` (response + streaming) are enabled (both `defaultValue: "false"`); with them off, payloads pass through untouched. A request can additionally opt OUT of any guardrail via header (`x-omniroute-disabled-guardrails`). Never make PII default-on (Hard Rule #20). See [`docs/security/GUARDRAILS.md`](docs/security/GUARDRAILS.md).
+
+### Cloud Agents (`src/lib/cloudAgent/`)
+
+`CloudAgentBase` abstract class + 3 agents (codex-cloud, devin, jules). Tasks persisted in `cloud_agent_tasks`; management auth required. See [`docs/frameworks/CLOUD_AGENT.md`](docs/frameworks/CLOUD_AGENT.md).
+
+### Evals (`src/lib/evals/`)
+
+Generic eval framework: `evalRunner.ts`, `runtime.ts`. Targets: combo / model / suite-default. See [`docs/frameworks/EVALS.md`](docs/frameworks/EVALS.md).
+
+### Webhooks (`src/lib/webhookDispatcher.ts`)
+
+HMAC-signed delivery, exponential backoff, auto-disable after 10 failures. 7 event types. See [`docs/frameworks/WEBHOOKS.md`](docs/frameworks/WEBHOOKS.md).
+
+### Authorization Pipeline (`src/server/authz/`)
+
+`classify → policies → enforce`. 3 route classes (PUBLIC / CLIENT_API / MANAGEMENT). See [`docs/architecture/AUTHZ_GUIDE.md`](docs/architecture/AUTHZ_GUIDE.md).
+
+### Reasoning Replay (`src/lib/db/reasoningCache.ts` + `open-sse/services/reasoningCache.ts`)
+
+Hybrid in-memory + SQLite cache for `reasoning_content`. Re-injects on multi-turn for strict providers (DeepSeek V4, Kimi K2, Qwen-Thinking, GLM, xiaomi-mimo). See [`docs/routing/REASONING_REPLAY.md`](docs/routing/REASONING_REPLAY.md).
+
+### Tunnels (`src/lib/{cloudflaredTunnel,ngrokTunnel}.ts` + `src/app/api/tunnels/`)
+
+Cloudflare Quick/Named, ngrok, Tailscale Funnel. See [`docs/ops/TUNNELS_GUIDE.md`](docs/ops/TUNNELS_GUIDE.md).
+
+### Adding a New Provider
+
+1. Register in `src/shared/constants/providers.ts`
+2. Add executor in `open-sse/executors/` (if custom logic needed)
+3. Add translator in `open-sse/translator/` (if non-OpenAI format)
+4. Add OAuth config in `src/lib/oauth/constants/oauth.ts` (if OAuth-based)
+5. Add models in `open-sse/config/providerRegistry.ts`
+
+---
+
+## Subdirectory AGENTS.md Files
+
+- **[`src/lib/db/AGENTS.md`](src/lib/db/AGENTS.md)** — SQLite persistence, domain modules, migrations
+- **[`open-sse/services/AGENTS.md`](open-sse/services/AGENTS.md)** — Routing engine, combo resolution, strategy selection
+
+## Reference Documentation (docs/)
+
+For any non-trivial change, read the matching deep-dive first:
+
+| Area                                       | Doc                                                                                                             |
+| ------------------------------------------ | --------------------------------------------------------------------------------------------------------------- |
+| Repo navigation                            | [`docs/architecture/REPOSITORY_MAP.md`](docs/architecture/REPOSITORY_MAP.md)                                    |
+| Architecture                               | [`docs/architecture/ARCHITECTURE.md`](docs/architecture/ARCHITECTURE.md)                                        |
+| Engineering reference                      | [`docs/architecture/CODEBASE_DOCUMENTATION.md`](docs/architecture/CODEBASE_DOCUMENTATION.md)                    |
+| Auto-Combo (12-factor, 18 strategies)      | [`docs/routing/AUTO-COMBO.md`](docs/routing/AUTO-COMBO.md)                                                      |
+| Resilience (3 layers)                      | [`docs/architecture/RESILIENCE_GUIDE.md`](docs/architecture/RESILIENCE_GUIDE.md)                                |
+| Skills                                     | [`docs/frameworks/SKILLS.md`](docs/frameworks/SKILLS.md)                                                        |
+| Memory                                     | [`docs/frameworks/MEMORY.md`](docs/frameworks/MEMORY.md)                                                        |
+| Cloud agents                               | [`docs/frameworks/CLOUD_AGENT.md`](docs/frameworks/CLOUD_AGENT.md)                                              |
+| Guardrails                                 | [`docs/security/GUARDRAILS.md`](docs/security/GUARDRAILS.md)                                                    |
+| Evals                                      | [`docs/frameworks/EVALS.md`](docs/frameworks/EVALS.md)                                                          |
+| Compliance                                 | [`docs/security/COMPLIANCE.md`](docs/security/COMPLIANCE.md)                                                    |
+| Webhooks                                   | [`docs/frameworks/WEBHOOKS.md`](docs/frameworks/WEBHOOKS.md)                                                    |
+| Authz                                      | [`docs/architecture/AUTHZ_GUIDE.md`](docs/architecture/AUTHZ_GUIDE.md)                                          |
+| Stealth                                    | [`docs/security/STEALTH_GUIDE.md`](docs/security/STEALTH_GUIDE.md)                                              |
+| Reasoning replay                           | [`docs/routing/REASONING_REPLAY.md`](docs/routing/REASONING_REPLAY.md)                                          |
+| Agent protocols (A2A / ACP / Cloud)        | [`docs/frameworks/AGENT_PROTOCOLS_GUIDE.md`](docs/frameworks/AGENT_PROTOCOLS_GUIDE.md)                          |
+| MCP server                                 | [`docs/frameworks/MCP-SERVER.md`](docs/frameworks/MCP-SERVER.md)                                                |
+| A2A server                                 | [`docs/frameworks/A2A-SERVER.md`](docs/frameworks/A2A-SERVER.md)                                                |
+| API reference                              | [`docs/reference/API_REFERENCE.md`](docs/reference/API_REFERENCE.md) + [`docs/openapi.yaml`](docs/openapi.yaml) |
+| Provider catalog (auto-generated)          | [`docs/reference/PROVIDER_REFERENCE.md`](docs/reference/PROVIDER_REFERENCE.md)                                  |
+| Tunnels                                    | [`docs/ops/TUNNELS_GUIDE.md`](docs/ops/TUNNELS_GUIDE.md)                                                        |
+| Electron desktop                           | [`docs/guides/ELECTRON_GUIDE.md`](docs/guides/ELECTRON_GUIDE.md)                                                |
+| Release flow                               | [`docs/ops/RELEASE_CHECKLIST.md`](docs/ops/RELEASE_CHECKLIST.md)                                                |
+| Quality gates (35 gates, allowlist policy) | [`docs/architecture/QUALITY_GATES.md`](docs/architecture/QUALITY_GATES.md)                                      |
+| Cluster opt-in profiles (memory, bifrost)  | [`docs/architecture/cluster-decisions.md`](docs/architecture/cluster-decisions.md)                              |
+
+---
+
+## Fork / Upstream Workflow
+
+This repository is a fork of `diegosouzapw/OmniRoute`. Keep fork-only operational
+changes (for example GHCR image publishing, personal deployment workflows, or local
+automation) out of upstream contribution PRs.
+
+When preparing a PR for upstream, always start the work branch from `upstream/main`,
+not from this fork's `main`:
 
 ```bash
 git fetch upstream
-git switch -c <branch-name> upstream/<default-branch>
+git switch -c <branch-name> upstream/main
 ```
 
-Target that same release branch in the pull request. Stage only the intended files, run the
-focused checks, and use a Conventional Commit message (for example, `docs: slim AGENTS.md`).
+Only cherry-pick or reapply the changes intended for the upstream PR.
 
-## Reference documentation
+---
 
-Use the source of truth for the area you are changing:
+## Review Focus
 
-| Area                                   | Reference                                                                                                                                                                                                                                              |
-| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Repository navigation and architecture | [`docs/architecture/REPOSITORY_MAP.md`](docs/architecture/REPOSITORY_MAP.md), [`docs/architecture/ARCHITECTURE.md`](docs/architecture/ARCHITECTURE.md)                                                                                                 |
-| API and providers                      | [`docs/reference/API_REFERENCE.md`](docs/reference/API_REFERENCE.md), [`docs/reference/PROVIDER_REFERENCE.md`](docs/reference/PROVIDER_REFERENCE.md), [`docs/openapi.yaml`](docs/openapi.yaml)                                                         |
-| Routing, resilience, and reasoning     | [`docs/routing/AUTO-COMBO.md`](docs/routing/AUTO-COMBO.md), [`docs/architecture/RESILIENCE_GUIDE.md`](docs/architecture/RESILIENCE_GUIDE.md), [`docs/routing/REASONING_REPLAY.md`](docs/routing/REASONING_REPLAY.md)                                   |
-| Security                               | [`docs/security/GUARDRAILS.md`](docs/security/GUARDRAILS.md), [`docs/security/COMPLIANCE.md`](docs/security/COMPLIANCE.md), [`docs/security/STEALTH_GUIDE.md`](docs/security/STEALTH_GUIDE.md)                                                         |
-| Platform features                      | [`docs/frameworks/MCP-SERVER.md`](docs/frameworks/MCP-SERVER.md), [`docs/frameworks/A2A-SERVER.md`](docs/frameworks/A2A-SERVER.md), [`docs/frameworks/SKILLS.md`](docs/frameworks/SKILLS.md), [`docs/frameworks/MEMORY.md`](docs/frameworks/MEMORY.md) |
-| Releases and quality                   | [`docs/ops/RELEASE_CHECKLIST.md`](docs/ops/RELEASE_CHECKLIST.md), [`docs/architecture/QUALITY_GATES.md`](docs/architecture/QUALITY_GATES.md)                                                                                                           |
+- **DB ops** go through `src/lib/db/` modules, never raw SQL in routes
+- **Provider requests** flow through `open-sse/handlers/`
+- **MCP/A2A pages** are tabs inside `/dashboard/endpoint`, not standalone routes
+- **No memory leaks** in SSE streams (abort signals, cleanup)
+- **Rate limit headers** must be parsed correctly
+- All API inputs validated with **Zod schemas**
+- **Provider constants** validated at module load via Zod (`src/shared/validation/providerSchema.ts`)
+- **Pricing data** syncs from LiteLLM via `src/lib/pricingSync.ts`
+- **Memory/Skills** are cross-cutting: affect MCP tools, request pipeline, and A2A skills
+- **⛔ NEVER close a contributor's PR** after using their code — always merge via GitHub so they get credit. See `.agents/workflows/review-prs.md` for full policy.

CLAUDE.md

@@ -35,22 +35,22 @@ For full test matrix, see `CONTRIBUTING.md` → "Running Tests". For deep archit
 
 ## Project at a Glance
 
-**OmniRoute** — unified AI proxy/router. One endpoint, 290 LLM providers, auto-fallback.
+**OmniRoute** — unified AI proxy/router. One endpoint, 250 LLM providers, auto-fallback.
 
-| Layer         | Location                | Purpose                                                                                                                                                 |
-| ------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| API Routes    | `src/app/api/v1/`       | Next.js App Router — entry points                                                                                                                       |
-| Handlers      | `open-sse/handlers/`    | Request processing (chat, embeddings, etc)                                                                                                              |
-| Executors     | `open-sse/executors/`   | Provider-specific HTTP dispatch                                                                                                                         |
-| Translators   | `open-sse/translator/`  | Format conversion (OpenAI↔Claude↔Gemini)                                                                                                                |
-| Transformer   | `open-sse/transformer/` | Responses API ↔ Chat Completions                                                                                                                        |
-| Services      | `open-sse/services/`    | Combo routing, rate limits, caching, etc                                                                                                                |
-| Database      | `src/lib/db/`           | SQLite domain modules (130 migrations)                                                                                                                  |
-| Domain/Policy | `src/domain/`           | Policy engine, cost rules, fallback logic                                                                                                               |
-| MCP Server    | `open-sse/mcp-server/`  | 104 tools (42 base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules), 3 transports (stdio / SSE / Streamable HTTP), 31 scopes |
-| A2A Server    | `src/lib/a2a/`          | JSON-RPC 2.0 agent protocol                                                                                                                             |
-| Skills        | `src/lib/skills/`       | Extensible skill framework                                                                                                                              |
-| Memory        | `src/lib/memory/`       | Persistent conversational memory                                                                                                                        |
+| Layer         | Location                | Purpose                                                                                                                                                |
+| ------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| API Routes    | `src/app/api/v1/`       | Next.js App Router — entry points                                                                                                                      |
+| Handlers      | `open-sse/handlers/`    | Request processing (chat, embeddings, etc)                                                                                                             |
+| Executors     | `open-sse/executors/`   | Provider-specific HTTP dispatch                                                                                                                        |
+| Translators   | `open-sse/translator/`  | Format conversion (OpenAI↔Claude↔Gemini)                                                                                                               |
+| Transformer   | `open-sse/transformer/` | Responses API ↔ Chat Completions                                                                                                                       |
+| Services      | `open-sse/services/`    | Combo routing, rate limits, caching, etc                                                                                                               |
+| Database      | `src/lib/db/`           | SQLite domain modules (95 files, 110 migrations)                                                                                                       |
+| Domain/Policy | `src/domain/`           | Policy engine, cost rules, fallback logic                                                                                                              |
+| MCP Server    | `open-sse/mcp-server/`  | 94 tools (34 base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules), 3 transports (stdio / SSE / Streamable HTTP), 30 scopes |
+| A2A Server    | `src/lib/a2a/`          | JSON-RPC 2.0 agent protocol                                                                                                                            |
+| Skills        | `src/lib/skills/`       | Extensible skill framework                                                                                                                             |
+| Memory        | `src/lib/memory/`       | Persistent conversational memory                                                                                                                       |
 
 Monorepo: `src/` (Next.js 16 app), `open-sse/` (streaming engine workspace), `electron/` (desktop app), `tests/`, `bin/` (CLI entry point).
 
@@ -72,7 +72,7 @@ Client → /v1/chat/completions (Next.js route)
 
 API routes follow a consistent pattern: `Route → CORS preflight → Zod body validation → Optional auth (extractApiKey/isValidApiKey) → API key policy enforcement → Handler delegation (open-sse)`. No global Next.js middleware — interception is route-specific.
 
-**Combo routing** (`open-sse/services/combo.ts`): 19 public strategies (priority, weighted, fill-first, round-robin, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, cache-optimized, context-relay, fusion, pipeline). Each target calls `handleSingleModel()` which wraps `handleChatCore()` with per-target error handling and circuit breaker checks. The `fusion` strategy is the exception: it fans out to a panel of models in parallel, then a judge model synthesizes one final answer (`open-sse/services/fusion.ts`). See `docs/routing/AUTO-COMBO.md` for the 13-factor Auto-Combo scoring + the full strategy table and `docs/architecture/RESILIENCE_GUIDE.md` for the 3 resilience layers.
+**Combo routing** (`open-sse/services/combo.ts`): 18 strategies (priority, weighted, fill-first, round-robin, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline). Each target calls `handleSingleModel()` which wraps `handleChatCore()` with per-target error handling and circuit breaker checks. The `fusion` strategy is the exception: it fans out to a panel of models in parallel, then a judge model synthesizes one final answer (`open-sse/services/fusion.ts`). See `docs/routing/AUTO-COMBO.md` for the 12-factor Auto-Combo scoring + the full strategy table and `docs/architecture/RESILIENCE_GUIDE.md` for the 3 resilience layers.
 
 ---
 
@@ -332,7 +332,7 @@ For any non-trivial change, read the matching deep-dive first:
 | Repo navigation                               | `docs/architecture/REPOSITORY_MAP.md`                   |
 | Architecture                                  | `docs/architecture/ARCHITECTURE.md`                     |
 | Engineering reference                         | `docs/architecture/CODEBASE_DOCUMENTATION.md`           |
-| Auto-Combo (13-factor scoring, 19 strategies) | `docs/routing/AUTO-COMBO.md`                            |
+| Auto-Combo (12-factor scoring, 18 strategies) | `docs/routing/AUTO-COMBO.md`                            |
 | Resilience (3 mechanisms)                     | `docs/architecture/RESILIENCE_GUIDE.md`                 |
 | Reasoning replay                              | `docs/routing/REASONING_REPLAY.md`                      |
 | Skills framework                              | `docs/frameworks/SKILLS.md`                             |
@@ -461,18 +461,10 @@ own dedicated branch, and you MUST confirm the base branch with the operator bef
    git fetch origin "$BASE_BRANCH"
    git worktree add ".claude/worktrees/${TASK##*/}" -b "$TASK" "origin/$BASE_BRANCH"
    cd ".claude/worktrees/${TASK##*/}"
-   # Reuse the main checkout's node_modules to skip a per-worktree npm install.
-   # HARD LINKS (`cp -al`), never a symlink: ~5s for the whole tree and near-zero extra
-   # disk (the inodes are shared), and unlike a symlink it does not break the dev server.
-   cp -al "$(git -C <main_checkout> rev-parse --show-toplevel)/node_modules" node_modules
+   # symlink node_modules from the main checkout to skip a per-worktree npm install:
+   ln -s "$(git -C <main_checkout> rev-parse --show-toplevel)/node_modules" node_modules
    ```
 
-   **Never `ln -s` node_modules.** Turbopack rejects a symlink that resolves outside the
-   project root, so `npm run dev` dies with a FATAL panic (`Symlink [project]/node_modules
-   is invalid, it points out of the filesystem root`) while typecheck, lint and the test
-   runners all keep passing — the error names "filesystem root", not the worktree, so it
-   reads like a Next/build bug and costs real time to trace (incident 2026-07-31, #9043).
-
    In Claude Code prefer the native `EnterWorktree` tool (it already creates worktrees under
    `.claude/worktrees/`): create the worktree with the command above, then call `EnterWorktree`
    with its `path`.
@@ -490,8 +482,8 @@ list` shows worktrees you didn't create, leave them alone. End every session wit
 
 ## Environment
 
-- **Runtime**: Node.js ≥22.0.0 <23 || ≥24.0.0 <27, ES Modules. This is the **only supported** runtime for the published `omniroute` CLI, the server, and the test suites (`node:test` + vitest) — `engines.node` is authoritative and end users never need Bun. A **best-effort `bun:sqlite` compatibility path** exists so a global Bun install (`bun install -g omniroute`) can start without `better-sqlite3` (driver adapter + Bun-aware process spawning); it is **not** a supported runtime — no support guarantees — and every Bun-specific runtime change MUST preserve the Node driver/fallback chain and ship a Bun test (`test:bun:db`) or an explicit reason why the path is Node-only.
-- **Bun (build/dev script runner + compatibility smoke only)**: Bun `1.3.14` is pinned as an **exact devDependency** (provisioned through the existing `npm ci` via the lockfile's `@oven/bun-*` platform binaries — no `setup-bun`/ad-hoc install). It is used **only** to execute a small, allow-listed set of TypeScript **gate/generator scripts** (replacing `node --import tsx` for startup speed): the CI checks `check:provider-consistency`, `check:compression-budget`, `check:known-symbols`, and the non-CI `gen:provider-reference`, `bench:compression` — plus the focused `test:bun:db` compatibility smoke suite for the best-effort `bun:sqlite` path. **Do NOT** widen Bun to `npm install`, the build (`build:cli*`), `check:pack-artifact`, the supported published runtime, or the main test runners — those stay on Node. Any new Bun-invoking gate/generator script must be validated byte-identical against its `node --import tsx` output first. After pulling the lockfile change, run `npm install` so `bun` resolves locally (a stale `node_modules` will fail those scripts with `bun: not found`).
+- **Runtime**: Node.js ≥22.0.0 <23 || ≥24.0.0 <27, ES Modules. This is the **only** runtime for the published `omniroute` CLI, the server, and the test suites (`node:test` + vitest) — `engines.node` is authoritative and end users never need Bun.
+- **Bun (build/dev script runner only)**: Bun `1.3.10` is pinned as an **exact devDependency** (provisioned through the existing `npm ci` via the lockfile's `@oven/bun-*` platform binaries — no `setup-bun`/ad-hoc install). It is used **only** to execute a small, allow-listed set of TypeScript **gate/generator scripts** (replacing `node --import tsx` for startup speed): the CI checks `check:provider-consistency`, `check:compression-budget`, `check:known-symbols`, and the non-CI `gen:provider-reference`, `bench:compression`. **Do NOT** widen Bun to `npm install`, the build (`build:cli*`), `check:pack-artifact`, the published runtime, or the test runners — those stay on Node. Any new Bun-invoking script must be validated byte-identical against its `node --import tsx` output first. After pulling the lockfile change, run `npm install` so `bun` resolves locally (a stale `node_modules` will fail those 5 scripts with `bun: not found`).
 - **TypeScript**: 6.0+, target ES2022, module esnext, resolution bundler
 - **Path aliases**: `@/*` → `src/`, `@omniroute/open-sse` → `open-sse/`, `@omniroute/open-sse/*` → `open-sse/*`
 - **Default port**: 20128 (API + dashboard on same port)

CONTRIBUTING.md

@@ -2,11 +2,6 @@
 
 Thank you for your interest in contributing! This guide covers everything you need to get started.
 
-For the official per-change workflow, start with the
-[Contribution Golden Path](docs/dev/CONTRIBUTION_GOLDEN_PATH.md). It maps provider, routing,
-UI/UX, i18n, CLI, database, and build/deploy changes to their contracts, focused tests, CI
-coverage, and reconciliation steps.
-
 ---
 
 ## Development Setup
@@ -108,19 +103,13 @@ Default URLs:
 ## Git Workflow
 
 > ⚠️ **NEVER commit directly to `main`.** Always use feature branches.
->
-> **PR base:** target the active `release/vX.Y.Z` branch (not `main`). See
-> [`docs/ops/BRANCHING_MODEL.md`](docs/ops/BRANCHING_MODEL.md) for the
-> release-per-branch + tag-at-ship model.
 
 ```bash
-# Branch from the active release tip (example: release/v3.8.49)
-git fetch origin
-git checkout -b feat/your-feature-name origin/release/v3.8.49
+git checkout -b feat/your-feature-name
 # ... make changes ...
 git commit -m "feat: describe your change"
 git push -u origin feat/your-feature-name
-# Open a Pull Request with base = release/v3.8.49
+# Open a Pull Request on GitHub
 ```
 
 ### Branch Naming
@@ -203,15 +192,11 @@ Coverage notes:
 
 ### Pull Request Requirements
 
-Before opening a PR, use the
-[Contribution Golden Path](docs/dev/CONTRIBUTION_GOLDEN_PATH.md) to run the focused loop for
-what you changed. The full unit suite (4 CI shards), Vitest, the **60%+** coverage gate, and
-the production build are CI's responsibility — running them locally adds no signal the PR
-checks will not already give you, and on smaller machines it can saturate the host (#8084):
+Before opening or merging a PR:
 
-- Run the test files that cover your change: `node --import tsx/esm --test tests/unit/<file>.test.ts`
-- Run `npm run lint`
-- Include or update automated tests in the same PR whenever production code changes
+- Run `npm run test:unit`
+- Run `npm run test:coverage`
+- Ensure the coverage gate stays at **60%+** statements/lines/functions/branches
 - Include the changed or added test files in the PR description when production code changed
 - Check the SonarQube result on the PR when the project secrets are configured in CI
 
@@ -237,31 +222,6 @@ Current test status: **122 unit test files** covering:
 - **Zod validation** — Use Zod v4 schemas for all API input validation
 - **Naming**: Files = camelCase/kebab-case, components = PascalCase, constants = UPPER_SNAKE
 
-### Error handling / empty catch blocks
-
-Never leave a `catch` unexplained. Classify it into one of two buckets (operationalizes
-the hard rule "never silently swallow errors in SSE streams"):
-
-- **Intentional (our own best-effort cleanup/telemetry)** — a failure here is expected and
-  harmless; add a one-line rationale comment, no logging (logging on every request is the
-  noise this convention avoids).
-
-  ```ts
-  } catch {} // closing an already-closed controller after client disconnect is expected
-  ```
-
-- **Should log (external/caller-supplied code, or the swallow changes control flow)** — keep
-  the catch (never let it break the stream) but emit a contextual `console.debug`/`warn` so the
-  failure is discoverable.
-
-  ```ts
-  } catch (e) {
-    console.debug("[STREAM] onFailure callback error:", e);
-  }
-  ```
-
-See `open-sse/utils/stream.ts` and `open-sse/utils/streamHandler.ts` for applied examples.
-
 ---
 
 ## Project Structure
@@ -277,7 +237,7 @@ src/                        # TypeScript (.ts / .tsx)
 │   ├── a2a/                # Agent-to-Agent v0.3 protocol server
 │   ├── acp/                # Agent Communication Protocol registry
 │   ├── compliance/         # Compliance policy engine
-│   ├── db/                 # SQLite domain modules + 130 migrations
+│   ├── db/                 # SQLite database layer (21 modules + 16 migrations)
 │   ├── memory/             # Persistent conversational memory
 │   ├── oauth/              # OAuth providers, services, and utilities
 │   ├── skills/             # Extensible skill framework
@@ -287,7 +247,7 @@ src/                        # TypeScript (.ts / .tsx)
 ├── mitm/                   # MITM proxy (cert, DNS, target routing)
 ├── shared/
 │   ├── components/         # React components (.tsx)
-│   ├── constants/          # Provider definitions (290), MCP scopes, 19 routing strategies
+│   ├── constants/          # Provider definitions (177), MCP scopes, 14 routing strategies
 │   ├── utils/              # Circuit breaker, sanitizer, auth helpers
 │   └── validation/         # Zod v4 schemas
 └── sse/                    # SSE proxy pipeline
@@ -295,7 +255,7 @@ src/                        # TypeScript (.ts / .tsx)
 open-sse/                   # @omniroute/open-sse workspace
 ├── executors/              # 14 provider-specific request executors
 ├── handlers/               # 11 request handlers (chat, responses, embeddings, images, etc.)
-├── mcp-server/             # MCP server (104 tools, 3 transports, 31 scopes)
+├── mcp-server/             # MCP server (25 tools, 3 transports, 10 scopes)
 ├── services/               # 36+ services (combo, autoCombo, rateLimitManager, etc.)
 ├── translator/             # Format translators (OpenAI ↔ Claude ↔ Gemini ↔ Responses ↔ Ollama)
 ├── transformer/            # Responses API transformer

Dockerfile

@@ -1,5 +1,5 @@
 # ── Common base with runtime deps ──────────────────────────────────────────
-FROM node:26-trixie-slim AS base
+FROM node:24-trixie-slim AS base
 WORKDIR /app
 
 # `apt-get upgrade` pulls the security-patched versions of the Debian (trixie)
@@ -8,8 +8,8 @@ WORKDIR /app
 # that already have a fix published in trixie. CVEs without an upstream fix yet
 # (local-only TOCTOU, etc.) remain until the distro patches them and the image
 # is rebuilt; none are reachable from the proxy's request surface at runtime.
-RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=locked \
-  --mount=type=cache,id=apt-lists,target=/var/lib/apt/lists,sharing=locked \
+RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=shared \
+  --mount=type=cache,id=apt-lists,target=/var/lib/apt/lists,sharing=shared \
   apt-get update \
   && apt-get upgrade -y \
   && apt-get install -y --no-install-recommends libsecret-1-0 ca-certificates \
@@ -29,8 +29,8 @@ FROM base AS builder
 
 # Build tools for native module compilation
 # apt-get update needed here because base's rm -rf clears the shared cache
-RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=locked \
-  --mount=type=cache,id=apt-lists,target=/var/lib/apt/lists,sharing=locked \
+RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=shared \
+  --mount=type=cache,id=apt-lists,target=/var/lib/apt/lists,sharing=shared \
   apt-get update \
   && apt-get install -y --no-install-recommends python3 make g++ \
   && rm -rf /var/lib/apt/lists/*
@@ -62,28 +62,10 @@ RUN test -f package-lock.json \
 # from that indirection. Invoking `node-gyp rebuild` directly inside the package
 # directory bypasses npm's script-running layer entirely and is deterministic
 # regardless of npm version or ignore-scripts allowlist behavior.
-# node-gyp comes from npm's own bundled copy (deterministic, already in the image)
-# instead of `npx --yes`, which would install an arbitrary registry version
-# on-demand and run its lifecycle scripts (Sonar docker:S6505).
-#
-# tls-client-node (chatgpt-web/claude-web/grok-web/lmarena/perplexity-web TLS
-# impersonation) hits the same --ignore-scripts wall: its own postinstall.js
-# fetches a platform .so/.dylib/.dll from the bogdanfinn/tls-client GitHub
-# Releases API and is never invoked when npm ci skips lifecycle scripts. Unlike
-# better-sqlite3 above, that script never throws on failure — it only
-# `console.warn`s and exits 0 — so a rate-limited or offline build would
-# otherwise succeed silently with an empty bin/ and only fail at first request
-# in production (TlsClientUnavailableError, #7802). Run it explicitly here so
-# a broken/rate-limited fetch fails the BUILD loudly instead of shipping a
-# broken image.
 RUN --mount=type=cache,id=npm-cache,target=/root/.npm \
   npm ci --no-audit --no-fund --legacy-peer-deps --ignore-scripts \
-  && (cd node_modules/better-sqlite3 \
-      && node /usr/local/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js rebuild) \
-  && node -e "require('better-sqlite3')(':memory:').close()" \
-  && node node_modules/tls-client-node/scripts/postinstall.js \
-  && (test -n "$(find node_modules/tls-client-node/bin -mindepth 1 -print -quit 2>/dev/null)" \
-      || (echo "tls-client-node native binary missing after postinstall — GitHub API fetch likely rate-limited or failed (#7802)" >&2 && exit 1))
+  && (cd node_modules/better-sqlite3 && npx --yes node-gyp rebuild) \
+  && node -e "require('better-sqlite3')(':memory:').close()"
 
 # Build with Turbopack (stable in Next 16, the repo default). The v3.8.27-era
 # TurbopackInternalError panic ("entered unreachable code: there must be a path to a
@@ -95,11 +77,6 @@ RUN --mount=type=cache,id=npm-cache,target=/root/.npm \
 # See docs/ops/QUALITY_GATE_PLAYBOOK.md Parte 6.
 ENV OMNIROUTE_USE_TURBOPACK=1
 
-# Next.js basePath is fixed at build time; pass OMNIROUTE_BASE_PATH here when the
-# image should serve under a reverse-proxy subpath without a runtime patch.
-ARG OMNIROUTE_BASE_PATH=""
-ENV OMNIROUTE_BASE_PATH=$OMNIROUTE_BASE_PATH
-
 # Docker containers cannot run the MITM/Agent-Bridge stack (no host DNS/cert
 # access), so keep @/mitm/manager on the graceful stub (#3390). This flag is
 # Docker-only: npm/Electron/VPS builds must bundle the REAL manager (#6344).
@@ -133,12 +110,6 @@ LABEL org.opencontainers.image.title="omniroute" \
 ENV NODE_ENV=production
 ENV PORT=20128
 ENV HOSTNAME=0.0.0.0
-# Runtime heap ceiling. 1024MB is enough for normal traffic but can be tight
-# for large fusion-combo panels (many models fanned out in parallel, each
-# response buffered in full — see open-sse/services/fusion.ts::FUSION_DEFAULTS
-# .maxPanel, issue #1905). Override at `docker run` time with
-# `-e OMNIROUTE_MEMORY_MB=2048` (or higher) if you raise fusionTuning.maxPanel
-# above the default cap.
 ENV OMNIROUTE_MEMORY_MB=1024
 ENV NODE_OPTIONS="--max-old-space-size=${OMNIROUTE_MEMORY_MB}"
 

GEMINI.md

@@ -27,7 +27,7 @@ When creating _any_ validation tests or one-off logic scripts, default to using
 7. **Never bypass Husky hooks** (`--no-verify`, `--no-gpg-sign`) without explicit operator approval.
 8. **Always validate inputs with Zod schemas** from `src/shared/validation/schemas.ts`.
 9. **Always include tests when changing production code** (`src/`, `open-sse/`, `electron/`, `bin/`).
-10. **Coverage must stay** ≥ 60 % statements / lines / functions / branches — the official CI gate (`npm run test:coverage`). The ratchet baseline in `quality-baseline.json` may freeze a higher floor; never regress it.
+10. **Coverage must stay** ≥ 75 % statements / 75 % lines / 75 % functions / 70 % branches (real measured: ~82 %).
 
 ## 3. Codebase navigation
 

SECURITY.md

@@ -42,7 +42,7 @@ Request → CORS → Authz pipeline (classify → policies → enforce)
 | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
 | **Dashboard Login**   | Password-based auth with JWT tokens (HttpOnly cookies)                                                                                    |
 | **API Key Auth**      | HMAC-signed keys with CRC validation                                                                                                      |
-| **OAuth 2.0 + PKCE**  | 13 providers (Claude, Codex, GitHub, Cursor, Antigravity, Gemini, Kimi Coding, Kilo Code, Cline, Kiro, Qoder, Windsurf, GitLab Duo)       |
+| **OAuth 2.0 + PKCE**  | 14 providers (Claude, Codex, GitHub, Cursor, Antigravity, Gemini, Kimi Coding, Kilo Code, Cline, Qwen, Kiro, Qoder, Windsurf, GitLab Duo) |
 | **Token Refresh**     | Automatic OAuth token refresh before expiry                                                                                               |
 | **Secure Cookies**    | `AUTH_COOKIE_SECURE=true` for HTTPS environments                                                                                          |
 | **Authz Pipeline**    | Route classification (PUBLIC / CLIENT_API / MANAGEMENT) — see `docs/architecture/AUTHZ_GUIDE.md`                                          |
@@ -77,28 +77,21 @@ Custom guardrails register via `registerGuardrail(new MyGuardrail())`. The model
 
 ### 🧠 Prompt Injection Guard
 
-Best-effort heuristic middleware that detects prompt injection patterns in LLM requests.
-**Not a complete prompt-injection firewall** — can produce false positives (benign
-persona/RPG prompts) and false negatives (leetspeak, spacing, non-English patterns).
+Middleware that detects and blocks prompt injection attacks in LLM requests:
 
 | Pattern Type        | Severity | Example                                        |
 | ------------------- | -------- | ---------------------------------------------- |
 | System Override     | High     | "ignore all previous instructions"             |
-| Role Hijack         | Medium   | "you are now DAN, you can do anything"         |
-| Delimiter Injection | High     | Encoded separators to break context boundaries |
-| DAN/Jailbreak       | Medium   | Known jailbreak prompt patterns                |
-| Instruction Leak    | High     | "show me your system prompt"                   |
-| Encoding Evasion    | Medium   | base64/rot13/hex decode + instruction keywords |
-
-Only **High** severity detections are blocked in `block` mode. Medium-severity
-families are logged but never blocked by `sanitizeRequest`.
+| Role Hijack         | High     | "you are now DAN, you can do anything"         |
+| Delimiter Injection | Medium   | Encoded separators to break context boundaries |
+| DAN/Jailbreak       | High     | Known jailbreak prompt patterns                |
+| Instruction Leak    | Medium   | "show me your system prompt"                   |
 
 Configure via dashboard (Settings → Security) or `.env`:
 
 ```env
 INPUT_SANITIZER_ENABLED=true
-INPUT_SANITIZER_MODE=block    # warn | block (injection policy; legacy "redact" does not strip injection text)
-INPUT_SANITIZER_BLOCK_THRESHOLD=high  # high (default) | medium | low — severities at/above this are blocked in block mode
+INPUT_SANITIZER_MODE=block    # warn | block | redact
 ```
 
 ### 🔒 PII Redaction
@@ -115,8 +108,7 @@ Automatic detection and optional redaction of personally identifiable informatio
 | SSN (US)      | `123-45-6789`         | `[SSN_REDACTED]`   |
 
 ```env
-PII_REDACTION_ENABLED=true   # request PII rewrite; independent of INPUT_SANITIZER_MODE
-PII_RESPONSE_SANITIZATION=true  # optional: redact PII in provider responses returned to clients
+PII_REDACTION_ENABLED=true
 ```
 
 ### 🌐 Network Security

bin/aliasResolver.mjs

@@ -1,230 +0,0 @@
-/**
- * ESM path-alias resolver for global installs.
- *
- * Problem (#7791): when OmniRoute is installed via `npm i -g omniroute`, the
- * package files live under `node_modules/omniroute/`. tsx's tsconfig-path
- * resolution does not apply there, so specifiers like `@/shared/utils/featureFlags`
- * (declared in tsconfig.json `paths` as `@/* → ./src/*`) or
- * `@omniroute/open-sse/services/usage` fail with `ERR_MODULE_NOT_FOUND`.
- * The CLI crashes before any command can run.
- *
- * Fix: register a Node ESM `resolve` hook that rewrites alias specifiers to
- * absolute file URLs. Covers all tsconfig.json `paths` entries:
- *   - `@/*`             → `./src/*`
- *   - `@omniroute/open-sse`    → `./open-sse/index.ts`
- *   - `@omniroute/open-sse/*`  → `./open-sse/*`
- * The hook runs after tsx so `.ts` extensions are already handled, and only
- * intercepts matched prefixes — everything else falls through to Node's
- * default resolver.
- *
- * Exposed as pure functions so the mapping logic is unit-testable without a
- * running module loader.
- */
-
-import { existsSync, statSync } from "node:fs";
-import { dirname, join, relative, isAbsolute } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-
-/**
- * Alias mapping table — mirrors tsconfig.json `paths`.
- * Processed top-to-bottom; first matching prefix wins.
- *
- * Each entry:
- *   prefix  — specifier prefix to match (e.g. `"@/"`, `"@omniroute/open-sse/"`)
- *   target  — directory name under the package root (e.g. `"src"`, `"open-sse"`)
- *   exact   — if true, the prefix also matches when the specifier equals the
- *             prefix *without* a trailing slash (e.g. `@omniroute/open-sse` →
- *             `<root>/open-sse/index.ts`).
- *
- * Exported for tests/consumers.
- */
-export const ALIAS_MAP = [
-  { prefix: "@/", target: "src", exact: false },
-  { prefix: "@omniroute/open-sse/", target: "open-sse", exact: false },
-  { prefix: "@omniroute/open-sse", target: "open-sse", exact: true },
-];
-
-/** @deprecated Use ALIAS_MAP instead. Kept for backward compat. */
-export const ALIAS_PREFIX = "@/";
-
-// This file is ESM (no CJS __dirname global) — derive it from import.meta.url
-// so the pathToFileURL(join(__dirname, ...)) call below resolves correctly
-// regardless of the caller's cwd.
-const __dirname = dirname(fileURLToPath(import.meta.url));
-
-/**
- * Resolve an alias specifier to an absolute file URL.
- *
- * Rules mirror tsconfig.json `paths` via `ALIAS_MAP`:
- *   "@/..."                     → <root>/src/...
- *   "@omniroute/open-sse/..."   → <root>/open-sse/...
- *   "@omniroute/open-sse"       → <root>/open-sse/index.*
- *
- * - Strips the matched alias prefix and joins the remainder against the
- *   corresponding target directory.
- * - Probes the underlying filesystem for the actual source file: the specifier
- *   itself, then with common source extensions (`.ts`, `.tsx`, `.js`, `.mjs`,
- *   `.cjs`, `.json`), then `<dir>/index.*`. Returns the first existing match
- *   as a `file://` URL.
- * - Returns `null` for specifiers that do not match any alias, for malformed
- *   escapes, for path-traversal attempts, or when no corresponding source
- *   file exists on disk. The caller treats `null` as "defer to the default
- *   resolver".
- *
- * @param {string} specifier  Module specifier from an `import` statement.
- * @param {string} root       Absolute path to the package root.
- * @returns {string|null}     Absolute `file://` URL, or `null` when unresolved.
- */
-const SOURCE_EXTENSIONS = [".ts", ".tsx", ".js", ".mjs", ".cjs", ".json"];
-
-export function resolveAlias(specifier, root) {
-  if (typeof specifier !== "string" || !root || typeof root !== "string") {
-    return null;
-  }
-
-  // Find the first matching alias entry (top-to-bottom order).
-  let matchedEntry = null;
-  let rest = null;
-  for (const entry of ALIAS_MAP) {
-    if (specifier.startsWith(entry.prefix)) {
-      // For non-exact entries, require at least one char after the prefix
-      // to avoid matching bare "@/" as "nothing".
-      const after = specifier.slice(entry.prefix.length);
-      if (after.length === 0 && !entry.exact) continue;
-      matchedEntry = entry;
-      rest = after;
-      break;
-    }
-  }
-  if (!matchedEntry) return null;
-
-  const targetDir = join(root, matchedEntry.target);
-
-  // Exact match (e.g. `@omniroute/open-sse` with no trailing path) →
-  // resolve to `<target>/index.*`.
-  if (rest === "" || rest === undefined) {
-    return probeIndex(targetDir);
-  }
-
-  // Guard against absolute-ish escapes (`@//etc/passwd`, `@/\x00`).
-  if (rest.startsWith("/") || rest.startsWith("\\")) {
-    return null;
-  }
-  // Guard against path-traversal escapes (`@/../../../etc/hostname`).
-  const segments = rest.split(/[\\\/]+/);
-  if (segments.includes("..")) {
-    return null;
-  }
-  const base = join(targetDir, rest);
-  if (!isWithinRoot(targetDir, base)) {
-    return null;
-  }
-  return probeFile(base) ?? probeIndex(base) ?? null;
-}
-
-/**
- * Probe a bare path and its extension variants. Returns the first existing
- * match as a `file://` URL, or `null`.
- */
-function probeFile(base) {
-  // Try extension variants first — a bare `base` that happens to be a directory
-  // would match existsSync() but should NOT be returned as a file URL (the
-  // caller expects a file, not a directory). Extension-probing avoids this
-  // false positive (e.g. `usage` vs `usage.ts` vs `usage/`).
-  for (const ext of SOURCE_EXTENSIONS) {
-    const candidate = base + ext;
-    if (existsSync(candidate)) return pathToFileURL(candidate).href;
-  }
-  // Only accept the bare path if it is NOT a directory.
-  if (existsSync(base)) {
-    try {
-      const st = statSync(base);
-      if (!st.isDirectory()) return pathToFileURL(base).href;
-    } catch {}
-  }
-  return null;
-}
-
-/**
- * Probe a directory for an `index.*` entry. Returns the first existing
- * match as a `file://` URL, or `null`.
- */
-function probeIndex(dir) {
-  const indexBase = join(dir, "index");
-  for (const ext of SOURCE_EXTENSIONS) {
-    const candidate = indexBase + ext;
-    if (existsSync(candidate)) return pathToFileURL(candidate).href;
-  }
-  return null;
-}
-
-/**
- * True when `candidate` resolves to a location inside `ancestor` (or is
- * `ancestor` itself). Used as a second, path-normalization-aware layer of
- * defense against traversal beyond the literal `..` segment check above.
- *
- * @param {string} ancestor
- * @param {string} candidate
- * @returns {boolean}
- */
-function isWithinRoot(ancestor, candidate) {
-  const rel = relative(ancestor, candidate);
-  return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
-}
-
-/**
- * Register the ESM resolve hook for the current process. Safe to call multiple
- * times — subsequent calls are no-ops once the hook is installed.
- *
- * Uses Node's stable `module.register()` API (available since Node 20.6,
- * required Node 22+ here). The hook runs in a worker thread but only reads the
- * captured `root`, so no shared-state hazards.
- *
- * @param {string} root  Absolute path to the package root.
- * @returns {Promise<boolean>}  Resolves `true` once registered (or if already
- *   registered), `false` on environments where `module.register` is unavailable.
- */
-let _registered = false;
-export async function registerAliasResolver(root) {
-  // Validate input FIRST, before the _registered short-circuit. Otherwise the
-  // second call in the same process (e.g. a test suite that already registered
-  // once) would silently return `true` for invalid input instead of rejecting,
-  // masking programmer errors. Input validation must be unconditional.
-  if (!root || typeof root !== "string") {
-    throw new TypeError("registerAliasResolver: root must be a non-empty string");
-  }
-  if (_registered) return true;
-  // if the directory does not exist we would only mask a real misconfiguration
-  // by installing a hook that rewrites to nowhere.
-  if (!existsSync(join(root, "src"))) {
-    return false;
-  }
-
-  try {
-    const { register } = await import("node:module");
-    // #7808: load the hook from a real file on disk via pathToFileURL() instead
-    // of building a `data:text/javascript,...` URL dynamically. CodeQL's
-    // `js/incomplete-url-substring-sanitization` flagged the interpolated
-    // `new URL(...)` call; a file URL produced by pathToFileURL() is a trusted,
-    // fully-parsed URL — no sanitization ambiguity. The hook source lives in
-    // `bin/aliasResolverHook.mjs` (sibling of this file), shipped via
-    // package.json "files": ["bin/"].
-    const hookPath = join(__dirname, "aliasResolverHook.mjs");
-    const hookUrl = pathToFileURL(hookPath);
-    register(hookUrl, { data: { root } });
-    _registered = true;
-    return true;
-  } catch {
-    // Older Node or sandboxed env without module.register — fall back to the
-    // default resolver. The bug will resurface only in the exact global-install
-    // scenario, which is what we explicitly patched; other entry points still
-    // work because they import via relative paths.
-    return false;
-  }
-}
-
-// #7808: the ESM loader hook source now lives in `bin/aliasResolverHook.mjs`,
-// loaded via `pathToFileURL()` above. The previous inline `HOOK_SOURCE` template
-// literal was removed because its `new URL(\`data:text/javascript,...\`)` wrapper
-// triggered CodeQL `js/incomplete-url-substring-sanitization`. The hook logic
-// itself is unchanged — see aliasResolverHook.mjs for the resolver behaviour.

bin/aliasResolverHook.mjs

@@ -1,126 +0,0 @@
-/**
- * ESM loader hook for path-alias resolution (#7791 + #7808).
- *
- * This file runs in Node's loader worker thread after being registered via
- * `module.register(url, data)` from `bin/aliasResolver.mjs`. It MUST NOT import
- * anything from the parent module — all inputs arrive through `initialize(data)`.
- *
- * Behaviour:
- * - Rewrites alias specifiers to absolute filesystem paths, mirroring
- *   tsconfig.json `paths`:
- *     - `@/*`                    → <root>/src/*
- *     - `@omniroute/open-sse`     → <root>/open-sse/index.*
- *     - `@omniroute/open-sse/*`   → <root>/open-sse/*
- * - Probes the usual source extensions (`.ts`, `.tsx`, `.js`, `.mjs`, `.cjs`,
- *   `.json`) plus `index.*` for directory imports.
- * - Returns `shortCircuit: true` only when a candidate file exists on disk;
- *   otherwise delegates to the next resolver (tsx/Node) so unrelated imports
- *   and legitimate "module not found" errors pass through unchanged.
- *
- * Why a separate file instead of an inline `data:` URL?
- * CodeQL's `js/incomplete-url-substring-sanitization` flags dynamic `new URL(...)`
- * construction with interpolated strings. A real file URL produced by
- * `pathToFileURL()` is a trusted, fully-parsed URL — no sanitization ambiguity.
- */
-import { pathToFileURL } from "node:url";
-import { join, relative, isAbsolute } from "node:path";
-import { existsSync, statSync } from "node:fs";
-
-let ROOT = "";
-
-export function initialize(data) {
-  ROOT = (data && data.root) || "";
-}
-
-const EXTENSIONS = [".ts", ".tsx", ".js", ".mjs", ".cjs", ".json"];
-
-/**
- * Alias prefix table — mirrors ALIAS_MAP in aliasResolver.mjs and
- * tsconfig.json `paths`. Processed top-to-bottom; first match wins.
- *
- * @type {Array<{prefix: string, target: string, exact: boolean}>}
- */
-const ALIAS_TABLE = [
-  { prefix: "@/", target: "src", exact: false },
-  { prefix: "@omniroute/open-sse/", target: "open-sse", exact: false },
-  { prefix: "@omniroute/open-sse", target: "open-sse", exact: true },
-];
-
-function tryResolveAliasFsPath(specifier) {
-  if (!ROOT || typeof specifier !== "string") return null;
-
-  // Find the first matching alias entry.
-  let matchedEntry = null;
-  let rest = null;
-  for (const entry of ALIAS_TABLE) {
-    if (specifier.startsWith(entry.prefix)) {
-      const after = specifier.slice(entry.prefix.length);
-      if (after.length === 0 && !entry.exact) continue;
-      matchedEntry = entry;
-      rest = after;
-      break;
-    }
-  }
-  if (!matchedEntry) return null;
-
-  const targetDir = join(ROOT, matchedEntry.target);
-
-  // Exact match (e.g. `@omniroute/open-sse`) → resolve to `<target>/index.*`.
-  if (rest === "" || rest === undefined) {
-    return probeIndex(targetDir);
-  }
-
-  // Guard against absolute-ish escapes.
-  if (rest.startsWith("/") || rest.startsWith("\\")) return null;
-  // Guard against path-traversal escapes.
-  const segments = rest.split(/[\\\/]+/);
-  if (segments.includes("..")) return null;
-
-  const base = join(targetDir, rest);
-  if (!isWithinRoot(targetDir, base)) return null;
-  return probeFile(base) ?? probeIndex(base) ?? null;
-}
-
-function probeFile(base) {
-  // Extension variants first — avoids matching a bare directory name.
-  for (const ext of EXTENSIONS) {
-    const candidate = base + ext;
-    if (existsSync(candidate)) return candidate;
-  }
-  if (existsSync(base)) {
-    try {
-      const st = statSync(base);
-      if (!st.isDirectory()) return base;
-    } catch {}
-  }
-  return null;
-}
-
-function probeIndex(dir) {
-  const indexBase = join(dir, "index");
-  for (const ext of EXTENSIONS) {
-    const candidate = indexBase + ext;
-    if (existsSync(candidate)) return candidate;
-  }
-  return null;
-}
-
-/**
- * True when `candidate` resolves to a location inside `ancestor` (or is
- * `ancestor` itself). Path-normalization-aware defense against traversal.
- */
-function isWithinRoot(ancestor, candidate) {
-  const rel = relative(ancestor, candidate);
-  return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
-}
-
-export function resolve(specifier, context, nextResolve) {
-  const fsPath = tryResolveAliasFsPath(specifier);
-  if (fsPath) {
-    return {
-      url: pathToFileURL(fsPath).href,
-      shortCircuit: true,
-    };
-  }
-  return nextResolve(specifier, context);
-}

bin/cli/commands/auth-export.mjs

@@ -1,163 +0,0 @@
-import { chmodSync, existsSync, writeFileSync } from "node:fs";
-import { decryptCredential } from "../encryption.mjs";
-import { findProviderConnection, listProviderConnections } from "../provider-store.mjs";
-import { openOmniRouteDb } from "../sqlite.mjs";
-import { t } from "../i18n.mjs";
-
-/**
- * Local-only, operator-invoked command that dumps DECRYPTED provider credentials
- * (apiKey/accessToken/refreshToken/idToken). This never runs inside the HTTP server
- * process and must never be reachable over the network — no src/app/api/ route wraps
- * this. See docs/security/ for the threat-model writeup referenced in issue #6683.
- */
-
-const CREDENTIAL_FIELDS = [
-  { key: "apiKey", envSuffix: "API_KEY" },
-  { key: "accessToken", envSuffix: "ACCESS_TOKEN" },
-  { key: "refreshToken", envSuffix: "REFRESH_TOKEN" },
-  { key: "idToken", envSuffix: "ID_TOKEN" },
-];
-
-const VALID_FORMATS = new Set(["json", "env"]);
-const SECURE_FILE_MODE = 0o600;
-
-export function registerAuthExport(program) {
-  program
-    .command("auth export")
-    .description(t("authExport.description"))
-    .option("--id <id>", t("authExport.idOpt"))
-    .option("--format <format>", t("authExport.formatOpt"), "json")
-    .option("--out <file>", t("authExport.outOpt"))
-    .option("--force", t("authExport.forceOpt"))
-    .action(async (opts, cmd) => {
-      const globalOpts = cmd.optsWithGlobals();
-      const exitCode = await runAuthExportCommand({ ...opts, ...globalOpts });
-      if (exitCode !== 0) process.exit(exitCode);
-    });
-}
-
-export async function runAuthExportCommand(opts = {}) {
-  // Security control (a): confirmation gate BEFORE any DB access — a dry invocation
-  // never opens the database and never decrypts anything.
-  if (!opts.force) {
-    printConfirmationGate();
-    return 0;
-  }
-
-  const format = opts.format || "json";
-  if (!VALID_FORMATS.has(format)) {
-    console.error(t("authExport.invalidFormat", { format }));
-    return 1;
-  }
-
-  if (!process.env.STORAGE_ENCRYPTION_KEY) {
-    console.error(t("authExport.missingKey"));
-    return 1;
-  }
-
-  // Security control (b): stderr warning banner BEFORE any plaintext is emitted.
-  process.stderr.write(t("authExport.warning") + "\n");
-
-  const rows = await loadTargetConnections(opts.id);
-  if (rows === null) {
-    console.error(t("authExport.notFound", { id: opts.id }));
-    return 1;
-  }
-
-  const exported = rows.map(exportConnection);
-  const content = format === "env" ? formatAsEnv(exported) : formatAsJson(exported);
-
-  if (opts.out) {
-    writeSecureFile(opts.out, content);
-  } else {
-    console.log(content);
-  }
-
-  return 0;
-}
-
-function printConfirmationGate() {
-  console.log(
-    `\n${t("authExport.confirmHeading")}\n\n${t("authExport.confirmBody")}\n\n${t("authExport.confirmFooter")}\n`
-  );
-}
-
-async function loadTargetConnections(id) {
-  const { db } = await openOmniRouteDb();
-  try {
-    if (!id) return listProviderConnections(db);
-    const connection = findProviderConnection(db, id);
-    return connection ? [connection] : null;
-  } finally {
-    db.close();
-  }
-}
-
-function decryptField(rawValue) {
-  // Security control (d): a per-field decrypt failure surfaces as a boolean flag,
-  // never the caught error text. Security control (e): the caught error is never
-  // interpolated into any message.
-  try {
-    return { value: decryptCredential(rawValue), failed: false };
-  } catch {
-    return { value: null, failed: true };
-  }
-}
-
-function exportConnection(connection) {
-  const result = {
-    id: connection.id,
-    provider: connection.provider,
-    name: connection.name,
-    authType: connection.authType,
-  };
-
-  for (const { key } of CREDENTIAL_FIELDS) {
-    const rawValue = connection[key];
-    if (!rawValue) {
-      result[key] = null;
-      result[`${key}DecryptFailed`] = false;
-      continue;
-    }
-    const { value, failed } = decryptField(rawValue);
-    result[key] = value;
-    result[`${key}DecryptFailed`] = failed;
-  }
-
-  return result;
-}
-
-function formatAsJson(rows) {
-  return JSON.stringify(rows, null, 2);
-}
-
-function envSafeSegment(value) {
-  return String(value || "")
-    .toUpperCase()
-    .replace(/[^A-Z0-9]+/g, "_")
-    .replace(/^_+|_+$/g, "");
-}
-
-function formatAsEnv(rows) {
-  const lines = [];
-  for (const row of rows) {
-    lines.push(`# ${row.provider} (${row.id})`);
-    const providerSegment = envSafeSegment(row.provider);
-    for (const { key, envSuffix } of CREDENTIAL_FIELDS) {
-      const value = row[key];
-      if (!value) continue;
-      lines.push(`OMNIROUTE_${providerSegment}_${envSuffix}=${value}`);
-    }
-  }
-  return lines.join("\n");
-}
-
-function writeSecureFile(filePath, content) {
-  // Security control (c): file output written with mode 0o600 (plus chmodSync if the
-  // file pre-existed, belt-and-suspenders against an already world-readable file).
-  const preExisted = existsSync(filePath);
-  writeFileSync(filePath, content, { mode: SECURE_FILE_MODE });
-  if (preExisted) {
-    chmodSync(filePath, SECURE_FILE_MODE);
-  }
-}

bin/cli/commands/backup.mjs

@@ -78,15 +78,18 @@ export function registerBackup(program) {
       if (exitCode !== 0) process.exit(exitCode);
     });
 
-  // Legacy: `omniroute backup` without a subcommand still creates a backup
-  // (documented as the canonical usage in USER_GUIDE.md / CLI-TOOLS.md /
-  // AGENT-SKILLS.md). No flags are declared here — declaring the same
-  // option names as `create`/`auto enable` here previously shadowed them
-  // (#8512), and no doc shows `omniroute backup` invoked with flags.
+  // Legacy: `omniroute backup` without subcommand still creates a backup
   backup.action(async (opts) => {
     const exitCode = await runBackupCommand(opts);
     if (exitCode !== 0) process.exit(exitCode);
   });
+  backup
+    .option("--name <name>", t("backup.nameOpt"))
+    .option("--cloud", t("backup.cloudOpt"))
+    .option("--encrypt", t("backup.encryptOpt"))
+    .option("--key-file <path>", t("backup.keyFileOpt"))
+    .option("--exclude <pattern>", t("backup.excludeOpt"), (v, prev = []) => [...prev, v], [])
+    .option("--retention <n>", t("backup.retentionOpt"), parseInt);
 }
 
 export function registerRestore(program) {

bin/cli/commands/dashboard.mjs

@@ -1,22 +1,17 @@
 import { execFile } from "node:child_process";
 import { t } from "../i18n.mjs";
 
-function parsePort(value, fallback) {
-  const parsed = parseInt(String(value), 10);
-  return Number.isFinite(parsed) && parsed > 0 && parsed <= 65535 ? parsed : fallback;
-}
-
 export function registerDashboard(program) {
   program
     .command("dashboard")
     .description(t("dashboard.description"))
     .option("--url", t("dashboard.urlOnly"))
-    .option("--port <port>", "Port the server is running on")
+    .option("--port <port>", "Port the server is running on", "20128")
     .option("--tui", t("dashboard.tui") || "Open interactive TUI dashboard (terminal UI)")
     .action(async (opts, cmd) => {
       if (opts.tui) {
         const globalOpts = cmd.optsWithGlobals();
-        const port = parsePort(opts.port ?? process.env.PORT ?? "20128", 20128);
+        const port = opts.port ? parseInt(String(opts.port), 10) : 20128;
         const baseUrl = globalOpts.baseUrl ?? `http://localhost:${port}`;
         const apiKey = globalOpts.apiKey ?? null;
         const { startInteractiveTui } = await import("../tui/Dashboard.jsx");
@@ -29,7 +24,7 @@ export function registerDashboard(program) {
 }
 
 export async function runDashboardCommand(opts = {}) {
-  const port = parsePort(opts.port ?? process.env.PORT ?? "20128", 20128);
+  const port = opts.port ? parseInt(String(opts.port), 10) : 20128;
   const dashboardUrl = `http://localhost:${port}`;
 
   if (opts.url) {
@@ -49,22 +44,22 @@ export async function runDashboardCommand(opts = {}) {
   return 0;
 }
 
-/**
- * Resolve the command and args to open a URL in the default browser
- * for a given platform. Exported for testing — callers should use openFallback().
- * @param {"darwin"|"win32"|string} platform
- * @param {string} url
- * @returns {{ cmd: string, args: string[] }}
- */
-export function resolveOpenCommand(platform, url) {
-  if (platform === "darwin") return { cmd: "open", args: [url] };
-  if (platform === "win32") return { cmd: "rundll32", args: ["url.dll,FileProtocolHandler", url] };
-  return { cmd: "xdg-open", args: [url] };
-}
-
 function openFallback(url) {
   return new Promise((resolve) => {
-    const { cmd, args } = resolveOpenCommand(process.platform, url);
+    const { platform } = process;
+    let cmd, args;
+
+    if (platform === "darwin") {
+      cmd = "open";
+      args = [url];
+    } else if (platform === "win32") {
+      cmd = "cmd";
+      args = ["/c", "start", "", url];
+    } else {
+      cmd = "xdg-open";
+      args = [url];
+    }
+
     execFile(cmd, args, { stdio: "ignore" }, () => resolve());
   });
 }

bin/cli/commands/launch-codex.mjs

@@ -1,7 +1,6 @@
 import { spawn } from "node:child_process";
 import { t } from "../i18n.mjs";
 import { resolveActiveContext } from "../contexts.mjs";
-import { quoteShellArgs } from "../utils/winShellArgs.mjs";
 
 /** OpenAI/Codex env keys stripped from the child so a stale OpenAI key/base-url
  *  in the shell can't shadow the omniroute provider (defense-in-depth). Mirrors
@@ -30,23 +29,6 @@ export function resolveCodexSpawn(platform) {
   return { command: "codex", shell: undefined };
 }
 
-/**
- * `shell: true` makes Node join argv with plain spaces and no escaping (the
- * DEP0190 warning). That mangles every launch-codex invocation on Windows, not
- * just the ones with a multi-word user argument: the injected `-c` provider
- * flags carry TOML values whose quotes cmd.exe strips
- * (`model_providers.omniroute.name="OmniRoute"` arrives unquoted and no longer
- * parses as TOML). Quote the args ourselves on that path; off Windows there is
- * no shell, so argv is passed through untouched. Same fix as `launch` (#8837).
- *
- * @param {string[]} args
- * @param {NodeJS.Platform|string} platform
- * @returns {string[]}
- */
-export function quoteCodexArgs(args, platform) {
-  return quoteShellArgs(args, platform);
-}
-
 function stripTrailingSlash(value) {
   let s = String(value);
   let end = s.length;
@@ -171,7 +153,7 @@ export async function runLaunchCodexCommand(opts = {}, codexArgs = []) {
 
   return await new Promise((resolve) => {
     const { command: codexLaunch, shell: shellValue } = resolveCodexSpawn(process.platform);
-    const child = spawn(codexLaunch, quoteCodexArgs(extraArgs, process.platform), {
+    const child = spawn(codexLaunch, extraArgs, {
       env,
       stdio: "inherit",
       shell: shellValue,
@@ -213,10 +195,7 @@ export function registerLaunchCodex(program) {
     .argument("[codexArgs...]", "arguments passed through to the codex binary")
     .action(async (codexArgs, opts) => {
       const merged = { ...opts, profile: opts.profile ?? opts.p };
-      // process.exit() here aborted the process with a libuv assertion on
-      // Windows (`!(handle->flags & UV_HANDLE_CLOSING)`, async.c:94): it tears
-      // the loop down while the inherited stdio handles of the just-exited
-      // child are still closing. Setting exitCode lets the loop drain first.
-      process.exitCode = await runLaunchCodexCommand(merged, codexArgs ?? []);
+      const exitCode = await runLaunchCodexCommand(merged, codexArgs ?? []);
+      if (exitCode !== 0) process.exit(exitCode);
     });
 }

bin/cli/commands/launch.mjs

@@ -3,7 +3,6 @@ import { join } from "node:path";
 import os from "node:os";
 import { t } from "../i18n.mjs";
 import { resolveActiveContext } from "../contexts.mjs";
-import { quoteShellArgs } from "../utils/winShellArgs.mjs";
 
 function stripTrailingSlash(value) {
   let s = String(value);
@@ -91,34 +90,6 @@ export function resolveLaunchTarget(opts = {}) {
   return { baseUrl, authToken };
 }
 
-/**
- * #8246: on Windows, npm installs claude as a `.cmd` shim — spawn() without a
- * shell cannot resolve PATHEXT shims (and Node refuses to exec `.cmd` directly
- * since CVE-2024-27980), so the Windows path must go through cmd.exe.
- *
- * @param {NodeJS.Platform|string} platform
- * @returns {{ command: string, shell: true|undefined }}
- */
-export function resolveClaudeSpawn(platform) {
-  return platform === "win32"
-    ? { command: "claude.cmd", shell: true }
-    : { command: "claude", shell: undefined };
-}
-
-/**
- * `shell: true` makes Node join argv with plain spaces and no escaping (the
- * DEP0190 warning), so `-p "two words"` used to reach claude as `-p two` plus
- * three stray positional arguments. Quote the args ourselves on that path.
- * Off Windows there is no shell, so argv is passed through untouched.
- *
- * @param {string[]} args
- * @param {NodeJS.Platform|string} platform
- * @returns {string[]}
- */
-export function quoteClaudeArgs(args, platform) {
-  return quoteShellArgs(args, platform);
-}
-
 /**
  * @param {{port?:string, remote?:string, token?:string, apiKey?:string, profile?:string, claudeHome?:string}} opts
  * @param {string[]} claudeArgs  pass-through args for the claude binary
@@ -135,10 +106,10 @@ export async function runLaunchCommand(opts = {}, claudeArgs = []) {
     if (!res.ok) throw new Error(`status ${res.status}`);
   } catch {
     console.error(
-      (
-        t("launch.notRunning") ||
-        "OmniRoute is not reachable at {port}. Start it with 'omniroute serve'."
-      ).replace("{port}", baseUrl)
+      (t("launch.notRunning") || "OmniRoute is not reachable at {port}. Start it with 'omniroute serve'.").replace(
+        "{port}",
+        baseUrl
+      )
     );
     return 1;
   }
@@ -149,13 +120,7 @@ export async function runLaunchCommand(opts = {}, claudeArgs = []) {
   const env = buildClaudeEnv(process.env, baseUrl, authToken, { configDir });
 
   return await new Promise((resolve) => {
-    const { command, shell } = resolveClaudeSpawn(process.platform);
-    const child = spawn(command, quoteClaudeArgs(claudeArgs, process.platform), {
-      env,
-      stdio: "inherit",
-      shell,
-      ...(process.platform === "win32" ? { windowsHide: true } : {}),
-    });
+    const child = spawn("claude", claudeArgs, { env, stdio: "inherit" });
     child.on("error", (err) => {
       if (err && err.code === "ENOENT") {
         console.error(t("launch.notFound") || "The 'claude' CLI was not found in PATH.");
@@ -177,20 +142,14 @@ export function registerLaunch(program) {
     )
     .option("--port <port>", t("serve.port") || "Proxy port", "20128")
     .option("--remote <url>", "Remote OmniRoute base URL (overrides --port and the active context)")
-    .option(
-      "--profile <name>",
-      "Claude Code profile to use (CLAUDE_CONFIG_DIR ~/.claude/profiles/<name>)"
-    )
+    .option("--profile <name>", "Claude Code profile to use (CLAUDE_CONFIG_DIR ~/.claude/profiles/<name>)")
     .option("--token <token>", t("launch.token") || "Token Claude sends (ANTHROPIC_AUTH_TOKEN)")
     .option("--api-key <key>", "Alias for --token (OmniRoute access token / API key)")
     .allowUnknownOption(true)
     .allowExcessArguments(true)
     .argument("[claudeArgs...]", "arguments passed through to the claude binary")
     .action(async (claudeArgs, opts) => {
-      // process.exit() here aborted the process with a libuv assertion on
-      // Windows (`!(handle->flags & UV_HANDLE_CLOSING)`, async.c:94): it tears
-      // the loop down while the inherited stdio handles of the just-exited
-      // child are still closing. Setting exitCode lets the loop drain first.
-      process.exitCode = await runLaunchCommand(opts, claudeArgs ?? []);
+      const exitCode = await runLaunchCommand(opts, claudeArgs ?? []);
+      if (exitCode !== 0) process.exit(exitCode);
     });
 }

bin/cli/commands/oauth.mjs

@@ -7,6 +7,7 @@ const PROVIDERS_WITH_OAUTH = [
   { id: "gemini", name: "Google Gemini", flow: "browser" },
   { id: "antigravity", name: "Antigravity", flow: "browser" },
   { id: "windsurf", name: "Windsurf", flow: "browser" },
+  { id: "qwen", name: "Qwen Code", flow: "browser" },
   { id: "cursor", name: "Cursor", flow: "import" },
   { id: "zed", name: "Zed", flow: "import" },
   { id: "kiro", name: "Amazon Kiro", flow: "social" },

bin/cli/commands/registry.mjs

@@ -37,7 +37,6 @@ import { registerProviders } from "./providers.mjs";
 import { registerProvider } from "./provider-cmd.mjs";
 import { registerConfig } from "./config.mjs";
 import { registerKeys } from "./keys.mjs";
-import { registerAuthExport } from "./auth-export.mjs";
 import { registerModels } from "./models.mjs";
 import { registerCombo } from "./combo.mjs";
 import { registerStatus } from "./status.mjs";
@@ -70,8 +69,8 @@ import { registerSetupCursor } from "./setup-cursor.mjs";
 import { registerSetupRoo } from "./setup-roo.mjs";
 import { registerSetupCrush } from "./setup-crush.mjs";
 import { registerSetupGoose } from "./setup-goose.mjs";
-import { registerSetupAider } from "./setup-aider.mjs";
 import { registerSetupQwen } from "./setup-qwen.mjs";
+import { registerSetupAider } from "./setup-aider.mjs";
 import { registerConnect } from "./connect.mjs";
 import { registerContexts } from "./contexts.mjs";
 import { registerTokens } from "./tokens.mjs";
@@ -119,7 +118,6 @@ export function registerCommands(program) {
   registerProvider(program);
   registerConfig(program);
   registerKeys(program);
-  registerAuthExport(program);
   registerModels(program);
   registerCombo(program);
   registerStatus(program);
@@ -153,8 +151,8 @@ export function registerCommands(program) {
   registerSetupRoo(program);
   registerSetupCrush(program);
   registerSetupGoose(program);
-  registerSetupAider(program);
   registerSetupQwen(program);
+  registerSetupAider(program);
   registerConnect(program);
   registerContexts(program);
   registerTokens(program);

bin/cli/commands/serve.mjs

@@ -7,11 +7,6 @@ import { t } from "../i18n.mjs";
 import { writePidFile, cleanupPidFile, waitForServer } from "../utils/pid.mjs";
 import { ServerSupervisor, detectMitmCrash } from "../runtime/processSupervisor.mjs";
 import { isTermux } from "../../../scripts/build/postinstallSupport.mjs";
-import {
-  ensureAndroidCacheDir,
-  isFatalInstrumentationHookFailure,
-  formatAndroidInstrumentationFailureHint,
-} from "../utils/ensureAndroidCacheDir.mjs";
 import {
   resolveMaxOldSpaceMb,
   calibrateHeapFallbackMb,
@@ -67,37 +62,9 @@ export function registerServe(program) {
     });
 }
 
-/** Once-per-process guard so the Android/Termux cache hint is not spammed. */
-let instrumentationFailureHintPrinted = false;
-
-/**
- * If child output looks like Next.js failed to load its instrumentation hook
- * on Android/Termux, print a clear operator-facing fix hint.
- * Exported for unit tests.
- *
- * @param {string} text
- * @returns {boolean} true when a hint was printed
- */
-export function maybeReportInstrumentationHookFailure(text) {
-  if (instrumentationFailureHintPrinted) return false;
-  if (!isFatalInstrumentationHookFailure(text)) return false;
-  instrumentationFailureHintPrinted = true;
-  process.stderr.write(formatAndroidInstrumentationFailureHint(process.env.XDG_CACHE_HOME));
-  return true;
-}
-
-/** Test-only reset for the once-per-process hint guard. */
-export function resetInstrumentationFailureHintForTests() {
-  instrumentationFailureHintPrinted = false;
-}
-
 export async function runServe(opts = {}) {
   const startedAt = performance.now();
 
-  // Same prep as bin/omniroute.mjs — keep it here so a direct `runServe()` call
-  // (tests / programmatic) still gets a writable Next.js cache dir before spawn.
-  ensureAndroidCacheDir({ env: process.env });
-
   const { isNativeBinaryCompatible } =
     await import("../../../scripts/build/native-binary-compat.mjs");
   const { getNodeRuntimeSupport, getNodeRuntimeWarning } =
@@ -167,11 +134,7 @@ export async function runServe(opts = {}) {
     "Release",
     "better_sqlite3.node"
   );
-  if (
-    !process.versions.bun &&
-    existsSync(sqliteBinary) &&
-    !isNativeBinaryCompatible(sqliteBinary)
-  ) {
+  if (existsSync(sqliteBinary) && !isNativeBinaryCompatible(sqliteBinary)) {
     console.error(
       "\x1b[31m✖ better-sqlite3 native module is incompatible with this platform.\x1b[0m"
     );
@@ -267,16 +230,12 @@ export async function runServe(opts = {}) {
 function runDaemon(serverJs, env, memoryLimit, dashboardPort, apiPort) {
   // #5238: skip the explicit CLI --max-old-space-size when the user pinned the
   // heap via NODE_OPTIONS (a CLI arg would shadow/override their value).
-  const server = spawn(
-    process.versions.bun ? process.execPath : "node",
-    [...(process.versions.bun ? [] : buildNodeHeapArgs(process.env, memoryLimit)), serverJs],
-    {
-      cwd: APP_DIR,
-      env,
-      stdio: "ignore",
-      detached: true,
-    }
-  );
+  const server = spawn("node", [...buildNodeHeapArgs(process.env, memoryLimit), serverJs], {
+    cwd: APP_DIR,
+    env,
+    stdio: "ignore",
+    detached: true,
+  });
   writePidFile("server", server.pid);
   server.unref();
   console.log(`\x1b[32m✔ OmniRoute started in background (PID: ${server.pid})\x1b[0m`);
@@ -287,15 +246,11 @@ function runDaemon(serverJs, env, memoryLimit, dashboardPort, apiPort) {
 function runWithoutRecovery(serverJs, env, memoryLimit, dashboardPort, apiPort, noOpen, startedAt) {
   // #5238: skip the explicit CLI --max-old-space-size when the user pinned the
   // heap via NODE_OPTIONS (a CLI arg would shadow/override their value).
-  const server = spawn(
-    process.versions.bun ? process.execPath : "node",
-    [...(process.versions.bun ? [] : buildNodeHeapArgs(process.env, memoryLimit)), serverJs],
-    {
-      cwd: APP_DIR,
-      env,
-      stdio: "pipe",
-    }
-  );
+  const server = spawn("node", [...buildNodeHeapArgs(process.env, memoryLimit), serverJs], {
+    cwd: APP_DIR,
+    env,
+    stdio: "pipe",
+  });
 
   writePidFile("server", server.pid);
 
@@ -304,7 +259,6 @@ function runWithoutRecovery(serverJs, env, memoryLimit, dashboardPort, apiPort,
   server.stdout.on("data", (data) => {
     const text = data.toString();
     process.stdout.write(text);
-    maybeReportInstrumentationHookFailure(text);
     if (
       !started &&
       (text.includes("Ready") || text.includes("started") || text.includes("listening"))
@@ -314,11 +268,7 @@ function runWithoutRecovery(serverJs, env, memoryLimit, dashboardPort, apiPort,
     }
   });
 
-  server.stderr.on("data", (data) => {
-    const text = data.toString();
-    process.stderr.write(text);
-    maybeReportInstrumentationHookFailure(text);
-  });
+  server.stderr.on("data", (data) => process.stderr.write(data));
 
   server.on("error", (err) => {
     console.error("\x1b[31m✖ Failed to start server:\x1b[0m", err.message);
@@ -427,9 +377,6 @@ export function reportReadinessTimeout(dashboardPort, supervisor) {
     console.error("--- Recent server output ---");
     recentLog.forEach((l) => console.error(l));
     console.error("--- End recent output ---\n");
-    // If the buffered log already shows the Android instrumentation failure,
-    // print the actionable hint even when --log was off (default).
-    maybeReportInstrumentationHookFailure(recentLog.join("\n"));
   }
 }
 

bin/cli/commands/setup-open-code.mjs

@@ -218,29 +218,13 @@ function registerPluginInOpenCodeConfig({
  * a clear "could not run opencode" message instead of a hard import
  * failure.
  */
-/**
- * Pure resolver for the `opencode auth login` spawn descriptor. Extracted so the
- * platform-branching logic is unit-testable without mocking child_process or
- * mutating process.platform.
- *
- * On Windows the `opencode` binary is an npm `.cmd` shim that Node's hardened
- * spawnSync (post CVE-2024-27980) refuses to run without a shell — spawning it
- * with shell:false throws EINVAL (#7913). Mirror the same fix already applied to
- * codex (resolveCodexSpawn in launch-codex.mjs, crediting #6263) and
- * qodercli/Auggie (#6263/#6304): shell:true on win32, shell:false everywhere else.
- */
-export function resolveOpenCodeAuthSpawn(providerId, platform = process.platform) {
-  const isWin = platform === "win32";
-  return {
-    command: isWin ? "opencode.cmd" : "opencode",
-    args: ["auth", "login", "--provider", providerId],
-    options: { stdio: "inherit", shell: isWin },
-  };
-}
-
-export function runOpenCodeAuth(providerId) {
-  const { command, args, options } = resolveOpenCodeAuthSpawn(providerId);
-  const res = spawnSync(command, args, options);
+function runOpenCodeAuth(providerId) {
+  const isWin = process.platform === "win32";
+  const opencodeBin = isWin ? "opencode.cmd" : "opencode";
+  const res = spawnSync(opencodeBin, ["auth", "login", "--provider", providerId], {
+    stdio: "inherit",
+    shell: false,
+  });
   if (res.error) {
     // ENOENT = opencode is not on PATH
     if (res.error.code === "ENOENT") {

bin/cli/commands/setup-qwen.mjs

@@ -1,166 +1,156 @@
-/** Configure Qwen Code's OpenAI-compatible provider for OmniRoute. */
+/**
+ * omniroute setup-qwen — configure Qwen Code (QwenLM/qwen-code) for OmniRoute.
+ *
+ * Qwen Code is a terminal AI agent with a file-based config at
+ * ~/.qwen/settings.json. For a custom OpenAI-compatible endpoint it uses a
+ * `modelProviders` entry with authType "openai", baseUrl WITH /v1, and an
+ * `envKey` naming the env var holding the key (secret stays in the env, never the
+ * file). Remote-aware; headless test via `qwen -p "..."`.
+ */
 
-import {
-  chmodSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  renameSync,
-  unlinkSync,
-  writeFileSync,
-} from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 import os from "node:os";
-import path from "node:path";
-
-import {
-  mergeQwenCodeEnv,
-  mergeQwenCodeSettings,
-  normalizeQwenCodeBaseUrl,
-} from "../../../src/shared/services/qwenCodeConfig.ts";
+import { printHeading, printInfo, printSuccess, printError, createPrompt } from "../io.mjs";
 import { resolveActiveContext } from "../contexts.mjs";
-import { createPrompt, printError, printHeading, printInfo, printSuccess } from "../io.mjs";
 
-/** Resolve base URL and key from flags, active context, then local defaults. */
-export function resolveQwenTarget(opts = {}) {
-  let root = opts.remote ? String(opts.remote) : "";
-  let context;
-
-  if (!root || !(opts.apiKey ?? opts["api-key"])) {
-    try {
-      context = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT);
-    } catch {
-      // An active context is optional for local setup.
-    }
-  }
-
-  if (!root) root = context?.baseUrl || "";
-  if (!root) {
-    const port = Number(opts.port ?? process.env.PORT ?? 20128) || 20128;
-    root = `http://localhost:${port}`;
-  }
-
-  const apiKey =
-    opts.apiKey ??
-    opts["api-key"] ??
-    context?.accessToken ??
-    context?.apiKey ??
-    process.env.OMNIROUTE_API_KEY ??
-    "sk_omniroute";
-
-  return { baseUrl: normalizeQwenCodeBaseUrl(root), apiKey };
+function ensureV1(url) {
+  const s = String(url || "").replace(/\/+$/, "");
+  return s.endsWith("/v1") ? s : `${s}/v1`;
 }
 
-const readSettings = (filePath) => {
-  if (!existsSync(filePath)) return {};
-  const parsed = JSON.parse(readFileSync(filePath, "utf8"));
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("Qwen Code settings.json must contain a JSON object");
-  }
-  return parsed;
-};
-
-const readText = (filePath) => (existsSync(filePath) ? readFileSync(filePath, "utf8") : "");
-
-const writeAtomic = (filePath, content, mode) => {
-  const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
-  try {
-    writeFileSync(tempPath, content, { encoding: "utf8", mode });
-    if (mode !== undefined) chmodSync(tempPath, mode);
-    renameSync(tempPath, filePath);
-  } catch (error) {
+/** Resolve baseUrl (WITH /v1) + apiKey from flags → active context → localhost. */
+export function resolveQwenTarget(opts = {}) {
+  let root;
+  if (opts.remote) root = String(opts.remote).replace(/\/+$/, "");
+  else {
     try {
-      unlinkSync(tempPath);
+      root = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT)?.baseUrl;
     } catch {
-      // The temporary file may not have been created.
+      /* none */
     }
-    throw error;
+    if (!root) root = `http://localhost:${Number(opts.port ?? process.env.PORT ?? 20128) || 20128}`;
   }
-};
+  let apiKey = opts.apiKey ?? opts["api-key"];
+  if (!apiKey) {
+    try {
+      const c = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT);
+      apiKey = c?.accessToken || c?.apiKey;
+    } catch {
+      /* none */
+    }
+  }
+  if (!apiKey) apiKey = process.env.OMNIROUTE_API_KEY || "";
+  return { baseUrl: ensureV1(root), apiKey };
+}
 
-const fetchModelIds = async (baseUrl, apiKey) => {
+/** Merge the OmniRoute modelProvider into Qwen's settings.json (preserve rest). */
+export function buildQwenSettings(existing, { baseUrl, model }) {
+  const s = existing && typeof existing === "object" ? { ...existing } : {};
+  const providers = Array.isArray(s.modelProviders)
+    ? s.modelProviders.filter((p) => p?.id !== "omniroute")
+    : [];
+  providers.push({
+    id: "omniroute",
+    name: "OmniRoute",
+    authType: "openai",
+    baseUrl,
+    envKey: "OMNIROUTE_API_KEY",
+  });
+  s.modelProviders = providers;
+  if (model) {
+    s.selectedProvider = "omniroute";
+    s.model = model;
+  }
+  return s;
+}
+
+function readJson(path) {
   try {
-    const response = await fetch(`${baseUrl}/models`, {
-      headers: { Authorization: `Bearer ${apiKey}` },
+    if (existsSync(path)) return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    /* corrupt/missing */
+  }
+  return {};
+}
+
+async function fetchModelIds(baseUrl, apiKey) {
+  try {
+    const headers = { "Content-Type": "application/json" };
+    if (apiKey) headers["Authorization"] = `Bearer ${apiKey}`;
+    const res = await fetch(`${baseUrl.replace(/\/v1$/, "")}/v1/models`, {
+      headers,
       signal: AbortSignal.timeout(8000),
     });
-    if (!response.ok) return [];
-    const body = await response.json();
-    const models = Array.isArray(body) ? body : (body.data ?? body.models ?? []);
-    return models.map((entry) => (typeof entry === "string" ? entry : entry?.id)).filter(Boolean);
+    if (!res.ok) return [];
+    const body = await res.json();
+    const list = Array.isArray(body) ? body : (body.data ?? body.models ?? []);
+    return list.map((m) => (typeof m === "string" ? m : m?.id)).filter(Boolean);
   } catch {
     return [];
   }
-};
+}
 
 export async function runSetupQwenCommand(opts = {}) {
   const { baseUrl, apiKey } = resolveQwenTarget(opts);
   const dryRun = Boolean(opts.dryRun ?? opts["dry-run"]);
-  const settingsPath =
-    opts.configPath ?? opts["config-path"] ?? path.join(os.homedir(), ".qwen", "settings.json");
-  const envPath = opts.envPath ?? opts["env-path"] ?? path.join(path.dirname(settingsPath), ".env");
+  const configPath =
+    opts.configPath ?? opts["config-path"] ?? join(os.homedir(), ".qwen", "settings.json");
 
-  printHeading("OmniRoute → Qwen Code (OpenAI-compatible)");
+  printHeading("OmniRoute → Qwen Code (openai-compatible)");
   printInfo(`baseUrl: ${baseUrl}`);
 
-  let model = String(opts.model || "").trim();
-  if (!model && !opts.yes) {
-    const modelIds = await fetchModelIds(baseUrl, apiKey);
-    if (modelIds.length > 0) {
-      printInfo(`Examples: ${modelIds.slice(0, 20).join(", ")}${modelIds.length > 20 ? " …" : ""}`);
-    }
-    const prompt = createPrompt();
-    try {
-      model = String(await prompt.ask("Model id for Qwen Code")).trim();
-    } finally {
-      prompt.close();
+  let model = opts.model;
+  if (!model) {
+    const ids = await fetchModelIds(baseUrl, apiKey);
+    if (ids.length && !opts.yes) {
+      printInfo(`Examples: ${ids.slice(0, 20).join(", ")}${ids.length > 20 ? " …" : ""}`);
+      const prompt = createPrompt();
+      try {
+        model = await prompt.ask("Model id for Qwen");
+      } finally {
+        prompt.close();
+      }
     }
   }
-
   if (!model) {
     printError("A model is required. Pass --model <id>.");
     return 2;
   }
 
-  try {
-    const settings = mergeQwenCodeSettings(readSettings(settingsPath), { baseUrl, model });
-    const envText = mergeQwenCodeEnv(readText(envPath), apiKey);
-    const settingsText = `${JSON.stringify(settings, null, 2)}\n`;
+  const merged = buildQwenSettings(readJson(configPath), { baseUrl, model });
+  const out = JSON.stringify(merged, null, 2) + "\n";
 
-    if (dryRun) {
-      console.log(`\n${settingsText}`);
-      printInfo(`[dry-run] settings → ${settingsPath}`);
-      printInfo(`[dry-run] credential → ${envPath} (OMNIROUTE_API_KEY)`);
-      return 0;
-    }
-
-    mkdirSync(path.dirname(settingsPath), { recursive: true, mode: 0o700 });
-    mkdirSync(path.dirname(envPath), { recursive: true, mode: 0o700 });
-    writeAtomic(settingsPath, settingsText);
-    writeAtomic(envPath, envText, 0o600);
-    printSuccess(`Wrote ${settingsPath}`);
-    printSuccess(`Updated ${envPath} (OMNIROUTE_API_KEY only)`);
-    printInfo('Run: qwen   (or headless: qwen -p "reply OK")');
-    return 0;
-  } catch (error) {
-    printError(`Failed to configure Qwen Code: ${error?.message || error}`);
-    return 1;
+  if (dryRun) {
+    console.log("\n" + out);
+    printInfo(`[dry-run] → ${configPath}`);
+  } else {
+    mkdirSync(join(configPath, ".."), { recursive: true });
+    writeFileSync(configPath, out, "utf8");
+    printSuccess(`Wrote ${configPath}`);
   }
+  printInfo(
+    "\nProvide the key (settings reference OMNIROUTE_API_KEY):  export OMNIROUTE_API_KEY=..."
+  );
+  printInfo('Then run:  qwen        (or headless: qwen -p "reply OK")');
+  return 0;
 }
 
 export function registerSetupQwen(program) {
   program
     .command("setup-qwen")
-    .description("Configure Qwen Code's upstream V4 modelProviders format for OmniRoute")
+    .description(
+      "Configure Qwen Code for OmniRoute: write ~/.qwen/settings.json (openai modelProvider)"
+    )
     .option("--port <port>", "Local OmniRoute port (ignored when --remote is set)", "20128")
-    .option("--remote <url>", "Remote OmniRoute URL")
-    .option("--api-key <key>", "OmniRoute API key")
-    .option("--model <id>", "Model id for Qwen Code")
-    .option("--config-path <path>", "Qwen Code settings.json path")
-    .option("--env-path <path>", "Qwen Code .env path")
-    .option("--yes", "Non-interactive; requires --model")
-    .option("--dry-run", "Print settings without writing files or secrets")
+    .option("--remote <url>", "Remote OmniRoute URL, e.g. http://192.168.0.15:20128")
+    .option("--api-key <key>", "OmniRoute API key (defaults to OMNIROUTE_API_KEY env var)")
+    .option("--model <id>", "Model id for Qwen (required unless picked interactively)")
+    .option("--config-path <path>", "settings.json path (default: ~/.qwen/settings.json)")
+    .option("--yes", "Non-interactive: do not prompt (requires --model)")
+    .option("--dry-run", "Print what would be written without touching the filesystem")
     .action(async (opts) => {
       const code = await runSetupQwenCommand(opts);
-      if (code !== 0) process.exitCode = code;
+      if (code !== 0) process.exit(code);
     });
 }

bin/cli/commands/setup.mjs

@@ -26,7 +26,6 @@ function wantsProviderSetup(opts) {
 
 async function resolvePassword(opts, prompt, nonInteractive) {
   if (opts.password) return opts.password;
-  if (process.env.INITIAL_PASSWORD) return process.env.INITIAL_PASSWORD;
   if (nonInteractive) return "";
 
   const answer = await prompt.ask("Set an admin password now? [y/N]", "N");

bin/cli/commands/stop.mjs

@@ -8,7 +8,6 @@ import {
   sleep,
 } from "../utils/pid.mjs";
 import { t } from "../i18n.mjs";
-import { stopProcessGracefully } from "../../../src/shared/platform/windowsProcess.ts";
 
 const execFileAsync = promisify(execFile);
 
@@ -28,11 +27,18 @@ export async function runStopCommand(opts = {}) {
   if (pid && isPidRunning(pid)) {
     console.log(t("stop.stopping", { pid }));
     try {
-      // #8045: on win32, process.kill(pid, "SIGTERM") unconditionally force-terminates
-      // the target instead of delivering an interceptable signal, racing (and beating)
-      // the server's own async graceful shutdown / WAL checkpoint. stopProcessGracefully
-      // skips the immediate SIGTERM on win32 and just polls before escalating to SIGKILL.
-      await stopProcessGracefully({ pid, timeoutMs: 5000, isPidRunning, sleep });
+      process.kill(pid, "SIGTERM");
+
+      let waited = 0;
+      while (waited < 5000 && isPidRunning(pid)) {
+        await sleep(100);
+        waited += 100;
+      }
+
+      if (isPidRunning(pid)) {
+        process.kill(pid, "SIGKILL");
+        await sleep(500);
+      }
 
       killAllSubprocesses();
       cleanupPidFile("server");

bin/cli/locales/en.json

@@ -133,20 +133,6 @@
       "listTitle": "Keys expiring within {days} days:"
     }
   },
-  "authExport": {
-    "description": "Export DECRYPTED provider credentials (local-only, plaintext output)",
-    "idOpt": "Export only the connection matching this id/name/provider",
-    "formatOpt": "Output format: json or env",
-    "outOpt": "Write output to a file instead of stdout (written with 0600 permissions)",
-    "forceOpt": "Confirm you understand this prints/writes plaintext secrets",
-    "warning": "⚠ This prints/writes DECRYPTED plaintext API keys and OAuth tokens. Make sure your screen, shell history, and any output file stay private.",
-    "confirmHeading": "⚠ WARNING: this exports DECRYPTED provider credentials in plaintext",
-    "confirmBody": "This command decrypts and prints/writes apiKey, accessToken, refreshToken, and\nidToken for the selected connection(s). Treat the output as a secret.",
-    "confirmFooter": "To confirm, run:\n  omniroute auth export --force",
-    "missingKey": "STORAGE_ENCRYPTION_KEY is required to export credentials.",
-    "notFound": "Connection not found: {id}",
-    "invalidFormat": "Invalid format: {format}. Use json or env."
-  },
   "stream": {
     "description": "Stream a chat response with SSE inspection modes",
     "file": "Read prompt from file",

bin/cli/locales/pt-BR.json

@@ -132,20 +132,6 @@
       "listTitle": "Chaves que expiram nos próximos {days} dias:"
     }
   },
-  "authExport": {
-    "description": "Exportar credenciais DESCRIPTOGRAFADAS de provedores (somente local, saída em texto puro)",
-    "idOpt": "Exportar apenas a conexão correspondente a este id/nome/provedor",
-    "formatOpt": "Formato de saída: json ou env",
-    "outOpt": "Gravar a saída em um arquivo em vez do stdout (gravado com permissão 0600)",
-    "forceOpt": "Confirma que você entende que isso imprime/grava segredos em texto puro",
-    "warning": "⚠ Isso imprime/grava chaves de API e tokens OAuth DESCRIPTOGRAFADOS em texto puro. Garanta que sua tela, o histórico do shell e qualquer arquivo de saída permaneçam privados.",
-    "confirmHeading": "⚠ AVISO: isso exporta credenciais de provedores DESCRIPTOGRAFADAS em texto puro",
-    "confirmBody": "Este comando descriptografa e imprime/grava apiKey, accessToken, refreshToken e\nidToken da(s) conexão(ões) selecionada(s). Trate a saída como um segredo.",
-    "confirmFooter": "Para confirmar, execute:\n  omniroute auth export --force",
-    "missingKey": "STORAGE_ENCRYPTION_KEY é obrigatório para exportar credenciais.",
-    "notFound": "Conexão não encontrada: {id}",
-    "invalidFormat": "Formato inválido: {format}. Use json ou env."
-  },
   "stream": {
     "description": "Transmitir resposta de chat com modos de inspeção SSE",
     "file": "Ler prompt de arquivo",

bin/cli/locales/zh-CN.json

@@ -29,16 +29,16 @@
   "setup": {
     "title": "OmniRoute 设置",
     "passwordPrompt": "管理员密码",
-    "providerPrompt": "默认提供者（留空跳过）",
+    "providerPrompt": "默认提供商（留空跳过）",
     "done": "设置完成",
     "passwordSet": "管理员密码已配置",
-    "providerSet": "提供者已配置：{name}",
-    "testingProvider": "正在测试提供者连接：{name}",
-    "testPassed": "提供者测试通过",
-    "testFailed": "提供者测试失败：{error}",
+    "providerSet": "提供商已配置：{name}",
+    "testingProvider": "正在测试提供商连接：{name}",
+    "testPassed": "提供商测试通过",
+    "testFailed": "提供商测试失败：{error}",
     "loginEnabled": "登录：已启用（密码已更新）",
     "loginDisabled": "登录：已禁用",
-    "providerInfo": "提供者：{info}"
+    "providerInfo": "提供商：{info}"
   },
   "doctor": {
     "title": "OmniRoute 诊断",
@@ -52,29 +52,29 @@
     "warnings": "{count} 个警告 — 见上文。"
   },
   "providers": {
-    "title": "提供者",
-    "noProviders": "未配置提供者。运行：omniroute setup",
+    "title": "提供商",
+    "noProviders": "未配置提供商。运行：omniroute setup",
     "testing": "正在测试 {name}...",
-    "available": "{count} 个提供者可用",
+    "available": "{count} 个提供商可用",
     "connected": "已连接",
     "disconnected": "未连接",
     "validationFailed": "验证失败：{error}",
     "metrics": {
-      "description": "显示提供者性能指标（延迟、成功率、成本）",
-      "provider": "按提供者 ID 筛选",
+      "description": "显示提供商性能指标（延迟、成功率、成本）",
+      "provider": "按提供商 ID 筛选",
       "connection_id": "按连接 ID 筛选",
       "period": "时间范围：1h|6h|24h|7d|30d（默认：24h）",
       "metric": "关注特定指标字段",
       "sort": "按字段排序（降序）",
       "limit": "最大行数（默认：50）",
       "watch": "每 5 秒刷新（实时模式）",
-      "compare": "逗号分隔的提供者 ID，并排比较"
+      "compare": "逗号分隔的提供商 ID，并排比较"
     },
     "metric_single": {
       "description": "获取特定连接的单个指标值"
     },
     "rotate": {
-      "description": "轮换提供者连接的上游 API 密钥",
+      "description": "轮换提供商连接的上游 API 密钥",
       "newKeyOpt": "新 API 密钥值（避免使用：优先使用 --from-env）",
       "fromEnvOpt": "从环境变量 VAR 读取新密钥",
       "oauthOpt": "改为触发 OAuth 重新认证流程",
@@ -89,18 +89,18 @@
       "testFailed": "轮换后测试失败：{error}"
     },
     "status": {
-      "description": "显示所有提供者连接的密钥健康状态（期限、过期、冷却）",
-      "providerOpt": "按提供者名称筛选",
-      "header": "ID         提供者       名称                     过期状态  测试状态  冷却至",
-      "noData": "没有可用的提供者连接数据。",
+      "description": "显示所有提供商连接的密钥健康状态（期限、过期、冷却）",
+      "providerOpt": "按提供商名称筛选",
+      "header": "ID         提供商       名称                     过期状态  测试状态  冷却至",
+      "noData": "没有可用的提供商连接数据。",
       "requiresServer": "providers status 需要 OmniRoute 服务器正在运行。"
     }
   },
   "keys": {
     "title": "API 密钥",
-    "addDescription": "为提供者添加或更新 API 密钥",
+    "addDescription": "为提供商添加或更新 API 密钥",
     "listDescription": "列出所有已配置的 API 密钥",
-    "removeDescription": "移除提供者的 API 密钥",
+    "removeDescription": "移除提供商的 API 密钥",
     "regenerateDescription": "重新生成 OmniRoute API 密钥",
     "revokeDescription": "撤销 OmniRoute API 密钥",
     "revealDescription": "显示未掩码的 API 密钥值",
@@ -122,10 +122,10 @@
     "revoked": "密钥 {id} 已撤销。",
     "rotated": "密钥 {id} 已轮换。新密钥 ID：{newId}",
     "revealWarning": "⚠ 这将显示完整的未掩码密钥。请确保您的屏幕不被人看到。",
-    "providerRequired": "需要提供者。",
+    "providerRequired": "需要提供商。",
     "keyRequired": "需要 API 密钥。",
     "stdinEmpty": "未通过标准输入提供 API 密钥。",
-    "unknownProvider": "未知提供者：{provider}",
+    "unknownProvider": "未知提供商：{provider}",
     "policy": {
       "title": "密钥策略",
       "showDescription": "显示密钥的速率/成本策略",
@@ -165,7 +165,7 @@
     "analytics": {
       "description": "显示汇总使用分析",
       "period": "时间范围：1d|7d|30d|90d|ytd|all（默认：30d）",
-      "provider": "按提供者 ID 筛选"
+      "provider": "按提供商 ID 筛选"
     },
     "budget": {
       "description": "管理成本预算",
@@ -175,8 +175,8 @@
       }
     },
     "quota": {
-      "description": "显示提供者配额使用情况",
-      "provider": "按提供者 ID 筛选",
+      "description": "显示提供商配额使用情况",
+      "provider": "按提供商 ID 筛选",
       "check": "显示新请求是否有可用配额"
     },
     "logs": {
@@ -201,7 +201,7 @@
     }
   },
   "cost": {
-    "description": "按提供者、模型、组合或 API 密钥显示成本报告",
+    "description": "按提供商、模型、组合或 API 密钥显示成本报告",
     "period": "时间范围：1d|7d|30d|90d|ytd|all（默认：30d）",
     "since": "开始日期（ISO 格式，例如 2026-01-01）— 覆盖 --period",
     "until": "结束日期（ISO 格式）",
@@ -210,7 +210,7 @@
     "limit": "显示的最大行数（默认：100）"
   },
   "simulate": {
-    "description": "模拟路由（空运行）— 显示将选择哪些提供者而不调用上游",
+    "description": "模拟路由（空运行）— 显示将选择哪些提供商而不调用上游",
     "file": "从 JSON 文件加载完整请求体",
     "model": "模型 ID（默认：auto）",
     "combo": "强制指定组合名称",
@@ -301,7 +301,7 @@
     "cost": "成本（24h）："
   },
   "quota": {
-    "description": "显示提供者配额使用情况",
+    "description": "显示提供商配额使用情况",
     "noServer": "服务器未运行。启动：omniroute serve",
     "noData": "没有可用的配额信息。"
   },
@@ -315,12 +315,12 @@
     "description": "一键启动本地 Redis 容器（Podman 或 Docker），用于 OmniRoute 缓存和配额跟踪"
   },
   "test": {
-    "description": "测试提供者连接",
+    "description": "测试提供商连接",
     "noServer": "服务器未运行。启动：omniroute serve",
     "testing": "正在测试 {provider} / {model}...",
     "passed": "连接成功！",
     "failed": "连接失败：{error}",
-    "allProvidersOpt": "测试所有已配置的提供者",
+    "allProvidersOpt": "测试所有已配置的提供商",
     "latencyOpt": "显示延迟测量值（平均/最小/最大 毫秒）",
     "repeatOpt": "重复测试 N 次并汇总结果",
     "compareOpt": "逗号分隔的要比较的模型（例如 gpt-4o,claude-3-5-sonnet）",
@@ -328,7 +328,7 @@
     "saved": "结果已保存至 {path}",
     "compareTitle": "模型比较",
     "compareMinTwo": "--compare 需要至少两个模型（逗号分隔）",
-    "noProviders": "未配置提供者。添加：omniroute keys add"
+    "noProviders": "未配置提供商。添加：omniroute keys add"
   },
   "update": {
     "checking": "正在检查更新...",
@@ -509,7 +509,7 @@
   },
   "models": {
     "description": "列出可用模型（需要服务器）",
-    "search": "按 ID、名称、提供者或描述筛选模型",
+    "search": "按 ID、名称、提供商或描述筛选模型",
     "noServer": "服务器未运行。启动：omniroute serve",
     "noModels": "未找到模型。"
   },
@@ -656,25 +656,25 @@
     }
   },
   "oauth": {
-    "description": "管理 OAuth 提供者连接",
+    "description": "管理 OAuth 提供商连接",
     "providers": {
-      "description": "列出支持 OAuth 的提供者及其流程类型"
+      "description": "列出支持 OAuth 的提供商及其流程类型"
     },
     "start": {
-      "description": "为提供者启动 OAuth 授权流程",
-      "provider": "提供者 ID（gemini, copilot, cursor, ...）",
+      "description": "为提供商启动 OAuth 授权流程",
+      "provider": "提供商 ID（gemini, copilot, cursor, ...）",
       "no_browser": "仅打印 URL — 不打开浏览器",
       "import_system": "从本地系统配置自动导入凭据",
-      "social": "社交登录提供者（google|github）— kiro 需要",
+      "social": "社交登录提供商（google|github）— kiro 需要",
       "timeout": "等待授权超时时间（毫秒，默认：300000）"
     },
     "status": {
       "description": "列出活动的 OAuth 连接",
-      "provider": "按提供者 ID 筛选"
+      "provider": "按提供商 ID 筛选"
     },
     "revoke": {
       "description": "撤销 OAuth 连接",
-      "provider": "要撤销的提供者 ID",
+      "provider": "要撤销的提供商 ID",
       "connection_id": "按 ID 撤销特定连接",
       "yes": "跳过确认提示"
     }
@@ -884,11 +884,11 @@
     "description": "管理模型定价数据",
     "sync": {
       "description": "从上游同步价格",
-      "provider": "按提供者筛选",
+      "provider": "按提供商筛选",
       "force": "强制重新同步"
     },
     "list": {
-      "provider": "按提供者筛选",
+      "provider": "按提供商筛选",
       "model": "按模型筛选",
       "limit": "最大结果数"
     },
@@ -907,25 +907,25 @@
   "resilience": {
     "description": "检查和管理弹性机制",
     "status": {
-      "provider": "按提供者筛选"
+      "provider": "按提供商筛选"
     },
     "breakers": {
-      "provider": "按提供者筛选"
+      "provider": "按提供商筛选"
     },
     "cooldowns": {
-      "provider": "按提供者筛选",
+      "provider": "按提供商筛选",
       "connectionId": "按连接 ID 筛选"
     },
     "lockouts": {
-      "provider": "按提供者筛选",
+      "provider": "按提供商筛选",
       "model": "按模型筛选"
     },
     "reset": {
       "description": "重置断路器/冷却状态",
-      "provider": "要重置的提供者",
+      "provider": "要重置的提供商",
       "connectionId": "要重置的连接 ID",
       "model": "要重置锁定状态的模型",
-      "allCooldowns": "重置提供者的所有冷却",
+      "allCooldowns": "重置提供商的所有冷却",
       "yes": "跳过确认"
     },
     "profile": {
@@ -940,13 +940,13 @@
     }
   },
   "nodes": {
-    "description": "管理提供者节点（端点）",
+    "description": "管理提供商节点（端点）",
     "list": {
-      "provider": "按提供者筛选",
+      "provider": "按提供商筛选",
       "enabled": "仅显示已启用的节点"
     },
     "add": {
-      "provider": "提供者名称",
+      "provider": "提供商名称",
       "baseUrl": "节点的基础 URL",
       "name": "节点名称",
       "weight": "负载均衡权重",
@@ -965,7 +965,7 @@
     },
     "validate": {
       "baseUrl": "要验证的 URL",
-      "provider": "要验证的提供者"
+      "provider": "要验证的提供商"
     },
     "test": {
       "description": "向节点发送测试请求"
@@ -1091,7 +1091,7 @@
   "oneproxy": {
     "description": "管理 OneProxy 上游代理池",
     "stats": {
-      "provider": "按提供者筛选",
+      "provider": "按提供商筛选",
       "period": "时间范围（默认：24h）"
     },
     "fetch": {
@@ -1101,14 +1101,14 @@
     },
     "rotate": {
       "description": "强制轮换代理",
-      "provider": "要轮换的提供者",
+      "provider": "要轮换的提供商",
       "connectionId": "要轮换的特定连接 ID"
     },
     "config": {
       "description": "显示或更新 OneProxy 配置",
       "enabled": "启用代理池（true|false）",
       "poolSize": "池大小",
-      "providerSource": "代理提供者的 URL",
+      "providerSource": "代理提供商的 URL",
       "rotationPolicy": "轮换策略：sticky|per-request|periodic"
     },
     "pool": {
@@ -1201,7 +1201,7 @@
     "bash": "打印 bash 补全脚本",
     "fish": "打印 fish 补全脚本",
     "install": "为检测到的 Shell 全局安装补全脚本",
-    "refresh": "刷新组合/提供者/模型缓存"
+    "refresh": "刷新组合/提供商/模型缓存"
   },
   "logs": {
     "description": "流式传输或导出请求日志",

bin/cli/locales/zh-TW.json

@@ -29,16 +29,16 @@
   "setup": {
     "title": "OmniRoute 設定",
     "passwordPrompt": "管理員密碼",
-    "providerPrompt": "預設提供者（留空跳過）",
+    "providerPrompt": "預設提供商（留空跳過）",
     "done": "設定完成",
     "passwordSet": "管理員密碼已配置",
-    "providerSet": "提供者已配置：{name}",
-    "testingProvider": "正在測試提供者連線：{name}",
-    "testPassed": "提供者測試通過",
-    "testFailed": "提供者測試失敗：{error}",
+    "providerSet": "提供商已配置：{name}",
+    "testingProvider": "正在測試提供商連線：{name}",
+    "testPassed": "提供商測試通過",
+    "testFailed": "提供商測試失敗：{error}",
     "loginEnabled": "登入：已啟用（密碼已更新）",
     "loginDisabled": "登入：已停用",
-    "providerInfo": "提供者：{info}"
+    "providerInfo": "提供商：{info}"
   },
   "doctor": {
     "title": "OmniRoute 診斷",
@@ -52,29 +52,29 @@
     "warnings": "{count} 個警告 — 見上文。"
   },
   "providers": {
-    "title": "提供者",
-    "noProviders": "未配置提供者。執行：omniroute setup",
+    "title": "提供商",
+    "noProviders": "未配置提供商。執行：omniroute setup",
     "testing": "正在測試 {name}...",
-    "available": "{count} 個提供者可用",
+    "available": "{count} 個提供商可用",
     "connected": "已連線",
     "disconnected": "未連線",
     "validationFailed": "驗證失敗：{error}",
     "metrics": {
-      "description": "顯示提供者效能指標（延遲、成功率、成本）",
-      "provider": "按提供者 ID 篩選",
+      "description": "顯示提供商效能指標（延遲、成功率、成本）",
+      "provider": "按提供商 ID 篩選",
       "connection_id": "按連線 ID 篩選",
       "period": "時間範圍：1h|6h|24h|7d|30d（預設：24h）",
       "metric": "關注特定指標欄位",
       "sort": "按欄位排序（降序）",
       "limit": "最大行數（預設：50）",
       "watch": "每 5 秒重新整理（即時模式）",
-      "compare": "逗號分隔的提供者 ID，並排比較"
+      "compare": "逗號分隔的提供商 ID，並排比較"
     },
     "metric_single": {
       "description": "獲取特定連線的單個指標值"
     },
     "rotate": {
-      "description": "輪換提供者連線的上游 API 金鑰",
+      "description": "輪換提供商連線的上游 API 金鑰",
       "newKeyOpt": "新 API 金鑰值（避免使用：優先使用 --from-env）",
       "fromEnvOpt": "從環境變數 VAR 讀取新金鑰",
       "oauthOpt": "改為觸發 OAuth 重新認證流程",
@@ -89,18 +89,18 @@
       "testFailed": "輪換後測試失敗：{error}"
     },
     "status": {
-      "description": "顯示所有提供者連線的金鑰健康狀態（期限、過期、冷卻）",
-      "providerOpt": "按提供者名稱篩選",
-      "header": "ID         提供者       名稱                     過期狀態  測試狀態  冷卻至",
-      "noData": "沒有可用的提供者連線資料。",
+      "description": "顯示所有提供商連線的金鑰健康狀態（期限、過期、冷卻）",
+      "providerOpt": "按提供商名稱篩選",
+      "header": "ID         提供商       名稱                     過期狀態  測試狀態  冷卻至",
+      "noData": "沒有可用的提供商連線資料。",
       "requiresServer": "providers status 需要 OmniRoute 伺服器正在執行。"
     }
   },
   "keys": {
     "title": "API 金鑰",
-    "addDescription": "為提供者新增或更新 API 金鑰",
+    "addDescription": "為提供商新增或更新 API 金鑰",
     "listDescription": "列出所有已配置的 API 金鑰",
-    "removeDescription": "移除提供者的 API 金鑰",
+    "removeDescription": "移除提供商的 API 金鑰",
     "regenerateDescription": "重新生成 OmniRoute API 金鑰",
     "revokeDescription": "撤銷 OmniRoute API 金鑰",
     "revealDescription": "顯示未掩碼的 API 金鑰值",
@@ -122,10 +122,10 @@
     "revoked": "金鑰 {id} 已撤銷。",
     "rotated": "金鑰 {id} 已輪換。新金鑰 ID：{newId}",
     "revealWarning": "⚠ 這將顯示完整的未掩碼金鑰。請確保您的螢幕不被人看到。",
-    "providerRequired": "需要提供者。",
+    "providerRequired": "需要提供商。",
     "keyRequired": "需要 API 金鑰。",
     "stdinEmpty": "未通過標準輸入提供 API 金鑰。",
-    "unknownProvider": "未知提供者：{provider}",
+    "unknownProvider": "未知提供商：{provider}",
     "policy": {
       "title": "金鑰策略",
       "showDescription": "顯示金鑰的速率/成本策略",
@@ -151,7 +151,7 @@
     "model": "模型 ID（預設：auto）",
     "system": "系統提示",
     "combo": "強制指定組合名稱",
-    "max_tokens": "響應最大權杖數",
+    "max_tokens": "響應最大令牌數",
     "responses_api": "使用 /v1/responses 而不是 /v1/chat/completions",
     "raw": "列印接收到的原始 SSE 行",
     "debug": "在 stderr 中列印每塊的時間資訊",
@@ -165,7 +165,7 @@
     "analytics": {
       "description": "顯示彙總使用分析",
       "period": "時間範圍：1d|7d|30d|90d|ytd|all（預設：30d）",
-      "provider": "按提供者 ID 篩選"
+      "provider": "按提供商 ID 篩選"
     },
     "budget": {
       "description": "管理成本預算",
@@ -175,8 +175,8 @@
       }
     },
     "quota": {
-      "description": "顯示提供者配額使用情況",
-      "provider": "按提供者 ID 篩選",
+      "description": "顯示提供商配額使用情況",
+      "provider": "按提供商 ID 篩選",
       "check": "顯示新請求是否有可用配額"
     },
     "logs": {
@@ -201,7 +201,7 @@
     }
   },
   "cost": {
-    "description": "按提供者、模型、組合或 API 金鑰顯示成本報告",
+    "description": "按提供商、模型、組合或 API 金鑰顯示成本報告",
     "period": "時間範圍：1d|7d|30d|90d|ytd|all（預設：30d）",
     "since": "開始日期（ISO 格式，例如 2026-01-01）— 覆蓋 --period",
     "until": "結束日期（ISO 格式）",
@@ -210,12 +210,12 @@
     "limit": "顯示的最大行數（預設：100）"
   },
   "simulate": {
-    "description": "模擬路由（空執行）— 顯示將選擇哪些提供者而不呼叫上游",
+    "description": "模擬路由（空執行）— 顯示將選擇哪些提供商而不呼叫上游",
     "file": "從 JSON 檔案載入完整請求體",
     "model": "模型 ID（預設：auto）",
     "combo": "強制指定組合名稱",
     "reasoning": "推理努力級別（low|medium|high）",
-    "thinking": "擴充套件思維權杖預算",
+    "thinking": "擴充套件思維令牌預算",
     "explain": "在 stderr 中列印回退樹和成本範圍",
     "noCombo": "未找到匹配的組合。使用以下命令配置：omniroute combo create"
   },
@@ -225,11 +225,11 @@
     "stdin": "從標準輸入讀取提示",
     "system": "系統提示",
     "model": "模型 ID（預設：auto）",
-    "max_tokens": "響應最大權杖數",
+    "max_tokens": "響應最大令牌數",
     "temperature": "取樣溫度（0–2）",
     "top_p": "Top-p 核取樣",
     "reasoning_effort": "推理努力級別（low|medium|high）",
-    "thinking_budget": "擴充套件思維權杖預算",
+    "thinking_budget": "擴充套件思維令牌預算",
     "combo": "強制指定組合名稱",
     "responses_api": "使用 /v1/responses 而不是 /v1/chat/completions",
     "stream": "增量流式傳輸響應",
@@ -301,7 +301,7 @@
     "cost": "成本（24h）："
   },
   "quota": {
-    "description": "顯示提供者配額使用情況",
+    "description": "顯示提供商配額使用情況",
     "noServer": "伺服器未執行。啟動：omniroute serve",
     "noData": "沒有可用的配額資訊。"
   },
@@ -315,12 +315,12 @@
     "description": "一鍵啟動本地 Redis 容器（Podman 或 Docker），用於 OmniRoute 快取和配額跟蹤"
   },
   "test": {
-    "description": "測試提供者連線",
+    "description": "測試提供商連線",
     "noServer": "伺服器未執行。啟動：omniroute serve",
     "testing": "正在測試 {provider} / {model}...",
     "passed": "連線成功！",
     "failed": "連線失敗：{error}",
-    "allProvidersOpt": "測試所有已配置的提供者",
+    "allProvidersOpt": "測試所有已配置的提供商",
     "latencyOpt": "顯示延遲測量值（平均/最小/最大 毫秒）",
     "repeatOpt": "重複測試 N 次並彙總結果",
     "compareOpt": "逗號分隔的要比較的模型（例如 gpt-4o,claude-3-5-sonnet）",
@@ -328,7 +328,7 @@
     "saved": "結果已儲存至 {path}",
     "compareTitle": "模型比較",
     "compareMinTwo": "--compare 需要至少兩個模型（逗號分隔）",
-    "noProviders": "未配置提供者。新增：omniroute keys add"
+    "noProviders": "未配置提供商。新增：omniroute keys add"
   },
   "update": {
     "checking": "正在檢查更新...",
@@ -445,7 +445,7 @@
       "description": "配置壓縮設定",
       "engine": "壓縮引擎（caveman|rtk|hybrid|none）",
       "caveman_agg": "Caveman 激程序度 0.0–1.0",
-      "rtk_budget": "RTK 權杖預算",
+      "rtk_budget": "RTK 令牌預算",
       "language_pack": "要啟用的語言包"
     },
     "engine": {
@@ -509,7 +509,7 @@
   },
   "models": {
     "description": "列出可用模型（需要伺服器）",
-    "search": "按 ID、名稱、提供者或描述篩選模型",
+    "search": "按 ID、名稱、提供商或描述篩選模型",
     "noServer": "伺服器未執行。啟動：omniroute serve",
     "noModels": "未找到模型。"
   },
@@ -621,7 +621,7 @@
       "type": "按記憶型別篩選（user|feedback|project|reference）",
       "limit": "最大結果數（預設：20）",
       "api_key": "按 API 金鑰篩選",
-      "token_budget": "限制結果中的總權杖數"
+      "token_budget": "限制結果中的總令牌數"
     },
     "add": {
       "description": "新增新的記憶條目",
@@ -656,25 +656,25 @@
     }
   },
   "oauth": {
-    "description": "管理 OAuth 提供者連線",
+    "description": "管理 OAuth 提供商連線",
     "providers": {
-      "description": "列出支援 OAuth 的提供者及其流程型別"
+      "description": "列出支援 OAuth 的提供商及其流程型別"
     },
     "start": {
-      "description": "為提供者啟動 OAuth 授權流程",
-      "provider": "提供者 ID（gemini, copilot, cursor, ...）",
+      "description": "為提供商啟動 OAuth 授權流程",
+      "provider": "提供商 ID（gemini, copilot, cursor, ...）",
       "no_browser": "僅列印 URL — 不開啟瀏覽器",
       "import_system": "從本地系統配置自動匯入憑據",
-      "social": "社交登入提供者（google|github）— kiro 需要",
+      "social": "社交登入提供商（google|github）— kiro 需要",
       "timeout": "等待授權超時時間（毫秒，預設：300000）"
     },
     "status": {
       "description": "列出活動的 OAuth 連線",
-      "provider": "按提供者 ID 篩選"
+      "provider": "按提供商 ID 篩選"
     },
     "revoke": {
       "description": "撤銷 OAuth 連線",
-      "provider": "要撤銷的提供者 ID",
+      "provider": "要撤銷的提供商 ID",
       "connection_id": "按 ID 撤銷特定連線",
       "yes": "跳過確認提示"
     }
@@ -884,20 +884,20 @@
     "description": "管理模型定價資料",
     "sync": {
       "description": "從上游同步價格",
-      "provider": "按提供者篩選",
+      "provider": "按提供商篩選",
       "force": "強制重新同步"
     },
     "list": {
-      "provider": "按提供者篩選",
+      "provider": "按提供商篩選",
       "model": "按模型篩選",
       "limit": "最大結果數"
     },
     "defaults": {
       "description": "管理預設定價",
-      "input": "每 1M 權杖的輸入成本（美元）",
-      "output": "每 1M 權杖的輸出成本（美元）",
-      "cacheRead": "每 1M 權杖的快取讀取成本（美元）",
-      "cacheWrite": "每 1M 權杖的快取寫入成本（美元）"
+      "input": "每 1M 令牌的輸入成本（美元）",
+      "output": "每 1M 令牌的輸出成本（美元）",
+      "cacheRead": "每 1M 令牌的快取讀取成本（美元）",
+      "cacheWrite": "每 1M 令牌的快取寫入成本（美元）"
     },
     "diff": {
       "description": "顯示與上游價格的差異",
@@ -907,25 +907,25 @@
   "resilience": {
     "description": "檢查和管理彈性機制",
     "status": {
-      "provider": "按提供者篩選"
+      "provider": "按提供商篩選"
     },
     "breakers": {
-      "provider": "按提供者篩選"
+      "provider": "按提供商篩選"
     },
     "cooldowns": {
-      "provider": "按提供者篩選",
+      "provider": "按提供商篩選",
       "connectionId": "按連線 ID 篩選"
     },
     "lockouts": {
-      "provider": "按提供者篩選",
+      "provider": "按提供商篩選",
       "model": "按模型篩選"
     },
     "reset": {
       "description": "重置斷路器/冷卻狀態",
-      "provider": "要重置的提供者",
+      "provider": "要重置的提供商",
       "connectionId": "要重置的連線 ID",
       "model": "要重置鎖定狀態的模型",
-      "allCooldowns": "重置提供者的所有冷卻",
+      "allCooldowns": "重置提供商的所有冷卻",
       "yes": "跳過確認"
     },
     "profile": {
@@ -940,13 +940,13 @@
     }
   },
   "nodes": {
-    "description": "管理提供者節點（端點）",
+    "description": "管理提供商節點（端點）",
     "list": {
-      "provider": "按提供者篩選",
+      "provider": "按提供商篩選",
       "enabled": "僅顯示已啟用的節點"
     },
     "add": {
-      "provider": "提供者名稱",
+      "provider": "提供商名稱",
       "baseUrl": "節點的基礎 URL",
       "name": "節點名稱",
       "weight": "負載均衡權重",
@@ -965,7 +965,7 @@
     },
     "validate": {
       "baseUrl": "要驗證的 URL",
-      "provider": "要驗證的提供者"
+      "provider": "要驗證的提供商"
     },
     "test": {
       "description": "向節點發送測試請求"
@@ -993,7 +993,7 @@
       "description": "管理 RTK 上下文最佳化器",
       "config": {
         "description": "顯示或更新 RTK 配置",
-        "tokenBudget": "RTK 權杖預算",
+        "tokenBudget": "RTK 令牌預算",
         "reservePct": "保留百分比"
       },
       "filters": {
@@ -1091,7 +1091,7 @@
   "oneproxy": {
     "description": "管理 OneProxy 上游代理池",
     "stats": {
-      "provider": "按提供者篩選",
+      "provider": "按提供商篩選",
       "period": "時間範圍（預設：24h）"
     },
     "fetch": {
@@ -1101,14 +1101,14 @@
     },
     "rotate": {
       "description": "強制輪換代理",
-      "provider": "要輪換的提供者",
+      "provider": "要輪換的提供商",
       "connectionId": "要輪換的特定連線 ID"
     },
     "config": {
       "description": "顯示或更新 OneProxy 配置",
       "enabled": "啟用代理池（true|false）",
       "poolSize": "池大小",
-      "providerSource": "代理提供者的 URL",
+      "providerSource": "代理提供商的 URL",
       "rotationPolicy": "輪換策略：sticky|per-request|periodic"
     },
     "pool": {
@@ -1163,11 +1163,11 @@
       "fromCloud": "從雲備份初始化"
     },
     "tokens": {
-      "description": "管理同步權杖",
+      "description": "管理同步令牌",
       "create": {
-        "name": "權杖名稱",
-        "scope": "權杖作用域",
-        "ttl": "權杖有效期（例如 30d）"
+        "name": "令牌名稱",
+        "scope": "令牌作用域",
+        "ttl": "令牌有效期（例如 30d）"
       },
       "revoke": {
         "yes": "跳過確認"
@@ -1201,7 +1201,7 @@
     "bash": "列印 bash 補全指令碼",
     "fish": "列印 fish 補全指令碼",
     "install": "為檢測到的 Shell 全域性安裝補全指令碼",
-    "refresh": "重新整理組合/提供者/模型快取"
+    "refresh": "重新整理組合/提供商/模型快取"
   },
   "logs": {
     "description": "流式傳輸或匯出請求日誌",

bin/cli/runtime/nativeDeps.mjs

@@ -52,31 +52,6 @@ export function hasModule(name) {
   return existsSync(join(runtimeModules(), name, "package.json"));
 }
 
-/**
- * Probe whether a native addon (.node) file can actually be dlopen'd by the Node runtime that
- * is going to load it. Runs in a throwaway subprocess so a real ABI mismatch (which can segfault
- * the process instead of throwing) never takes down the caller — only the probe subprocess.
- */
-function probeNativeBinaryLoadable(binary) {
-  try {
-    const res = spawnSync(
-      process.execPath,
-      [
-        "-e",
-        "try { require(process.argv[1]); process.exit(0); } catch (e) { process.exit(1); }",
-        binary,
-      ],
-      { timeout: 10_000, stdio: "ignore" }
-    );
-    // status === 0 means require() (and therefore dlopen) succeeded. Anything else — a thrown
-    // ERR_DLOPEN_FAILED/NODE_MODULE_VERSION mismatch (status 1) or a crash (status null with a
-    // signal, e.g. SIGSEGV) — means the binary is not safe to load.
-    return res.status === 0;
-  } catch {
-    return false;
-  }
-}
-
 export function isBetterSqliteBinaryValid() {
   const binary = join(
     runtimeModules(),
@@ -93,18 +68,10 @@ export function isBetterSqliteBinaryValid() {
     closeSync(fd);
     const magic = buf.toString("hex");
     const os = platform();
-    let formatOk;
-    if (os === "linux") formatOk = magic.startsWith("7f454c46"); // ELF
-    else if (os === "darwin")
-      formatOk = magic.startsWith("cffaedfe") || magic.startsWith("cefaedfe"); // Mach-O
-    else if (os === "win32") formatOk = magic.startsWith("4d5a"); // PE/MZ
-    else formatOk = true;
-    if (!formatOk) return false;
-    // File-format magic bytes alone do not guarantee the binary was built for the Node ABI
-    // (NODE_MODULE_VERSION) that will load it — a stale/foreign-ABI binary passes the header
-    // check and then crashes (segfault) on load instead of triggering a rebuild. Actually
-    // attempt to load it, isolated in a subprocess.
-    return probeNativeBinaryLoadable(binary);
+    if (os === "linux") return magic.startsWith("7f454c46"); // ELF
+    if (os === "darwin") return magic.startsWith("cffaedfe") || magic.startsWith("cefaedfe"); // Mach-O
+    if (os === "win32") return magic.startsWith("4d5a"); // PE/MZ
+    return true;
   } catch {
     return false;
   }

bin/cli/runtime/processSupervisor.mjs

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import { dirname } from "node:path";
-import { writePidFile, cleanupPidFile, killAllSubprocesses, isPidRunning } from "../utils/pid.mjs";
+import { writePidFile, cleanupPidFile, killAllSubprocesses } from "../utils/pid.mjs";
 import {
   RESTART_RESET_MS,
   DEFAULT_MAX_RESTARTS,
@@ -9,22 +9,11 @@ import {
   waitUntilPortFree,
 } from "./supervisorPolicy.mjs";
 import { buildNodeHeapArgs } from "../../../scripts/build/runtime-env.mjs";
-import { stopProcessGracefully } from "../../../src/shared/platform/windowsProcess.ts";
-import {
-  isFatalInstrumentationHookFailure,
-  formatAndroidInstrumentationFailureHint,
-} from "../utils/ensureAndroidCacheDir.mjs";
 
 const CRASH_LOG_LINES = 50;
 
 export class ServerSupervisor {
-  constructor({
-    serverPath,
-    env,
-    maxRestarts = DEFAULT_MAX_RESTARTS,
-    memoryLimit = 512,
-    onCrashCallback,
-  }) {
+  constructor({ serverPath, env, maxRestarts = DEFAULT_MAX_RESTARTS, memoryLimit = 512, onCrashCallback }) {
     this.serverPath = serverPath;
     this.env = env;
     this.maxRestarts = maxRestarts;
@@ -35,13 +24,11 @@ export class ServerSupervisor {
     this.crashLog = [];
     this.child = null;
     this.isShuttingDown = false;
-    this.instrumentationFailureHintPrinted = false;
   }
 
   start() {
     this.startedAt = Date.now();
     this.crashLog = [];
-    this.instrumentationFailureHintPrinted = false;
 
     const showLog = process.env.OMNIROUTE_SHOW_LOG === "1";
     // #5238: skip the explicit CLI --max-old-space-size when the user pinned the
@@ -53,35 +40,20 @@ export class ServerSupervisor {
     // silently, so a boot that never becomes ready looked like a dead hang with zero
     // output even at APP_LOG_LEVEL=debug. Pipe stdout too and buffer it alongside
     // stderr so a readiness timeout can surface what the child actually printed.
-    this.child = spawn(
-      process.versions.bun ? process.execPath : "node",
-      [...(process.versions.bun ? [] : heapArgs), this.serverPath],
-      {
-        cwd: dirname(this.serverPath),
-        env: this.env,
-        stdio: showLog ? "inherit" : ["ignore", "pipe", "pipe"],
-      }
-    );
+    this.child = spawn("node", [...heapArgs, this.serverPath], {
+      cwd: dirname(this.serverPath),
+      env: this.env,
+      stdio: showLog ? "inherit" : ["ignore", "pipe", "pipe"],
+    });
 
     writePidFile("server", this.child.pid);
 
     const bufferOutput = (data) => {
-      const text = data.toString();
-      const lines = text.split("\n").filter(Boolean);
+      const lines = data.toString().split("\n").filter(Boolean);
       this.crashLog.push(...lines);
       if (this.crashLog.length > CRASH_LOG_LINES) {
         this.crashLog = this.crashLog.slice(-CRASH_LOG_LINES);
       }
-      // Surface Android/Termux instrumentation-hook failures even when --log is
-      // off (output is only buffered otherwise).
-      if (!this.instrumentationFailureHintPrinted && isFatalInstrumentationHookFailure(text)) {
-        this.instrumentationFailureHintPrinted = true;
-        process.stderr.write(
-          formatAndroidInstrumentationFailureHint(
-            this.env?.XDG_CACHE_HOME || process.env.XDG_CACHE_HOME
-          )
-        );
-      }
     };
 
     if (this.child.stdout) {
@@ -97,32 +69,12 @@ export class ServerSupervisor {
     return this.child;
   }
 
-  handleExit(code, err) {
+  handleExit(code) {
     // Node.js v24+ requires process.exit() to receive a number. Spawn-error events
     // deliver err.code (a string like 'ENOENT') via the 'error' listener; normalise here.
     const exitCode = typeof code === "number" ? code : null;
     cleanupPidFile("server");
 
-    // #8091: the child's spawn 'error' listener passes `err` through as a second
-    // argument, but it used to be silently dropped — the user only ever saw the
-    // hardcoded "code=-1" with a permanently empty crash log, with no way to
-    // diagnose why the child never started (ENOENT/EACCES/bad path/etc.). Surface
-    // the real reason immediately, both on the console and in the crash-log buffer
-    // so `dumpCrashLog()` shows it too.
-    if (err) {
-      const detail = [
-        err.code && `code=${err.code}`,
-        err.syscall && `syscall=${err.syscall}`,
-        err.path && `path=${err.path}`,
-        err.message,
-      ]
-        .filter(Boolean)
-        .join(" ");
-      const line = `⚠ Spawn error: ${detail || String(err)}`;
-      console.error(line);
-      this.crashLog.push(line);
-    }
-
     // #4425: only exit on an intentional shutdown. A spontaneous code-0 exit (e.g. a
     // systemd MemoryMax cgroup kill, which reports the process exited cleanly) is anomalous
     // and must be restarted, not treated as a graceful stop that leaves the gateway dead.
@@ -180,13 +132,14 @@ export class ServerSupervisor {
   stop() {
     this.isShuttingDown = true;
     if (this.child?.pid) {
-      // #8045: on win32, process.kill(pid, "SIGTERM") unconditionally force-terminates
-      // the target — it is never a real, interceptable signal there. The child already
-      // receives the real CTRL_C_EVENT/CTRL_CLOSE_EVENT independently (it shares the
-      // console) and runs its own async graceful shutdown (WAL checkpoint). Sending
-      // SIGTERM immediately on win32 races and beats that cleanup. Fire-and-forget:
-      // stop() itself stays sync so callers keep their existing control flow.
-      void stopProcessGracefully({ pid: this.child.pid, timeoutMs: 5000, isPidRunning });
+      try {
+        process.kill(this.child.pid, "SIGTERM");
+      } catch {}
+      setTimeout(() => {
+        try {
+          process.kill(this.child.pid, "SIGKILL");
+        } catch {}
+      }, 5000);
     }
     killAllSubprocesses();
   }

bin/cli/sqlite.mjs

@@ -3,85 +3,12 @@ import { resolveDataDir, resolveStoragePath } from "./data-dir.mjs";
 import { ensureProviderSchema } from "./provider-store.mjs";
 import { ensureSettingsSchema, hashManagementPassword, updateSettings } from "./settings-store.mjs";
 
-async function loadSqlite() {
-  if (process.versions.bun) {
-    return { Database: (await import("bun:sqlite")).Database };
-  }
+async function loadBetterSqlite() {
   try {
-    return { Database: (await import("better-sqlite3")).default };
-  } catch (error) {
-    return { error };
-  }
-}
-
-// #7586: unlike the real server (src/lib/db/adapters/driverFactory.ts::tryOpenSync),
-// this CLI helper historically had NO fallback beyond better-sqlite3 — so on any
-// machine where better-sqlite3's native binary is unavailable (Windows without a
-// prebuilt addon, etc.), every `omniroute doctor` DB check reported a false FAIL
-// even when the actual server was healthy via its own (correct) driver cascade.
-// Reuse that same cascade here instead of re-deriving it.
-async function openWithSyncDriverFallback(dbPath, options, importError) {
-  try {
-    const { tryOpenSync } = await import("../../src/lib/db/adapters/driverFactory.ts");
-    const adapter = tryOpenSync(dbPath, options);
-    if (adapter) {
-      return adapter;
-    }
+    return (await import("better-sqlite3")).default;
   } catch {
-    // fall through to the original better-sqlite3 error below
+    throw new Error("better-sqlite3 is not installed. Run npm install before using setup.");
   }
-  throw createSqliteNativeError(importError);
-}
-
-function openBunSqlite(Database, dbPath, options) {
-  const raw = new Database(dbPath, options);
-  const prepare = (sql) => {
-    const statement = raw.query(sql);
-    return {
-      run: (...params) => statement.run(...normalizeBunSqliteParams(params)),
-      get: (...params) => statement.get(...normalizeBunSqliteParams(params)),
-      all: (...params) => statement.all(...normalizeBunSqliteParams(params)),
-    };
-  };
-  return {
-    prepare,
-    query: (sql) => raw.query(sql),
-    exec: (sql) => raw.exec(sql),
-    transaction: (fn) => raw.transaction(fn),
-    close: () => raw.close(),
-    serialize: () => raw.serialize(),
-    pragma: (pragmaStr, pragmaOptions) => {
-      const statement = raw.query(`PRAGMA ${pragmaStr}`);
-      if (pragmaOptions?.simple) {
-        const row = statement.get();
-        return row ? (Object.values(row)[0] ?? null) : null;
-      }
-      return statement.all();
-    },
-  };
-}
-
-export function normalizeBunSqliteParams(params) {
-  if (
-    params.length !== 1 ||
-    params[0] === null ||
-    typeof params[0] !== "object" ||
-    Array.isArray(params[0]) ||
-    params[0] instanceof Uint8Array ||
-    (typeof Buffer !== "undefined" && Buffer.isBuffer(params[0]))
-  ) {
-    return params;
-  }
-  const expanded = {};
-  for (const [key, value] of Object.entries(params[0])) {
-    if (/^[:@$]/.test(key)) expanded[key] = value;
-    else {
-      expanded[`@${key}`] = value;
-      expanded[`:${key}`] = value;
-      expanded[`$${key}`] = value;
-    }
-  }
-  return [expanded];
 }
 
 export function createSqliteNativeError(error) {
@@ -94,41 +21,13 @@ export function createSqliteNativeError(error) {
         "(rebuilds into a user-writable runtime; works without a C++ toolchain)."
     );
   }
-  if (
-    message.includes("Could not locate the bindings file") ||
-    message.includes("MODULE_NOT_FOUND") ||
-    message.includes("Cannot find module 'better-sqlite3'")
-  ) {
-    return new Error(
-      "better-sqlite3 native binding could not be found (no prebuilt addon for this platform). " +
-        "This is common under `npx`, which runs a fresh, ephemeral install that never built the addon. " +
-        "Run: omniroute runtime repair  " +
-        "(rebuilds into a user-writable runtime; works without a C++ toolchain)."
-    );
-  }
   return error;
 }
 
 async function openSqliteDatabase(dbPath, options = {}) {
-  const loaded = await loadSqlite();
-  if (process.versions.bun) {
-    if (options.fileMustExist && !fs.existsSync(dbPath)) {
-      throw new Error(`SQLite file does not exist: ${dbPath}`);
-    }
-    const bunOptions = options.readonly
-      ? { readonly: true }
-      : { readwrite: true, create: options.fileMustExist !== true };
-    try {
-      return openBunSqlite(loaded.Database, dbPath, bunOptions);
-    } catch (error) {
-      throw createSqliteNativeError(error);
-    }
-  }
-  if (loaded.error) {
-    return openWithSyncDriverFallback(dbPath, options, loaded.error);
-  }
+  const Database = await loadBetterSqlite();
   try {
-    return new loaded.Database(dbPath, options);
+    return new Database(dbPath, options);
   } catch (error) {
     throw createSqliteNativeError(error);
   }
@@ -160,16 +59,7 @@ export async function withReadonlySqlite(dbPath, callback) {
 export async function backupSqliteFile(sourcePath, destPath) {
   const db = await openSqliteDatabase(sourcePath, { readonly: true });
   try {
-    if (typeof db.backup === "function") {
-      await db.backup(destPath);
-    } else if (sourcePath === ":memory:" && typeof db.serialize === "function") {
-      fs.writeFileSync(destPath, Buffer.from(db.serialize()));
-    } else {
-      try {
-        db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
-      } catch {}
-      fs.copyFileSync(sourcePath, destPath);
-    }
+    await db.backup(destPath);
   } finally {
     db.close();
   }

bin/cli/tray/autostart.mjs

@@ -6,7 +6,6 @@ import { fileURLToPath } from "node:url";
 
 const APP_LABEL = "com.omniroute.autostart";
 const WIN_REG_VALUE = "OmniRoute";
-const WIN_STARTUP_FILE = "OmniRoute.vbs";
 const LINUX_SERVICE_NAME = "omniroute.service";
 const LINUX_DESKTOP_NAME = "omniroute.desktop";
 
@@ -324,101 +323,38 @@ function isEnabledMac() {
   );
 }
 
-/**
- * Returns the absolute path to the Windows Startup folder
- * (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\),
- * or null when APPDATA is not set.
- */
-function winStartupDir() {
-  if (!process.env.APPDATA) return null;
-  return join(process.env.APPDATA, "Microsoft", "Windows", "Start Menu", "Programs", "Startup");
-}
-
-/**
- * Returns the full path to the VBS autostart script in the Startup folder,
- * or null when the Startup folder cannot be resolved.
- */
-function winStartupPath() {
-  const dir = winStartupDir();
-  return dir ? join(dir, WIN_STARTUP_FILE) : null;
-}
-
-/**
- * Builds the VBScript source that launches OmniRoute with WSH's Run method
- * using SW_HIDE (0) so no console window appears.
- *
- * 9Router uses the same pattern: a .vbs file in the Startup folder that calls
- * WScript.Shell.Run with window style 0 (hidden). This avoids the console
- * window flash that HKCU\Run causes for console-mode node.exe.
- */
-function buildWinVbsContent(cliPath) {
-  const execLine = buildServeExecLine(cliPath, { tray: true });
-  // VBScript doubles `"` inside a string to escape them. The execLine already
-  // contains quoted paths; escape each `"` to `""` so the VBS parser reads
-  // them as literal quote characters in the command string passed to Run().
-  const vbsSafe = execLine.replace(/"/g, '""');
-  return [
-    'Set WshShell = CreateObject("WScript.Shell")',
-    `WshShell.Run "${vbsSafe}", 0, False`,
-    "",
-  ].join("\n");
-}
-
-/**
- * Removes the legacy HKCU\Run registry value if present. Callers use this
- * during migration so stale Run entries don't linger after switching to the
- * VBS-based autostart.
- */
-function cleanLegacyWinReg() {
-  try {
-    execSync(
-      `reg delete HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v ${WIN_REG_VALUE} /f 2>nul`,
-      { stdio: "ignore", windowsHide: true }
-    );
-  } catch {
-    // entry did not exist or already removed — noop
-  }
-}
-
 function enableWin() {
   const cliPath = resolveCliPath();
   if (!cliPath) return false;
-  const vbsPath = winStartupPath();
-  if (!vbsPath) return false;
-  const dir = dirname(vbsPath);
-  mkdirSync(dir, { recursive: true });
-  writeFileSync(vbsPath, buildWinVbsContent(cliPath), { mode: 0o644 });
-  // Migrate away from the legacy HKCU\Run entry — it launches node.exe with
-  // a visible console window. The VBS approach is the replacement.
-  cleanLegacyWinReg();
-  return existsSync(vbsPath);
+  const value = `"${process.execPath}" "${cliPath}" serve --tray --no-open`;
+  try {
+    execSync(
+      `reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v ${WIN_REG_VALUE} /t REG_SZ /d "${value}" /f`,
+      { stdio: "ignore", windowsHide: true }
+    );
+    return true;
+  } catch {
+    return false;
+  }
 }
 
 function disableWin() {
-  const vbsPath = winStartupPath();
-  if (!vbsPath) return false;
   try {
-    unlinkSync(vbsPath);
+    execSync(
+      `reg delete HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v ${WIN_REG_VALUE} /f`,
+      { stdio: "ignore", windowsHide: true }
+    );
+    return true;
   } catch {
-    // already removed
+    return false;
   }
-  // Also clean up any lingering legacy registry entry as a safety net.
-  cleanLegacyWinReg();
-  return !existsSync(vbsPath);
 }
 
 function isEnabledWin() {
-  const vbsPath = winStartupPath();
-  if (!vbsPath) return false;
-  // Primary check: VBS file exists in the Startup folder.
-  if (existsSync(vbsPath)) return true;
-  // Fallback check: legacy HKCU\Run entry (for users who enabled autostart
-  // before the VBS migration). Treat it as enabled so the tray menu shows
-  // the correct toggle state, and calling disable() will clean it up.
   try {
     const out = execSync(
       `reg query HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v ${WIN_REG_VALUE}`,
-      { stdio: "pipe", windowsHide: true, encoding: "utf8", timeout: 3000 }
+      { stdio: "pipe", windowsHide: true, encoding: "utf8" }
     );
     return out.includes(WIN_REG_VALUE);
   } catch {

bin/cli/utils/ensureAndroidCacheDir.mjs

@@ -1,122 +0,0 @@
-/**
- * Next.js cache-dir prep for Android / Termux.
- *
- * Next.js `getCacheDirectory()` has no dedicated branch for
- * `process.platform === "android"`. On that path it only accepts a cache root
- * that *already* exists (`fs.existsSync` on `~/.cache` or a generic tmp dir).
- * If neither exists it prints `Unsupported platform: android` and exits — the
- * CLI can still look "running" while every request returns a bare HTTP 500
- * because the instrumentation hook never loads (and so neither does logging).
- *
- * Termux Node sometimes reports `platform === "android"` and sometimes
- * `"linux"` with Termux env signals (`TERMUX_VERSION` / `PREFIX`). Creating
- * `~/.cache` (and pointing `XDG_CACHE_HOME` at it when unset) makes the probe
- * succeed on both shapes.
- *
- * Call this *before* spawning or loading Next.js. Safe no-op on desktop
- * platforms that are not Termux.
- */
-
-import { existsSync, mkdirSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { isTermux } from "../../../scripts/build/postinstallSupport.mjs";
-
-/**
- * @param {string} [platform]
- * @param {NodeJS.ProcessEnv} [env]
- * @returns {boolean}
- */
-export function needsAndroidCacheDirPrep(platform = process.platform, env = process.env) {
-  return platform === "android" || isTermux(env);
-}
-
-/**
- * @param {() => string} [homedirFn]
- * @param {NodeJS.ProcessEnv} [env]
- * @returns {string}
- */
-export function resolveAndroidCacheDir(homedirFn = homedir, env = process.env) {
-  if (typeof env.XDG_CACHE_HOME === "string" && env.XDG_CACHE_HOME.trim()) {
-    return env.XDG_CACHE_HOME;
-  }
-  return join(homedirFn(), ".cache");
-}
-
-/**
- * Ensure a writable cache directory exists for Next.js on Android/Termux.
- *
- * @param {object} [options]
- * @param {string} [options.platform]
- * @param {NodeJS.ProcessEnv} [options.env]
- * @param {() => string} [options.homedirFn]
- * @param {typeof mkdirSync} [options.mkdirSyncFn]
- * @param {typeof existsSync} [options.existsSyncFn]
- * @param {boolean} [options.setEnv] When true (default), set `XDG_CACHE_HOME` on `env`
- *   if unset so child processes inherit a known-writable cache root.
- * @returns {{ prepared: boolean, cacheDir: string | null, created: boolean }}
- */
-export function ensureAndroidCacheDir(options = {}) {
-  const {
-    platform = process.platform,
-    env = process.env,
-    homedirFn = homedir,
-    mkdirSyncFn = mkdirSync,
-    existsSyncFn = existsSync,
-    setEnv = true,
-  } = options;
-
-  if (!needsAndroidCacheDirPrep(platform, env)) {
-    return { prepared: false, cacheDir: null, created: false };
-  }
-
-  const cacheDir = resolveAndroidCacheDir(homedirFn, env);
-  let created = false;
-  if (!existsSyncFn(cacheDir)) {
-    mkdirSyncFn(cacheDir, { recursive: true });
-    created = true;
-  }
-
-  if (setEnv && !(typeof env.XDG_CACHE_HOME === "string" && env.XDG_CACHE_HOME.trim())) {
-    env.XDG_CACHE_HOME = cacheDir;
-  }
-
-  return { prepared: true, cacheDir, created };
-}
-
-/**
- * Detect Next.js instrumentation-hook failures that leave the server looking
- * "up" while requests get silent HTTP 500s (typical when the Android cache
- * probe failed before logging started).
- *
- * @param {string} text
- * @returns {boolean}
- */
-export function isFatalInstrumentationHookFailure(text) {
-  if (!text) return false;
-  return (
-    /Unsupported platform:\s*android/i.test(text) ||
-    /error occurred while loading instrumentation hook/i.test(text)
-  );
-}
-
-/**
- * Operator-facing hint when that instrumentation failure shows up in child
- * output — defense in depth if prep was skipped or a future Next.js probe
- * regresses.
- *
- * @param {string} [cacheDir]
- * @returns {string}
- */
-export function formatAndroidInstrumentationFailureHint(cacheDir) {
-  const dir = cacheDir || join(homedir(), ".cache");
-  return (
-    `\n\x1b[31m✖ Next.js instrumentation failed on Android/Termux (likely missing cache dir).\x1b[0m\n` +
-    `  OmniRoute tried to create a writable cache at:\n` +
-    `    \x1b[36m${dir}\x1b[0m\n` +
-    `  Manual workaround (survives reinstalls — do NOT patch dist/server.js):\n` +
-    `    \x1b[36mmkdir -p ~/.cache\x1b[0m\n` +
-    `    then restart: \x1b[36momniroute serve\x1b[0m\n` +
-    `  See: docs/guides/TERMUX_GUIDE.md → Troubleshooting → Unsupported platform: android\n`
-  );
-}

bin/cli/utils/versionFastPath.mjs

@@ -1,25 +0,0 @@
-/**
- * Decide whether a CLI invocation is a bare `--version`/`-V` query that should
- * short-circuit BEFORE the runtime polyfill import, env-file loading, and
- * Commander's command registration (~70 command modules) are loaded.
- *
- * Scope is intentionally narrow — only a single, unambiguous `--version`/`-V`
- * argument fast-paths. Anything else (extra args, a subcommand, `--help`,
- * global options like `--lang`/`--output` alongside it) falls through to the
- * normal Commander flow. Unlike `--version`, OmniRoute's `--help` output is
- * generated dynamically from every registered subcommand, so skipping
- * registration would change (truncate) the help text — that flag is
- * deliberately NOT fast-pathed here.
- *
- * Mirrors the intent of upstream 9router PR #2414 (fast-path help/version
- * before expensive self-heal hooks), adapted to OmniRoute's Commander-based
- * CLI where the equivalent expensive work is eager command registration
- * rather than npm-install-based runtime self-healing.
- *
- * @param {string[]} argv - process.argv (node + script + args).
- * @returns {boolean}
- */
-export function isVersionFastPath(argv) {
-  const args = Array.isArray(argv) ? argv.slice(2) : [];
-  return args.length === 1 && (args[0] === "--version" || args[0] === "-V");
-}

bin/cli/utils/winShellArgs.mjs

@@ -1,47 +0,0 @@
-/**
- * Argument escaping for child processes spawned with `shell: true` on Windows.
- *
- * The launchers (`omniroute launch`, `omniroute launch-codex`) must go through
- * cmd.exe on win32 because the target binaries are npm `.cmd` shims that Node
- * cannot exec directly (CVE-2024-27980). With `shell: true` Node joins argv with
- * plain spaces and no escaping at all (the DEP0190 warning), so anything with a
- * space, a quote or a cmd metacharacter reaches the child mangled.
- */
-
-/** cmd.exe metacharacters that stay live inside a quoted argument. */
-const WIN_META_CHARS = /([()\][%!^"`<>&|;, *?])/g;
-
-/**
- * Escape one argument for a cmd.exe command line built by `shell: true`.
- *
- * Two layers, in order:
- *  1. the CRT argv rules the target binary parses (double the backslashes that
- *     precede a quote, escape embedded quotes, wrap in quotes);
- *  2. cmd.exe's metacharacters, caret-escaped — applied TWICE because the
- *     target is an npm `.cmd` shim that forwards `%*` to node, so the line is
- *     parsed by cmd a second time. Single-escaping truncated any argument at
- *     the first `&` or `|`. (Same rule as cross-spawn's doubleEscapeMetaChars.)
- *
- * @param {unknown} arg
- * @returns {string}
- */
-export function escapeWindowsShellArg(arg) {
-  const s = String(arg);
-  if (s === "") return '""';
-  let out = s.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\*)$/, "$1$1");
-  out = `"${out}"`;
-  return out.replace(WIN_META_CHARS, "^$1").replace(WIN_META_CHARS, "^$1");
-}
-
-/**
- * Escape a whole argv for the `shell: true` path. Off Windows there is no shell,
- * so argv is passed through untouched.
- *
- * @param {string[]} args
- * @param {NodeJS.Platform|string} platform
- * @returns {string[]}
- */
-export function quoteShellArgs(args, platform) {
-  const list = [...(args ?? [])];
-  return platform === "win32" ? list.map(escapeWindowsShellArg) : list;
-}

bin/omniroute.mjs

@@ -4,9 +4,6 @@
  * OmniRoute CLI entry point.
  *
  * Special bypasses (handled before Commander):
- *   --version / -V (alone)    Fast-path: print the version and exit, skipping the
- *                             tsx/esm + polyfill imports, env-file loading, and
- *                             Commander's ~70-command registration entirely.
  *   --mcp                     Start MCP server over stdio
  *   reset-encrypted-columns   Recovery tool for broken encrypted credentials
  *   reset-password            Reset the admin/management password
@@ -14,7 +11,7 @@
  * All other commands are routed through Commander (bin/cli/program.mjs).
  */
 
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import updateNotifier from "update-notifier";
@@ -22,26 +19,6 @@ import { isNativeBinaryCompatible } from "../scripts/build/native-binary-compat.
 import { getNodeRuntimeSupport, getNodeRuntimeWarning } from "./nodeRuntimeSupport.mjs";
 import { getDefaultDataDir } from "./cli/data-dir.mjs";
 import { shouldProvisionStorageKey } from "./cli/utils/storageKeyProvision.mjs";
-import { isVersionFastPath } from "./cli/utils/versionFastPath.mjs";
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-const ROOT = join(__dirname, "..");
-
-// Fast-path a bare `--version`/`-V` query BEFORE the tsx/esm registration, the
-// polyfill import, env-file loading, or Commander's command registration (~70
-// modules — DB, providers, OAuth, etc.) run. None of that work is needed to answer
-// "what version is this" — mirrors upstream 9router PR #2414 (fast-path help/version
-// ahead of expensive self-heal hooks), adapted to OmniRoute's Commander CLI where the
-// equivalent expensive work is eager command registration rather than npm-install-based
-// runtime self-healing. `--help` is intentionally NOT fast-pathed here: its output is
-// generated dynamically from every registered subcommand, so skipping registration
-// would truncate the help text instead of just speeding it up.
-if (isVersionFastPath(process.argv)) {
-  const pkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8"));
-  console.log(pkg.version);
-  process.exit(0);
-}
 
 // Register tsx so dynamic imports of .ts source files (referenced as .js per
 // TypeScript conventions) resolve correctly. The build never emits .js for
@@ -49,14 +26,9 @@ if (isVersionFastPath(process.argv)) {
 await import("tsx/esm");
 await import("../open-sse/utils/setupPolyfill.ts");
 
-// #7791: tsx's tsconfig-path resolution does not apply when OmniRoute is
-// installed globally (files live under node_modules/omniroute/), so bare
-// `@/...` specifiers (declared in tsconfig.json paths as `@/* → ./src/*`)
-// fail with ERR_MODULE_NOT_FOUND. Register an ESM resolve hook that maps
-// `@/...` to absolute file URLs under <ROOT>/src/. Safe no-op in dev checkout
-// (paths already resolve via tsconfig) and when ROOT has no `src/` dir.
-const { registerAliasResolver } = await import("./aliasResolver.mjs");
-await registerAliasResolver(ROOT);
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const ROOT = join(__dirname, "..");
 
 // MCP stdio transport uses stdout exclusively for JSON-RPC messages.
 // Redirect console.log/warn to stderr early (before loadEnvFile and DB init)
@@ -68,28 +40,6 @@ if (process.argv.includes("--mcp")) {
   console.warn = stderrConsole.warn.bind(stderrConsole);
 }
 
-// Electron persists secrets (JWT_SECRET, API_KEY_SECRET, STORAGE_ENCRYPTION_KEY) to
-// `<DATA_DIR>/server.env` (electron/main.js), never `.env`. Migrating an existing
-// install (storage.sqlite + server.env) to the CLI left those secrets undiscoverable —
-// the CLI only ever looked for `.env`, so the STORAGE_ENCRYPTION_KEY needed to decrypt
-// the migrated database was silently dropped (#7302). One-time, one-directory migration:
-// if `<dataDir>/.env` is absent but `<dataDir>/server.env` is present, copy it to `.env`
-// so it flows through the normal env-loading path below. Never overwrites an existing
-// `.env` — an explicit `.env` always wins over a legacy `server.env`.
-function migrateElectronServerEnv(dataDir) {
-  try {
-    const envPath = join(dataDir, ".env");
-    const serverEnvPath = join(dataDir, "server.env");
-    if (existsSync(envPath) || !existsSync(serverEnvPath)) return;
-    writeFileSync(envPath, readFileSync(serverEnvPath, "utf-8"), "utf-8");
-    console.log(
-      `  \x1b[2m♻ Migrated Electron secrets from ${serverEnvPath} to ${envPath}\x1b[0m`
-    );
-  } catch {
-    // Ignore errors migrating server.env — fall back to normal env loading below.
-  }
-}
-
 function loadEnvFile() {
   const envPaths = [];
   const loadedEnvPaths = [];
@@ -100,8 +50,6 @@ function loadEnvFile() {
     envPaths.push(envPath);
   };
 
-  migrateElectronServerEnv(process.env.DATA_DIR || getDefaultDataDir());
-
   if (process.env.DATA_DIR) {
     addEnvPath(join(process.env.DATA_DIR, ".env"));
   }
@@ -145,15 +93,6 @@ function loadEnvFile() {
 
 loadEnvFile();
 
-// Next.js has no android branch in getCacheDirectory(): if ~/.cache (and tmp)
-// do not already exist it aborts the instrumentation hook, and every request
-// then returns a silent HTTP 500 even though the CLI still looks "running".
-// Create the cache dir (and set XDG_CACHE_HOME when unset) before serve/Next.
-{
-  const { ensureAndroidCacheDir } = await import("./cli/utils/ensureAndroidCacheDir.mjs");
-  ensureAndroidCacheDir();
-}
-
 // Generate STORAGE_ENCRYPTION_KEY if not set (persisted to ~/.omniroute/.env)
 // This ensures the key survives across upgrades and is not regenerated on each install.
 // See: https://github.com/diegosouzapw/OmniRoute/issues/1622

changelog.d/features/8980-deprecate-gemini-cli-provider.md

@@ -1 +0,0 @@
-- **feat(sse):** deprecated the legacy `gemini-cli` **upstream provider**. It was not routable (no registry entry, no executor), yet the scheduler kept refreshing its token against Google — maintaining a credential that could never serve a request. A stored connection now becomes terminal with a legible reason and a working migration path: re-add the account under `gemini`, which uses the same Google OAuth client. The `gemini-cli` **client identity** (requests arriving *from* the Gemini CLI, issue #7034) is untouched ([#8980](https://github.com/diegosouzapw/OmniRoute/pull/8980))

changelog.d/fixes/8985-release-tooling-hidden-work.md

@@ -1 +0,0 @@
-- **fix(ci):** the reconciliation helper no longer bounds its scan with `git describe --tags` — releases squash-merge, so that range re-listed 1361 commits instead of the cycle's real 22, which is how ~200 PRs once slipped through without a changelog bullet. The base is now resolved from the commit that opened the cycle, and a new `sweep:stale-fragments` gate removes `changelog.d/` fragments that a back-merge from `main` resurrected after they had already been folded in ([#8985](https://github.com/diegosouzapw/OmniRoute/pull/8985))

changelog.d/fixes/8988-mac-updater-manifest-and-runner-split.md

@@ -1 +0,0 @@
-- **fix(ci):** fixed a live auto-update defect where **Intel Macs downloaded the ARM dmg** — the two macOS jobs each emitted their own `latest-mac.yml` and `merge-multiple` let one silently overwrite the other by arrival order, leaving `electron-updater`'s arch fallback pointing at the wrong build. The manifests are now merged deliberately, un-suffixed entry first. Also: test jobs pinned to hosted runners (`setup-node` measured 20m06s self-hosted vs 16s hosted), the npm publish no longer discards a valid build artifact because an unrelated shard was flaky, the agent-skills gate now runs on pushes to `main` instead of PRs only, and the CI summary names every job that ended cancelled ([#8988](https://github.com/diegosouzapw/OmniRoute/pull/8988))

changelog.d/fixes/9022-stream-error-diagnostic.md

@@ -1 +0,0 @@
-- **fix(sse):** error-only streams now preserve sanitized executor diagnostics for operators without changing stream-readiness fallback classification ([#9022](https://github.com/diegosouzapw/OmniRoute/pull/9022)) — thanks @shixi-li

changelog.d/fixes/9053-claude-to-openai-max-passthrough.md

@@ -1 +0,0 @@
-- **fix(translator):** pass `output_config.effort="max"` through verbatim instead of unconditionally rewriting it to `xhigh`, so Anthropic → OpenAI-shape upstream calls reach `sanitizeReasoningEffortForProvider` with the carrier intact and providers that accept `max` literally (Ollama Cloud, opencode-go DeepSeek, Moonshot K3, native Claude) no longer 400 on `invalid reasoning value: 'xhigh'`. Regression guard: end-to-end test in `tests/unit/base-executor-sanitize-effort.test.ts`.

changelog.d/fixes/9250-cli-compatible-provider-apply.md

@@ -1 +0,0 @@
-- **fix(cli-tools):** keep Apply enabled for active OpenAI-compatible and Anthropic-compatible providers without static catalog entries. (thanks @lazysaltyfish)

changelog.d/fixes/9253-translator-format-detection-2949.md

@@ -1 +0,0 @@
-- **fix(translator):** harden Claude format detection for relative message endpoints and kebab-case version metadata. (thanks @ervareza)

changelog.d/maintenance/8966-remove-iflow-ttl.md

@@ -1 +0,0 @@
-- **chore(sse):** dropped the leftover `iflow` entry from the token-refresh TTL map — the provider was removed from the product but its 24-hour refresh lead outlived it, and the identifier had exactly two occurrences left repo-wide ([#8966](https://github.com/diegosouzapw/OmniRoute/pull/8966))

changelog.d/maintenance/8967-remove-fork-publish-workflows.md

@@ -1 +0,0 @@
-- **chore(ci):** removed two fork-owned image-publish workflows that had ridden into the repo as unrelated extra files in on-topic PRs — `build-fork.yml` (`ghcr.io/kang-heewon`, job-level guard, so it instantiated a skipped run on every push to main and every tag) and `build-rinseaid-image.yml` (`ghcr.io/rinseaid`, no guard, never fired). Neither could authenticate against this repository's token; a new policy guard now fails CI on any workflow targeting a foreign registry namespace ([#8967](https://github.com/diegosouzapw/OmniRoute/pull/8967))

changelog.d/maintenance/8977-promote-latest-test-epipe.md

@@ -1 +0,0 @@
-- **test(ci):** fixed the intermittent `spawnSync bash EPIPE` failure in the `:latest` promotion guard — the script exits on a pre-release version before reading stdin, so the harness's pipe-backed `input:` raced that exit; stdin is now file-backed, which makes the race structurally impossible ([#8977](https://github.com/diegosouzapw/OmniRoute/pull/8977))

codecov.yml

@@ -1,19 +0,0 @@
-# Codecov — WS5.6/D7 of the v3.8.49 quality/velocity plan.
-# Philosophy: strict patch, lenient project — the project floor/ratchet already
-# lives in quality-baseline.json + the c8 60% gate; Codecov adds the DIFF view
-# ("new lines in this PR are covered"), which the global ratchet cannot see.
-# INFORMATIONAL during calibration: nothing here blocks a PR. Promote by flipping
-# informational to false after ~2 weeks without false blocks (owner decision).
-coverage:
-  status:
-    project:
-      default:
-        informational: true
-    patch:
-      default:
-        target: 70%
-        informational: true
-comment:
-  layout: "condensed_header, diff"
-  behavior: default
-  require_changes: true

config/quality/complexity-baseline.json

@@ -1,51 +1,43 @@
 {
   "_comment": "Catraca de complexidade (check-complexity.mjs, ESLint core rules complexity>=15 e max-lines-per-function>80 sobre src+open-sse+electron+bin via eslint.complexity.config.mjs). Conta total de violacoes; so pode cair. --update ratcheta.",
-  "_rebaseline_2026_07_25_8470_hyperagent_sticky_thread": "2130->2170 (+40). PR #8470 (artickc, fix/hyperagent-tool-loop-thread-sticky) pre-green validation. Trust-but-verify: origin/release/v3.8.49 tip alone (pristine, no PR changes) already measures 2169 with node scripts/check/check-complexity.mjs — i.e. +39 is inherited cycle drift unrelated to this PR (the cyclomatic-complexity ratchet does not run on PR->release fast-gates). This PR's OWN growth adds exactly +1: per-file eslint scoped scan on open-sse/executors/hyperagent.ts (base vs PR) shows extractMessageText() crossing the complexity>=15 threshold for the first time (new violation, complexity 25) from the new Anthropic tool_use/tool_result flattening branches; resolveHyperAgentThreadBinding's existing pre-#8470 violation (18) grows to 25 (still counted once, from the new root-key lookup tier); createHyperAgentThread and execute() are unchanged pre-existing violations. Net repo-wide total = 2169 (inherited drift) + 1 (this PR's own new violation) = 2170. Full-repo re-measurement of the merged branch was attempted but not completed live due to heavy concurrent devbox load (many other /green-prs sessions running the identical full-repo eslint scan in parallel); derived from two independently-clean measurements (base-tip full scan + per-file base-vs-PR delta). Covered by tests/unit/executor-hyperagent.test.ts (19/19). Tighten via --update next cycle.",
-  "_rebaseline_2026_07_25b_v3849_mergetrain_owngrowth": "Owner-approved (chat, 2026-07-25): 2169->2183 (+14). v3.8.49 /merge-prs 41-PR merge-train aggregate own-growth: measured 2183 on the combined boarded tree (tip ac15014ca7) vs 2169 on the pristine release tip. Each boarded PR sits under the ceiling individually, but the combined batch adds +14 (new branches in #8378 chatCore contextLimit / #8432 cursor native_todo / #8476 combo input-bound / #8526 combo select-all modals / etc \u2014 the pre-screen-flagged complexity-growth set). Same merge-burst-inherited-drift class as the notes below; owner chose absorbing the ceiling over per-PR helper-extraction churn. Structural shrink stays debt (#3501); tighten via --update next cycle.",
-  "_rebaseline_2026_07_25_v3849_mergequeue_drain": "Owner-approved (chat, 2026-07-25): 2130->2169 (+39). v3.8.49 /merge-prs queue-drain: the cycle's merge burst (the 8 base-red slices + owner PRs + parallel-session merges #8500-8508) accrued inherited cyclomatic drift the fast-path PR->release never ratchets (check:complexity does not run on PR->release). Measured 2169 on the pristine release tip 4053e2314a alone (BEFORE any queue PR boards) \u2014 so the entire +39 is base drift already on the tip, not any queued PR's own growth. Every merge-ready PR in the queue was tripping Fast Quality Gates on this shared base-red. Owner approved raising the ceiling to the measured tip value so the ~34-PR merge-train lands without per-PR helper-extraction churn. Structural shrink stays debt (#3501); tighten via --update next cycle.",
-  "_rebaseline_2026_07_27_3850_quality_relax_TEMP_3851_retighten_v2_20pct": "_rebaseline_2026_07_27_3850_quality_relax_TEMP_3851_retighten_v2_20pct: 2188->2774 (+586, +26.8% over pristine 2188). OWNER-APPROVED TEMPORARY relax for v3.8.50-3.8.54 PREPARE phase (docs/ROADMAP.md). v1 was +124 (2x daily drift) on 2026-07-27; v2 = v1 +20% buffer = +218 \u2192 +586 total (cycle 2188 measured pristine \u2192 2774 ceiling). Justification: v3.8.50 release cut coincides with high-merge activity (33-PR Train 1D + ~37-PR Train 2 backlog + post-freeze re-home rebase churn); owner accepted enlarging the headroom so the entire PREPARE phase window (5 minor cycles: .50-.54) flows without per-PR rebaseline noise, given that re-tightening happens mechanically at v3.8.51 via #8675/#8700 decomposition work scheduled in .51 (Executor registry in-place + combo.ts decomposition per ROADMAP.md). RE-TIGHTENING MANDATORY in v3.8.51: target 2282 (shrink of 492 from structural extraction during #8675/#8700 decomposition campaigns + combo.ts split scheduled in .52, or via npm run quality:ratchet -- --update if natural shrink appears earlier). The 2282 floor still gives 94 units of post-tighten headroom vs the current pristine 2188. Tracked via roadmap issue (TO BE OPENED as part of this PR). Window: v3.8.50 (release cut, 2026-07-28 target) \u2192 v3.8.54 close (RE-TIGHTEN executed at v3.8.51 prep merge per ROADMAP.md). This entry is the LAST rebaseline in this file unless a measured regression appears. v1 entry retained below for audit trail.",
-  "count": 2774,
-  "_rebaseline_2026_07_27_3850_quality_relax_TEMP_3851_retighten": "_rebaseline_2026_07_27_3850_quality_relax_TEMP_3851_retighten: 2188->2312 (+124). OWNER-APPROVED TEMPORARY relax for v3.8.50-3.8.54 PREPARE phase (docs/ROADMAP.md). +124 = 2x the daily drift observed in jul (~4.5 cyclomatic/day over 25d = ~114); covers ~28d of normal merge activity without per-PR rebaseline churn. RE-TIGHTENING MANDATORY in v3.8.51: target 2282 (shrink of 30 from structural extraction during #8675/#8700 decomposition campaigns, or via npm run quality:ratchet -- --update if natural shrink appears). Tracked via roadmap issue (TO BE OPENED). Window: 3.8.50 (release cut) \u2192 3.8.54 close (re-tighten at 3.8.51 prep merge per ROADMAP.md). SUPERSEDED by _rebaseline_2026_07_27_3850_quality_relax_TEMP_3851_retighten_v2_20pct (v1 +20% buffer) \u2014 retained for audit. Tracked via roadmap issue (TO BE OPENED as part of this PR). Window: v3.8.50 (release cut) \u2192 v3.8.54 close (RE-TIGHTEN executed at v3.8.51 prep merge per ROADMAP.md).",
-  "_rebaseline_2026_07_19_v3849_fix_sweep_cluster": "2059->2072 (owner-approved, 2026-07-19). /fix-prs validation-train sweep: a cluster of otherwise-clean contributor PRs (#6973/#7683/#7662/#7672/#7633/#7767, each +1/+2 cyclomatic own-growth from new provider/auth/combo branches) collectively pushed the count from tip 2056 to 2068. Individually all but #6973 sit under the old 2059 baseline; combined they exceed it. The tip had only 3 units of slack (2056 vs 2059), so every new-feature PR was tripping the ratchet (this was the 4th such block of the day after #7695/#7747/#7768). Owner approved raising the ceiling to 2072 = combined-cluster 2068 + 4 units headroom, so the cluster lands without per-PR helper-extraction churn and near-term feature PRs have breathing room. Measured 2068 on the 9-PR combined probe tree. Structural shrink stays debt (#3501); tighten via --update next cycle.",
-  "_rebaseline_2026_07_18_pr7360_quota_visibility_resync": "2058->2059 (+1 vs recorded ceiling; measured 2056 fresh on release tip cab9e5f0c alone, so this ceiling still carries 2 units of un-banked slack from prior shrinkage \u2014 real regression from this merge is 2056->2059, +3). PR #7360 (JxnLexn) release-resync: merging origin/release/v3.8.49 to resolve the 3-file conflict (ConnectionRow.tsx/ConnectionsListPanel.tsx/useProviderConnections.ts) unions two already-compliant features in the same already-oversized god-component: release's confirm-delete-account wiring (#7361) and this PR's per-connection quota-visibility wiring. Diffed release-tip-only vs merged violation lists (scripts dumped via getComplexityEslintReport): most entries are the SAME pre-existing violations shifted a few lines (ConnectionRow/getStatusPresentation/inferErrorType \u2014 no count change) or marginally bigger (ConnectionRow function complexity 85->86, ConnectionsListPanel function 498->510 lines) from the two ConnectionRow call sites each gaining both PRs' multi-line JSX props. The 2 genuinely NEW crossings are the 'no tag' and 'tagged groups' .map() render callbacks in ConnectionsListPanel.tsx (83 and 85 lines, was <=80 on both parents individually) tipping over 80 lines specifically because both PRs' props land on the same call sites. No new logic was written during the resync itself (only import-statement unions); the growth is inherent to combining the two already-reviewed feature branches. Structural shrink tracked in #3501. Tighten via --update next cycle (true floor is 2056, not 2058).",
-  "_rebaseline_2026_07_17_v3849_ownerprs_providers": "2056->2058 (+2). v3.8.49 owner-PR merge campaign own-growth: the new provider handlers/dispatch branches merged this cycle (freetheai/felo/notion/segmind/deepinfra/novita/msdesigner image+video handlers, each adding a format-dispatch guard) pushed cyclomatic violations 2056->2058. Fast-gates PR->release do not run the complexity ratchet, so this surfaced only on re-sync. Spread across the new leaf handlers (not a single extractable function); measured on the release tip. Structural shrink tracked in #3501.",
-  "_rebaseline_2026_07_10_v3847_merge_burst": "2053->2054 (+1). Drift herdado do merge burst do dia em release/v3.8.47 (campanha /implement-prs: ~36 PRs mergeados \u2014 \u00f3rf\u00e3os, features do dono, ports). O check:complexity N\u00c3O roda no fast-path PR->release, ent\u00e3o o ramo acumulou o +1 sem rebaselinar (mesma fam\u00edlia de todos os rebaselines abaixo). Trust-but-verify: medido 2054 no tip da release p\u00f3s-burst; a \u00fanica fun\u00e7\u00e3o flagada nova \u00e9 pr\u00e9-existente (getResolvedModelCapabilities em modelCapabilities.ts, j\u00e1 >teto antes de #6714). Nenhum PR \u00f3rf\u00e3o/feature introduz viola\u00e7\u00e3o NOVA \u2014 os fixes deste ciclo s\u00e3o complexity-net-zero. Rebaseline aprovado pelo dono (2026-07-10) para destravar o FQG dos ~7 \u00f3rf\u00e3os verdes-exceto-complexity. Tighten via --update next cycle.",
+  "count": 2056,
+  "_rebaseline_2026_07_10_v3847_merge_burst": "2053->2054 (+1). Drift herdado do merge burst do dia em release/v3.8.47 (campanha /implement-prs: ~36 PRs mergeados — órfãos, features do dono, ports). O check:complexity NÃO roda no fast-path PR->release, então o ramo acumulou o +1 sem rebaselinar (mesma família de todos os rebaselines abaixo). Trust-but-verify: medido 2054 no tip da release pós-burst; a única função flagada nova é pré-existente (getResolvedModelCapabilities em modelCapabilities.ts, já >teto antes de #6714). Nenhum PR órfão/feature introduz violação NOVA — os fixes deste ciclo são complexity-net-zero. Rebaseline aprovado pelo dono (2026-07-10) para destravar o FQG dos ~7 órfãos verdes-exceto-complexity. Tighten via --update next cycle.",
   "_rebaseline_2026_07_10_gcf_v3_2": "2054->2056 (+2). PR feat/headroom-gcf-v3.2-nested-flattening: own growth from re-vendoring the GCF (Headroom) codec to spec v3.2 (nested flattening). The 2 new over-threshold functions are the v3.2 `>`-path flatten/unflatten walk in the vendored generic-profile encode/decode paths (open-sse/services/compression/engines/headroom/gcf/{generic,decode_generic}.ts). This is imported third-party code kept byte-faithful to upstream gcf-typescript, not extractable without diverging from the vendored source; local measures 2055 on the merged tree; frozen at 2056 = the base's CI-observed 2054 + this PR's 2 new functions, matching the documented local-vs-CI off-by-one convention (see _rebaseline_2026_07_02_v3844_ci_observed) so the GitHub runner stays green. Round-trip guarded by tests/unit/compression/headroom-smartcrusher.test.ts (deep-nested case). Structural shrink belongs upstream in gcf, not here.",
-  "_rebaseline_2026_07_08_6556_inherited_drift": "2052->2053 (+1). PR #6556 (omniglyph engine): drift herdado do merge burst da base (a catraca nao roda no fast-path PR->release, mesmo padrao dos rebaselines v3.8.44/46). Trust-but-verify: o proprio codigo do PR e complexity-net-zero \u2014 as 2 violacoes que ele introduzia (runCompressionAsync complexity 17 apos o branch do modo omniglyph; OmniglyphContextPageClient 161 linhas) foram CORRIGIDAS por extracao real (engines/omniglyphSingleMode.ts + split do componente em section components), medido: 2055->2053 local; base pura origin/release/v3.8.47 mede 2053 identico. Tighten via --update next cycle.",
-  "_rebaseline_2026_07_07_v3846_release_close": "2035->2050 (+15). v3.8.46 release close (generate-release Phase 0 pre-flight): drift herdado do merge burst do ciclo (39 commits do dia + campanha /review-*). Trust-but-verify: os fixes de base-red do captain (agentSkills path.resolve #6366, catalogo cache #6408, tipagem de teste no-explicit-any, MitmProxyTab suppression) sao complexity-net-zero \u2014 check:complexity mede 2050 identico com e sem os fixes (a catraca NAO roda no fast-path PR->release, entao o ramo acumulou sem rebaselinar). Tighten via --update next cycle.",
-  "_rebaseline_2026_07_04_v3844_release_close": "2026->2028 (+2). v3.8.44 release close (generate-release Phase 0/1): drift residual do fim do ciclo medido no tip pos-#6155 (merge burst final: #6155 cooling-panel + #6104 Kenari + #6139/#6128 provider-limits). Trust-but-verify: os 2 fixes de codigo do release-captain (model.ts alias boundary, auggie.ts stdin error handlers) adicionam 0 violacoes NOVAS \u2014 eslint.complexity direto nos 2 arquivos flagra apenas funcoes que ja estouravam o limite antes (runStreaming/start ja >80 linhas; resolveModelByProviderInference/getModelInfoCore pre-existentes de #5918), e resolveProviderAlias segue abaixo de 15. Logo o +2 e drift herdado do burst. Tighten via --update next cycle.",
+  "_rebaseline_2026_07_08_6556_inherited_drift": "2052->2053 (+1). PR #6556 (omniglyph engine): drift herdado do merge burst da base (a catraca nao roda no fast-path PR->release, mesmo padrao dos rebaselines v3.8.44/46). Trust-but-verify: o proprio codigo do PR e complexity-net-zero — as 2 violacoes que ele introduzia (runCompressionAsync complexity 17 apos o branch do modo omniglyph; OmniglyphContextPageClient 161 linhas) foram CORRIGIDAS por extracao real (engines/omniglyphSingleMode.ts + split do componente em section components), medido: 2055->2053 local; base pura origin/release/v3.8.47 mede 2053 identico. Tighten via --update next cycle.",
+  "_rebaseline_2026_07_07_v3846_release_close": "2035->2050 (+15). v3.8.46 release close (generate-release Phase 0 pre-flight): drift herdado do merge burst do ciclo (39 commits do dia + campanha /review-*). Trust-but-verify: os fixes de base-red do captain (agentSkills path.resolve #6366, catalogo cache #6408, tipagem de teste no-explicit-any, MitmProxyTab suppression) sao complexity-net-zero — check:complexity mede 2050 identico com e sem os fixes (a catraca NAO roda no fast-path PR->release, entao o ramo acumulou sem rebaselinar). Tighten via --update next cycle.",
+  "_rebaseline_2026_07_04_v3844_release_close": "2026->2028 (+2). v3.8.44 release close (generate-release Phase 0/1): drift residual do fim do ciclo medido no tip pos-#6155 (merge burst final: #6155 cooling-panel + #6104 Kenari + #6139/#6128 provider-limits). Trust-but-verify: os 2 fixes de codigo do release-captain (model.ts alias boundary, auggie.ts stdin error handlers) adicionam 0 violacoes NOVAS — eslint.complexity direto nos 2 arquivos flagra apenas funcoes que ja estouravam o limite antes (runStreaming/start ja >80 linhas; resolveModelByProviderInference/getModelInfoCore pre-existentes de #5918), e resolveProviderAlias segue abaixo de 15. Logo o +2 e drift herdado do burst. Tighten via --update next cycle.",
   "_rebaseline_2026_07_03_v3844_ipfilter_release_green": "2015->2026 (+11). v3.8.44 cycle drift measured on release tip 32e4c906e during the #6131/#5975 release-green rebaseline. Inherited from the merge burst (Quality Ratchet does not run on PR->release fast-gates). route-edge-coverage +7 is my #5975 test comment; the rest is parallel-session drift. Tighten via --update next cycle.",
   "_rebaseline_2026_07_03_6007_sidecar_manifest": "2007->2015. PR #6007 (re-cut) adds sidecar/provider-manifest header wiring and the public manifest URL helper; the feature files themselves introduce 0 new complexity violations (check-complexity flags none in providerPluginManifestUrl.ts). The +8 vs the 2007 release baseline is inherited release/v3.8.44 drift absorbed at merge (check:complexity measures 2015 on the current release tip). Tighten via --update next cycle / at /generate-release Phase 0.",
   "_rebaseline_2026_07_02_v3844_ci_observed": "2006->2007 (+1). Local Ubuntu measures 2006 on this tree; the GitHub fast-gates runner measures 2007 (same local-vs-CI off-by-one already documented in _rebaseline_2026_06_26_v3838_release_fast_gate). Use the CI-observed value so the gate is deterministic where it actually runs.",
-  "_rebaseline_2026_07_02_v3844_post_5939": "2003->2006 (+3). Inherited drift from the release/v3.8.44 merges after 3a3d618fe (#5809 audio translations et al.), surfaced by PR fix#5959: check:complexity measures 2006 on the pristine base (cbd08ef78) WITH AND WITHOUT this PR's one-line CLI change (verified by reverting the file and re-measuring) \u2014 the PR is complexity-net-zero. Tighten via --update next cycle.",
-  "_rebaseline_2026_07_02_v3844_merge_burst": "1995->2003 (+8). Inherited v3.8.44 cycle drift surfaced by PR #5939: check:complexity measures 2003 on BOTH the pristine release tip (3a3d618fe) and this PR's merged HEAD \u2014 identical, so all +8 came from the 2026-07-02 merge burst into release/v3.8.44 (#5933 codex schema, #5950 OCR, #5904/#5920 combo, #6000/#6008 executor refactors, etc.) merged while the fast-gates queue was base-red (file-size #5933). PR #5939 itself was verified complexity-net-zero during its own CI cycle (DiscoveryPageClient refactored into hooks/sub-components to stay under max-lines-per-function). Tighten via --update next cycle.",
-  "_rebaseline_2026_07_02_5798_release_green": "1982->1995 (+13). Inherited v3.8.43 cycle drift surfaced by the release-green unblock #5798 / PR #5896: check:complexity measures 1995 on BOTH the pristine release tip (0d3875a98) and this PR's HEAD \u2014 identical, so all +13 came from the 2026-07-01/02 merge burst (providers/usage/dashboard fixes merged via --admin while the fast-gates queue was base-red). This PR touches only gate scripts, docs, baselines and test files \u2014 0 production logic. Tighten via --update next cycle.",
-  "_rebaseline_2026_07_01_v3843_release": "1981->1982 (+1). v3.8.43 cycle drift, surfaced after check:mutation-test-coverage was fixed (it was masked behind that earlier step in the Fast Quality Gates chain). 1982 = the value measured by check:complexity on BOTH fce85136c (release tip) and 6d7060e21 (release + the 5 CI fixes) \u2014 identical, so all +1 is inherited cycle drift; the fixes touch only test files + linkify.ts safeHttpHref (cyclomatic ~4, well under the >=15 threshold, 0 new violations) + config JSON. Tighten via --update next cycle.",
-  "_rebaseline_2026_06_28_v3840_5237_reconcile": "1980->1981 (+1). Inherited release/v3.8.40 drift surfaced while merging PR #5237 (impersonation-UA refresh) \u2014 the +1 is present on the pristine release tip (d8a392a47) WITHOUT #5237's changes, so it is #5222 (antigravity fallback-LRU retry) / #5221 (command-code) growth that merged via --admin without ratcheting complexity (the PR->release fast-gates do not run check:complexity). #5237 itself is complexity-net-zero: its only edits are a single UA constant, a regenerated golden snapshot, and baseline JSONs. Structural reduction tracked in #3501.",
-  "_rebaseline_2026_06_27_v3838_release": "1978->1980 (+2). v3.8.38 cycle-close drift surfaced by the release-green pre-flight (check:complexity does NOT run on PR->release fast-gates). +2 from late-cycle feature/fix merges (compression fidelity-gate steps #5143, SSE hardening). Release-finalize working tree touches ONLY CHANGELOG.md + i18n mirrors + the 2 baseline JSONs \u2014 0 production-code change. Structural reduction tracked in #3501.",
+  "_rebaseline_2026_07_02_v3844_post_5939": "2003->2006 (+3). Inherited drift from the release/v3.8.44 merges after 3a3d618fe (#5809 audio translations et al.), surfaced by PR fix#5959: check:complexity measures 2006 on the pristine base (cbd08ef78) WITH AND WITHOUT this PR's one-line CLI change (verified by reverting the file and re-measuring) — the PR is complexity-net-zero. Tighten via --update next cycle.",
+  "_rebaseline_2026_07_02_v3844_merge_burst": "1995->2003 (+8). Inherited v3.8.44 cycle drift surfaced by PR #5939: check:complexity measures 2003 on BOTH the pristine release tip (3a3d618fe) and this PR's merged HEAD — identical, so all +8 came from the 2026-07-02 merge burst into release/v3.8.44 (#5933 codex schema, #5950 OCR, #5904/#5920 combo, #6000/#6008 executor refactors, etc.) merged while the fast-gates queue was base-red (file-size #5933). PR #5939 itself was verified complexity-net-zero during its own CI cycle (DiscoveryPageClient refactored into hooks/sub-components to stay under max-lines-per-function). Tighten via --update next cycle.",
+  "_rebaseline_2026_07_02_5798_release_green": "1982->1995 (+13). Inherited v3.8.43 cycle drift surfaced by the release-green unblock #5798 / PR #5896: check:complexity measures 1995 on BOTH the pristine release tip (0d3875a98) and this PR's HEAD — identical, so all +13 came from the 2026-07-01/02 merge burst (providers/usage/dashboard fixes merged via --admin while the fast-gates queue was base-red). This PR touches only gate scripts, docs, baselines and test files — 0 production logic. Tighten via --update next cycle.",
+  "_rebaseline_2026_07_01_v3843_release": "1981->1982 (+1). v3.8.43 cycle drift, surfaced after check:mutation-test-coverage was fixed (it was masked behind that earlier step in the Fast Quality Gates chain). 1982 = the value measured by check:complexity on BOTH fce85136c (release tip) and 6d7060e21 (release + the 5 CI fixes) — identical, so all +1 is inherited cycle drift; the fixes touch only test files + linkify.ts safeHttpHref (cyclomatic ~4, well under the >=15 threshold, 0 new violations) + config JSON. Tighten via --update next cycle.",
+  "_rebaseline_2026_06_28_v3840_5237_reconcile": "1980->1981 (+1). Inherited release/v3.8.40 drift surfaced while merging PR #5237 (impersonation-UA refresh) — the +1 is present on the pristine release tip (d8a392a47) WITHOUT #5237's changes, so it is #5222 (antigravity fallback-LRU retry) / #5221 (command-code) growth that merged via --admin without ratcheting complexity (the PR->release fast-gates do not run check:complexity). #5237 itself is complexity-net-zero: its only edits are a single UA constant, a regenerated golden snapshot, and baseline JSONs. Structural reduction tracked in #3501.",
+  "_rebaseline_2026_06_27_v3838_release": "1978->1980 (+2). v3.8.38 cycle-close drift surfaced by the release-green pre-flight (check:complexity does NOT run on PR->release fast-gates). +2 from late-cycle feature/fix merges (compression fidelity-gate steps #5143, SSE hardening). Release-finalize working tree touches ONLY CHANGELOG.md + i18n mirrors + the 2 baseline JSONs — 0 production-code change. Structural reduction tracked in #3501.",
   "_rebaseline_2026_06_26_v3838_ownerprs_batch": "1972->1978 (+6). Drift do lote de merges de PRs do dono + contribuidores em release/v3.8.38 (sessao /review-prs): #4845 (antigravity convertGeminiToOpenAI), #5105 (executor zenmux-free), #5020 (executor grok-cli), #4940 (usage dedupe guard), #5093 (resilience: quota cutoff/gemini mime/model-lockout cooldown), #5015 (quota hydration + auto-combo scoping). Cada um e crescimento de feature/fix legitimo recem-TDD'd, nao regressao; o gate check:complexity NAO roda no fast-path PR->release, entao o ramo acumula sem rebaselinar (mesma familia dos rebaselines anteriores). #5121 cookie-dedup foi mantido complexity-NEUTRO via extracao do helper findExistingCookieConnection. Reducao estrutural fica como debt (#3501).",
   "_rebaseline_2026_06_26_v3838_release_fast_gate": "1963->1972 (+9). Reconciles inherited release/v3.8.38 drift surfaced by PR #5124. Local origin/release/v3.8.38 measured 1971 and this PR also measured 1971 after refactoring the new JSON-body SSE sniffing path, while the GitHub Ubuntu fast gate measured 1972; use the CI-observed value so the release branch gate is deterministic. The streaming fix is complexity-net-zero relative to the local release base. The release fast-path does not consistently ratchet complexity between release-cycle merges; keep structural reductions as separate debt.",
-  "_rebaseline_2026_06_25_v3836_release": "Reconciliacao release-volatil 1920->1950 (+30) no fechamento do ciclo v3.8.36, surfada pelo CI da fix-PR #5029 (a catraca de complexidade NAO roda no fast-path PR->release nem foi medida no release PR #4854 \u2014 Quality Ratchet foi SKIPPED la \u2014 so PR->main, entao o ramo acumulou os 137 commits sem rebaselinar). O +30 e drift de condicionais NOVOS das features legitimas do ciclo: Quota-Share Fase 2/3 (estrategia dedicada DRR+P2C, multi-window buckets, concurrency control, headroom, saturacao proativa \u2014 #4885/#4907/#4908/#4927/#4928/#4929/#4939/#4965/#4967/#4970), task-aware + Fusion combo (#4945/#4652), e ramos de provider/translator de contribuidores. A god-file decomposition #3501 e PURA (move codigo p/ leaves, complexity-neutra). Verificado que esta fix-PR (#5029) toca SO scripts/build/pack-artifact-policy.ts (array de strings), tests/integration/resilience-http-e2e.test.ts (2 keys) e os 2 baselines json \u2014 contribui 0 ao gate que varre src+open-sse+electron+bin. Mesma familia dos rebaselines anteriores \u2014 crescimento de feature legitimo recem-TDD'd, nao regressao; reducao estrutural fica como debt (#3501).",
-  "_rebaseline_2026_06_23_v3835_release": "Reconciliacao release-volatil 1916->1920 (+4) no fechamento do ciclo v3.8.35, surfada pelo pre-flight check:release-green (a catraca de complexidade NAO roda no fast-path PR->release, so release->main, entao o ramo acumula sem rebaselinar). O +4 e drift de condicionais NOVOS dos merges de contribuidor/feature deste ciclo (Compression Phase 4 #4694/#4707/#4716/#4720, combos auto-promote #4774, tier no-auth #4753, deepseek-web tool-fold #4756, dedupe provider nodes #4768). Verificado que o trabalho de release-finalize desta sessao toca SO docs/*.md (THREAT_MODEL), CHANGELOG.md, baselines e 1 linha de string em scripts/check/check-fabricated-docs.mjs (fora do escopo src+open-sse+electron+bin que o gate varre) \u2014 contribui 0. Mesma familia dos rebaselines anteriores \u2014 crescimento de feature legitimo recem-TDD'd, nao regressao; reducao estrutural fica como debt (#3501).",
-  "_rebaseline_2026_06_23_v3834_release": "Reconciliacao release-volatil 1915->1916 (+1) no fechamento do ciclo v3.8.34. check:complexity NAO roda no fast-path PR->release (so release->main), entao o ramo acumula sem rebaselinar; surfou no full CI do release PR (run em c98e7ff6d). O +1 e drift de condicional NOVO de merge de contribuidor do ciclo (features quota/usage/opencode-go/M365). Verificado que o commit de release-finalize NAO adiciona complexity: toca CHANGELOG/baseline/mirrors/3 testes + 1 linha de regex em opencodeOllamaUsage.ts (sem novo ramo) + reorder de dados no reka registry \u2014 local mede 1916 com ou sem essa mudanca. Mesma familia dos rebaselines anteriores \u2014 crescimento de feature legitimo, nao regressao; reducao estrutural fica como debt (#3501).",
-  "_rebaseline_2026_06_21_v3833_4537_nested_combo": "Reconciliacao 1913->1915 (+2) do PR #4537 (nestedComboMode execute \u2014 black-box combo-ref execution). O +2 vem do branch novo de dispatch nested em handleComboChat (combo.ts: normalizeNestedComboMode + executeModeUnits/hasExecutableComboRef + o ramo simpleExecuteStrategies que roda resolveComboRuntimeUnits com recursion caps depth/cycle/budget) \u2014 ramos condicionais no chokepoint de dispatch do combo. Medido com `node scripts/check/check-complexity.mjs` no estado merged. Crescimento de feature legitimo recem-TDD'd, nao regressao; reducao estrutural fica como debt (#3501).",
+  "_rebaseline_2026_06_25_v3836_release": "Reconciliacao release-volatil 1920->1950 (+30) no fechamento do ciclo v3.8.36, surfada pelo CI da fix-PR #5029 (a catraca de complexidade NAO roda no fast-path PR->release nem foi medida no release PR #4854 — Quality Ratchet foi SKIPPED la — so PR->main, entao o ramo acumulou os 137 commits sem rebaselinar). O +30 e drift de condicionais NOVOS das features legitimas do ciclo: Quota-Share Fase 2/3 (estrategia dedicada DRR+P2C, multi-window buckets, concurrency control, headroom, saturacao proativa — #4885/#4907/#4908/#4927/#4928/#4929/#4939/#4965/#4967/#4970), task-aware + Fusion combo (#4945/#4652), e ramos de provider/translator de contribuidores. A god-file decomposition #3501 e PURA (move codigo p/ leaves, complexity-neutra). Verificado que esta fix-PR (#5029) toca SO scripts/build/pack-artifact-policy.ts (array de strings), tests/integration/resilience-http-e2e.test.ts (2 keys) e os 2 baselines json — contribui 0 ao gate que varre src+open-sse+electron+bin. Mesma familia dos rebaselines anteriores — crescimento de feature legitimo recem-TDD'd, nao regressao; reducao estrutural fica como debt (#3501).",
+  "_rebaseline_2026_06_23_v3835_release": "Reconciliacao release-volatil 1916->1920 (+4) no fechamento do ciclo v3.8.35, surfada pelo pre-flight check:release-green (a catraca de complexidade NAO roda no fast-path PR->release, so release->main, entao o ramo acumula sem rebaselinar). O +4 e drift de condicionais NOVOS dos merges de contribuidor/feature deste ciclo (Compression Phase 4 #4694/#4707/#4716/#4720, combos auto-promote #4774, tier no-auth #4753, deepseek-web tool-fold #4756, dedupe provider nodes #4768). Verificado que o trabalho de release-finalize desta sessao toca SO docs/*.md (THREAT_MODEL), CHANGELOG.md, baselines e 1 linha de string em scripts/check/check-fabricated-docs.mjs (fora do escopo src+open-sse+electron+bin que o gate varre) — contribui 0. Mesma familia dos rebaselines anteriores — crescimento de feature legitimo recem-TDD'd, nao regressao; reducao estrutural fica como debt (#3501).",
+  "_rebaseline_2026_06_23_v3834_release": "Reconciliacao release-volatil 1915->1916 (+1) no fechamento do ciclo v3.8.34. check:complexity NAO roda no fast-path PR->release (so release->main), entao o ramo acumula sem rebaselinar; surfou no full CI do release PR (run em c98e7ff6d). O +1 e drift de condicional NOVO de merge de contribuidor do ciclo (features quota/usage/opencode-go/M365). Verificado que o commit de release-finalize NAO adiciona complexity: toca CHANGELOG/baseline/mirrors/3 testes + 1 linha de regex em opencodeOllamaUsage.ts (sem novo ramo) + reorder de dados no reka registry — local mede 1916 com ou sem essa mudanca. Mesma familia dos rebaselines anteriores — crescimento de feature legitimo, nao regressao; reducao estrutural fica como debt (#3501).",
+  "_rebaseline_2026_06_21_v3833_4537_nested_combo": "Reconciliacao 1913->1915 (+2) do PR #4537 (nestedComboMode execute — black-box combo-ref execution). O +2 vem do branch novo de dispatch nested em handleComboChat (combo.ts: normalizeNestedComboMode + executeModeUnits/hasExecutableComboRef + o ramo simpleExecuteStrategies que roda resolveComboRuntimeUnits com recursion caps depth/cycle/budget) — ramos condicionais no chokepoint de dispatch do combo. Medido com `node scripts/check/check-complexity.mjs` no estado merged. Crescimento de feature legitimo recem-TDD'd, nao regressao; reducao estrutural fica como debt (#3501).",
   "_rebaseline_2026_06_21_v3833_reviewprs_r4_owner": "Reconciliacao release-volatil 1911->1913 (+2) apos o lote de PRs do owner desta rodada (#4560 RTK cache_control, #4552 Cursor auto-import macOS, #4551 Codex /responses probe, #4554 Cursor Composer </think> decode + o stack #3501 #4538/#4544/#4548). O fast-path do release nao roda check:complexity (so release->main). As 3 extracoes chatCore #3501 (#4538 recupera 4 leaves, #4544 failureUsage, #4548 claudeSystemRole+upstreamExecuteHeaders) sao PURAS/complexity-neutras (movem codigo p/ leaves sob o teto, chatCore ENCOLHE); o +2 vem dos condicionais NOVOS das features .32-portadas (#4554 decode de bloco </think> visivel do Composer + #4551 probe do endpoint real Codex /responses). Medido com `node scripts/check/check-complexity.mjs` no tip 4b34a75fe. Crescimento de feature legitimo recem-TDD'd, nao regressao; reducao estrutural fica como debt (#3501).",
-  "_rebaseline_2026_06_21_v3833_reviewprs_r4": "Reconciliacao release-volatil 1906->1911 (+5) apos o lote /review-prs r4 (5 PRs de contribuidores mergeados em release/v3.8.33: #4557 health-polls, #4556 mobile-table, #4545 provider-wildcard, #4558 isHidden, #4489 sticky-weighted) + 1 merge concorrente de sessao paralela (#4565 quota perf). O fast-path do release nao roda check:complexity (so release->main), entao o ramo acumula sem rebaselinar. Condicionais NOVOS legitimos: #4545 (expandProviderWildcardsInCombo/Collection + wildcardMatch glob/registry branching em providerWildcard.ts/wildcardRouter.ts), #4489 (eligibility pass sticky-weighted: resolveWeightedStepGroups + isTargetSelectableForWeighted + renormalizacao em combo.ts), #4558 (filtro isHidden em buildAutoCandidates/virtualFactory) e #4565 (guardas de skip de quota_snapshots idle). Medido com `node scripts/check/check-complexity.mjs` no tip 39b2bbfea. Mesma familia dos rebaselines anteriores \u2014 crescimento de feature legitimo recem-TDD'd, nao regressao; reducao estrutural fica como debt (#3501).",
-  "_rebaseline_2026_06_21_v3833_cycle_open_stranded": "1905 -> 1906 (+1). Abertura do ciclo v3.8.33: o +1 vem dos 4 commits stranded na release/v3.8.32 (p\u00f3s-merge da v3.8.32) trazidos via cherry-pick para release/v3.8.33 \u2014 isolado em #4483 (autoStrategy.ts evaluateQuotaCutoff/quotaPreflight.ts, guardas de quota-cutoff inerentemente ramificadas, opt-in default-OFF). main mede 1905; o .33 branch (main + cherry-picks) mede 1906. Crescimento de feature legitimo rec\u00e9m-mergeado, n\u00e3o regress\u00e3o; redu\u00e7\u00e3o fica como debt (#3501).",
-  "_rebaseline_2026_06_20_reviewprs_mine_r2": "Reconciliacao release-volatil 1900->1905 (+5) apos o lote /review-prs 'apenas minhas' r2 (17 PRs meus mergeados em release/v3.8.32). Breakdown medido com `node scripts/check/check-complexity.mjs` + diff por-arquivo eslint complexity JSON entre o tip pre-lote (9052c5a78 = 1902) e o tip pos-lote (1905): (a) +2 JA latentes no tip pre-lote (1900->1902), drift de merges concorrentes de outras sessoes ANTERIORES a este lote (nao introduzidos por mim) que o fast-path do release nao rebaselina (check:complexity so roda release->main); (b) +3 deste lote, isolados em DOIS arquivos: open-sse/translator/helpers/geminiHelper.ts +1 (convertOpenAIContentToParts passou de 80->93 linhas pela branch de audio do #4426 \u2014 max-lines-per-function, funcao de dispatch coesa por tipo de content part) e open-sse/translator/response/openai-to-gemini-sse.ts +2 (translator SSE NOVO do #4453, openAIChunkToGeminiChunk + convertOpenAIResponseToGemini em complexity 19 cada \u2014 conversores de chunk SSE inerentemente ramificados, levemente acima de 15). Crescimento de feature legitimo recem-TDD'd, nao regressao; refatorar feature recem-mergeada so para raspar +3 seria over-engineering arriscado. Reducao fica como debt.",
-  "_rebaseline_2026_06_20_reviewprs_v3831_batch": "Reconciliacao release-volatil 1896->1900 (+4): drift do lote /review-prs v3.8.31 (25 PRs A+B+C + merges concorrentes). Condicionais NOVOS legitimos \u2014 sobretudo #4381 (rotas /api/local/redis/{start,stop,status} detectRuntime + guardas + bifrost relay) e #4366 (classificacao de exhaustion de erro entre os 2 dispatchers de combo). Medido 1900 ESTAVEL em fd1391c0b E f46c69f2a com `node scripts/check/check-complexity.mjs` (commit concorrente intermediario foi complexity-neutro). O fast-path do release nao roda check:complexity (so release->main), entao o ramo acumula sem rebaselinar. Mesma familia dos rebaselines anteriores \u2014 crescimento de feature legitimo, nao regressao; valor final reconciliado no release->main.",
-  "_rebaseline_2026_06_20_postlote_concurrent_drift": "Reconciliacao release-volatil: 1895->1896 (+1). Drift de condicional NOVO de PRs mergeados pela sessao concorrente APOS o #4338 ratchetar para 1895 (#4355 pricing gpt-5.x-pro / #4364 cli active-context cred / #4363 compliance cleanup / #4358 mitm mask / #4332 injection-guard-16KB). O fast-path do release nao roda check:complexity (so release->main), entao o ramo acumula sem rebaselinar. Medido com `node scripts/check/check-complexity.mjs` no tip cdfd71c17. Mesma familia \u2014 crescimento de feature legitimo, nao regressao.",
-  "_note_2026_06_20_4371_chatcore_heap_leaf": "PR #4371 (extract checkHeapPressureGuard leaf, god-file decomposition start) e complexity-NEUTRO: handleChatCore so PERDE codigo e o novo heapPressure.ts checkHeapPressureGuard fica sob o teto \u2014 a contagem permanece 1896 (medido no tip mesclado com check-complexity.mjs).",
-  "_ratchet_2026_06_19_phasecombosetup_fix": "1896->1895 (-1, ratchet DOWN \u2014 melhoria, NAO reconciliacao). O #4336 reconciliou o drift do lote para 1896 INCLUINDO a violacao que o #4326 (ComboContext) introduziu: phaseComboSetup media complexity 17 (>15) porque a extracao concentrou os condicionais de pinning/ternarios numa funcao que estourava o teto (ir\u00f4nico p/ uma decomposicao). Este PR CORRIGE na origem \u2014 extrai resolveContextCachePin (helper do pinning), phaseComboSetup volta a <15 \u2014 baixando a contagem 1. Medido com `node scripts/check/check-complexity.mjs` no tip pos-#4336.",
-  "_rebaseline_2026_06_19_lote3_postdeploy_drift": "Reconciliacao release-volatil pos-merge do lote adicional (6 PRs apos o deploy): 1890->1896 (+6). Drift de condicionais NOVOS de #4327 (per-key USD usage quotas \u2014 apiKeyUsageLimits.ts + validation/policy branches), #4334 (cache-aware compression guard) e #4326 (phaseComboSetup extraido). Medido no tip real da release com `node scripts/check/check-complexity.mjs`. Mesma familia/justificativa do _rebaseline_2026_06_19_lote3_merge_drift abaixo \u2014 feature legitima, nao regressao.",
-  "_rebaseline_2026_06_19_lote3_merge_drift": "Reconciliacao release-volatil pos-merge do lote de 13 PRs (release/v3.8.30): 1888->1890 (+2). Drift de condicionais NOVOS trazidos por #4313 (5 harvested features \u2014 combo allowlist intersection, serviceKind filter) e #4323 (compression e2e \u2014 novos ramos em ultra/aggressive/gcf/strategySelector), merges que entraram DEPOIS do #4318 medir 1888. O fast-path do release nao roda check:complexity (so release->main), entao os ramos acumulam sem rebaselinar. Medido no tip real da release pos-merge com `node scripts/check/check-complexity.mjs`. Mesma familia dos rebaselines anteriores \u2014 crescimento de feature legitimo, nao regressao; reducao fica como debt de refactor dedicado.",
-  "_rebaseline_2026_06_19_bin_scope_wired": "Task 6A.11 (de verdade): o ESLINT_ARGS de check-complexity.mjs passava apenas `src open-sse` \u2014 o config eslint.complexity.config.mjs e este baseline JA documentavam o escopo src+open-sse+electron+bin, mas a edicao do scan nunca tinha sido aplicada (fake-green: o gate alegava cobrir bin/electron e nunca os varria). Agora ESLINT_ARGS passa `src open-sse electron bin`, casando o config. Medido: electron+bin contribuem 0 violacoes (electron so tem types.d.ts, ignorado; os 4 .ts de bin/ estao sob os thresholds) \u2014 o widening e 0-custo. O +1 (1887->1888) NAO vem do widening: e drift pre-existente em src/open-sse trazido pela base release/v3.8.30 a23d0d678 (merges do ciclo, incl. #4308 cache-hit-cost), que o fast-path do release nao rebaselina (check:complexity so roda no release->main). Mesma familia dos rebaselines anteriores \u2014 crescimento de feature legitimo, nao regressao.",
+  "_rebaseline_2026_06_21_v3833_reviewprs_r4": "Reconciliacao release-volatil 1906->1911 (+5) apos o lote /review-prs r4 (5 PRs de contribuidores mergeados em release/v3.8.33: #4557 health-polls, #4556 mobile-table, #4545 provider-wildcard, #4558 isHidden, #4489 sticky-weighted) + 1 merge concorrente de sessao paralela (#4565 quota perf). O fast-path do release nao roda check:complexity (so release->main), entao o ramo acumula sem rebaselinar. Condicionais NOVOS legitimos: #4545 (expandProviderWildcardsInCombo/Collection + wildcardMatch glob/registry branching em providerWildcard.ts/wildcardRouter.ts), #4489 (eligibility pass sticky-weighted: resolveWeightedStepGroups + isTargetSelectableForWeighted + renormalizacao em combo.ts), #4558 (filtro isHidden em buildAutoCandidates/virtualFactory) e #4565 (guardas de skip de quota_snapshots idle). Medido com `node scripts/check/check-complexity.mjs` no tip 39b2bbfea. Mesma familia dos rebaselines anteriores — crescimento de feature legitimo recem-TDD'd, nao regressao; reducao estrutural fica como debt (#3501).",
+  "_rebaseline_2026_06_21_v3833_cycle_open_stranded": "1905 -> 1906 (+1). Abertura do ciclo v3.8.33: o +1 vem dos 4 commits stranded na release/v3.8.32 (pós-merge da v3.8.32) trazidos via cherry-pick para release/v3.8.33 — isolado em #4483 (autoStrategy.ts evaluateQuotaCutoff/quotaPreflight.ts, guardas de quota-cutoff inerentemente ramificadas, opt-in default-OFF). main mede 1905; o .33 branch (main + cherry-picks) mede 1906. Crescimento de feature legitimo recém-mergeado, não regressão; redução fica como debt (#3501).",
+  "_rebaseline_2026_06_20_reviewprs_mine_r2": "Reconciliacao release-volatil 1900->1905 (+5) apos o lote /review-prs 'apenas minhas' r2 (17 PRs meus mergeados em release/v3.8.32). Breakdown medido com `node scripts/check/check-complexity.mjs` + diff por-arquivo eslint complexity JSON entre o tip pre-lote (9052c5a78 = 1902) e o tip pos-lote (1905): (a) +2 JA latentes no tip pre-lote (1900->1902), drift de merges concorrentes de outras sessoes ANTERIORES a este lote (nao introduzidos por mim) que o fast-path do release nao rebaselina (check:complexity so roda release->main); (b) +3 deste lote, isolados em DOIS arquivos: open-sse/translator/helpers/geminiHelper.ts +1 (convertOpenAIContentToParts passou de 80->93 linhas pela branch de audio do #4426 — max-lines-per-function, funcao de dispatch coesa por tipo de content part) e open-sse/translator/response/openai-to-gemini-sse.ts +2 (translator SSE NOVO do #4453, openAIChunkToGeminiChunk + convertOpenAIResponseToGemini em complexity 19 cada — conversores de chunk SSE inerentemente ramificados, levemente acima de 15). Crescimento de feature legitimo recem-TDD'd, nao regressao; refatorar feature recem-mergeada so para raspar +3 seria over-engineering arriscado. Reducao fica como debt.",
+  "_rebaseline_2026_06_20_reviewprs_v3831_batch": "Reconciliacao release-volatil 1896->1900 (+4): drift do lote /review-prs v3.8.31 (25 PRs A+B+C + merges concorrentes). Condicionais NOVOS legitimos — sobretudo #4381 (rotas /api/local/redis/{start,stop,status} detectRuntime + guardas + bifrost relay) e #4366 (classificacao de exhaustion de erro entre os 2 dispatchers de combo). Medido 1900 ESTAVEL em fd1391c0b E f46c69f2a com `node scripts/check/check-complexity.mjs` (commit concorrente intermediario foi complexity-neutro). O fast-path do release nao roda check:complexity (so release->main), entao o ramo acumula sem rebaselinar. Mesma familia dos rebaselines anteriores — crescimento de feature legitimo, nao regressao; valor final reconciliado no release->main.",
+  "_rebaseline_2026_06_20_postlote_concurrent_drift": "Reconciliacao release-volatil: 1895->1896 (+1). Drift de condicional NOVO de PRs mergeados pela sessao concorrente APOS o #4338 ratchetar para 1895 (#4355 pricing gpt-5.x-pro / #4364 cli active-context cred / #4363 compliance cleanup / #4358 mitm mask / #4332 injection-guard-16KB). O fast-path do release nao roda check:complexity (so release->main), entao o ramo acumula sem rebaselinar. Medido com `node scripts/check/check-complexity.mjs` no tip cdfd71c17. Mesma familia — crescimento de feature legitimo, nao regressao.",
+  "_note_2026_06_20_4371_chatcore_heap_leaf": "PR #4371 (extract checkHeapPressureGuard leaf, god-file decomposition start) e complexity-NEUTRO: handleChatCore so PERDE codigo e o novo heapPressure.ts checkHeapPressureGuard fica sob o teto — a contagem permanece 1896 (medido no tip mesclado com check-complexity.mjs).",
+  "_ratchet_2026_06_19_phasecombosetup_fix": "1896->1895 (-1, ratchet DOWN — melhoria, NAO reconciliacao). O #4336 reconciliou o drift do lote para 1896 INCLUINDO a violacao que o #4326 (ComboContext) introduziu: phaseComboSetup media complexity 17 (>15) porque a extracao concentrou os condicionais de pinning/ternarios numa funcao que estourava o teto (irônico p/ uma decomposicao). Este PR CORRIGE na origem — extrai resolveContextCachePin (helper do pinning), phaseComboSetup volta a <15 — baixando a contagem 1. Medido com `node scripts/check/check-complexity.mjs` no tip pos-#4336.",
+  "_rebaseline_2026_06_19_lote3_postdeploy_drift": "Reconciliacao release-volatil pos-merge do lote adicional (6 PRs apos o deploy): 1890->1896 (+6). Drift de condicionais NOVOS de #4327 (per-key USD usage quotas — apiKeyUsageLimits.ts + validation/policy branches), #4334 (cache-aware compression guard) e #4326 (phaseComboSetup extraido). Medido no tip real da release com `node scripts/check/check-complexity.mjs`. Mesma familia/justificativa do _rebaseline_2026_06_19_lote3_merge_drift abaixo — feature legitima, nao regressao.",
+  "_rebaseline_2026_06_19_lote3_merge_drift": "Reconciliacao release-volatil pos-merge do lote de 13 PRs (release/v3.8.30): 1888->1890 (+2). Drift de condicionais NOVOS trazidos por #4313 (5 harvested features — combo allowlist intersection, serviceKind filter) e #4323 (compression e2e — novos ramos em ultra/aggressive/gcf/strategySelector), merges que entraram DEPOIS do #4318 medir 1888. O fast-path do release nao roda check:complexity (so release->main), entao os ramos acumulam sem rebaselinar. Medido no tip real da release pos-merge com `node scripts/check/check-complexity.mjs`. Mesma familia dos rebaselines anteriores — crescimento de feature legitimo, nao regressao; reducao fica como debt de refactor dedicado.",
+  "_rebaseline_2026_06_19_bin_scope_wired": "Task 6A.11 (de verdade): o ESLINT_ARGS de check-complexity.mjs passava apenas `src open-sse` — o config eslint.complexity.config.mjs e este baseline JA documentavam o escopo src+open-sse+electron+bin, mas a edicao do scan nunca tinha sido aplicada (fake-green: o gate alegava cobrir bin/electron e nunca os varria). Agora ESLINT_ARGS passa `src open-sse electron bin`, casando o config. Medido: electron+bin contribuem 0 violacoes (electron so tem types.d.ts, ignorado; os 4 .ts de bin/ estao sob os thresholds) — o widening e 0-custo. O +1 (1887->1888) NAO vem do widening: e drift pre-existente em src/open-sse trazido pela base release/v3.8.30 a23d0d678 (merges do ciclo, incl. #4308 cache-hit-cost), que o fast-path do release nao rebaselina (check:complexity so roda no release->main). Mesma familia dos rebaselines anteriores — crescimento de feature legitimo, nao regressao.",
   "_rebaseline_2026_06_19_4293_codex_spark_scope": "PR #4293 (isolate Codex Spark quota scope): +2 over the v3.8.30 baseline (1885->1887). Measured on the actual merged tree (release/v3.8.30 + #4293), not the PR's own estimate. The thin requestedModel-scoped Codex quota headroom/preflight branches needed so GPT-5.3-Codex-Spark and normal Codex are evaluated independently add the new conditional cost; heavy parsing/display logic was extracted to leaf helpers under the cap (codexQuotaScopes.ts, codexUsageQuotas.ts, codexFailover.ts). Legitimate feature growth, not regression; structural shrink remains debt.",
-  "_rebaseline_2026_06_19_v3830": "Re-baseline consciente: drift 1800->1885 (+85) do ciclo v3.8.25->v3.8.29 (round-9, ~130 PRs: combo split D7/D8, chatCore split, novos providers/modelos, cost-telemetry, MITM decrypt, remote-mode CLI). Medido no tip release/v3.8.30 (3e6be4701). Mesma familia dos re-baselines anteriores \u2014 crescimento de feature legitima, nao regressao. Reducao fica como debt de refactor dedicado.",
-  "_rebaseline_2026_06_13_v3825": "Re-baseline consciente: drift 1794->1800 (+6) do ciclo v3.8.24->v3.8.25 (features #3799-#3806). Mesma familia dos re-baselines anteriores \u2014 crescimento de feature legitima, nao regressao. Reducao fica como debt de refactor dedicado.",
-  "_rebaseline_2026_06_10": "Re-baseline consciente: 1739 foi medido na branch das Fases 0-6 (base ~v3.8.17); a v3.8.18 publicada ja carrega 1746 (provado: o commit-base 5f2722bd6, anterior a qualquer commit do ciclo v3.8.19, mede 1746 \u2014 funcoes complexas dos reworks RequestLoggerV2/stream/combo). Mesma familia dos re-baselines de eslintWarnings/file-size. Reducao = Fase 6A (2026-06-16).",
-  "_rebaseline_2026_06_13_6a11": "Re-baseline consciente Task 6A.11: escopo ampliado para src+open-sse+electron+bin (electron/bin contribuem 0 violacoes novas \u2014 todos os 4 arquivos .ts em bin/ estao abaixo dos thresholds). Drift 1746\u21921794 pre-existente de features mergeadas nos ciclos v3.8.22/v3.8.23 (nao causado por esta task). Congelado no valor real medido para destrancar o gate.",
-  "_rebaseline_2026_06_26_v3837_release": "1950->1963 (+13). v3.8.37 cycle drift surfaced by the release-green pre-flight (the Quality Ratchet does NOT run on PR->release fast-gates, so warnings/complexity accrued unmeasured across this cycle's 76 commits \u2014 provider adds DGrid/Pioneer/xAI, headroom proxy lifecycle #4649, ~50 SSE/translator fixes, Engine Combos #5062). Trust-but-verify: this release-finalize working tree touches ONLY CHANGELOG.md, docs/i18n/*/CHANGELOG.md mirrors, and these baselines \u2014 0 production-code change, so all drift is inherited cycle drift (`any` warn-allowed in open-sse/ + tests/). Tighten via --require-tighten next cycle.",
-  "_rebaseline_2026_07_06_v3845_release_close": "2028->2035 (+7). v3.8.45 release close (generate-release Phase 0): drift herdado do merge burst final do ciclo (#6216 streaming fixes, #6251/#6253 dashboard UX, #6292 zero-width, fixes do pre-flight ce897453 \u2014 todos test/config/workflow-neutros em complexidade nova, verificado pelo validador no tip 5ecca12aa5). Tighten via --update next cycle.",
+  "_rebaseline_2026_06_19_v3830": "Re-baseline consciente: drift 1800->1885 (+85) do ciclo v3.8.25->v3.8.29 (round-9, ~130 PRs: combo split D7/D8, chatCore split, novos providers/modelos, cost-telemetry, MITM decrypt, remote-mode CLI). Medido no tip release/v3.8.30 (3e6be4701). Mesma familia dos re-baselines anteriores — crescimento de feature legitima, nao regressao. Reducao fica como debt de refactor dedicado.",
+  "_rebaseline_2026_06_13_v3825": "Re-baseline consciente: drift 1794->1800 (+6) do ciclo v3.8.24->v3.8.25 (features #3799-#3806). Mesma familia dos re-baselines anteriores — crescimento de feature legitima, nao regressao. Reducao fica como debt de refactor dedicado.",
+  "_rebaseline_2026_06_10": "Re-baseline consciente: 1739 foi medido na branch das Fases 0-6 (base ~v3.8.17); a v3.8.18 publicada ja carrega 1746 (provado: o commit-base 5f2722bd6, anterior a qualquer commit do ciclo v3.8.19, mede 1746 — funcoes complexas dos reworks RequestLoggerV2/stream/combo). Mesma familia dos re-baselines de eslintWarnings/file-size. Reducao = Fase 6A (2026-06-16).",
+  "_rebaseline_2026_06_13_6a11": "Re-baseline consciente Task 6A.11: escopo ampliado para src+open-sse+electron+bin (electron/bin contribuem 0 violacoes novas — todos os 4 arquivos .ts em bin/ estao abaixo dos thresholds). Drift 1746→1794 pre-existente de features mergeadas nos ciclos v3.8.22/v3.8.23 (nao causado por esta task). Congelado no valor real medido para destrancar o gate.",
+  "_rebaseline_2026_06_26_v3837_release": "1950->1963 (+13). v3.8.37 cycle drift surfaced by the release-green pre-flight (the Quality Ratchet does NOT run on PR->release fast-gates, so warnings/complexity accrued unmeasured across this cycle's 76 commits — provider adds DGrid/Pioneer/xAI, headroom proxy lifecycle #4649, ~50 SSE/translator fixes, Engine Combos #5062). Trust-but-verify: this release-finalize working tree touches ONLY CHANGELOG.md, docs/i18n/*/CHANGELOG.md mirrors, and these baselines — 0 production-code change, so all drift is inherited cycle drift (`any` warn-allowed in open-sse/ + tests/). Tighten via --require-tighten next cycle.",
+  "_rebaseline_2026_07_06_v3845_release_close": "2028->2035 (+7). v3.8.45 release close (generate-release Phase 0): drift herdado do merge burst final do ciclo (#6216 streaming fixes, #6251/#6253 dashboard UX, #6292 zero-width, fixes do pre-flight ce897453 — todos test/config/workflow-neutros em complexidade nova, verificado pelo validador no tip 5ecca12aa5). Tighten via --update next cycle.",
   "_rebaseline_2026_07_07_6552_chirag_api_models_filter": "2050->2052 (+2). PR #6552 (@chirag127, #6328): hidePaidModels filter across the 4 dashboard /api/models endpoints adds 2 functions over the complexity threshold. Owner-approved rebaseline (contributor own-growth). Tighten via --update next cycle."
-}
+}

config/quality/dashboard-typecheck-baseline.json

@@ -1,241 +0,0 @@
-{
-  "open-sse/services/payloadRules.ts": {
-    "TS2677": 1
-  },
-  "src/app/(dashboard)/dashboard/HomePageClient.tsx": {
-    "TS2339": 16
-  },
-  "src/app/(dashboard)/dashboard/agent-skills/AgentSkillsPageClient.tsx": {
-    "TS2503": 3
-  },
-  "src/app/(dashboard)/dashboard/agent-skills/components/CoverageBar.tsx": {
-    "TS2503": 1
-  },
-  "src/app/(dashboard)/dashboard/agent-skills/components/McpA2aLinksBar.tsx": {
-    "TS2503": 2
-  },
-  "src/app/(dashboard)/dashboard/agent-skills/components/SkillCard.tsx": {
-    "TS2503": 1
-  },
-  "src/app/(dashboard)/dashboard/agent-skills/components/SkillPreviewPane.tsx": {
-    "TS2503": 2
-  },
-  "src/app/(dashboard)/dashboard/cache/__tests__/CachePage.test.tsx": {
-    "TS2305": 3,
-    "TS1117": 1
-  },
-  "src/app/(dashboard)/dashboard/cache/__tests__/CachePerformance.test.tsx": {
-    "TS2305": 1,
-    "TS2322": 2
-  },
-  "src/app/(dashboard)/dashboard/cache/__tests__/CacheTrends.test.tsx": {
-    "TS2305": 1,
-    "TS2322": 6
-  },
-  "src/app/(dashboard)/dashboard/cache/__tests__/IdempotencyLayer.test.tsx": {
-    "TS2305": 1
-  },
-  "src/app/(dashboard)/dashboard/cache/__tests__/MemoryCards.test.tsx": {
-    "TS2305": 1,
-    "TS2322": 1
-  },
-  "src/app/(dashboard)/dashboard/cache/components/CachePerformance.tsx": {
-    "TS2339": 1
-  },
-  "src/app/(dashboard)/dashboard/cli-code/components/ClaudeToolCard.tsx": {
-    "TS2339": 2
-  },
-  "src/app/(dashboard)/dashboard/cli-code/components/CodexToolCard.tsx": {
-    "TS2345": 3
-  },
-  "src/app/(dashboard)/dashboard/cli-code/components/CustomCliCard.tsx": {
-    "TS2345": 1
-  },
-  "src/app/(dashboard)/dashboard/cli-code/components/DroidToolCard.tsx": {
-    "TS2554": 2
-  },
-  "src/app/(dashboard)/dashboard/combos/page.tsx": {
-    "TS2339": 4,
-    "TS2345": 5,
-    "TS2698": 1,
-    "TS2322": 13
-  },
-  "src/app/(dashboard)/dashboard/compression/studio/EncoderComparisonTable.tsx": {
-    "TS2322": 1
-  },
-  "src/app/(dashboard)/dashboard/costs/quota-share/QuotaSharePageClient.tsx": {
-    "TS2551": 7,
-    "TS2322": 2,
-    "TS2719": 2,
-    "TS2739": 1
-  },
-  "src/app/(dashboard)/dashboard/costs/quota-share/components/StackedAllocationBar.tsx": {
-    "TS2503": 1
-  },
-  "src/app/(dashboard)/dashboard/costs/quota-share/components/UsageLogCard.tsx": {
-    "TS2869": 2
-  },
-  "src/app/(dashboard)/dashboard/discovery/__tests__/DiscoveryPageClient.test.tsx": {
-    "TS2305": 2
-  },
-  "src/app/(dashboard)/dashboard/endpoint/EndpointPageClient.tsx": {
-    "TS2322": 18
-  },
-  "src/app/(dashboard)/dashboard/memory/components/tabs/MemoriesTab.tsx": {
-    "TS2322": 1
-  },
-  "src/app/(dashboard)/dashboard/omni-skills/OmniSkillsPageClient.tsx": {
-    "TS2503": 1
-  },
-  "src/app/(dashboard)/dashboard/omni-skills/components/OmniExecutionsTab.tsx": {
-    "TS2503": 1
-  },
-  "src/app/(dashboard)/dashboard/omni-skills/components/OmniMarketplaceTab.tsx": {
-    "TS2503": 1
-  },
-  "src/app/(dashboard)/dashboard/omni-skills/components/OmniSandboxTab.tsx": {
-    "TS2503": 1
-  },
-  "src/app/(dashboard)/dashboard/omni-skills/components/OmniSkillCard.tsx": {
-    "TS2503": 1
-  },
-  "src/app/(dashboard)/dashboard/omni-skills/components/OmniSkillsList.tsx": {
-    "TS2503": 1
-  },
-  "src/app/(dashboard)/dashboard/omni-skills/components/SkillInspectorPane.tsx": {
-    "TS2503": 1
-  },
-  "src/app/(dashboard)/dashboard/playground/components/PresetPicker.tsx": {
-    "TS2352": 1
-  },
-  "src/app/(dashboard)/dashboard/playground/components/ToolsBuilder.tsx": {
-    "TS2339": 1
-  },
-  "src/app/(dashboard)/dashboard/providers/[id]/ProviderDetailPageClient.tsx": {
-    "TS2322": 4
-  },
-  "src/app/(dashboard)/dashboard/providers/[id]/__tests__/phase1e.test.tsx": {
-    "TS2741": 2
-  },
-  "src/app/(dashboard)/dashboard/providers/[id]/components/CompatibleModelsSection.tsx": {
-    "TS2741": 1
-  },
-  "src/app/(dashboard)/dashboard/providers/[id]/components/ConnectionRow.tsx": {
-    "TS2345": 3,
-    "TS2322": 1
-  },
-  "src/app/(dashboard)/dashboard/providers/[id]/components/ConnectionsListPanel.tsx": {
-    "TS2322": 2
-  },
-  "src/app/(dashboard)/dashboard/providers/[id]/components/CustomModelsSection.tsx": {
-    "TS2739": 1
-  },
-  "src/app/(dashboard)/dashboard/providers/[id]/components/ModelCompatPopover.tsx": {
-    "TS2304": 5
-  },
-  "src/app/(dashboard)/dashboard/providers/[id]/components/ProviderModalsPanel.tsx": {
-    "TS2322": 3,
-    "TS2739": 1,
-    "TS2345": 3
-  },
-  "src/app/(dashboard)/dashboard/providers/[id]/components/ProviderModelsSection.tsx": {
-    "TS2322": 1
-  },
-  "src/app/(dashboard)/dashboard/providers/[id]/components/ProviderParamFilterSection.tsx": {
-    "TS2339": 6
-  },
-  "src/app/(dashboard)/dashboard/providers/[id]/components/ProviderPlaygroundPanel.tsx": {
-    "TS2503": 1
-  },
-  "src/app/(dashboard)/dashboard/providers/[id]/components/__tests__/phase1d.test.tsx": {
-    "TS2739": 2
-  },
-  "src/app/(dashboard)/dashboard/providers/[id]/components/modals/EditConnectionModal.tsx": {
-    "TS2322": 1
-  },
-  "src/app/(dashboard)/dashboard/providers/[id]/hooks/useModelImportHandlers.ts": {
-    "TS2339": 1
-  },
-  "src/app/(dashboard)/dashboard/providers/[id]/hooks/useModelVisibilityHandlers.ts": {
-    "TS2339": 15
-  },
-  "src/app/(dashboard)/dashboard/providers/components/onboarding/providerOnboardingCatalog.ts": {
-    "TS2339": 4,
-    "TS2345": 2
-  },
-  "src/app/(dashboard)/dashboard/providers/providerPageUtils.ts": {
-    "TS2345": 1
-  },
-  "src/app/(dashboard)/dashboard/quota/page.tsx": {
-    "TS2339": 4
-  },
-  "src/app/(dashboard)/dashboard/runtime/RuntimePageClient.tsx": {
-    "TS2304": 1
-  },
-  "src/app/(dashboard)/dashboard/settings/components/AppearanceTab.tsx": {
-    "TS2339": 4
-  },
-  "src/app/(dashboard)/dashboard/settings/components/RedisLauncherPanel.tsx": {
-    "TS2345": 11
-  },
-  "src/app/(dashboard)/dashboard/tools/traffic-inspector/components/CustomHostsManager.tsx": {
-    "TS2339": 1
-  },
-  "src/app/(dashboard)/dashboard/tools/traffic-inspector/components/tabs/ResponseBodyTab.tsx": {
-    "TS2339": 5
-  },
-  "src/app/(dashboard)/dashboard/translator/components/MonitorTab.tsx": {
-    "TS2345": 1
-  },
-  "src/app/(dashboard)/dashboard/translator/components/advanced/StreamTransformerAccordion.tsx": {
-    "TS2345": 1
-  },
-  "src/app/(dashboard)/dashboard/usage/components/ProviderLimits/index.tsx": {
-    "TS2339": 2
-  },
-  "src/app/(dashboard)/dashboard/usage/components/ProviderLimits/parts/QuotaEnvGroup.tsx": {
-    "TS2739": 1
-  },
-  "src/lib/combos/builderDraft.ts": {
-    "TS2741": 1
-  },
-  "src/lib/providers/codexFastTier.ts": {
-    "TS2367": 1
-  },
-  "src/lib/services/htmlRewriter.ts": {
-    "TS2322": 2,
-    "TS2345": 2
-  },
-  "src/mitm/inspector/sseMerger.ts": {
-    "TS2352": 1
-  },
-  "src/shared/components/Header.tsx": {
-    "TS2353": 1
-  },
-  "src/shared/components/OAuthModal.tsx": {
-    "TS2769": 3,
-    "TS2345": 3
-  },
-  "src/shared/components/SkillsConceptCard.tsx": {
-    "TS2503": 1
-  },
-  "src/shared/components/analytics/charts.tsx": {
-    "TS2345": 1
-  },
-  "src/shared/components/analytics/rechartsDonuts.tsx": {
-    "TS2739": 2
-  },
-  "src/shared/hooks/useElectron.ts": {
-    "TS2339": 19
-  },
-  "src/shared/providers/webSessionCredentials.ts": {
-    "TS2353": 1,
-    "TS2322": 1
-  },
-  "src/shared/schemas/cliCatalog.ts": {
-    "TS2554": 2
-  },
-  "src/shared/services/opencodeConfig.ts": {
-    "TS2345": 1
-  }
-}

config/quality/dependency-allowlist.json

@@ -45,7 +45,6 @@
     "concurrently",
     "cross-env",
     "csv-stringify",
-    "ctrf",
     "dompurify",
     "dpdm",
     "electron",
@@ -64,7 +63,6 @@
     "glob",
     "http-proxy-middleware",
     "https-proxy-agent",
-    "httpyac",
     "husky",
     "ink",
     "ink-spinner",
@@ -76,7 +74,6 @@
     "jscpd",
     "jsdom",
     "jsonc-parser",
-    "junit-to-ctrf",
     "keytar",
     "knip",
     "license-checker-rseidelsohn",
@@ -102,9 +99,7 @@
     "pino-abstract-transport",
     "pino-pretty",
     "playwright",
-    "playwright-ctrf-json-reporter",
     "prettier",
-    "promptfoo",
     "react",
     "react-dom",
     "react-is",
@@ -114,7 +109,6 @@
     "safe-regex",
     "selfsigned",
     "size-limit",
-    "smol-toml",
     "socks",
     "sql.js",
     "sqlite-vec",

config/quality/e2e-timings.json

@@ -1,39 +0,0 @@
-{
-  "_meta": "Relative weights for scripts/quality/balance-e2e-shards.mjs (LPT shard packing). Unitless \u2014 only ratios matter. Seeded from spec LOC (proxy) on 2026-07-13; replace values with real per-file durations (seconds) from a full CI run's reports whenever convenient. New specs without an entry get the median weight.",
-  "a11y-resilience.spec.ts": 59,
-  "a11y.spec.ts": 281,
-  "agent-bridge-traffic-cross.spec.ts": 155,
-  "agent-bridge.spec.ts": 160,
-  "agent-skills-page.spec.ts": 205,
-  "analytics-tabs.spec.ts": 334,
-  "api-keys-flow.spec.ts": 643,
-  "api.spec.ts": 30,
-  "combo-live-studio.spec.ts": 35,
-  "combo-unification.spec.ts": 192,
-  "combos-flow.spec.ts": 629,
-  "compression-studio.spec.ts": 55,
-  "error-pages.spec.ts": 101,
-  "group-b-activity-feed.spec.ts": 96,
-  "group-b-quota-plans-config.spec.ts": 154,
-  "group-b-quota-share-pools.spec.ts": 98,
-  "group-b-redirect-logs-activity.spec.ts": 56,
-  "memory-engine.spec.ts": 607,
-  "memory-qdrant-routes.spec.ts": 360,
-  "memory-settings.spec.ts": 193,
-  "navigation.spec.ts": 28,
-  "playground-compare.spec.ts": 138,
-  "playground-studio.spec.ts": 101,
-  "protocol-visibility.spec.ts": 25,
-  "providers-bailian-coding-plan.spec.ts": 240,
-  "providers-management.spec.ts": 324,
-  "proxy-registry.smoke.spec.ts": 218,
-  "resilience-plan-alignment.spec.ts": 382,
-  "responsive.spec.ts": 21,
-  "search-tools-studio.spec.ts": 133,
-  "settings-toggles.spec.ts": 127,
-  "skills-marketplace.spec.ts": 209,
-  "smoke.spec.ts": 33,
-  "traffic-inspector.spec.ts": 212,
-  "translator-friendly.spec.ts": 115,
-  "visual-resilience-smoke.spec.ts": 20
-}

config/quality/file-size-baseline.json

@@ -1,24 +1,4 @@
 {
-  "_rebaseline_2026_07_24_8470_hyperagent_sticky_thread": "PR #8470 (artickc, fix/hyperagent-tool-loop-thread-sticky) own growth: open-sse/executors/hyperagent.ts 936->1025 (wc -l; check-file-size.mjs counts via split(\"\\n\").length so the gate sees 937->1026, +89, crosses the 1000 cap). Fixes a real bug where a reverse-conversion proxy (text-Intent/JSON to Claude Code native tool_calls) rewrites assistant messages between agentic tool-loop turns, breaking HyperAgent's conversation-prefix fingerprint and cold-starting the thread mid tool-loop. Adds Anthropic tool_use/tool_result flattening to extractMessageText() plus a new rootUserFingerprint()/root-key lookup tier in resolveHyperAgentThreadBinding()/storeHyperAgentThreadAfterTurn() so the thread stays sticky across the tool loop. Cohesive additions inside the existing single-file executor; not extractable without splitting the executor mid-request-flow. Covered by tests/unit/executor-hyperagent.test.ts (19/19, +5 new cases for tool_result/tool_use flattening + root-key stickiness). Pre-merge review flagged a cross-conversation root-key collision risk (tracked in the PR's own mandatory pre-merge checklist, not yet addressed) — unrelated to this file-size ratchet, tracked separately by /fix-prs.",
-  "_rebaseline_2026_07_25_8494_capability_filter_fail_closed": "PR #8494 (fix/capability-filters-fail-closed, #8488) own growth: open-sse/services/combo.ts 3640->3693 (+53) adds a fail-closed guard after filterTargetsByRequestCompatibility() — when every eligible target is excluded by request-capability filtering (vision/tools/etc) instead of quota/health, the combo now returns an explicit `capability_mismatch` 400 (describeCapabilityFilterExhaustion, imported from combo/comboStructure.ts) rather than silently falling through to a generic no-targets error, plus a `compatFilterFailOpen` escape hatch (combo config OR settings) mirrored at both the main/auto and round-robin call sites for symmetry. combo/comboStructure.ts (previously under cap, un-frozen) grows 794->918 (+124) — new home for describeCapabilityFilterExhaustion + providerSupportsEmulatedToolCalling (#5240 emulated tool-calling exemption so fail-closed does not regress prompt-emulation-only combos like all-chatgpt-web). Irreducible orchestration wiring at the existing filter chokepoint (same precedent as #7301's universal-cooldown-retry generalization). Companion test tests/unit/combo-routing-engine.test.ts 3409->3449 (+40, fail-closed/fail-open coverage across both call sites) also rebaselined. Covered by tests/unit/8488-capability-filter-fail-closed.test.ts (new) + 95/95 passing across both files. Structural shrink of combo.ts tracked in #3501.",
-  "_rebaseline_2026_07_25_8499_ts7_result_union_predicates": "PR #8499 (backryun, chore/ts7-types-executor-scattered) own growth: muse-spark-web.ts 1396->1405 (+9, irreducible). Under this workspace's `strictNullChecks: false`, the boolean-literal discriminant on `GraphqlResult` (`{ ok: true } | { ok: false; error: string }`) narrows the positive `.ok===true` branch but leaves `!result.ok` at the full union under TS7, making `.error` unreachable to the checker at the two call sites (warmup, mode-switch). Fixed by adding a single `isGraphqlFailure()` type-predicate helper (doc comment + 3-line body) reused at both call sites instead of duplicating the predicate inline — not extractable to a shared module without splitting a single-file executor's local narrowing helper out of its own file. Covered by the existing muse-spark-web executor test suite (no behavior change, pure narrowing fix).",
-  "_rebaseline_2026_07_22_8131_windowshide_cloudflared_spawn": "PR #8167 (Dingding-leo, fix/windows-hide-child-process, #8131) own growth: src/lib/cloudflaredTunnel.ts 934->935 (+1, irreducible call-site wiring — the single `windowsHide: true` option added to the existing cloudflared spawn() options object so no transient conhost.exe/cmd console window flashes open on Windows). Covered by the pre-merge-fix regression test tests/unit/windows-hide-child-process-spawns-8131.test.ts (added for the two additional spawn() sites the PR missed: ServiceSupervisor.ts, versionManager/processManager.ts) plus the windowsHide assertion added to tests/unit/services/installers/runNpm-shell-5379.test.ts (installers/utils.ts buildNpmExecOptions).",
-  "_rebaseline_2026_07_22_8006_adobe_firefly_media_provider": "PR #8006 (artickc, feat/adobe-firefly-media) own growth: adds Adobe Firefly as a media-only (image + video) provider — unofficial IMS/cookie-session bridge for firefly.adobe.com covering IMS cookie->access_token exchange, discovery-catalog fallback, credits/balance usage, and submit+poll dispatch for both image (nano-banana/gpt-image families) and video (Sora 2/Veo 3.1/Kling 3.0) generation, with 408-under-load retry handling. New leaf open-sse/services/adobeFireflyClient.ts frozen at 1958 (>>cap 800) — a single self-contained upstream client (mirrors the qoderCli.ts precedent for a new provider client that is legitimately large on day one: IMS auth, cookie/JWT normalization, payload builders for 2 media types x multiple model families, SSE-less submit/poll state machine, error sanitization); not extractable without scattering a single upstream integration across artificial module boundaries mid-PR. open-sse/config/imageRegistry.ts (existing, previously under cap) grows 800->821 (+21, the new adobe-firefly IMAGE_PROVIDERS entry + models list, additive registry data at the existing registry chokepoint). src/lib/usage/providerLimits.ts 1000->1003 (+3, adobe-firefly/firefly added to the existing apikey-usage-fetcher allowlist, irreducible call-site wiring mirroring the sibling #7994 PromptQL/HyperAgent entries in the same PR group). Covered by tests/unit/adobe-firefly.test.ts (35/35). Structural shrink tracked in #3501.",
-  "_rebaseline_2026_07_22_7994_hyperagent_web_provider": "PR #7994 (artickc, feat/hyperagent-web) own growth: adds HyperAgent (hyperagent.com) as a new unofficial web-cookie chat provider, reverse-engineered from live SPA captures (thread/session SSE flow, credits/usage endpoint). New leaf open-sse/executors/hyperagent.ts frozen at 937 (>cap 800) — single self-contained executor covering cookie auth, SSE parsing (text/session_start/session_end/done events), and a sticky thread/session cache for multi-turn continuity; not extractable without splitting the executor mid-request-flow (mirrors the sseParser.ts/muse-spark-web.ts precedent for new provider executors that exceed cap on day one). src/lib/usage/providerLimits.ts 1000->1003 (+3, irreducible call-site wiring adding hyperagent/ha to the existing USAGE_FETCHER_PROVIDERS-style allowlist at the chokepoint other web-cookie providers already extend). Covered by tests/unit/executor-hyperagent.test.ts (16/16). Structural shrink tracked in #3501.",
-  "_rebaseline_2026_07_21_7301_universal_cooldown_retry": "PR #7301 (ViFigueiredo, feat/universal-cooldown-retry) own growth, surfaced during rebase-onto-tip reconciliation (fast-gates PR->release do not run check:file-size): open-sse/services/combo.ts 3388->3479 (+91) generalizes the existing quota-share-only cooldown-aware retry (dispatchWithCooldownRetry) to ALL combo strategies (priority/weighted/round-robin/etc), gates it on the model lockout's REAL reason (not a hardcoded \"rate_limit\") via the existing getModelLockoutInfo/resolveComboCooldownWaitDecision chokepoint, and adds a global comboTimeoutMs guard + aggregated per-target error diagnostics on exhaustion. Companion leaves open-sse/services/combo/comboCooldownRetry.ts (+29), combo/autoStrategy.ts (+9, auto-strategy combo-ref guard so a combo cannot recursively reference itself as a candidate), combo/comboSetup.ts (+3), comboConfig.ts (+6) all stay under cap. Irreducible orchestration wiring at the existing dispatch chokepoint (mirrors the quota-share-only precedent this PR generalizes); not extractable without hiding the retry loop. Covered by tests/unit/combo-auto-candidate-expansion.test.ts (+61, combo-ref guard), tests/unit/combo-routing-engine.test.ts (+68, universal retry across strategies + comboTimeoutMs, no-explicit-any clean), tests/unit/serial/combo-quota-share-cooldown-wait-timing.test.ts (+136, quota_exhausted vs rate_limit reason gating, disabled-flag passthrough). Structural shrink of combo.ts tracked in #3501.",
-  "_rebaseline_2026_07_21_7935_vi_locale_residual_ui": "PR #7935 (nguyenha935, fix/vietnamese-locale-residual) own growth: 9 dashboard components gained `useTranslations()` wiring (import + hook call + a handful of `t(\"key\")` call-sites replacing hardcoded English strings) as part of restoring i18n coverage — ComboHealthTab.tsx 1028->1031 (+3), cloud-agents/page.tsx 922->931 (+9), PoolWizard.tsx 1007->1022 (+15), EndpointPageClient.tsx 2612->2615 (+3), health/page.tsx 1091->1095 (+4), ProviderOnboardingWizard.tsx 912->948 (+36, largest — several previously-hardcoded wizard step labels/descriptions), PricingTab.tsx 1012->1017 (+5), ProxyRegistryManager.tsx 1461->1464 (+3), BudgetTab.tsx 1016->1028 (+12). All additions are literal `t(...)`/`tc(...)` call-site swaps for existing UI text, verified byte-identical in intent against the corresponding new `src/i18n/messages/{en,vi}.json` keys (see tests/unit/dashboard-localization-contract.test.ts, tests/unit/i18n-vi-completeness.test.ts, tests/unit/gamification-display-contract.test.ts, tests/unit/cli-catalog-display-contract.test.ts added by the same PR). Fast-gates PR->release do not run check:file-size, so this surfaced only during rebase-onto-tip reconciliation.",
-  "_rebaseline_2026_07_21_7908_chathelpers_abort_guard": "PR #7908 (insoln, don't cool down accounts or trip the breaker on client-side stream aborts, #7907) own growth: src/sse/handlers/chatHelpers.ts 876->877 (+1 = the single `isLocalStreamLifecycleError(failure?.message ?? failure)` clause added to executeChatWithBreaker's onStreamFailure connection-disable check, verified working by the existing #4602 test + the PR's own circuit-breaker-client-abort.test.ts, no regressions). Irreducible call-site wiring at the existing failure-classification chokepoint. Fast-gates PR->release do not run check:file-size, so this surfaced only during the /green-prs pre-merge pass.",
-  "_rebaseline_2026_07_21_7908_combo_breaker_abort_guard": "PR #7908 pre-green fix (green-prs pipeline): shouldRecordProviderBreakerFailure() (open-sse/services/combo/comboPredicates.ts, not frozen) gained an `error` field so a client-side stream abort no longer trips the whole-provider circuit breaker in the combo path (mirrors the connection-cooldown fix shouldSkipConnDisable() already applies for the same #4602/#7907 policy). Own growth: open-sse/services/combo.ts 3387->3388 (+1, irreducible call-site wiring — the single new `error: errorText,` field passed at the existing shouldRecordProviderBreakerFailure() call site inside handleComboChat's executeTarget). Covered by tests/unit/circuit-breaker-abort-provider-trip-7907.test.ts.",
-  "_rebaseline_2026_07_20_7818_provider_tier_field": "Issue #7818 (explicit tier override for any provider connection) own growth: EditConnectionModal.tsx 1285->1287 (+2 = import + a single <ProviderTierField .../> render call, mirroring the m365Tier.ts precedent). All actual selector logic (fetch/save against the new /api/settings/tier-config route) lives in the new leaf src/app/(dashboard)/dashboard/providers/[id]/components/modals/ProviderTierField.tsx + providerTierField.ts (both well under cap). Covered by tests/unit/tier-config-provider-override-route.test.ts and tests/unit/tier-resolver-provider-override.test.ts.",
-  "_rebaseline_2026_07_19_7546_ghe_copilot_route": "PR #7546 (GHE Copilot OAuth provider) own growth: oauth/[provider]/[action]/route.ts 960->963 (gate units, +3 = ghe-copilot device-code wiring at the existing multi-provider device-code branch — reading + HTTPS-validating the gheUrl search param (isValidGheUrl guards at both raw entry points, security-review hardening, 963->970), adding ghe-copilot to the no-PKCE provider set, and building the provider config override / threading gheUrl through poll->postExchange extraData). Mirrors the existing kiro/amazon-q startUrl override pattern right above it in the same branch; cohesive with the existing device-code dispatch chokepoint, not separately extractable without splitting a single provider-switch mid-branch. Frozen so can only shrink; structural shrink tracked in #3501.",
-  "_rebaseline_2026_07_19_6846_nvidia_concurrency_gate": "Issue #6846 Phase 1 (nvidia NIM local RPM budget + per-model lockout + per-connection concurrency cap) own growth: open-sse/executors/default.ts 877->890 (+13 = the irreducible call-site wiring at DefaultExecutor.execute(), the only place nvidia requests dispatch through — the existing session-pool body was extracted verbatim into a new private executeWithSessionPool() so the outer execute() can wrap it in the nvidia concurrency-gate acquire/finally-release). All actual gating logic (semaphore key + cap resolution) lives in the new leaf open-sse/executors/default/nvidiaConcurrencyGate.ts (not frozen, well under cap). Covered by tests/unit/nvidia-quota-phase1.test.ts.",
-  "_rebaseline_2026_07_18_v3849_provider_detail_wiring": "Merge campaign R2/R3 (2026-07-18): three authorized PRs each add irreducible call-site wiring to ProviderDetailPageClient.tsx — #7360 +5 (ProviderQuotaVisibilityToggle render, component extracted), #7419 +4 (NoAuthProviderControls wiring), #7062 +3 (Dahl provider hook) = 786->798. All three follow the extracted-component pattern (AgentrouterConsoleFields precedent); the frozen file only takes the wiring. Structural shrink tracked in #3501.",
-  "_rebaseline_2026_07_18_pr7653_chat_tracker_import": "PR #7653 merge-interaction growth: release moved chat.ts to its 1796 cap while this PR adds the single side-effect import 'quotaTrackersBatch.ts' (line 130) — chat.ts IS the canonical quota-fetcher registration point (codex/bailian/deepseek/openrouter/opencode/generic all import+register there), so the +1 is irreducible call-site wiring. 1796->1797. Covered by tests/unit/{agentrouter,v0,freemodel}-quota-fetcher.test.ts.",
-  "_rebaseline_2026_07_17_pr7653_agentrouter_console_fields": "PR #7653 own growth (missing acceptance criterion: the AgentRouter quota tracker (#6850) read providerSpecificData.consoleApiKey/newApiUserId but neither field had dashboard UI for provider agentrouter — consoleApiKey was gated to bailian-coding-plan only and newApiUserId had zero UI). AddApiKeyModal.tsx 961->967 (+6) and EditConnectionModal.tsx 1278->1286 (+8) = import + a single <AgentrouterConsoleFields .../> render call plus the newApiUserId formData init field. The actual Input rendering (both consoleApiKey reuse + the new newApiUserId field) was EXTRACTED into a new leaf src/app/(dashboard)/dashboard/providers/[id]/components/modals/AgentrouterConsoleFields.tsx (48 LOC, <cap), mirroring the QuotaScrapingFields.tsx / GlmTeamQuotaFields.tsx precedent (#6351) so the frozen modals only carry the irreducible call-site wiring. Persist logic lives in connectionProviderSpecificData.ts (not frozen). Covered by tests/unit/agentrouter-connection-modal-fields.test.ts.",
-  "_rebaseline_2026_07_17_v3849_6842_free_window_wiring": "PR #7651 (openrouter :free-window quota tracking) follow-up: the counter shipped built but never wired into the request pipeline, so combos kept spending guaranteed-429 requests on exhausted free-tier targets. Own growth: src/sse/services/auth.ts 2461->2462 (+1, irreducible at the existing model-aware preflight chokepoint — the `provider === \"codex\"` check that forwards requestedModel into the connection arg is extended to also cover `openrouter`, one added boolean + a doc comment, offset to a single net line by dropping the now-redundant inline condition). Enforcement itself lives in open-sse/services/openrouterQuotaFetcher.ts (not frozen) and the dispatch-time record/correct hooks live in open-sse/executors/base.ts (not frozen). Covered by tests/unit/openrouter-free-window-wiring-6842.test.ts.",
-  "_rebaseline_2026_07_17_v3849_ownerprs_media_audio": "Own-growth from the v3.8.49 owner-PR merge campaign (fast-gates PR->release do not run check:file-size, so this surfaced only on re-sync): src/app/api/usage/analytics/route.ts 942->948 (+6 = the 180d/365d getRangeStartIso cases from #7213 usage-extended-periods) and tests/unit/audio-transcription-handler.test.ts new testFrozen 824 (Gladia async STT test cases added by #7603). Both irreducible additions covered by their PR tests; structural shrink tracked in #3501.",
-  "_rebaseline_2026_07_14_7034_goog_api_key": "Issue #7034 (gemini-cli x-goog-api-key client auth) own growth: src/sse/services/auth.ts 2458->2461 (+3 = import + the two-line extractGoogApiKeyHeader() call/return at the existing extractApiKey() chokepoint, plus a 1-line doc-comment mention offset by a 1-line net save elsewhere in the same edit). The actual header-read/trim logic was EXTRACTED into a new leaf module src/sse/services/googApiKeyAuth.ts (shared by both extractApiKey() here and extractBearer() in src/server/authz/policies/clientApi.ts, which is not frozen) to keep this frozen file's growth to the irreducible call-site wiring. Covered by tests/unit/auth-extract-api-key.test.ts and tests/unit/authz/client-api-policy.test.ts.",
-  "_rebaseline_2026_07_14_6928_comfyui_baseurl_override": "Issue #6928 own growth: open-sse/handlers/videoGeneration.ts 1265->1275 (+10 = resolveComfyUiBaseUrl import + expanding the comfyui dispatch call into a multi-line object literal so the per-connection providerSpecificData.baseUrl override — same storage convention self-hosted chat providers use — is threaded through to handleComfyUIVideoGeneration; Prettier's 100-char width forces the multi-line form), src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts 1053->1054 (+1 = comfyui added to CONFIGURABLE_BASE_URL_PROVIDERS/DEFAULT_PROVIDER_BASE_URLS/getProviderBaseUrlPlaceholder so the Add/Edit connection modals render an editable base-URL field for ComfyUI, mirroring self-hosted chat providers). The identical dispatch pattern was also applied to imageGeneration.ts and musicGeneration.ts, both well under their frozen caps. Covered by tests/unit/comfyui-baseurl-override-6928.test.ts (resolver unit tests + handler-level fetch-mock overrides for image/video/music) and the new provider-page-helpers-3501.test.ts assertion.",
   "_rebaseline_2026_07_07_v3846_proxy_insecure_random": "PR #6580 (v3.8.46 post-release closing fix): proxies.ts 1173->1177 (+4) — o fix de segurança CodeQL #698/#699 troca Math.random por crypto.randomInt no random rotation strategy (#6365) e adiciona 4 linhas de comentário explicando por que (a seleção flui para credenciais do proxy). Crescimento irreducivel do proprio fix; frozen so encolhe daqui.",
   "_rebaseline_2026_07_07_v3846_release_close": "Release v3.8.46 Phase 0 (generate-release) — drift de ciclo absorvido no fechamento (fast-gates PR->release nao rodam check:file-size). PROD god-files crescidos por merges do ciclo (nao meus; DECOMPOR idealmente, debt #3501): proxies.ts 1060->1173, chat.ts 1681->1751, ApiManagerPageClient.tsx 3058->3120, ProxyRegistryManager.tsx 1125->1437 (feature de proxy). TEST frozen: models-catalog-route.test.ts 1600->1605 (+5 do fix#2 do captain, #6408 catalogo cache), vscode-token-routes.test.ts 1212->1285 (cycle drift + os asserts effort_tiers/supportsThinking do #6241 alinhados no release-PR-CI base-red), que adiciona o import + 2 chamadas do hook __resetCatalogBuilderRunsForTest existente no setup (harness, sem asserts). Shrink estrutural rastreado no roadmap #3501.",
   "_rebaseline_2026_07_04_v3844_release_close": "Release v3.8.44 Phase 0 (generate-release): drift de ciclo absorvido no fechamento, medido no tip 415d159c8 (fast-gates PR->release nao rodam check:file-size). oauth/[provider]/[action]/route.ts 924->960 (#6054 zed keychain-import 400 gracioso; PR #6158 aberto extrai o guard e restaura o freeze — quando mergear, o frozen so encolhe), providerLimits.ts 982->998 (#6139 TOCTOU quota recovery + #6128), chat.ts 1647->1662 (#6057 per-request Auto-Combo X-OmniRoute-Mode/Budget + #6097), auth.ts 2405->2426 (#6139 + #6090 quota preflight lockouts + #5943 codex session affinity). Crescimento irreducivel em chokepoints existentes, coberto por testes por-PR; shrink estrutural rastreado no roadmap #3501.",
@@ -101,7 +81,7 @@
   "_rebaseline_2026_06_18_qg9_chatcore_split_prB": "QG v2 Fase 9 T5 C6-C7: chatCore.ts 5265->5060 (shrink, stacked on prA #4188) — two pure, byte-identical extractions into open-sse/handlers/chatCore/. (1) comboContextCache.ts (<cap): the combo/upstream-proxy context caches — getCombosCached/clearCombosCache/getUpstreamProxyConfigCached/clearUpstreamProxyConfigCache plus their consts COMBOS_CACHE_TTL/PROXY_CONFIG_CACHE_TTL AND the two module-level cache Maps (_proxyConfigCache + the _combosPromise/_combosCacheTs/_combosCacheVersionSnapshot combos cache) moved WITH their accessor functions so each Map stays a single instance in one module (state cohesion — no double-state). clearCombosCache/clearUpstreamProxyConfigCache re-exported from chatCore.ts (combo-cache-invalidation + chatcore-translation-paths tests). (2) executorHelpers.ts (<cap): resolveAccountSemaphoreKey/resolveAccountSemaphoreAccountKey/resolveAccountSemaphoreMaxConcurrency + buildClaudePromptCacheLogMeta; the private toFiniteNumberOrNull helper (its only remaining caller was resolveAccountSemaphoreMaxConcurrency) moved with them rather than creating a barrel import. Orphaned imports dropped from chatCore.ts (buildAccountSemaphoreKey, getUpstreamProxyConfig). No re-export needed for the executor helpers (none were ever public). Pure move, no logic change.",
   "_rebaseline_2026_06_18_qg9_chatcore_split_prA": "QG v2 Fase 9 T5 C2-C3-C5: chatCore.ts 5445->5265 (wc -l 5264 + 1). Fase 2 of the chatCore split following #4159 (which created 10 leaf modules). Three more sibling leaves created under open-sse/handlers/chatCore/, all <cap, pure byte-identical moves (no runtime change): passthroughHelpers.ts (C2: shouldUseNativeCodexPassthrough/redactPassthroughThinkingSignatures/isClaudeCodeSemanticPassthroughRequest), responseHeaders.ts (C3: STREAMING_RESPONSE_HEADER_DENYLIST/buildStreamingResponseHeaders/materializeDeduplicatedExecutionResult/stripStaleForwardingHeaders), telemetryHelpers.ts (C5: forwardDashboardEventToLiveWs/maybeSyncClaudeExtraUsageState). chatCore.ts imports all 8 still-referenced symbols back from the leaves and re-exports the 5 previously-public ones (shouldUseNativeCodexPassthrough/redactPassthroughThinkingSignatures/isClaudeCodeSemanticPassthroughRequest/buildStreamingResponseHeaders/stripStaleForwardingHeaders) so existing test importers keep resolving. No barrel imports in the new leaves.",
   "_rebaseline_2026_06_18_4176_free_models": "PR #4176 own growth: AddApiKeyModal.tsx 845->866 (+21) and EditConnectionModal.tsx 1174->1204 (+30) = the 'import only free models' connection option — a free-models Toggle gated by providerHasFreeModels() plus its form-state wiring (importFreeModelsOnly field + providerSpecificData persistence, explicit-false on edit so the PUT merge doesn't keep a stale true) added to both connection modals, mirroring the prior per-modal toggle bumps #3879 (redact-thinking) and #2997 (disable-cooling). Detection lives in the new shared src/shared/utils/freeModels.ts (112 LOC, <cap); the duplicated Toggle is ~6 lines and the per-modal state wiring is intrinsic, so the remaining growth is cohesive UI, not an extractable block.",
-  "_rebaseline_2026_06_18_3931_qwen_web_models": "Issue #3931 (Problem #3) own growth: providers/[id]/models/route.ts 2512->2531 (+19 = one PROVIDER_MODELS_CONFIG entry for `qwen-web` + a 4-line comment). qwen-web was missing from the config map so its model-discovery page returned nothing. Pure additive config entry pointing at the public chat.qwen.ai/api/v2/models endpoint; standard per-provider addition, not extractable.",
+  "_rebaseline_2026_06_18_3931_qwen_web_models": "Issue #3931 (Problem #3) own growth: providers/[id]/models/route.ts 2512->2531 (+19 = one PROVIDER_MODELS_CONFIG entry for `qwen-web` + a 4-line comment). qwen-web was missing from the config map so its model-discovery page returned nothing (the OAuth fallback only fires for provider===qwen). Pure additive config entry pointing at the public chat.qwen.ai/api/v2/models endpoint; standard per-provider addition, not extractable.",
   "_rebaseline_2026_06_18_4165_queue_timeout_msg": "Issue #4165 own growth: rateLimitManager.ts 1022->1035 (+13 at the existing withRateLimit catch chokepoint). Bottleneck's raw `This job timed out after <maxWaitMs> ms.` is rewritten into a clear OmniRoute-owned error (names resilienceSettings.requestQueue.maxWaitMs, disclaims upstream, keeps the original as `cause`, tags code=RATE_LIMIT_QUEUE_TIMEOUT) so queue-saturation 502s stop masquerading as provider outages. The branch already existed (it only logged); this adds the error construction at the same point. Not extractable — closes over provider/model/maxWaitMs locals of the single catch.",
   "_rebaseline_2026_06_18_qg9_combo_split_d4": "QG v2 Fase 9 T5 D4: combo.ts 4740->4589 — shadow routing extracted byte-identically to the new open-sse/services/combo/shadowRouting.ts (<cap, normalizeShadowRoutingConfig/resolveShadowTargets/drainShadowResponse/withTimeout/cloneRequestBodyForShadowRouting/scheduleShadowRouting). The shared isRecord guard moved to the new combo/comboData.ts leaf (<cap) so submodules can use it without importing the barrel. resolveShadowTargets/scheduleShadowRouting re-exported from combo.ts for compatibility (handleComboChat/handleRoundRobinCombo callers unchanged). Pure move, no logic change.",
   "_rebaseline_2026_06_18_qg9_combo_split_d5": "QG v2 Fase 9 T5 D5: combo.ts 4589->4430 — target sorters extracted byte-identically to the new open-sse/services/combo/targetSorters.ts (<cap, normalizeModelEntry/selectWeightedTarget/orderTargetsForWeightedFallback/sortModelsByCost/sortTargetsByCost/sortModelsByUsage/sortTargetsByUsage/getP2CTargetScore/orderTargetsByPowerOfTwoChoices). None were ever public, so combo.ts imports back only the six still called by code that stays (no re-export). getComboStepTarget/getComboStepWeight imports dropped from combo.ts (only normalizeModelEntry used them). Pure move, no logic change.",
@@ -156,55 +136,206 @@
   "_rebaseline_2026_06_20_1449_1444_test_route": "Re-baseline providers test route.ts 842->887: combined growth of sibling fixes #1449 (bound OAuth connection-test probe with a timeout) + #1444 (label a deactivated account distinctly from a revoked token), both at the same connection-test chokepoint. Cohesive route handler; not extractable without hiding the test flow.",
   "_rebaseline_2026_06_20_1409_1294_models": "Re-baseline src/lib/db/models.ts 1184->1221: combined growth of sibling fixes #1409 (cascade-delete orphaned model aliases when a provider is removed) + #1294 (persist max_input_tokens/max_output_tokens on custom models), both adding CRUD at the existing models domain module. Cohesive db module; not extractable.",
   "_rebaseline_2026_06_20_4389_thinking_toolchoice": "Re-baseline base.ts 1387->1399 (#4389): tool_choice-forced thinking guard at the existing Claude wire-image injection chokepoint (effThinking gate avoids the Anthropic 400 when tool_choice forces a tool). Cohesive guard; structural shrink tracked in #3501.",
-  "_rebaseline_2026_07_18_6979_codex_test": "PR #6979 own growth: executor-codex.test.ts 1340->1347 (+7 = generalized ensureThinkingBudget assertion added to the existing codex thinking-budget cases). antigravity-test bump 942->977 REVERTED here: #7408's test split dropped that file to 888, so this PR's +35 fits under the original 942 frozen cap.",
-  "_rebaseline_2026_07_24_8354_logs_timeline_sidebar": "PR #8354 (hartmark, feature/scrolling-log) own growth: src/shared/constants/sidebarVisibility/sections.ts 812->820 (+8, the single new logs-timeline SidebarItemDefinition entry added to LOGS_GROUP.items for the new /dashboard/logs/timeline scrolling request-timeline page). Irreducible data-literal wiring at the existing sidebar-sections chokepoint, same shape as every other item in the file; not extractable without an ad-hoc single-item exception to the file's otherwise-uniform multi-line item style.",
-  "cap": 1000,
-  "testCap": 1000,
+  "cap": 800,
+  "frozen": {
+    "_rebaseline_2026_07_02_5816_qoder": "PR #5816 (@AgentKiller45, qoder PAT via qodercli): qoderCli.ts 666->989, new-above-cap frozen (owner-approved baseline freeze). The growth is the legitimate PAT job-token exchange + quota parsing CLI transport (the pure-JS Cosy path 500'd on every PAT request); extracting the spawn/parse helpers now would just add indirection to a contributor PR mid-merge. Test frozen also raised for this PR's coverage growth: providers-page-utils.test.ts 1052->1092. Additionally clears an inherited base-red from the already-merged #5933 (codex json_schema->text.format): translator-openai-responses-req.test.ts 1097->1172 (+75 regression tests, no offending branch left). All remain frozen (cannot grow further); release captain's rebaseline-at-release supersedes.",
+    "open-sse/services/qoderCli.ts": 989,
+    "_rebaseline_pr1043_minimax_tts": "Upstream port decolua/9router#1043 (toanalien) own growth: audioSpeech.ts 965->1061 (+96). Adds MiniMax T2A v2 TTS dispatch (handleMinimaxSpeech + hexToBytes helper) — provider entry was already in audioRegistry (format: minimax-tts) but no handler existed, falling through to the OpenAI-compatible default that fails (T2A has custom shape + hex-encoded audio + base_resp envelope). New branch sits next to the other inline provider branches (xiaomi-mimo, coqui, tortoise, aws-polly) — extracting would just create indirection. Covered by tests/unit/minimax-tts-1043.test.ts (3 tests, GREEN: success, base_resp error, invalid-hex).",
+    "open-sse/config/providerRegistry.ts": 4731,
+    "open-sse/executors/antigravity.ts": 1813,
+    "open-sse/executors/base.ts": 1540,
+    "open-sse/executors/chatgpt-web.ts": 3206,
+    "open-sse/executors/claude-web.ts": 1057,
+    "open-sse/executors/codex.ts": 1541,
+    "open-sse/executors/cursor.ts": 1577,
+    "open-sse/executors/deepseek-web.ts": 1148,
+    "_rebaseline_2026_06_22_4644_deepseek_web_tools": "PR #4644 (BugsBag/robust deepseek-web tool-call parsing): open-sse/executors/deepseek-web.ts 1117->1125 (+8). The new agentic tool-call path emits surrounding text + reasoning before tool_calls and swaps to the dedicated deepseekWebTools.ts parser; the +8 lines are cohesive wiring at the existing transformSSE chokepoint (the parser itself lives in the new deepseekWebTools.ts file, already under cap). The PR's own fast-gate (PR->release) does not run check:file-size, so this surfaced only at release reconcile. Covered by tests/unit/deepseek-web-tools-variants.test.ts + deepseek-web-tools-execute.test.ts.",
+    "_rebaseline_2026_06_23_4712_deepseek_web_tool_results": "PR for #4712 (deepseek-web drops role:tool): open-sse/executors/deepseek-web.ts 1125->1148 (+23). messagesToPrompt() now folds role:\"tool\" results into the single-prompt transcript (recovering the tool name from the preceding assistant tool_calls by tool_call_id) instead of silently dropping them; the lines are cohesive wiring inside the existing function. Covered by tests/unit/deepseek-web-tool-result-prompt-4712.test.ts.",
+    "_rebaseline_2026_06_28_5237_impersonation_ua_refresh": "PR #5237 (refresh impersonation UAs): grok-web.ts 1871->1873 (+2), muse-spark-web.ts 1284->1302 (+18), perplexity-web.ts 1013->1032 (+19). Net semantic change in each file is a single User-Agent constant (Chrome 147->149 for grok/muse; perplexity kept at Firefox 148 to stay matched with the firefox_148 TLS profile — the contributor's 152 bump was reverted to avoid a UA-vs-JA3 mismatch, #2459). The growth is Prettier reflow that lint-staged unavoidably applies to these grandfathered long-line files the moment they are touched; not extractable. src/sse/services/auth.ts 2336->2401 in the same reconcile is #5222's antigravity-LRU-retry growth that merged via --admin without a baseline bump.",
+    "open-sse/executors/duckduckgo-web.ts": 925,
+    "open-sse/executors/grok-web.ts": 1873,
+    "open-sse/executors/muse-spark-web.ts": 1302,
+    "open-sse/executors/perplexity-web.ts": 1032,
+    "open-sse/handlers/audioSpeech.ts": 1061,
+    "open-sse/handlers/chatCore.ts": 5125,
+    "open-sse/handlers/imageGeneration.ts": 3777,
+    "open-sse/handlers/responseSanitizer.ts": 1139,
+    "open-sse/handlers/search.ts": 1546,
+    "open-sse/handlers/sseParser.ts": 830,
+    "open-sse/handlers/videoGeneration.ts": 1265,
+    "open-sse/mcp-server/schemas/tools.ts": 1497,
+    "open-sse/mcp-server/server.ts": 1555,
+    "open-sse/mcp-server/tools/advancedTools.ts": 1120,
+    "_rebaseline_2026_06_27_5193_antigravity_basered": "Base-red (pre-existing release drift, fast-gate PR->release skips check:file-size): accountFallback.ts 1773->1777 and src/app/api/providers/[id]/test/route.ts 924->940 were already over their frozen caps on release/v3.8.39 independent of any antigravity change. Owner chose to rebaseline (keep the documented issue-reference comments #1846/#1449/#347 etc.) rather than accept the contributor comment-stripping in #5200/#5198. Reverted #5200 to restore the comments; bumped these two frozen caps to the actual base sizes. No logic change.",
+    "open-sse/services/accountFallback.ts": 1864,
+    "open-sse/services/batchProcessor.ts": 915,
+    "open-sse/services/browserBackedChat.ts": 850,
+    "open-sse/services/claudeCodeCompatible.ts": 1202,
+    "_rebaseline_pr4592_exclude_exhausted_auto": "Reconcile #4592 already-merged growth: combo.ts 2991->3036 (+45, terminal-status quota-cutoff exclusion in buildAutoCandidates + opt-in gate). Fast-gate PR->release does not run check:file-size.",
+    "_rebaseline_2026_06_24_headroom_strategy": "Headroom-aware connection selection (dario technique): combo.ts 3168->3180 (+12 = a new `else if (strategy === \"headroom\")` dispatch branch in handleComboChat that delegates to orderTargetsByHeadroom + its log line, plus the import). The actual logic lives OUT of the god-file: the pure ranker rankByHeadroom/computeHeadroom is the new leaf open-sse/services/combo/headroomRanking.ts (91 LOC, <cap) and the async orderer orderTargetsByHeadroom is appended to the existing open-sse/services/combo/quotaStrategies.ts (<cap) next to its sibling reset-aware/reset-window orderers (reuses their connection-expansion machinery). headroom = 1 - max(util_5h, util_7d) from getSaturation (src/lib/quota/saturationSignals.ts), prefers the connection with the most free capacity. Only the dispatch wiring is irreducible at the existing combo strategy chokepoint (mirrors the reset-aware/reset-window/context-optimized branches); not extractable without hiding the call site. fill-first stays default; all existing strategies untouched. Covered by tests/unit/combo-headroom-ranking.test.ts (pure helper) + tests/unit/combo-headroom-strategy.test.ts (orderer, saturation injected). Structural shrink of combo.ts tracked in #3501.",
+    "_rebaseline_2026_06_24_quota_share_strategy": "Dedicated quota-share strategy (Phase 3 #9): combo.ts 3180->3190 (+10 = one new `else if (strategy === \"quota-share\")` dispatch branch in handleComboChat that delegates 100% to selectQuotaShareTarget + its log line, plus the import). All the new logic lives OUT of the god-file in two new leaves under open-sse/services/combo/: quotaShareInflight.ts (in-flight counter with TTL/lease, ~150 LOC <cap) and quotaShareStrategy.ts (per-model bucket gating via isBucketSaturated + DRR proportional to weight + P2C over in-flight, ~240 LOC <cap). Only the dispatch wiring is irreducible at the existing combo strategy chokepoint (mirrors the headroom/reset-aware/reset-window/context-optimized branches); not extractable without hiding the call site. ZERO existing strategy cases were modified — only this branch was added, and the qtSd/ combos switched from fill-first to quota-share in src/lib/quota/quotaCombos.ts. Covered by tests/unit/quota-share-strategy.test.ts (gating, DRR fairness, P2C in-flight, fail-open, activation). Structural shrink of combo.ts tracked in #3501.",
+    "_rebaseline_2026_06_24_task_aware_routing": "Task-aware routing strategy (port PR #2045, OmniRoute #4945): combo.ts 3190->3225 (+35) = one new `else if (strategy === \"task-aware\")` dispatch branch delegating 100% to selectTaskAwareTarget + its imports/log lines. All scoring/classification logic lives OUT of the god-file in the new leaf open-sse/services/taskAwareRouting.ts (553 LOC <cap). Only the dispatch wiring is irreducible at the existing combo strategy chokepoint (mirrors quota-share/headroom/reset-aware branches). ZERO existing strategy cases modified. Covered by tests/unit/combo-task-aware.test.ts (35 tests). Structural shrink of combo.ts tracked in #3501.",
+    "open-sse/services/combo.ts": 3387,
+    "_rebaseline_2026_06_26_fidelity_gate_extraction": "Milestone-B fidelity-gate wiring residual: bodyToText+gateAdvance extracted to fidelityGateStep.ts (889->854, -35), but the StackOptions.fidelityGate field, the `const fidelityGate` reads at the two stacked-loop dispatch chokepoints, and the import of FidelityGateConfig are irreducible wiring that cannot leave strategySelector without an architectural refactor of the pre-existing stacked pipeline. Net: 889->854 (+6 vs the pre-Milestone-B frozen 848). Covered by tests/unit/compression/*.test.ts (940 pass).",
+    "_rebaseline_2026_06_28_5243_risk_gate_prepass": "PR #5243 (compression risk-gate pre-pass) own growth: open-sse/services/compression/strategySelector.ts 854->899 (+45). The three exported entry points (applyCompression/applyStackedCompression/applyStackedCompressionAsync) become thin wrappers over pure-extracted private bodies (runCompression/runStackedCompression/runStackedCompressionAsync) so the risk-gate mask->run->restore wrapper sits strictly OUTSIDE the per-step loop — a single universal integration point. The wrapper logic itself (resolveRiskGate/withRiskGate) lives in the new riskGate/strategyWrap.ts (<cap); the residual growth is the duplicated thin-wrapper signatures + the extracted bodies' dispatch boundary, guarded by a byte-identical parity test (riskGateIntegration). Default off (DEFAULT_COMPRESSION_CONFIG unchanged). Not extractable without hiding the dispatch boundary, mirroring prior compression rebaselines. Structural shrink tracked in #3501.",
+    "_rebaseline_2026_06_29_5286_memoization": "PR #5286 own growth: strategySelector.ts 899->960 (+61 = the opt-in result-memoization branches in applyCompression/applyCompressionAsync — principal+determinism gate, makeMemoKey lookup/store with model+supportsVision folded into the key, recompute-with-memo-off). Default off (memoizeCompressionResults), so zero behavior change. The memo helpers live in the leaf resultMemo.ts (<cap); the chokepoint wiring here is not extractable. Structural shrink of this hot-path file tracked in #3501.",
+    "open-sse/services/compression/strategySelector.ts": 1043,
+    "_rebaseline_2026_07_10_gcf_v3_2_decode": "PR #6838 own growth: new vendored file open-sse/services/compression/engines/headroom/gcf/decode_generic.ts frozen at 880 (> 800 cap). It is the vendored GCF generic-profile decoder (spec v3.2 nested flattening plus the prototype-pollution / hasOwnProperty hardening added in this PR's Gemini review). Kept as one file faithful to upstream gcf-typescript so re-vendoring stays a clean copy rather than a re-split each cycle (sibling generic.ts/scalar.ts stay < cap; extraction would also fragment the file's frozen eslint no-explicit-any suppressions). Round-trip + prototype-pollution regression coverage in tests/unit/compression/headroom-smartcrusher.test.ts. Frozen: only shrinks from here.",
+    "open-sse/services/compression/engines/headroom/gcf/decode_generic.ts": 880,
+    "open-sse/services/rateLimitManager.ts": 1035,
+    "_rebaseline_2026_06_29_4038_cas_guard": "PR (#4038) own growth: tokenRefresh.ts 2103->2181 (+78 = the compare-and-swap guard on the refresh persist — runWithCasGuard/getActiveCasGuard AsyncLocalStorage pair mirroring runWithOnPersist, casGuardShouldSkipPersist that rereads the row right before persisting and skips the write when a concurrent writer already rotated the refresh_token past the one presented, plus getCasGuardStats counters). Fixes the sibling-rotation-revert → token-family-revocation storm. Gated behind an active guard (opt-in; no guard => byte-identical). Wiring lives at the two persist chokepoints inside getAccessToken; the comparison reuses wasRefreshTokenRotated from refreshSerializer. Not extractable without splitting the refresh hot path.",
+    "_rebaseline_2026_07_09_6126_clinepass_dual_auth": "PR #6126 (@hajilok, dual-auth ClinePass) own growth: tokenRefresh.ts 2181->2182 (+1 = a single `case \"clinepass\":` fallthrough label added to the existing `case \"cline\":` in _getAccessTokenInternal's provider switch, so clinepass token refresh dispatches to the already-shared refreshClineToken() instead of silently falling through to the generic OAuth refresh). Irreducible 1-line switch-case wiring at the existing chokepoint; the header-building logic for the same feature was extracted to a new leaf src/shared/utils/clineAuth.ts::buildClinepassHeaders() (well under cap) to avoid growing open-sse/executors/default.ts. Covered by tests/unit/clinepass-provider.test.ts.",
+    "_rebaseline_2026_07_09_6363_kiro_external_idp": "PR #6363 (@artickc, Kiro external IdP) own growth: tokenRefresh.ts 2182->2249 (+67 = the external_idp refresh branch inside refreshKiroToken — standard public-client OAuth2 refresh_token grant against the org IdP tokenEndpoint via buildExternalIdpRefreshParams/isExternalIdpAuthMethod from the new leaf open-sse/services/kiroExternalIdp.ts, with invalid_grant/invalid_client -> unrecoverable_refresh_error mapping). Cohesive addition at the existing refreshKiroToken chokepoint. Covered by tests/unit/kiro-external-idp.test.ts.",
+    "open-sse/services/tokenRefresh.ts": 2249,
+    "open-sse/services/usage.ts": 3454,
+    "open-sse/translator/request/openai-to-gemini.ts": 906,
+    "open-sse/translator/request/openai-to-kiro.ts": 912,
+    "open-sse/translator/response/openai-responses.ts": 1092,
+    "open-sse/utils/cursorAgentProtobuf.ts": 1521,
+    "open-sse/utils/stream.ts": 2796,
+    "src/app/(dashboard)/dashboard/HomePageClient.tsx": 1385,
+    "src/app/(dashboard)/dashboard/analytics/ComboHealthTab.tsx": 1028,
+    "src/app/(dashboard)/dashboard/api-manager/ApiManagerPageClient.tsx": 3120,
+    "src/app/(dashboard)/dashboard/cache/media/MediaPageClient.tsx": 1105,
+    "src/app/(dashboard)/dashboard/cache/page.tsx": 845,
+    "src/app/(dashboard)/dashboard/cli-code/components/CodexToolCard.tsx": 900,
+    "src/app/(dashboard)/dashboard/cloud-agents/page.tsx": 922,
+    "src/app/(dashboard)/dashboard/combos/page.tsx": 4655,
+    "src/app/(dashboard)/dashboard/costs/CostOverviewTab.tsx": 1495,
+    "src/app/(dashboard)/dashboard/costs/quota-share/components/PoolWizard.tsx": 1007,
+    "src/app/(dashboard)/dashboard/endpoint/EndpointPageClient.tsx": 2612,
+    "src/app/(dashboard)/dashboard/health/page.tsx": 1091,
+    "src/app/(dashboard)/dashboard/playground/components/tabs/ApiTab.tsx": 847,
+    "src/app/(dashboard)/dashboard/providers/[id]/ProviderDetailPageClient.tsx": 786,
+    "src/app/(dashboard)/dashboard/providers/[id]/components/ConnectionRow.tsx": 942,
+    "src/app/(dashboard)/dashboard/providers/[id]/components/modals/AddApiKeyModal.tsx": 961,
+    "src/app/(dashboard)/dashboard/providers/[id]/components/modals/EditConnectionModal.tsx": 1278,
+    "src/app/(dashboard)/dashboard/providers/[id]/hooks/useProviderConnections.ts": 954,
+    "src/app/(dashboard)/dashboard/providers/[id]/hooks/useProviderModels.ts": 155,
+    "src/app/(dashboard)/dashboard/providers/[id]/hooks/useProviderSettings.ts": 264,
+    "src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts": 1053,
+    "src/app/(dashboard)/dashboard/providers/components/onboarding/ProviderOnboardingWizard.tsx": 912,
+    "src/app/(dashboard)/dashboard/providers/page.tsx": 1927,
+    "src/app/(dashboard)/dashboard/runtime/RuntimePageClient.tsx": 1201,
+    "src/app/(dashboard)/dashboard/settings/components/AppearanceTab.tsx": 819,
+    "src/app/(dashboard)/dashboard/settings/components/ComboDefaultsTab.tsx": 884,
+    "src/app/(dashboard)/dashboard/settings/components/CompressionSettingsTab.tsx": 974,
+    "src/app/(dashboard)/dashboard/settings/components/MemorySkillsTab.tsx": 898,
+    "src/app/(dashboard)/dashboard/settings/components/PricingTab.tsx": 1012,
+    "src/app/(dashboard)/dashboard/settings/components/ProxyRegistryManager.tsx": 1461,
+    "src/app/(dashboard)/dashboard/settings/components/ResilienceTab.tsx": 1183,
+    "src/app/(dashboard)/dashboard/settings/components/RoutingTab.tsx": 1629,
+    "src/app/(dashboard)/dashboard/settings/components/SystemStorageTab.tsx": 1924,
+    "src/app/(dashboard)/dashboard/usage/components/BudgetTab.tsx": 1016,
+    "src/app/(dashboard)/dashboard/usage/components/EvalsTab.tsx": 2148,
+    "src/app/(dashboard)/dashboard/usage/components/ProviderLimits/index.tsx": 1127,
+    "src/app/api/oauth/[provider]/[action]/route.ts": 960,
+    "src/app/api/providers/[id]/models/route.ts": 2593,
+    "src/app/api/providers/[id]/test/route.ts": 940,
+    "src/app/api/usage/analytics/route.ts": 942,
+    "src/app/api/v1/models/catalog.ts": 1615,
+    "src/lib/cloudflaredTunnel.ts": 934,
+    "src/lib/db/apiKeys.ts": 1662,
+    "src/lib/db/core.ts": 1825,
+    "src/lib/db/migrationRunner.ts": 1125,
+    "src/lib/db/models.ts": 1259,
+    "src/lib/db/providers.ts": 1107,
+    "src/lib/db/proxies.ts": 1177,
+    "src/lib/db/settings.ts": 1155,
+    "src/lib/db/usageAnalytics.ts": 925,
+    "src/lib/evals/evalRunner.ts": 961,
+    "src/lib/memory/retrieval.ts": 1171,
+    "src/lib/modelsDevSync.ts": 934,
+    "src/lib/providers/validation.ts": 4523,
+    "src/lib/resilience/settings.ts": 841,
+    "src/lib/tailscaleTunnel.ts": 1202,
+    "src/lib/usage/callLogs.ts": 997,
+    "src/lib/usage/providerLimits.ts": 1000,
+    "src/lib/usage/usageHistory.ts": 988,
+    "_rebaseline_2026_06_27_5193_5203_antigravity_oauthmodal": "Antigravity remote-login own growth: OAuthModal.tsx 960->969 (gate units). #5193 (+~4: remote paste instruction shown for all remote incl. Google + its rationale comment) and #5203 (+~5: handleManualSubmit credential-blob branch + button guard; submit logic extracted to oauthBlobSubmit.ts to minimize). Frozen set to the SUM so either merge order passes. Cohesive at the existing manual-submit chokepoint.",
+    "src/shared/components/OAuthModal.tsx": 993,
+    "src/shared/components/RequestLoggerV2.tsx": 1629,
+    "src/shared/components/analytics/charts.tsx": 1558,
+    "_rebaseline_2026_07_10_6318_omp_letta": "PR #6318 (@hamsa0x7, omp+letta CLI integrations) own growth: cliTools.ts (+53 = 2 registry entries incl. omp docsUrl) and cliRuntime.ts (+18 = runtime-detection wiring for the 2 new tools). Cohesive registry/wiring growth at the existing chokepoints; scope reduced from the original 5 tools (pi/codewhale/jcode shipped separately).",
+    "src/shared/constants/cliTools.ts": 916,
+    "src/shared/constants/pricing.ts": 1662,
+    "src/shared/constants/providers.ts": 3276,
+    "src/shared/constants/sidebarVisibility.ts": 1198,
+    "src/shared/services/cliRuntime.ts": 1128,
+    "src/shared/validation/schemas.ts": 2523,
+    "_rebaseline_2026_06_28_5275_correlation_id_extract": "Extraction of the safe CorrelationId subset of #5275 (hartmark) — request correlation id stored in call_logs (migration 109) and returned via the X-Correlation-Id response header, WITHOUT the combo/resilience or build/lazy-loading changes (those stay in #5275). Own growth: callLogs.ts 975->985 (correlation_id column on CallLogSummaryRow + read/map), usageHistory.ts 983->988 (correlationId metadata normalize), chat.ts 1575->1632 (withCorrelationId response wiring + combo-failure log carrying correlationId), chatHelpers.ts new 811 (withCorrelationId helper + reqId threading; was 791<cap pre-feature). Cohesive request/logging chokepoint wiring; structural shrink of chat.ts tracked in #3501.",
+    "_rebaseline_2026_07_09_6678_routing_strategy_9router": "#6678 (SeaXen) — 9router-parity Routing Strategy settings card + per-provider/combo sticky-round-robin override. Own growth: ProviderDetailPageClient.tsx 784->786 (single ProviderAccountRoutingCard mount + import), auth.ts 2448->2458 (providerStrategies override resolution: fallbackStrategy/stickyRoundRobinLimit per-provider cascade in getProviderCredentials). Both additive, zero unrelated refactor; new UI/logic lives in new files (ProviderAccountRoutingCard.tsx, RoutingStrategyCard.tsx, rrState.ts::resolveComboStickyRoundRobinLimit). chat.ts value below reflects the current release tip (grown by other concurrent PRs, e.g. #6640), not this PR own change.",
+    "src/sse/handlers/chat.ts": 1796,
+    "src/sse/handlers/chatHelpers.ts": 876,
+    "src/sse/services/auth.ts": 2458,
+    "open-sse/executors/default.ts": 877,
+    "open-sse/translator/request/openai-responses.ts": 902,
+    "open-sse/executors/kiro.ts": 944,
+    "open-sse/translator/request/openai-to-claude.ts": 823,
+    "tests/unit/account-fallback-service.test.ts": 1572,
+    "tests/unit/provider-validation-specialty.test.ts": 2980,
+    "open-sse/executors/huggingchat.ts": 813,
+    "_rebaseline_2026_07_01_v3843_release_5609": "Rebaseline v3.8.43 (PR #5609 release reconciliation). DRIFT dos 109 commits do ciclo: 8 god-files existentes cresceram (ApiManagerPageClient 2983->3017, combos/page 4594->4608, AddApiKeyModal 868->869, providerPageHelpers 974->996, chat.ts 1635->1647, auth.ts 2401->2403, batchProcessor 828->915, combo.ts 3368->3387) + 2 novos acima do cap (huggingchat.ts 813, tests web-cookie-providers-new 827) + 4 test files cresceram. Modularizacao deferida (blast-radius mid-release); congelado no estado atual p/ o proximo ciclo ratchetar daqui.",
+    "src/lib/providers/validation/webProvidersA.ts": 809,
+    "src/lib/tokenHealthCheck.ts": 832,
+    "_rebaseline_2026_07_09_6587_kiro_api_key_auth": "PR #6587 (@strangersp) own growth for Kiro long-lived API-key auth, merged onto v3.8.47 tip: openai-to-kiro.ts 890->912 (+22, auth-header selection for API-key-vs-OAuth-token connections), providerLimits.ts 998->1000 (+2, API-key auth-type branch), translator-openai-to-kiro.test.ts 1234->1257 (+23), providers-page-utils.test.ts 1109->1107 (net -2 after merging with parallel release drift; connectionMatchesProviderCard api_key coverage added), provider-validation-specialty.test.ts 2856->2980 (+124 net after merge with parallel release drift; this PR also removed the file's `@typescript-eslint/no-explicit-any` eslint-suppression entry by fixing all `any` usages, adding typed replacements). Cohesive additive feature growth, well tested; not extractable without splitting the existing chokepoints mid-merge.",
+    "src/lib/localDb.ts": 805,
+    "_rebaseline_2026_07_12_v3847_mergeprs_tail": "v3.8.47 /merge-prs tail (owner-approved): src/lib/localDb.ts NEW>800 (799->805, +6 re-exports countFreeProxies + recordFreeProxySyncErrors/clearFreeProxySyncErrors/getFreeProxySyncErrors + FreeProxySyncErrors type for #6909 free-pool relay-repair; re-export-only per Hard Rule #2, not extractable)."
+  },
+  "testCap": 800,
   "testFrozen": {
+    "_rebaseline_2026_07_09_6126_clinepass_dualauth": "#6126 (ClinePass dual-auth) own test growth: oauth-providers-config.test.ts 842->845 (+3: clinepass key/config/required-fields entries reusing the Cline WorkOS flow config, needed after registering clinepass in the oauth.ts PROVIDERS enum).",
     "_rebaseline_2026_06_27_5193_antigravity_test": "#5193 own test growth: oauth-providers-config.test.ts 870->873 (+3: antigravity projectId assertion + 50ms tick for the now fire-and-forget onboarding, matching the no-PKCE/no-openid flow).",
     "_rebaseline_2026_07_02_5928_base_red": "web-cookie-providers-new.test.ts 845->850: #5928 (test(security) Kimi Web URL host parse, CodeQL #689) grew the file +5 lines and merged into release/v3.8.44 WITHOUT rebaselining, leaving a fast-gates base-red that blocked every subsequent PR->release. Test growth is legitimate (a security regression test); maintainer absorbs the drift here. Frozen at 850.",
-    "_rebaseline_2026_07_09_6126_clinepass_dualauth": "#6126 (ClinePass dual-auth) own test growth: oauth-providers-config.test.ts 842->845 (+3: clinepass key/config/required-fields entries reusing the Cline WorkOS flow config, needed after registering clinepass in the oauth.ts PROVIDERS enum).",
-    "_rebaseline_2026_07_12_v3847_mergeprs_tail": "v3.8.47 /merge-prs tail: translator-openai-responses-req.test.ts 1172->1195 (+23 = #6807 reasoning-summary-for-effort-only regression tests). Frozen only shrinks.",
-    "_rebaseline_2026_07_22_8056_headroom_minrows": "#8056 (@RaviTharuma, persist Headroom minRows) own growth: src/lib/db/compression.ts 850->866 (+16 HeadroomConfig+DEFAULT_HEADROOM_CONFIG+normalize/store in get/updateCompressionSettings) and open-sse/services/compression/strategySelector.ts 1054->1060 (+6 merge settings.headroom into stacked stepConfig). Cohesive settings-persistence + stacked-merge wiring at existing chokepoints, frozen at new size.",
-    "_rebaseline_2026_07_22_8123_agy_live_model_sync": "#8123 (safeer/@adevwithpurpose) own test growth: provider-models-route.test.ts 1757->1783 (+26) — live AGY model discovery assertions (isDiscoverableAgyModelId + filterUserCallableAntigravityModels), composing with the #8013 fusion's antigravity discovery rewrite.",
-    "_rebaseline_2026_07_22_8213_combo_config_cooldown_wait_tests": "PR #8213 (hartmark, fix/gemini-tpm-quota-cooldown-wait) own growth: tests/unit/combo-config.test.ts 880->940 (+60, entirely this PR's diff — testFrozen add covering isComboCooldownWaitEligible (gating cooldown-wait to auto/quota-share strategies with the feature enabled) and resolveComboTargetTimeoutMsForCombo (raising the per-target timeout floor to cover the cooldown-wait budget + buffer for eligible strategies, fixing the 120s default cutting off a 130s wait early and returning a synthetic 524)). Covered by the new assertions themselves.",
-    "_rebaseline_2026_07_23_8122_codex_image_edits": "#8122 (@xiaoyaner0201) own growth: tests/unit/image-generation-handler.test.ts 2019->2029 (+10) — new coverage for Codex reference image edits (POST /v1/images/edits) plus the sanitizeImageProviderError/redactSensitiveErrorText hardening it introduces. Test-only growth at the existing handler test file.",
-    "_rebaseline_2026_07_25_8510_adobe_firefly_reference_images_tests": "#8510 (artickc, feat/adobe-firefly-reference-images) own test growth: tests/unit/adobe-firefly.test.ts 711->871 (+159, entirely this PR's diff — new referenceBlobs upload/dispatch coverage for handleAdobeFireflyImageGeneration, resolveAdobeSourceImageIds, and the storage-upload wire contract). Route-level /v1/images/edits coverage (credentials/rate-limit/4-ref-cap branches added to route.ts) lives in the new tests/unit/8510-adobe-firefly-edits-route.test.ts instead of growing this file further.",
     "_rebaseline_basered_codebuddy_cn": "Base-red fix (#4664 CodeBuddy CN): oauth-providers-config.test.ts 867->870 (+3) to align the EXPECTED provider list/config with the codebuddy-cn provider that #4664 added to the registry without updating this test (it asserts 'exactly once').",
+    "_rebaseline_pr4561_qwen_oauth_url": "Reconcile #4561 (port decolua/9router#683) already-merged growth: oauth-providers-config.test.ts 855->867 (+12, qwen.ai URL regression-pin test). Fast-gate PR->release does not run check:file-size, so this surfaced post-merge.",
     "_rebaseline_pr4613_compatible_provider_groups": "Reconcile #4613 already-merged growth: providers-page-utils.test.ts 1004->1052 (+48, buildCompatibleProviderGroups partition unit test). Fast-gate PR->release does not run check:file-size, so this surfaced post-merge.",
-    "tests/integration/chat-pipeline.test.ts": 1592,
-    "tests/integration/chatcore-compression-integration.test.ts": 1114,
-    "tests/unit/account-fallback-service.test.ts": 1563,
+    "tests/integration/chat-pipeline.test.ts": 1601,
+    "tests/integration/chatcore-compression-integration.test.ts": 1111,
+    "tests/integration/skills-pipeline.test.ts": 918,
+    "tests/unit/account-fallback-service.test.ts": 1572,
+    "tests/unit/arena-elo-sync.test.ts": 830,
     "tests/unit/batch_api.test.ts": 1324,
     "tests/unit/cc-compatible-provider.test.ts": 1217,
-    "tests/unit/chatcore-translation-paths.test.ts": 2776,
-    "tests/unit/chatgpt-web.test.ts": 3148,
-    "tests/unit/combo-routing-engine.test.ts": 3449,
-    "tests/unit/db-migration-runner.test.ts": 1499,
+    "tests/unit/chatcore-sanitization.test.ts": 831,
+    "tests/unit/chatcore-translation-paths.test.ts": 2810,
+    "tests/unit/chatgpt-web.test.ts": 3170,
+    "tests/unit/combo-config.test.ts": 881,
+    "tests/unit/combo-routing-engine.test.ts": 3209,
+    "tests/unit/combo-strategy-fallbacks.test.ts": 880,
+    "tests/unit/db-core-init.test.ts": 877,
+    "tests/unit/db-migration-runner.test.ts": 1491,
+    "tests/unit/db-settings-crud.test.ts": 941,
     "tests/unit/deepseek-web.test.ts": 1092,
-    "tests/unit/executor-codex.test.ts": 1339,
-    "tests/unit/executor-default-base.test.ts": 1519,
+    "tests/unit/executor-antigravity.test.ts": 942,
+    "tests/unit/executor-codex.test.ts": 1340,
+    "tests/unit/executor-default-base.test.ts": 1523,
     "tests/unit/grok-web.test.ts": 2437,
-    "tests/unit/image-generation-handler.test.ts": 2029,
+    "tests/unit/image-generation-handler.test.ts": 2019,
     "tests/unit/model-sync-route.test.ts": 1016,
-    "tests/unit/models-catalog-route.test.ts": 1636,
-    "tests/unit/perplexity-web.test.ts": 1355,
-    "tests/unit/provider-models-route.test.ts": 1784,
+    "tests/unit/models-catalog-route.test.ts": 1605,
+    "tests/unit/oauth-providers-config.test.ts": 845,
+    "tests/unit/perplexity-web.test.ts": 999,
+    "tests/unit/provider-models-route.test.ts": 1752,
     "tests/unit/provider-validation-specialty.test.ts": 2980,
-    "tests/unit/providers-page-utils.test.ts": 1106,
+    "tests/unit/providers-page-utils.test.ts": 1107,
+    "tests/unit/reasoning-cache.test.ts": 980,
     "tests/unit/response-sanitizer.test.ts": 1063,
     "tests/unit/route-edge-coverage.test.ts": 1241,
-    "tests/unit/search-handler-extended.test.ts": 1071,
+    "tests/unit/search-handler-extended.test.ts": 1124,
     "tests/unit/sse-auth.test.ts": 1600,
     "tests/unit/stream-utils.test.ts": 2445,
-    "tests/unit/token-refresh-service.test.ts": 1378,
-    "tests/unit/translator-openai-responses-req.test.ts": 1194,
-    "tests/unit/translator-openai-to-gemini.test.ts": 1616,
-    "tests/unit/translator-openai-to-kiro.test.ts": 1250,
+    "tests/unit/token-refresh-service.test.ts": 1353,
+    "tests/unit/translator-friendly-test-bench.test.tsx": 848,
+    "tests/unit/translator-helper-branches.test.ts": 870,
+    "tests/unit/translator-openai-responses-req.test.ts": 1195,
+    "tests/unit/translator-openai-to-gemini.test.ts": 1553,
+    "tests/unit/translator-openai-to-kiro.test.ts": 1257,
     "tests/unit/translator-resp-gemini-to-openai.test.ts": 1234,
-    "tests/unit/usage-service-hardening.test.ts": 1483,
-    "tests/unit/vscode-token-routes.test.ts": 1256,
-    "tests/unit/executor-antigravity.test.ts": 1098
+    "tests/unit/usage-service-hardening.test.ts": 1503,
+    "tests/unit/vscode-token-routes.test.ts": 1285,
+    "tests/unit/web-cookie-providers-new.test.ts": 890,
+    "_rebaseline_2026_07_12_v3847_mergeprs_tail": "v3.8.47 /merge-prs tail: translator-openai-responses-req.test.ts 1172->1195 (+23 = #6807 reasoning-summary-for-effort-only regression tests). Frozen only shrinks."
   },
   "_rebaseline_2026_06_09": "Re-baseline consciente pre-release v3.8.19: 9 arquivos cresceram durante o ciclo (features mergeadas: RequestLoggerV2 +281 request-logger rework, stream +101, combo +73, chatCore +45, catalog +32 fable-5/catalog-flag, callLogs +4, accountFallback +2, usageHistory novo 840) + core.ts +7 (fix resetAllDbModuleState, PR 3536). A catraca segue valendo destes valores — proximo crescimento falha. Decisao: encolher (esp. RequestLoggerV2/chatCore) e a issue #3501 ficam para o ciclo seguinte.",
   "_rebaseline_2026_06_11_phase1f": "Phase 1f (#3501): ProviderDetailPageClient.tsx 4948→4062 (-886 LOC); 3 novos hooks extraídos. useProviderConnections.ts=954 acima do cap=800 — justificado: extração direta do god-component (zero lógica nova), própria redução do cliente supera o custo. useProviderSettings.ts=263 e useProviderModels.ts=154 já abaixo do cap.",
@@ -270,150 +401,5 @@
   "_rebaseline_2026_07_07_6534_chirag": "PR #6534 (@chirag127) own growth: open-sse/services/compression/strategySelector.ts ->1025. Owner-approved rebaseline. Frozen.",
   "_rebaseline_2026_07_08_6556_omniglyph_mode": "PR #6556 (omniglyph engine) own growth: open-sse/services/compression/strategySelector.ts 1025->1043 (+18 at the existing mode-dispatch chokepoints). Two single-mode branches (sync no-op + async resolve via the engine registry, mirroring the rtk single-mode pattern, B-MODE-ENGINE-DECOUPLE) plus the optional providerTransport field threaded through the three options types (gates transport-sensitive engines). The engine itself lives in engines/omniglyphAdapter.ts (<cap); the residual is cohesive dispatch/type wiring not extractable without hiding the dispatch boundary, mirroring the prior compression rebaselines (#5243/#5286/phase4b/#6534). Covered by tests/unit/compression/omniglyph-*.test.ts (22). Structural shrink of this file tracked in #3501.",
   "_rebaseline_2026_07_07_6546_chirag": "PR #6546 (@chirag127) own growth: src/sse/handlers/chatHelpers.ts ->876. Owner-approved rebaseline. Frozen.",
-  "_rebaseline_2026_07_07_6525_chirag_image_guard": "PR #6525 (@chirag127, #6457) own growth: chat.ts ->1778 (reject image-only models on /v1/chat/completions; stacks on #6515). Owner-approved. Frozen.",
-  "_rebaseline_2026_07_15_7045_perf_instrumentation": "PR #7045 (@oyi77) own growth: open-sse/utils/stream.ts 2796->2814 (+18) from performance.mark/measure instrumentation around the SSE dispatch chokepoint (b48ba21c4), a TextEncoder hoisting fix to avoid a per-chunk allocation on the hot path (c35e8a9b4), and clearing the fixed-name \"omni-request-body-size\" mark immediately after creation (babysit fix, addressing a review-flagged unbounded-growth leak in Node's global performance timeline). Cohesive wiring at the existing stream-dispatch chokepoint; not extractable. Covered by tests/unit/chatcore-streaming-pipeline.test.ts + tests/unit/stream-request-body-size-mark-7045.test.ts.",
-  "_rebaseline_2026_07_18_basereds_test_realignment": "Base-red sweep own growth (post 102-PR campaign, full-suite realignment): tests/unit/combo-routing-engine.test.ts 3209->3243 (+34 = least-used tests now prime usage through real handleComboChat calls so recordComboRequest keys by the resolved executionKey exactly as production does — #7015 keying); tests/unit/db-migration-runner.test.ts 1491->1499 (+8 = withNonTestEnvironment now also strips node --test tokens from process.execArgv, matching the #7359 isAutomatedTestProcess widening); tests/unit/executor-default-base.test.ts 1523->1527 (+4 = 1M-beta assertion updated for claude-sonnet-4-6 GA #7129). All three are test-fidelity realignments, not extractable.",
-  "_rebaseline_2026_07_21_7930_pplx_quota_cooldown": "PR #7930 (@artickc) own growth, reconstructed against release/v3.8.49 base-drift: tests/unit/perplexity-web.test.ts 1192->1355 (+163 = two new regression cases — 'Live multi-step: reconstructs answer without status COMPLETED' proving RFC-6902 diff-patched plan_block goals now surface as reasoning_content the same as a materialized plan_block, and 'Advanced-model quota upsell with empty answer surfaces clear error' proving the new advanced_models_quota_low upsell_information detection maps to HTTP 429 + reset_seconds + Retry-After instead of a silent empty-content 502). Most of the PR's original 'multi-step empty content' claims were already independently fixed on release via a different mechanism (extractAnswerFromFinalText + longestMarkdownAnswer); only the two genuinely new, non-conflicting pieces (diff-block plan-goal extraction + quota cooldown) were ported. Covered by the two new tests; not extractable without splitting the whole executor test file.",
-  "_rebaseline_2026_07_22_v3849_ownGrowth_merge_batch": "OAuthModal(#7735 grok chooser), muse-spark-web(#7528 WS), combo.ts+combo-routing-engine.test(#7301 cooldown-retry) — pre-existing on tip; PricingTab(#7972), ComboDefaultsTab(#8008/#7973) — this train batch. Legitimate own-growth, owner-approved rebaseline.",
-  "_rebaseline_2026_07_23_v3849_merge_train_15": "Own-growth do merge-train de 15 PRs (2026-07-23), medido na tip combinada, release pura abaixo do baseline (auth.ts 2448, muse-spark 1393, translator-test 1523). auth.ts 2462->2475 (#8321 cookie-auth 401 cooldown-em-vez-de-terminal + #8324 noauth opencode-zen via proxy — wiring de classificação no chokepoint getProviderCredentials/markAccountUnavailable, não extraível), muse-spark-web.ts 1394->1396 (#8298 sanitizeErrorMessage runtime repairs isolados do #8177), tests/unit/translator-openai-to-gemini.test.ts 1553->1616 (#8312 cobertura do cap de thinking budget no path budget_tokens explícito). Owner-approved. Frozen; shrink estrutural em #3501.",
-  "_rebaseline_2026_07_22_providerLimits_webcookie_chain": "providerLimits.ts 1003->1005: own-growth from web-cookie provider usage-fetcher entries (#7994/#8006/#8027 chain) landing after the prior rebaseline.",
-  "_rebaseline_2026_07_22_8056_headroom_minrows": "#8056 (@RaviTharuma, persist Headroom minRows) own growth: src/lib/db/compression.ts 850->866 (+16 HeadroomConfig+DEFAULT_HEADROOM_CONFIG+normalize/store in get/updateCompressionSettings) and open-sse/services/compression/strategySelector.ts 1054->1060 (+6 merge settings.headroom into stacked stepConfig). Cohesive settings-persistence + stacked-merge wiring at existing chokepoints, frozen at new size.",
-  "_rebaseline_2026_07_25_v3849_basered_filesize": "Base-red unblock (2026-07-25): check:file-size was failing on release/v3.8.49 at its own HEAD (36f8fd10), so the quality.yml fast-gates job was red for EVERY PR->release regardless of content — growth inherited from already-merged PRs, with no offending PR branch left to fix (same situation as _rebaseline_2026_07_02_5798_release_green). Prod frozen raised to the current base values: src/lib/tokenHealthCheck.ts 832->841, src/sse/handlers/chat.ts 1865->1866, src/sse/services/auth.ts 2475->2486, open-sse/services/accountFallback.ts 1941->1966, open-sse/services/combo.ts 3630->3642. accountFallback.ts was first frozen here at 1960 (the base value at 36f8fd10) and re-measured to 1966 at base tip 1cafd328c a few hours later — the same inherited drift this entry exists for, since check:file-size does not run on the PR->release fast path and so accrues unmeasured between release rebaselines. These files remain frozen and cannot grow further; any in-flight PR that adds lines to them (e.g. #8482 touches accountFallback.ts and combo.ts) bumps its own entry as usual. The release captain rebaseline-at-release supersedes this note.",
-  "_rebaseline_2026_07_25_v3849_basered_filesize_2": "Base-red unblock (2026-07-25, second pass): after _rebaseline_2026_07_25_v3849_basered_filesize (measured at 36f8fd10) two more already-merged PRs grew frozen files on release/v3.8.49, so check:file-size — and with it the whole Fast Quality Gates job — is red for EVERY PR->release again, with no offending PR branch left to fix. src/lib/tokenHealthCheck.ts 841->843 (#8426 4528fc455, excludes local CLI providers from expiration) and src/app/(dashboard)/dashboard/providers/page.tsx 1927->1990 (#8349 58ab8b1d2, scroll-position restore on provider-card back-navigation). Trust-but-verify: both values measured on the pristine release tip 30709255 with no working-tree changes. Same situation and remedy as _rebaseline_2026_07_02_5798_release_green. Structural reduction of providers/page.tsx stays tracked separately — it is a 1990-line page, not something to extract inside a base-repair PR.",
-  "_rebaseline_2026_07_27_3850_relax_filesize_cap_v2_20pct": "OWNER-APPROVED TEMPORARY relax for v3.8.50-3.8.54 PREPARE phase (docs/ROADMAP.md). v1 was cap 800->900 / testCap 800->900 on 2026-07-27; v2 = v1 +20% buffer = cap 900->1000 (+100), testCap 900->1000 (+100). Justification: same as complexity v2 — the v3.8.50 release cut coincides with high-merge activity; owner accepted enlarging the headroom to cover the entire PREPARE phase (5 minor cycles .50-.54) without per-PR rebaseline noise. Targets: decompose-existing-frozen unchanged (frozen still only-shrink — see frozen[] entries and the 105 files >900 that still need structural decomposition regardless of cap); this only relaxes the cap for NEW files in the decompose/extract-while-PREPARE phase (.51='executor registry in-place' and .52='combo.ts decomposition' create new leaf modules above 800). RE-TIGHTENING MANDATORY in v3.8.51: cap target 850 = 850 once decomposition wave stabilizes (gives 150 units of post-tighten headroom vs the new 1000 ceiling). Tracked via same roadmap issue as complexity v2. Window: v3.8.50 (release cut) → v3.8.54 close (RE-TIGHTEN at v3.8.51 prep merge per ROADMAP.md). Last entry unless measured regression. v1 entry retained below for audit trail.",
-  "_rebaseline_2026_07_27_3850_relax_filesize_cap": "OWNER-APPROVED TEMPORARY relax for v3.8.50-3.8.54 PREPARE phase (docs/ROADMAP.md). cap 800->900 (+100), testCap 800->900 (+100). Targets: decompose-existing-frozen unchanged (frozen still only-shrink); this only relaxes the cap for NEW files in the decompose/extract-while-PREPARE phase (.51='executor registry in-place' and .52='combo.ts decomposition' create new leaf modules above 800). RE-TIGHTENING MANDATORY in v3.8.51: cap target 850 = 850 once decomposition wave stabilizes. SUPERSEDED by _rebaseline_2026_07_27_3850_relax_filesize_cap_v2_20pct (v1 +20% buffer) — retained for audit. Tracked via same roadmap issue.",
-  "_rebaseline_2026_07_27_v3849_train1h": "Merge-train 1H (31 PRs) — owner-approved 2026-07-27. Two distinct causes, kept separate on purpose: (1) GENUINE irreducible growth at existing chokepoints — providerLimits/auth (#8632 Kimi quota-reset recovery), rateLimitManager (#8616 idle wedged limiters), models-catalog-route.test (#8610 OpenCode Go effort aliases); (2) COLLISION with #8585, which banked shrinks measured on the pre-train release tip while 30 sibling PRs in the SAME train grew those files again — chat/accountFallback (#8628), chatCore (#8613), videoGeneration (#8581), imageGeneration. The zero-headroom frozen entries cannot absorb either. Ceilings re-pinned to the post-merge tip; #8612 (also in this train) automates shrink-banking so this self-inflicted drift stops recurring. Detail: src/lib/usage/providerLimits.ts 1006->1013 (#8632); src/sse/services/auth.ts 2492->2508 (#8632); open-sse/services/rateLimitManager.ts 1014->1060 (#8616); src/sse/handlers/chat.ts 1842->1845 (#8628); open-sse/handlers/chatCore.ts 4939->4955 (#8613); open-sse/handlers/imageGeneration.ts 3100->3101 ((sem PR — teto do #8585)); open-sse/handlers/videoGeneration.ts 1038->1063 (#8581); open-sse/services/accountFallback.ts 1965->1966 (#8628); tests/unit/models-catalog-route.test.ts 1608->1636 (#8610)",
-  "frozen": {
-    "_rebaseline_2026_06_22_4644_deepseek_web_tools": "PR #4644 (BugsBag/robust deepseek-web tool-call parsing): open-sse/executors/deepseek-web.ts 1117->1125 (+8). The new agentic tool-call path emits surrounding text + reasoning before tool_calls and swaps to the dedicated deepseekWebTools.ts parser; the +8 lines are cohesive wiring at the existing transformSSE chokepoint (the parser itself lives in the new deepseekWebTools.ts file, already under cap). The PR's own fast-gate (PR->release) does not run check:file-size, so this surfaced only at release reconcile. Covered by tests/unit/deepseek-web-tools-variants.test.ts + deepseek-web-tools-execute.test.ts.",
-    "_rebaseline_2026_06_23_4712_deepseek_web_tool_results": "PR for #4712 (deepseek-web drops role:tool): open-sse/executors/deepseek-web.ts 1125->1148 (+23). messagesToPrompt() now folds role:\"tool\" results into the single-prompt transcript (recovering the tool name from the preceding assistant tool_calls by tool_call_id) instead of silently dropping them; the lines are cohesive wiring inside the existing function. Covered by tests/unit/deepseek-web-tool-result-prompt-4712.test.ts.",
-    "_rebaseline_2026_06_24_headroom_strategy": "Headroom-aware connection selection (dario technique): combo.ts 3168->3180 (+12 = a new `else if (strategy === \"headroom\")` dispatch branch in handleComboChat that delegates to orderTargetsByHeadroom + its log line, plus the import). The actual logic lives OUT of the god-file: the pure ranker rankByHeadroom/computeHeadroom is the new leaf open-sse/services/combo/headroomRanking.ts (91 LOC, <cap) and the async orderer orderTargetsByHeadroom is appended to the existing open-sse/services/combo/quotaStrategies.ts (<cap) next to its sibling reset-aware/reset-window orderers (reuses their connection-expansion machinery). headroom = 1 - max(util_5h, util_7d) from getSaturation (src/lib/quota/saturationSignals.ts), prefers the connection with the most free capacity. Only the dispatch wiring is irreducible at the existing combo strategy chokepoint (mirrors the reset-aware/reset-window/context-optimized branches); not extractable without hiding the call site. fill-first stays default; all existing strategies untouched. Covered by tests/unit/combo-headroom-ranking.test.ts (pure helper) + tests/unit/combo-headroom-strategy.test.ts (orderer, saturation injected). Structural shrink of combo.ts tracked in #3501.",
-    "_rebaseline_2026_06_24_quota_share_strategy": "Dedicated quota-share strategy (Phase 3 #9): combo.ts 3180->3190 (+10 = one new `else if (strategy === \"quota-share\")` dispatch branch in handleComboChat that delegates 100% to selectQuotaShareTarget + its log line, plus the import). All the new logic lives OUT of the god-file in two new leaves under open-sse/services/combo/: quotaShareInflight.ts (in-flight counter with TTL/lease, ~150 LOC <cap) and quotaShareStrategy.ts (per-model bucket gating via isBucketSaturated + DRR proportional to weight + P2C over in-flight, ~240 LOC <cap). Only the dispatch wiring is irreducible at the existing combo strategy chokepoint (mirrors the headroom/reset-aware/reset-window/context-optimized branches); not extractable without hiding the call site. ZERO existing strategy cases were modified — only this branch was added, and the qtSd/ combos switched from fill-first to quota-share in src/lib/quota/quotaCombos.ts. Covered by tests/unit/quota-share-strategy.test.ts (gating, DRR fairness, P2C in-flight, fail-open, activation). Structural shrink of combo.ts tracked in #3501.",
-    "_rebaseline_2026_06_24_task_aware_routing": "Task-aware routing strategy (port PR #2045, OmniRoute #4945): combo.ts 3190->3225 (+35) = one new `else if (strategy === \"task-aware\")` dispatch branch delegating 100% to selectTaskAwareTarget + its imports/log lines. All scoring/classification logic lives OUT of the god-file in the new leaf open-sse/services/taskAwareRouting.ts (553 LOC <cap). Only the dispatch wiring is irreducible at the existing combo strategy chokepoint (mirrors quota-share/headroom/reset-aware branches). ZERO existing strategy cases modified. Covered by tests/unit/combo-task-aware.test.ts (35 tests). Structural shrink of combo.ts tracked in #3501.",
-    "_rebaseline_2026_06_26_fidelity_gate_extraction": "Milestone-B fidelity-gate wiring residual: bodyToText+gateAdvance extracted to fidelityGateStep.ts (889->854, -35), but the StackOptions.fidelityGate field, the `const fidelityGate` reads at the two stacked-loop dispatch chokepoints, and the import of FidelityGateConfig are irreducible wiring that cannot leave strategySelector without an architectural refactor of the pre-existing stacked pipeline. Net: 889->854 (+6 vs the pre-Milestone-B frozen 848). Covered by tests/unit/compression/*.test.ts (940 pass).",
-    "_rebaseline_2026_06_27_5193_5203_antigravity_oauthmodal": "Antigravity remote-login own growth: OAuthModal.tsx 960->969 (gate units). #5193 (+~4: remote paste instruction shown for all remote incl. Google + its rationale comment) and #5203 (+~5: handleManualSubmit credential-blob branch + button guard; submit logic extracted to oauthBlobSubmit.ts to minimize). Frozen set to the SUM so either merge order passes. Cohesive at the existing manual-submit chokepoint.",
-    "_rebaseline_2026_06_27_5193_antigravity_basered": "Base-red (pre-existing release drift, fast-gate PR->release skips check:file-size): accountFallback.ts 1773->1777 and src/app/api/providers/[id]/test/route.ts 924->940 were already over their frozen caps on release/v3.8.39 independent of any antigravity change. Owner chose to rebaseline (keep the documented issue-reference comments #1846/#1449/#347 etc.) rather than accept the contributor comment-stripping in #5200/#5198. Reverted #5200 to restore the comments; bumped these two frozen caps to the actual base sizes. No logic change.",
-    "_rebaseline_2026_06_28_5237_impersonation_ua_refresh": "PR #5237 (refresh impersonation UAs): grok-web.ts 1871->1873 (+2), muse-spark-web.ts 1284->1302 (+18), perplexity-web.ts 1013->1032 (+19). Net semantic change in each file is a single User-Agent constant (Chrome 147->149 for grok/muse; perplexity kept at Firefox 148 to stay matched with the firefox_148 TLS profile — the contributor's 152 bump was reverted to avoid a UA-vs-JA3 mismatch, #2459). The growth is Prettier reflow that lint-staged unavoidably applies to these grandfathered long-line files the moment they are touched; not extractable. src/sse/services/auth.ts 2336->2401 in the same reconcile is #5222's antigravity-LRU-retry growth that merged via --admin without a baseline bump.",
-    "_rebaseline_2026_06_28_5243_risk_gate_prepass": "PR #5243 (compression risk-gate pre-pass) own growth: open-sse/services/compression/strategySelector.ts 854->899 (+45). The three exported entry points (applyCompression/applyStackedCompression/applyStackedCompressionAsync) become thin wrappers over pure-extracted private bodies (runCompression/runStackedCompression/runStackedCompressionAsync) so the risk-gate mask->run->restore wrapper sits strictly OUTSIDE the per-step loop — a single universal integration point. The wrapper logic itself (resolveRiskGate/withRiskGate) lives in the new riskGate/strategyWrap.ts (<cap); the residual growth is the duplicated thin-wrapper signatures + the extracted bodies' dispatch boundary, guarded by a byte-identical parity test (riskGateIntegration). Default off (DEFAULT_COMPRESSION_CONFIG unchanged). Not extractable without hiding the dispatch boundary, mirroring prior compression rebaselines. Structural shrink tracked in #3501.",
-    "_rebaseline_2026_06_28_5275_correlation_id_extract": "Extraction of the safe CorrelationId subset of #5275 (hartmark) — request correlation id stored in call_logs (migration 109) and returned via the X-Correlation-Id response header, WITHOUT the combo/resilience or build/lazy-loading changes (those stay in #5275). Own growth: callLogs.ts 975->985 (correlation_id column on CallLogSummaryRow + read/map), usageHistory.ts 983->988 (correlationId metadata normalize), chat.ts 1575->1632 (withCorrelationId response wiring + combo-failure log carrying correlationId), chatHelpers.ts new 811 (withCorrelationId helper + reqId threading; was 791<cap pre-feature). Cohesive request/logging chokepoint wiring; structural shrink of chat.ts tracked in #3501.",
-    "_rebaseline_2026_06_29_4038_cas_guard": "PR (#4038) own growth: tokenRefresh.ts 2103->2181 (+78 = the compare-and-swap guard on the refresh persist — runWithCasGuard/getActiveCasGuard AsyncLocalStorage pair mirroring runWithOnPersist, casGuardShouldSkipPersist that rereads the row right before persisting and skips the write when a concurrent writer already rotated the refresh_token past the one presented, plus getCasGuardStats counters). Fixes the sibling-rotation-revert → token-family-revocation storm. Gated behind an active guard (opt-in; no guard => byte-identical). Wiring lives at the two persist chokepoints inside getAccessToken; the comparison reuses wasRefreshTokenRotated from refreshSerializer. Not extractable without splitting the refresh hot path.",
-    "_rebaseline_2026_06_29_5286_memoization": "PR #5286 own growth: strategySelector.ts 899->960 (+61 = the opt-in result-memoization branches in applyCompression/applyCompressionAsync — principal+determinism gate, makeMemoKey lookup/store with model+supportsVision folded into the key, recompute-with-memo-off). Default off (memoizeCompressionResults), so zero behavior change. The memo helpers live in the leaf resultMemo.ts (<cap); the chokepoint wiring here is not extractable. Structural shrink of this hot-path file tracked in #3501.",
-    "_rebaseline_2026_07_01_v3843_release_5609": "Rebaseline v3.8.43 (PR #5609 release reconciliation). DRIFT dos 109 commits do ciclo: 8 god-files existentes cresceram (ApiManagerPageClient 2983->3017, combos/page 4594->4608, AddApiKeyModal 868->869, providerPageHelpers 974->996, chat.ts 1635->1647, auth.ts 2401->2403, batchProcessor 828->915, combo.ts 3368->3387) + 2 novos acima do cap (huggingchat.ts 813, tests web-cookie-providers-new 827) + 4 test files cresceram. Modularizacao deferida (blast-radius mid-release); congelado no estado atual p/ o proximo ciclo ratchetar daqui.",
-    "_rebaseline_2026_07_02_5816_qoder": "PR #5816 (@AgentKiller45, qoder PAT via qodercli): qoderCli.ts 666->989, new-above-cap frozen (owner-approved baseline freeze). The growth is the legitimate PAT job-token exchange + quota parsing CLI transport (the pure-JS Cosy path 500'd on every PAT request); extracting the spawn/parse helpers now would just add indirection to a contributor PR mid-merge. Test frozen also raised for this PR's coverage growth: providers-page-utils.test.ts 1052->1092. Additionally clears an inherited base-red from the already-merged #5933 (codex json_schema->text.format): translator-openai-responses-req.test.ts 1097->1172 (+75 regression tests, no offending branch left). All remain frozen (cannot grow further); release captain's rebaseline-at-release supersedes.",
-    "_rebaseline_2026_07_09_6126_clinepass_dual_auth": "PR #6126 (@hajilok, dual-auth ClinePass) own growth: tokenRefresh.ts 2181->2182 (+1 = a single `case \"clinepass\":` fallthrough label added to the existing `case \"cline\":` in _getAccessTokenInternal's provider switch, so clinepass token refresh dispatches to the already-shared refreshClineToken() instead of silently falling through to the generic OAuth refresh). Irreducible 1-line switch-case wiring at the existing chokepoint; the header-building logic for the same feature was extracted to a new leaf src/shared/utils/clineAuth.ts::buildClinepassHeaders() (well under cap) to avoid growing open-sse/executors/default.ts. Covered by tests/unit/clinepass-provider.test.ts.",
-    "_rebaseline_2026_07_09_6363_kiro_external_idp": "PR #6363 (@artickc, Kiro external IdP) own growth: tokenRefresh.ts 2182->2249 (+67 = the external_idp refresh branch inside refreshKiroToken — standard public-client OAuth2 refresh_token grant against the org IdP tokenEndpoint via buildExternalIdpRefreshParams/isExternalIdpAuthMethod from the new leaf open-sse/services/kiroExternalIdp.ts, with invalid_grant/invalid_client -> unrecoverable_refresh_error mapping). Cohesive addition at the existing refreshKiroToken chokepoint. Covered by tests/unit/kiro-external-idp.test.ts.",
-    "_rebaseline_2026_07_09_6587_kiro_api_key_auth": "PR #6587 (@strangersp) own growth for Kiro long-lived API-key auth, merged onto v3.8.47 tip: openai-to-kiro.ts 890->912 (+22, auth-header selection for API-key-vs-OAuth-token connections), providerLimits.ts 998->1000 (+2, API-key auth-type branch), translator-openai-to-kiro.test.ts 1234->1257 (+23), providers-page-utils.test.ts 1109->1107 (net -2 after merging with parallel release drift; connectionMatchesProviderCard api_key coverage added), provider-validation-specialty.test.ts 2856->2980 (+124 net after merge with parallel release drift; this PR also removed the file's `@typescript-eslint/no-explicit-any` eslint-suppression entry by fixing all `any` usages, adding typed replacements). Cohesive additive feature growth, well tested; not extractable without splitting the existing chokepoints mid-merge.",
-    "_rebaseline_2026_07_09_6678_routing_strategy_9router": "#6678 (SeaXen) — 9router-parity Routing Strategy settings card + per-provider/combo sticky-round-robin override. Own growth: ProviderDetailPageClient.tsx 784->786 (single ProviderAccountRoutingCard mount + import), auth.ts 2448->2458 (providerStrategies override resolution: fallbackStrategy/stickyRoundRobinLimit per-provider cascade in getProviderCredentials). Both additive, zero unrelated refactor; new UI/logic lives in new files (ProviderAccountRoutingCard.tsx, RoutingStrategyCard.tsx, rrState.ts::resolveComboStickyRoundRobinLimit). chat.ts value below reflects the current release tip (grown by other concurrent PRs, e.g. #6640), not this PR own change.",
-    "_rebaseline_2026_07_10_6318_omp_letta": "PR #6318 (@hamsa0x7, omp+letta CLI integrations) own growth: cliTools.ts (+53 = 2 registry entries incl. omp docsUrl) and cliRuntime.ts (+18 = runtime-detection wiring for the 2 new tools). Cohesive registry/wiring growth at the existing chokepoints; scope reduced from the original 5 tools (pi/codewhale/jcode shipped separately).",
-    "_rebaseline_2026_07_10_gcf_v3_2_decode": "PR #6838 own growth: new vendored file open-sse/services/compression/engines/headroom/gcf/decode_generic.ts frozen at 880 (> 800 cap). It is the vendored GCF generic-profile decoder (spec v3.2 nested flattening plus the prototype-pollution / hasOwnProperty hardening added in this PR's Gemini review). Kept as one file faithful to upstream gcf-typescript so re-vendoring stays a clean copy rather than a re-split each cycle (sibling generic.ts/scalar.ts stay < cap; extraction would also fragment the file's frozen eslint no-explicit-any suppressions). Round-trip + prototype-pollution regression coverage in tests/unit/compression/headroom-smartcrusher.test.ts. Frozen: only shrinks from here.",
-    "_rebaseline_2026_07_12_v3847_mergeprs_tail": "v3.8.47 /merge-prs tail (owner-approved): src/lib/localDb.ts NEW>800 (799->805, +6 re-exports countFreeProxies + recordFreeProxySyncErrors/clearFreeProxySyncErrors/getFreeProxySyncErrors + FreeProxySyncErrors type for #6909 free-pool relay-repair; re-export-only per Hard Rule #2, not extractable).",
-    "_rebaseline_2026_07_15_7070_combos_memo": "PR #7070 (perf/p1-memo) own growth: src/app/(dashboard)/dashboard/combos/page.tsx 4655->4656 (+1 = React.memo wrapping of ComboCard). Covered by tests/unit/ui/combos-page-smoke.test.tsx.",
-    "_rebaseline_2026_07_18_7399_xai_oauth_modal": "PR #7399 (xAI OAuth PKCE) own growth: OAuthModal.tsx 993->998 (+5 = provider entry + PKCE flow branch wiring at the existing provider-switch chokepoint; the provider logic itself lives in src/lib/oauth/providers/xai-oauth.ts, new leaf). Third irreducible wiring bump on this modal (969->989->993->998); structural shrink tracked in #3501.",
-    "_rebaseline_2026_07_19_6636_codex_session_json": "#6636 own growth: OAuthModal.tsx 998->1030 (gate units, split(\"\\n\").length incl. trailing newline; +32 = session-JSON paste branch for handleManualSubmit plus a shared submitCodexAccessToken() helper extracted from the pre-existing bare-JWT branch, mirroring the #5203 oauthBlobSubmit.ts extraction precedent; the normalizer logic itself lives in the new src/lib/oauth/utils/codexSessionImport.ts leaf module, not here). Fourth irreducible wiring bump on this modal (969->989->993->998->1030); structural shrink tracked in #3501.",
-    "_rebaseline_2026_07_19_7546_ghe_copilot_modal": "PR #7546 (GHE Copilot OAuth provider) own growth: OAuthModal.tsx 1030->1056 (gate units). Adds a gheUrl input state, routes ghe-copilot through the existing device-code branch, and threads gheUrl into the device-code request/poll extraData at the existing provider-switch chokepoints (+~24 lines, cohesive with the same pattern as #7399/#6636). The standalone GHE enterprise-URL config step JSX (originally +31 lines inline) was extracted to the new src/shared/components/oauthModal/GheConfigStep.tsx leaf component to minimize the bump; what remains is the irreducible provider-branch wiring. Fifth bump on this modal (969->989->993->998->1030->1056); structural shrink tracked in #3501.",
-    "_rebaseline_2026_07_19_7787_ic2_localdb_reexports": "PR #7787 (IC2 raw connections cache + lazy-decrypt) own growth: localDb.ts 805->807 (gate units, +2). localDb.ts is the re-export-only layer (hard rule #2 — no logic); the PR adds 4 new db/readCache re-exports (touchConnectionLastUsed, getCachedRawProviderConnections, getCachedProviderConnectionById, getCachedProviderNodes) required by existing barrel importers. Irreducible for a re-export list; frozen so it can only shrink.",
-    "_rebaseline_2026_07_20_7779_routingcombo_thread": "PR #7779 own growth: chatHelpers.ts 876->877 (+1, thread routingComboId into executeChatWithBreaker for compression-combo assignment). Frozen so it can only shrink.",
-    "_rebaseline_2026_07_20_7819_autocandidateoverrides_reexport": "PR for #7819 (Level 1+2: read-only auto/* candidate transparency + per-API-key exclusions) own growth: localDb.ts 807->808 (+1). Adds a single `export * from \"./db/autoCandidateOverrides\"` barrel re-export (hard rule #2 — no logic) for the new DB module backing per-apiKey candidate exclusions. Irreducible for a re-export list; frozen so it can only shrink.",
-    "_rebaseline_2026_07_21_8027_grok_cli_auth_json_paste": "PR #8027 (RaviTharuma, fix(grok-cli) #7610) own growth: OAuthModal.tsx 1080->1100 (gate units). Requires the full ~/.grok/auth.json (with refresh_token) on the paste-import path instead of a bare JWT, at the existing paste-token chokepoint (renamed tab label, updated instructions/placeholder, textarea for the auth.json blob, inline error surface). The validation logic itself (parseGrokCliPasteToken, previously an inline ~75-line function) was extracted to the new src/lib/oauth/utils/grokCliAuthJson.ts leaf module — mirroring the #6636/#7546 extraction precedent — so only the irreducible UI wiring remains here. Sixth bump on this modal (969->989->993->998->1030->1056->1100); structural shrink tracked in #3501.",
-    "_rebaseline_2026_07_21_8034_compression_exclusions_sidebar": "#8034 (compression exclusions dashboard tab) own growth: sections.ts 796->806 (+10, one new COMPRESSION_CONTEXT_GROUP sidebar item linking /dashboard/compression/exclusions). The file was already 796/800 before this PR (organic growth from prior sidebar entries), so a single new nav item pushed it 6 lines over cap. Freezing at 806 (cannot grow further); the sidebar item array is data, not extractable logic.",
-    "_rebaseline_2026_07_22_7936_namespace_roundtrip": "#7936 (@RCrushMe, Responses-Chat namespace round-trip identity seam) own growth: open-sse/translator/response/openai-responses.ts 1092->1125 (+33) and open-sse/utils/stream.ts 2814->2869 (+55) — threading the namespace-identity seam through the Responses↔Chat translation + stream paths so tool-call namespaces survive the round-trip. Cohesive translation/stream wiring at existing chokepoints, frozen at new size.",
-    "_rebaseline_2026_07_22_8010_codex_responses_engine": "PR #8010 (@JxnLexn) own growth: open-sse/mcp-server/schemas/tools.ts 1497->1505 (+8 = threading the new \"codex-responses\" literal into the compressionConfigureInput strategy/autoTriggerMode Zod enums and setCompressionEngineInput engine enum, mirroring the existing rtk/omniglyph enum entries; no new tool). open-sse/services/compression/strategySelector.ts 1043->1054 (+11 = one new `if (mode === \"codex-responses\")` dispatch branch in runCompression that delegates 100% to the new codexResponsesEngine.apply, mirroring the existing rtk single-mode dispatch, plus threading config.codexResponsesConfig.preserveToolNames into the shared adaptBodyForCompression call at the 3 existing call sites). src/lib/db/compression.ts (untracked, new-file cap 800) 794->845 (+51 = normalizeCodexResponsesConfig, mirroring the existing normalizeRtkConfig normalizer, plus registering \"codex-responses\" in the COMPRESSION_MODES/STACKED_PIPELINE_ENGINE_IDS/SINGLE_MODE_ENGINE sets and the getCompressionSettings load/save switch) — added to the baseline at its current size. All three are cohesive dispatch/normalizer wiring at existing chokepoints (mirroring the prior compression-mode rebaselines #6534/#6556), not extractable without hiding the mode-dispatch boundary. Covered by tests/unit/compression/codex-responses.test.ts (6) + omniglyph-registries.test.ts/types.test.ts (22, updated for the new mode).",
-    "_rebaseline_2026_07_22_8034_compression_exclusions_persistence": "#8034 (compression exclusions) own growth: src/lib/db/compression.ts 845->850 (+5 = threading the new compressionExclusions field through the existing getCompressionSettings/saveCompressionSettings load/save switch over the shared key_value compression namespace — no new table, no raw SQL). Mirrors the prior compression-field rebaselines (#8010 codex-responses normalizer at the same chokepoint); the load/save switch is a single dispatch boundary, not extractable without hiding it. Covered by the PR's 8 node:test + 3 vitest cases.",
-    "_rebaseline_2026_07_22_8050_model_lockout_exact_family": "#8050 (@AndrianBalanescu) own growth: accountFallback.ts 1864->1892 (+28) — exact-vs-family model-lockout scoping (getModelLockKey/isModelLocked/clearModelLock/getModelLockoutInfo) so an Antigravity 404 for one bare model no longer hijacks the whole family cooldown. Cohesive lockout logic; frozen at new size.",
-    "_rebaseline_2026_07_22_8056_headroom_minrows": "#8056 (@RaviTharuma, persist Headroom minRows) own growth: src/lib/db/compression.ts 850->866 (+16 HeadroomConfig+DEFAULT_HEADROOM_CONFIG+normalize/store in get/updateCompressionSettings) and open-sse/services/compression/strategySelector.ts 1054->1060 (+6 merge settings.headroom into stacked stepConfig). Cohesive settings-persistence + stacked-merge wiring at existing chokepoints, frozen at new size.",
-    "_rebaseline_2026_07_22_8081_reasoning_placeholder_guard": "#8081 (@Dingding-leo) own growth: openai-responses.ts 1125->1137 (+12) restructuring the reasoning-placeholder guard so it skips only the empty content block and still emits finish_reason/tool_calls in the same chunk. Cohesive translator wiring; frozen at new size.",
-    "_rebaseline_2026_07_22_8210_openrouter_midstream_error": "PR #8210 (hartmark, fix/openrouter-midstream-error-surfacing) own growth: open-sse/translator/response/openai-responses.ts 1137->1163 (+26) measured on the merged tip (release 1137 + this PR own growth). Adds a single new branch inside openaiToOpenAIResponsesResponse() that detects an OpenRouter-style mid-stream aggregator error (HTTP 200 SSE chunk with empty choices + a top-level error object) and surfaces it as state.upstreamError instead of silently falling through to the no-op/awaitingTrailingUsage path, which previously masked the failure as a false empty-success completion and skipped combo fallback. Irreducible call-site addition at the existing chunk-dispatch chokepoint (mirrors the Gemini-to-OpenAI translator's #4177 precedent for the same class of upstream error surfacing). Note: this baseline entry does NOT cover the separate pre-existing +11 drift already on the release tip from #8081/#8162 (1125->1136, unrelated reasoning-placeholder-stripping fix merged after this PR branched) — that drift belongs to the maintainer's rebaseline, not this PR.",
-    "_rebaseline_2026_07_22_8211_gemini_malformed_tool_choice": "PR #8211 (hartmark, fix/gemini-malformed-function-call-tool-choice) own growth: open-sse/translator/response/gemini-to-openai.ts 771->821 (+50, entirely this PR's diff — no other commit touched this file between the PR's merge-base and the release tip). Adds MALFORMED_FUNCTION_CALL/UNEXPECTED_TOOL_CALL handling inside geminiToOpenAIResponse(): synthesizes a `malformed_tool_call` tool_calls entry so finish_reason normalizes to the standard \"tool_calls\" instead of an unrecognized raw enum value that OpenAI-compatible clients (e.g. OpenClaw) silently ignore, and always synthesizes (rather than skipping when a real tool call already exists) so a malformed attempt alongside a real one in the same turn is not silently discarded. Irreducible cohesive addition at the existing candidate/finishReason translation chokepoint (mirrors the 9router#2462 raw-finish-reason precedent immediately below it in the same function). Covered by the PR's own tests/unit test additions for both the malformed-only and malformed-plus-real-call cases.",
-    "_rebaseline_2026_07_22_8213_chat_abandoned_target_abort": "PR #8213 (hartmark, fix/gemini-tpm-quota-cooldown-wait) own growth: src/sse/handlers/chat.ts 1794->1860 (+66, measured against the PR's own merge-base — the release tip separately carries an unrelated -5 net shrink from #8013's antigravity callable-catalog alignment, which this PR's branch does not include and this entry does not cover). Adds resolveDispatchClientRawRequest(): merges a per-target modelAbortSignal into clientRawRequest.signal (via mergeAbortSignals) so a combo target abandoned by comboTargetTimeoutMs actually observes its own abort and reaches its cleanup path, instead of hanging forever inside withRateLimit/acquireAccountSemaphore and leaking a permanent 'pending' dashboard entry (live incident, log id 1784418258231-14961a). Also wires combo-exhausted rejection logging to capture request body + attempted models via the new rejectedRequestUsage helper. Irreducible additions at the existing chat dispatch chokepoint. Covered by the PR's own combo-config + integration test additions.",
-    "_rebaseline_2026_07_22_8213_combo_cooldown_wait_recording": "PR #8213 (hartmark, fix/gemini-tpm-quota-cooldown-wait) own growth: open-sse/services/combo.ts 3548->3604 (+56, entirely this PR's diff — no other commit touched this file between the PR's merge-base and the release tip). Fixes combo cooldown-wait state recording so a bogus 503 is no longer crystallized when the cooldown-wait vars reset every setTry, adds an OpenAI-format SSE error frame path for combo-exhausted rejections (capturing request body + attempted models), and gives an abandoned per-target dispatch its own timeout instead of leaking a permanent 'pending' dashboard entry. Irreducible additions at the existing handleComboChat dispatch/retry chokepoint (mirrors the prior quota-share/headroom/task-aware strategy-branch precedents already frozen in this file). Covered by the PR's own combo-config + Gemini TPM-ceiling benchmark test additions.",
-    "_rebaseline_2026_07_22_8213_gemini_tpm_quota_cooldown_wait": "PR #8213 (hartmark, fix/gemini-tpm-quota-cooldown-wait) own growth: open-sse/services/accountFallback.ts 1857->1932 on the merged tip (release 1892 incl #8050 +35, plus this PR own growth +40); measured against the PR own merge-base was 1857->1898 (+41 — the release tip separately carries an unrelated +34 from #8050's antigravity 404 model-not-found lockout scoping, which this PR's branch does not include and this entry does not cover). Own growth is the Gemini TPM-ceiling classification + cooldown-wait wiring feeding into the combo cooldown-wait state machine (rate-limit wedge recovery) introduced by this PR's commit series. Irreducible additions at the existing account-fallback/model-lockout chokepoint. Covered by the PR's own gemini-rate-limit-tracker and TPM-ceiling benchmark test additions.",
-    "_rebaseline_2026_07_22_8213_health_unblock_model_cooldowns": "PR #8213 (hartmark, fix/gemini-tpm-quota-cooldown-wait) own growth: src/app/(dashboard)/dashboard/health/page.tsx 1094->1165 (+71, entirely this PR's diff — no other commit touched this file between the PR's merge-base and the release tip). Adds handleUnblockAll/handleUnblockOne dashboard actions (DELETE /api/resilience/model-cooldowns) so an operator can manually clear a Gemini TPM-wedge model lockout surfaced by this PR's cooldown-wait fixes, instead of waiting out the ceiling. Irreducible UI wiring at the existing health-page action chokepoint. Covered by the PR's own dashboard/resilience test additions.",
-    "_rebaseline_2026_07_22_8213_requestloggerdetail_unblock_ui": "PR #8213 (hartmark, fix/gemini-tpm-quota-cooldown-wait) own growth: src/shared/components/RequestLoggerDetail.tsx 799->941 (+142, entirely this PR's diff — no other commit touched this file between the PR's merge-base and the release tip; crosses the general 800-line new-file cap so is frozen here for the first time). Adds a collapsible section header (open/expand-less toggle) plus per-log-entry unblock (`unblocking`/`cleared` state, isCombo503 detection) so the request-logger detail panel surfaces the same Gemini TPM cooldown-wait / model-lockout unblock action introduced by this PR at the individual-request level (mirrors the health-page bulk unblock action added in the same PR). Covered by the PR's own dashboard/resilience test additions.",
-    "_rebaseline_2026_07_22_fusion_8013_8098_antigravity": "Fusion of #8013 (backryun, catalog/IDE-CLI-split rewrite) + #8098 (nguyenha935, protocol-fidelity/fail-closed/credits/tool-cloaking): open-sse/services/usage/antigravity.ts NEW 802 (>cap 800, +2 — #8098 credits/tier usage service on #8013's profile-aware headers). Test growth (models-catalog-route 1605->1608, provider-models-route 1752->1757 from #8013 Gemini 3.6 catalog) tracked in testFrozen.",
-    "_rebaseline_2026_07_23_8127_grok_weekly_quota": "#8127 (@apoapostolov) own growth: src/sse/handlers/chat.ts 1861->1865 (+4) — weekly quota tracking for grok-web wires a quota-fetch hook at the existing dispatch chokepoint. Thin wiring mirroring adjacent provider-quota branches; not extractable. Covered by tests/unit/grok-quota-fetcher.test.ts.",
-    "_rebaseline_2026_07_23_8143_empty_catch_logging": "#8143 (@chirag127) own growth: open-sse/utils/stream.ts 2869->2887 (+18) — replacing empty catch blocks in the SSE stream subsystem with console.debug logging (Rule #6 silent-swallow fix, issues #8138-#8142). Cohesive logging additions at the existing catch chokepoints, not extractable; frozen at new size. Covered by tests/unit/stream-handler-catch-logging-8143.test.ts.",
-    "_rebaseline_2026_07_23_8219_cache_ttl_settings_sidebar": "#8219 (@oyi77) own growth: sections.ts 806->813 (+7) — configurable model-catalog cache-TTL settings adds a new sidebar nav entry + its visibility wiring. Sidebar item array is data, not extractable logic; frozen at new size.",
-    "_rebaseline_2026_07_23_8247_8248_model_unhealthy": "#8247+#8248 own growth: accountFallback.ts 1940->1941 (+1, irreducible import statement only — the substantive #8248 DEGRADED-pattern classifier was extracted into open-sse/config/errorConfig.ts, which has ample headroom, instead of growing this frozen file; #8247's fix is a single existing-line condition change, net zero lines). Scoping the credits-exhausted 403/429 branch to isCompatibleProvider() (per-model-quota openai/anthropic-compatible-* nicknames) so it stays model-scoped instead of terminalling the whole connection, and classifying NVIDIA NIM 'Function ... DEGRADED' 400 bodies as model-access-denied instead of a raw passthrough 400. Covered by tests/unit/8247-accountfallback-model-unhealthy.test.ts and tests/unit/8248-accountfallback-nvidia-degraded.test.ts.",
-    "_rebaseline_2026_07_23_8252_combo_400_advance": "#8252 (@RaviTharuma) own growth: accountFallback.ts 1932->1940 (+8) + combo.ts 3604->3630 (+26) — advance combo on model-scoped 400s wrapped as invalid/Bad-Request. Irreducible wiring at existing account-fallback + combo dispatch chokepoints. Covered by combo-model-scoped-400-advance.test.ts.",
-    "_rebaseline_2026_07_23_8266_alibaba_media": "#8266 (@backryun) own growth: imageRegistry.ts 821->979 (+158) — Alibaba-family media models (Qwen image/video, Bailian, Wan) added to the image/video registry. Registry model data, not extractable logic; frozen at new size.",
-    "_rebaseline_2026_07_24_8388_compression_detail_persist": "#8388 (compression engine DETAIL settings — Headroom/session-dedup/CCR — dropped on save) own growth: src/lib/db/compression.ts 866->872 (+6 = irreducible call-site wiring at the existing getCompressionSettings/updateCompressionSettings chokepoint: one import line, one `...buildDetailConfigDefaults()` spread in the seed config, and one `case \"sessionDedup\": case \"ccr\": applyDetailConfigUpdate(config, key, parsed); break;` load-switch case, mirroring the existing headroom/#8056 case immediately above it). The actual normalizer logic (normalizeSessionDedupConfig/normalizeCcrConfig, matching SESSION_DEDUP_SCHEMA/CCR_SCHEMA bounds) was EXTRACTED into a new leaf src/lib/db/compressionDetailNormalizers.ts (well under cap) so this frozen file only carries the minimal dispatch wiring. Covered by tests/unit/8388-compression-detail-persist.test.ts (schema-accept + full DB save->reload round-trip for both new sub-objects, plus a no-regression assertion on the existing headroom round-trip).",
-    "_rebaseline_2026_07_24_responses_toolcalls_log_summary": "hartmark, fix/responses-tool-calls-log-summary own growth: open-sse/translator/response/openai-responses.ts 1163->1174 (+11). closeToolCall() now also writes the completed tool call into the shared state.toolCalls Map (already populated by the openai-to-claude / claude-to-openai / gemini-to-openai response translators) so stream.ts's completion-log summary builder (which reads state.toolCalls, not this translator's own funcCallIds/funcNames/funcArgsBuf bookkeeping) reports finish_reason \"tool_calls\" and message.tool_calls for openai->openai-responses translated streams instead of always logging \"stop\" with no tool_calls — the actual client-facing SSE events were already correct; only the persisted call-log summary was wrong. Irreducible call-site addition at the existing tool-call-close chokepoint. Covered by the new regression test in tests/unit/translator-resp-openai-responses.test.ts.",
-    "_rebaseline_2026_07_25_8476_combo_input_bound_homogeneous_scope": "PR #8476 (herjarsa, fix/8375-8459-combo-image-fixes, #8375) own growth: open-sse/services/combo.ts 3642->3679 (+37 net: +29 the PR's own isInputBoundFailure short-circuit for deterministic context_length_exceeded/context_window_exceeded failures, +8 a /green-prs pre-merge fix scoping that short-circuit to homogeneous remainders only — the shipped code fired unconditionally on ANY target, regressing the intentional heterogeneous-combo fallback #6637/isContextOverflow400 protects, exactly as flagged by this PR's own review evidence but never actually implemented in the branch). The fix compares orderedTargets[i+1..] modelStr against the failing target's modelStr at the existing executeTarget dispatch chokepoint (mirrors the sameProviderNext precedent a few lines below) — irreducible call-site wiring, not extractable without hiding the dispatch boundary. Covered by tests/unit/combo-input-bound-failure-8375.test.ts (homogeneous pool still short-circuits) and the new tests/unit/combo-input-bound-heterogeneous-8375.test.ts (heterogeneous combo now correctly falls through to the larger-context target).",
-    "_rebaseline_2026_07_25_adobe_firefly_reference_images": "Follow-up to #8006: storage upload + referenceBlobs for image/video and /v1/images/edits dispatch. adobeFireflyClient.ts 1958->2317 (+upload helpers, extract sources, resolve blob ids). Note: 2317 not 2316 — check-file-size.mjs counts LOC via split(\"\\n\").length (counts the trailing-newline empty element), which is 1 higher than `wc -l` on a file ending in \\n; the PR's original entry (2316) was measured with wc -l and undercounted by 1 against the actual gate.",
-    "_rebaseline_pr1043_minimax_tts": "Upstream port decolua/9router#1043 (toanalien) own growth: audioSpeech.ts 965->1061 (+96). Adds MiniMax T2A v2 TTS dispatch (handleMinimaxSpeech + hexToBytes helper) — provider entry was already in audioRegistry (format: minimax-tts) but no handler existed, falling through to the OpenAI-compatible default that fails (T2A has custom shape + hex-encoded audio + base_resp envelope). New branch sits next to the other inline provider branches (xiaomi-mimo, coqui, tortoise, aws-polly) — extracting would just create indirection. Covered by tests/unit/minimax-tts-1043.test.ts (3 tests, GREEN: success, base_resp error, invalid-hex).",
-    "_rebaseline_pr4592_exclude_exhausted_auto": "Reconcile #4592 already-merged growth: combo.ts 2991->3036 (+45, terminal-status quota-cutoff exclusion in buildAutoCandidates + opt-in gate). Fast-gate PR->release does not run check:file-size.",
-    "open-sse/executors/antigravity.ts": 1528,
-    "open-sse/executors/base.ts": 1578,
-    "open-sse/executors/chatgpt-web.ts": 3241,
-    "open-sse/executors/codex.ts": 1534,
-    "open-sse/executors/cursor.ts": 1560,
-    "open-sse/executors/deepseek-web.ts": 1148,
-    "open-sse/executors/grok-web.ts": 1044,
-    "open-sse/executors/muse-spark-web.ts": 1405,
-    "open-sse/handlers/chatCore.ts": 5020,
-    "open-sse/handlers/imageGeneration.ts": 3101,
-    "open-sse/handlers/responseSanitizer.ts": 1115,
-    "open-sse/handlers/search.ts": 1536,
-    "open-sse/handlers/videoGeneration.ts": 1063,
-    "open-sse/mcp-server/schemas/tools.ts": 1505,
-    "open-sse/mcp-server/server.ts": 1407,
-    "open-sse/mcp-server/tools/advancedTools.ts": 1120,
-    "open-sse/services/accountFallback.ts": 1966,
-    "open-sse/services/adobeFireflyClient.ts": 2322,
-    "open-sse/services/claudeCodeCompatible.ts": 1202,
-    "open-sse/services/combo.ts": 3648,
-    "open-sse/services/compression/strategySelector.ts": 1060,
-    "open-sse/services/rateLimitManager.ts": 1060,
-    "open-sse/translator/response/openai-responses.ts": 1174,
-    "open-sse/utils/cursorAgentProtobuf.ts": 1505,
-    "open-sse/utils/stream.ts": 2889,
-    "src/app/(dashboard)/dashboard/HomePageClient.tsx": 1381,
-    "src/app/(dashboard)/dashboard/analytics/ComboHealthTab.tsx": 1031,
-    "src/app/(dashboard)/dashboard/api-manager/ApiManagerPageClient.tsx": 3117,
-    "src/app/(dashboard)/dashboard/cache/media/MediaPageClient.tsx": 1067,
-    "src/app/(dashboard)/dashboard/combos/page.tsx": 4647,
-    "src/app/(dashboard)/dashboard/costs/CostOverviewTab.tsx": 1283,
-    "src/app/(dashboard)/dashboard/costs/quota-share/components/PoolWizard.tsx": 1022,
-    "src/app/(dashboard)/dashboard/endpoint/EndpointPageClient.tsx": 2615,
-    "src/app/(dashboard)/dashboard/health/page.tsx": 1165,
-    "src/app/(dashboard)/dashboard/providers/[id]/components/modals/EditConnectionModal.tsx": 1316,
-    "src/app/(dashboard)/dashboard/providers/page.tsx": 1923,
-    "src/app/(dashboard)/dashboard/runtime/RuntimePageClient.tsx": 1201,
-    "src/app/(dashboard)/dashboard/settings/components/PricingTab.tsx": 1019,
-    "src/app/(dashboard)/dashboard/settings/components/ProxyRegistryManager.tsx": 1464,
-    "src/app/(dashboard)/dashboard/settings/components/ResilienceTab.tsx": 1123,
-    "src/app/(dashboard)/dashboard/settings/components/RoutingTab.tsx": 1629,
-    "src/app/(dashboard)/dashboard/settings/components/SystemStorageTab.tsx": 1573,
-    "src/app/(dashboard)/dashboard/usage/components/BudgetTab.tsx": 1028,
-    "src/app/(dashboard)/dashboard/usage/components/EvalsTab.tsx": 2148,
-    "_rebaseline_2026_07_30_8916_quota_compact_layout": "PR #8916 (apoapostolov, feat/improve-provider-quota-layouts) own growth: src/app/(dashboard)/dashboard/usage/components/ProviderLimits/index.tsx 1109->1153 (+44) adds Full/Compact layout toggle — LS_LAYOUT_MODE constant, LayoutMode type, layoutMode state, toggleLayoutMode callback, toggle button with icon. At existing filter/settings chokepoint. Not extractable without splitting state + toolbar away from data-fetching. Covered by tests/unit/quota-card-grid-compact-layout-8916.test.ts.",
-    "src/app/(dashboard)/dashboard/usage/components/ProviderLimits/index.tsx": 1153,
-    "src/app/api/providers/[id]/models/route.ts": 2250,
-    "src/app/api/v1/models/catalog.ts": 1549,
-    "src/lib/db/apiKeys.ts": 1529,
-    "src/lib/db/core.ts": 1637,
-    "src/lib/db/migrationRunner.ts": 1077,
-    "src/lib/db/models.ts": 1097,
-    "src/lib/db/providers.ts": 1034,
-    "src/lib/memory/retrieval.ts": 1073,
-    "src/lib/tailscaleTunnel.ts": 1202,
-    "src/lib/usage/providerLimits.ts": 1013,
-    "src/shared/components/OAuthModal.tsx": 1134,
-    "src/shared/components/RequestLoggerV2.tsx": 1629,
-    "src/shared/components/analytics/charts.tsx": 1035,
-    "src/shared/services/cliRuntime.ts": 1122,
-    "src/sse/handlers/chat.ts": 1845,
-    "src/sse/services/auth.ts": 2508,
-    "tests/unit/account-fallback-service.test.ts": 1572,
-    "tests/unit/provider-validation-specialty.test.ts": 2980,
-    "open-sse/executors/hyperagent.ts": 1026
-  },
-  "_rebaseline_2026_07_27_v3849_train2": "Merge-train 2 (7 PRs) — owner-approved 2026-07-27. Single entry: chatCore.ts 4955->5006 (#8595, Responses multi-turn image compaction before the context hard-reject). Genuine irreducible growth at the existing compaction chokepoint in handleChatCore — the PR adds a last-resort retry against the concrete budget plus the estimateFinalInputTokens helper, both wired at the pre-existing call site rather than a new branch. Covered by tests/unit/8560-responses-image-compaction.test.ts (4 tests).",
-  "_rebaseline_2026_07_27_v3849_train3": "Merge-train 3 (13 PRs) — owner-approved 2026-07-27. Both entries are genuine irreducible growth at existing chokepoints, not new branches: src/lib/db/apiKeys.ts 1518->1529 (#8805 cx/* ≡ codex/* API-key model permissions); open-sse/handlers/chatCore.ts 5006->5020 (#8806 real response payload into plugin onResponse hooks). Covered by tests/unit/db-apiKeys-crud.test.ts (4 new cases) and the two plugin-hook test files updated in #8806 respectively.",
-  "_rebaseline_2026_07_28_8842_antigravity_projectid_refresh": "PR #8842 (fix/antigravity-projectid-refresh) own growth: open-sse/executors/antigravity.ts 1493->1528 (+35 = projectId discovery in refreshCredentials: import ensureAntigravityProjectAssigned + trim projectId + call ensureAntigravityProjectAssigned with 8s timeout + persistDiscoveredAntigravityProjectId + log success/failure). Irreducible wiring at the existing credential-refresh chokepoint. Covered by tests/unit/executor-antigravity.test.ts (4 new test cases).",
-  "_rebaseline_2026_07_28_8842_antigravity_test": "PR #8842 test growth: tests/unit/executor-antigravity.test.ts new testFrozen 1098 (4 new test cases for projectId discovery during refresh: discovers when empty, skips when set, handles failure, skips when access_token not a string). All above cap 1000 on day one.",
-  "_rebaseline_2026_07_28_8860_tokenrefresh_projectid": "PR #8860 (fix/antigravity-projectid-centralized) own test growth: tests/unit/token-refresh-service.test.ts 1311->1378 (+67 = 4 cases covering projectId discovery on the tokenRefresh.ts path — the Dashboard/health-check refresh route, which #8842 did not reach since that fixed the executor path). Covered by the same file.",
-  "_rebaseline_2026_07_28_8861_xiaomi_token_plan": "PR #8861 (feat/xiaomi-token-plan-protocol-selector) own growth: EditConnectionModal.tsx 1283->1316 (+33 = the per-connection API-protocol selector field) and open-sse/executors/base.ts 1540->1562 (+22 = alternate-format resolution at the existing buildUrl/headers chokepoint). Both are irreducible wiring at existing call sites.",
-  "_rebaseline_2026_07_28_8863_firefly_detail_level": "PR #8863 (fix/adobe-firefly-gpt-detail-level-max) own growth: adobeFireflyClient.ts 2317->2322 (+5 = gpt-image detailLevel defaulting to maximal at the existing payload-build site). Covered by tests/unit/adobe-firefly.test.ts.",
-"_rebaseline_2026_07_29_8281_home_quickstart_prefetch": "Release v3.8.49 base-red fix (no PR — captain sweep): src/app/(dashboard)/dashboard/HomePageClient.tsx 1377->1381 (+4). #8292 added prefetch={false} to the sidebar but left /home's five quick-start Links prefetching, so first paint still fired 12 speculative RSC requests — caught by navigation.spec.ts only after the e2e helper bug (APP_ROUTE_PATTERN missing /home) was repaired in the same cycle. Growth is the five prefetch attributes; it was offset first by extracting the repeated className literals (INLINE_LINK x4, DOCS_LINK x1), which collapsed five wrapped <Link> blocks back to one line each — a naive fix measured 1391. Guard: tests/unit/sidebar-prefetch-policy-8281.test.ts.",
-  "_rebaseline_2026_08_02_v3850_agentrouter_responses": "Release v3.8.50 AgentRouter/Codex compatibility reconciliation. open-sse/executors/base.ts 1562->1578: #9190 wires AgentRouter's selected Claude/OpenAI/Responses protocol through the existing executor URL, auth, identity-header and fingerprint chokepoints; the reusable alternate resolver remains outside base.ts. open-sse/utils/stream.ts 2887->2889: #9213 evaluates Responses ID and usage normalization independently so response.completed always receives finite usage.total_tokens instead of short-circuiting after an ID rewrite. tests/unit/chatcore-translation-paths.test.ts 2769->2776: #9191 updates the existing Claude-Code bridge assertions for the dynamic AgentRouter wire image. PR #9224 offsets its own chatCore growth by extracting the AgentRouter protocol decisions into chatCore/agentRouterProtocol.ts, leaving chatCore below its frozen ceiling. Covered by agentrouter executor/chatCore protocol tests, chatcore translation-path tests, and responses-commentary-passthrough tests."
+  "_rebaseline_2026_07_07_6525_chirag_image_guard": "PR #6525 (@chirag127, #6457) own growth: chat.ts ->1778 (reject image-only models on /v1/chat/completions; stacks on #6515). Owner-approved. Frozen."
 }

config/quality/install-upgrade-allowlist.json

@@ -1,6 +0,0 @@
-{
-  "_doc": "Tables that exist ONLY in databases upgraded from an older version — residue whose CREATE left the migration set in some past cycle but survives where it already existed. Harmless (nothing references them), but recorded here so check-install-upgrade.mjs can still fail on a NEW divergence. The opposite direction (a table a clean install creates but an upgrade does not) is NEVER allowlisted: it means every existing user is missing structure the code expects.",
-  "residualTables": {
-    "cache_metrics": "Measured 2026-07-30 on a real 3.8.48 install upgraded to 3.8.49 (VPS .16, 165 MB database, 114 → 117 tables). Present in upgraded databases, absent from clean installs. No code path referenced it during the upgrade (zero `no such table` in 150 log lines, both installs healthy). Left in place rather than dropped: a DROP migration on a table we cannot prove is unused everywhere is the riskier change. Revisit when the cache subsystem is next touched."
-  }
-}

config/quality/quality-baseline.json

@@ -27,23 +27,22 @@
       "eps": 0
     },
     "coverage.statements": {
-      "value": 80.8,
+      "value": 76.5,
       "direction": "up",
       "tightenSlack": 5
     },
     "coverage.lines": {
-      "value": 80.8,
+      "value": 76.5,
       "direction": "up",
       "tightenSlack": 5
     },
     "coverage.functions": {
-      "value": 86.42,
+      "value": 82,
       "direction": "up",
-      "tightenSlack": 5,
-      "_rebaseline_2026_07_17_combo_recovery_hints": "86.44 -> 86.42 (-0.02). PR #7625: adds failureTracker.ts with new functions (+2 function definitions). Coverage denominator grew by 2 functions; numerator unchanged (the 8 coverage shards do not exercise failureTracker.ts). Legitimate drift from feature addition, not regression. Tighten via --require-tighten next cycle."
+      "tightenSlack": 5
     },
     "coverage.branches": {
-      "value": 78.1,
+      "value": 73,
       "direction": "up",
       "eps": 1.5,
       "tightenSlack": 5
@@ -55,49 +54,49 @@
       "tightenSlack": 10
     },
     "coverage.combo.lines": {
-      "value": 85.42,
+      "value": 80,
       "direction": "up",
       "eps": 1.5,
       "tightenSlack": 10
     },
     "coverage.accountFallback.lines": {
-      "value": 96.78,
+      "value": 88,
       "direction": "up",
       "eps": 1.5,
       "tightenSlack": 10
     },
     "coverage.auth.lines": {
-      "value": 92.55,
+      "value": 90,
       "direction": "up",
       "eps": 1.5,
       "tightenSlack": 10
     },
     "coverage.routeGuard.lines": {
-      "value": 98.73,
+      "value": 94,
       "direction": "up",
       "eps": 1.5,
       "tightenSlack": 10
     },
     "coverage.error.lines": {
-      "value": 92.13,
+      "value": 88,
       "direction": "up",
       "eps": 1.5,
       "tightenSlack": 10
     },
     "coverage.publicCreds.lines": {
-      "value": 99.07,
+      "value": 92,
       "direction": "up",
       "eps": 1.5,
       "tightenSlack": 10
     },
     "coverage.circuitBreaker.lines": {
-      "value": 95.09,
+      "value": 92,
       "direction": "up",
       "eps": 1.5,
       "tightenSlack": 10
     },
     "openapiCoverage.pct": {
-      "value": 38,
+      "value": 38.0,
       "direction": "up",
       "eps": 0.5,
       "_tighten_2026_07_04_v3844_release": "36.9 -> 39.3 (aperto exigido pelo --require-tighten no PR de release #5925). A cobertura OpenAPI melhorou no ciclo (9 rotas documentadas em 8fb020676 + as rotas novas de #5939/#5817/#6034/#5998 documentadas junto das features). 39.3 = valor medido pelo CI Quality Ratchet no run 28708141003 (tip 00c55afcb).",
@@ -106,13 +105,12 @@
       "_rebaseline_2026_07_13_v3847_release": "39.3 -> 38.0 (-1.3, beyond the 0.5 eps). v3.8.47 cycle drift: the cycle merged ~45 PRs adding API routes (relay repair/free-pool #6909, backpressure #6590, combo context requirements #6907, services/usage endpoints) faster than openapi.yaml documentation; same class as the v3.8.34/v3.8.39 rebaselines. Documented follow-up: raise coverage next cycle via docs/openapi.yaml additions."
     },
     "i18nUiCoverage.pct": {
-      "value": 99,
+      "value": 75.5,
       "direction": "up",
       "eps": 0.5,
       "_rebaseline_2026_07_04_v3844_release": "77.5 -> 76.8 (-0.7, beyond the 0.5 eps). v3.8.44 cycle drift surfaced only on the release PR (i18n-ui-coverage does NOT run on PR->release fast-gates). The cycle added ~1352 new UI keys to the en.json denominator (Discovery dashboard tab #5939, Bifrost/Mux embedded-service tabs #5817/#6034, proxy batch-ops #5918, fusion defaults #5598, tool-source toggle #5978, quota-row collapse #5977, CodeWhale/Crush CLI cards #5996/#5970, etc.) that the async i18n translation workflow has not yet back-filled (worst locales measure 76.8; __MISSING__ placeholders count as uncovered by design). Same shape and remedy as _rebaseline_2026_06_28_v3839_release. Recover via the i18n workflow next cycle; tighten with --require-tighten once translations land.",
       "_rebaseline_2026_06_28_v3839_release": "78.4 -> 77.5 (-0.9, beyond the 0.5 eps). v3.8.39 cycle drift surfaced ONLY on the release PR (i18n-ui-coverage does NOT run on PR->release fast-gates). The cycle added new UI strings (compression studio TOON A/B table, antigravity remote-login dashboard field, amber warning icon) to the en denominator faster than the 37 non-en locales were translated; those locales need `npm run i18n:run` with OMNIROUTE_TRANSLATION_API_KEY (unavailable locally) — same precedent as _rebaseline_2026_06_18_v3828_cycle_close + _quality_rebaseline_2026_06_20_ci_ratchet. Measured by CI collect-metrics (run 28317145160) = 77.5. My release-finalize tree changes no src/i18n/messages/*.json. Tightening is tracked as follow-up (run i18n:run with creds).",
-      "_rebaseline_2026_07_13_v3847_release": "76.8 -> 75.5 (-1.3, beyond the 0.5 eps). v3.8.47 cycle drift: merged UI features added EN strings (relay repair UI #6909, combo builder #6907/#6991, capability override UI #6727) ahead of the 42-locale mirrors; same class as the v3.8.39/v3.8.44 rebaselines.",
-      "_rebaseline_2026_07_28_v3849_release": "75.5 -> 99 (+23.5). Aperto EXIGIDO pelo modo --require-tighten do ratchet: a métrica melhorou de verdade no ciclo v3.8.49. A causa é o workflow assíncrono de tradução, que finalmente alcançou o denominador em EN — as rebaselines anteriores (v3.8.39/.44/.47) foram todas afrouxamentos registrando o atraso das traduções, e agora ele foi pago. O coletor SUBTRAI os placeholders (present - placeholder em scripts/quality/collect-metrics.mjs), então os 317 marcadores __MISSING__ que esta release introduziu para o drift de valor já estão descontados dos 99 — o número é honesto, não inflado por placeholder. Medido pelo collect-metrics do CI no run 30404226939."
+      "_rebaseline_2026_07_13_v3847_release": "76.8 -> 75.5 (-1.3, beyond the 0.5 eps). v3.8.47 cycle drift: merged UI features added EN strings (relay repair UI #6909, combo builder #6907/#6991, capability override UI #6727) ahead of the 42-locale mirrors; same class as the v3.8.39/v3.8.44 rebaselines."
     },
     "deadExports": {
       "value": 227,
@@ -124,10 +122,7 @@
       "_rebaseline_2026_06_26_v3837_release": "343->345. v3.8.37 cycle drift surfaced by the release-green pre-flight (the Quality Ratchet does NOT run on PR->release fast-gates, so warnings/complexity accrued unmeasured across this cycle's 76 commits — provider adds DGrid/Pioneer/xAI, headroom proxy lifecycle #4649, ~50 SSE/translator fixes, Engine Combos #5062). Trust-but-verify: this release-finalize working tree touches ONLY CHANGELOG.md, docs/i18n/*/CHANGELOG.md mirrors, and these baselines — 0 production-code change, so all drift is inherited cycle drift (`any` warn-allowed in open-sse/ + tests/). Tighten via --require-tighten next cycle."
     },
     "cognitiveComplexity": {
-      "value": 1223,
-      "_rebaseline_2026_07_25_8470_hyperagent_sticky_thread": "951->957 (+6). PR #8470 (artickc, fix/hyperagent-tool-loop-thread-sticky) pre-green validation. Trust-but-verify: origin/release/v3.8.49 tip alone (pristine, no PR changes) already measures 956 with node scripts/check/check-cognitive-complexity.mjs — i.e. +5 is inherited cycle drift unrelated to this PR (cognitive-complexity does not run on PR->release fast-gates). This PR's OWN growth adds exactly +1: per-file eslint scoped scan (eslint --config eslint.complexity-ratchets.config.mjs open-sse/executors/hyperagent.ts) on base vs PR shows extractMessageText() crossing the threshold for the first time (new sonarjs/cognitive-complexity violation, 26 > 15) from the new Anthropic tool_use/tool_result flattening branches; resolveHyperAgentThreadBinding's existing pre-#8470 violation (16) grows to 21 (still counted once) from the new root-key lookup tier; createHyperAgentThread and execute() are unchanged pre-existing violations. Net repo-wide total = 956 (inherited drift) + 1 (this PR's own new violation) = 957. Full-repo re-measurement of the merged branch was attempted but not completed live due to heavy concurrent devbox load (many other /green-prs sessions running the identical full-repo eslint scan in parallel); the value here is derived from two independently-clean measurements (base-tip full scan + per-file base-vs-PR delta) rather than a third full-repo run. Covered by tests/unit/executor-hyperagent.test.ts (19/19). Tighten via --update next cycle.",
-      "_rebaseline_2026_07_25b_v3849_mergetrain_owngrowth": "Owner-approved (chat, 2026-07-25): 956->968 (+12). v3.8.49 /merge-prs 41-PR merge-train aggregate own-growth: measured 968 on the combined boarded tree (tip ac15014ca7) vs 956 on the pristine release tip. The batch's new over-threshold functions come from the pre-screen-flagged complexity-growth set (#8378/#8432/#8476/#8526 etc); each PR is under-ceiling alone, the combined batch adds +12. Same merge-burst class as the notes below; owner chose ceiling-absorb over per-PR extraction. Structural shrink tracked in #3501; tighten via --update next cycle.",
-      "_rebaseline_2026_07_25_v3849_mergequeue_drain": "Owner-approved (chat, 2026-07-25): 951->956 (+5). v3.8.49 /merge-prs queue-drain: inherited cognitive-complexity drift from the cycle's merge burst (base-red slices + owner PRs + parallel-session merges #8500-8508); check:cognitive-complexity does not run on PR->release fast-gates, so it accrued unmeasured. Measured 956 on the pristine release tip 4053e2314a alone (BEFORE any queue PR boards) — the entire +5 is base drift already on the tip, reddening Fast Quality Gates for every merge-ready PR. Owner approved raising the ceiling to the measured tip value so the ~34-PR merge-train lands without per-PR extraction churn. Structural shrink tracked in #3501; tighten via --update next cycle.",
+      "value": 890,
       "_rebaseline_2026_07_10_gcf_v3_2": "885->888 (+3). PR feat/headroom-gcf-v3.2-nested-flattening: own growth from re-vendoring the GCF (Headroom) codec to spec v3.2 (nested flattening). The new over-threshold functions are the vendored v3.2 flatten/unflatten walk in open-sse/services/compression/engines/headroom/gcf/{generic,decode_generic}.ts. Imported third-party code kept byte-faithful to upstream gcf-typescript; measured 888 with the update vs 885 on the pristine origin/release/v3.8.47 tip. Guarded by tests/unit/compression/headroom-smartcrusher.test.ts (deep-nested case). Structural shrink belongs upstream in gcf.",
       "_rebaseline_2026_07_12_v3847_mergetrain_burst": "885->890 (+5). v3.8.47 /merge-prs merge-train batch (23 merge-ready PRs) inherited drift: cognitive-complexity does NOT run on PR->release fast-gates, so incidental growth accrued unmeasured across the batch. Measured 890 on the combined merge-train tip (5d980352d) vs 885 on the pristine release tip 1b7a9150e. #6838 (headroom gcf codec re-vendor) accounts for +3 (its own baseline bump to 888, superseded here by this later 890 rebaseline which already covers it); the remaining +2 is parallel-batch drift across the other 22 PRs. Owner-approved rebaseline (merge-burst reconciliation, same class as the v3.8.46/v3.8.44 notes below). Tighten via --update next cycle.",
       "_rebaseline_2026_07_09_6587_kiro_api_key_auth": "884->885 (+1). PR #6587 (@strangersp) own growth: open-sse/services/usage/kiro.ts gains ONE new over-threshold function — getKiroUsage grew from a single fetch to a 3-endpoint fallback chain (codewhisperer-get / codewhisperer-post / q-get) with per-attempt auth-header selection (tokentype: API_KEY vs Bearer-only), needed so usage/quota lookups work for the new long-lived-API-key auth path in addition to the existing OAuth path (measured: 0 violations on release tip -> 1 violation, complexity 33, at open-sse/services/usage/kiro.ts). Covered by tests/unit/kiro-iam-profilearn-usage.test.ts (tokentype header selection, friendly auth-expired/rejected-token messages). Cohesive multi-endpoint-fallback logic at an existing usage chokepoint; not extractable without splitting the fallback loop mid-merge. Structural shrink tracked in #3501.",
@@ -149,9 +144,7 @@
       "_rebaseline_2026_06_26_v3838_release": "826->833. v3.8.38 release base measures 833 locally on origin/release/v3.8.38 (800b04ad6) while the committed baseline still says 826. This PR measures the same 833 after refactoring jsonToSse helpers back under the sonarjs/cognitive-complexity threshold, so it does not add a net cognitive-complexity violation. The baseline bump records inherited release-base drift only; structural shrink remains tracked by the existing chatCore decomposition work.",
       "_rebaseline_2026_07_06_v3845_release_close": "867->877 (+10). v3.8.45 cycle drift measured by check:release-green (hermetic) on release tip 5ecca12aa5 during the /generate-release Phase 0 pre-flight. Inherited from the cycle's merge burst (cognitive-complexity does not run on PR->release fast-gates); the captain's pre-flight fixes are gate/test/workflow changes (complexity-neutral). Tighten via --update next cycle.",
       "_rebaseline_2026_07_07_6519_chirag_fallback_reasons": "882->883 (+1). PR #6519 (@chirag127, #6461): the preview route's fallbackReasons dedup loop adds one function over the cognitive threshold. Owner-approved rebaseline (contributor own-growth). Tighten via --update next cycle.",
-      "_rebaseline_2026_07_08_6556_inherited_drift": "883->884 (+1). PR #6556 (omniglyph engine): drift herdado do merge burst da base (cognitive-complexity nao roda no fast-path PR->release). Trust-but-verify: check:cognitive-complexity mede 884 IDENTICO na base pura origin/release/v3.8.47 e neste HEAD — o PR e cognitive-net-zero (runCompressionAsync extraido para engines/omniglyphSingleMode.ts e o page client dividido em section components na mesma rodada). Tighten via --update next cycle.",
-      "_rebaseline_2026_07_19_v3849_fix_sweep_cluster": "890->900 (owner-approved, 2026-07-19). Same /fix-prs cluster as the complexity note: the clean-by-cyclomatic subset still bumped cognitive-complexity (measured 896 on the 9-PR combined probe tip vs 890 baseline). Raised to 900 = 896 + 4 headroom, matching the complexity rebaseline. Tighten via --update next cycle.",
-      "_note_8266": "2026-07-23: +1 own-growth from #8266 (@backryun) Alibaba media provider dispatch wiring"
+      "_rebaseline_2026_07_08_6556_inherited_drift": "883->884 (+1). PR #6556 (omniglyph engine): drift herdado do merge burst da base (cognitive-complexity nao roda no fast-path PR->release). Trust-but-verify: check:cognitive-complexity mede 884 IDENTICO na base pura origin/release/v3.8.47 e neste HEAD — o PR e cognitive-net-zero (runCompressionAsync extraido para engines/omniglyphSingleMode.ts e o page client dividido em section components na mesma rodada). Tighten via --update next cycle."
     },
     "typeCoveragePct": {
       "value": 92.17,
@@ -165,23 +158,17 @@
       "dedicatedGate": true
     },
     "secretFindings": {
-      "_note": "Zeroed 2026-07-13 (WS6/D3): the 3 frozen generic-api-key FPs are allowlisted with justification in .gitleaks.toml — any NEW finding regresses the ratchet.",
-      "value": 0,
+      "value": 3,
       "direction": "down",
       "dedicatedGate": true
     },
     "zizmorFindings": {
-      "value": 190,
-      "_rebaseline_2026_07_20_aliasresolver_hook_split_7808": "175 -> 176 (+1). Companion to PR #7808 (CodeQL js/incomplete-url-substring-sanitization fix in bin/aliasResolver.mjs). The +1 is NOT caused by this PR's code changes (bin/* is not a workflow file) — it is a pre-existing drift that surfaced because the ratchet gate runs on this PR's CI: the zizmor scanner version on the GitHub runner gained a new rule (or extended an existing one) since the v3.8.49 baseline was seeded on 2026-07-17. Breakdown: the new finding is an unpinned-uses @vN class item on one of the existing workflows (same deliberate convention as _scanner_harden_workflows_2026_06_16 — @vN is intentional, SHA-pinning only this one would violate the convention). No new template-injection/artipacked/cache-poisoning/dangerous-triggers classes introduced. Measured by the Quality Gates (Extended) job on run 29713001401 = 176, baseline was 175. Note: by the time this landed on release/v3.8.49, the baseline was already at 176 via _rebaseline_2026_07_17_combo_recovery_hints — this entry is kept as historical record; no further bump applied.",
-      "_rebaseline_2026_07_17_v3849_release": "169 -> 175 (+6). Cycle workflow drift (v3.8.48/v3.8.49): npm-publish.yml (new, WS1.3 #7092), electron-release.yml, nightly-compat.yml, nightly-release-green.yml, CI restructures (#7501 full-history base fetch, #7355 main-green, #7202 merge-queue gates, Trunk/Codecov). Breakdown vs v3.8.47: +3 unpinned-uses (@vN convention, deliberate per _scanner_harden_workflows_2026_06_16), +2 cache-poisoning (artifact upload/cache in the OWN electron-release/npm-publish RELEASE workflows -- operator-controlled, not fork-PR exploitable), +1 excessive-permissions (nightly-compat.yml permissions:issues). No new template-injection/artipacked/dangerous-triggers. Measured with zizmor 1.25.2 via `node scripts/check/check-workflows.mjs --ratchet` = 175 on da3a0be69.",
+      "value": 169,
       "direction": "down",
       "dedicatedGate": true,
-      "_rebaseline_2026_07_17_combo_recovery_hints": "175 -> 176 (+1). Pre-existing workflow drift on source branch (PR #7625 touches zero workflow files). Measured 176 via CI check-workflows same as unmodified upstream/main tip. No new findings from this PR's changes. Same class as _rebaseline_2026_07_17_v3849_release. Tighten via --update next cycle.",
       "_rebaseline_2026_06_23_fastpath_gates": "155 -> 159 (+4). Two new jobs added to .github/workflows/quality.yml (fast-vitest, fast-unit) to run vitest + the full unit suite on the PR->release fast-path (release-acceleration plan, _tasks/release-bench/v3.8.35/PLANO-IMPLEMENTACAO.md). The +4 are unpinned-uses: actions/checkout@v7 + actions/setup-node@v6 in each of the 2 jobs — the SAME deliberate @vN convention as every other workflow (see _scanner_harden_workflows_2026_06_16). SHA-pinning only these would violate the convention. No new template-injection/artipacked/cache-poisoning. Measured locally via `npm run check:workflows -- --ratchet` = 159.",
       "_rebaseline_2026_06_23_v3834_release": "152 -> 155 (+3). The 3 new unpinned-uses are in .github/workflows/nightly-release-green.yml (added by #4622 this cycle): actions/checkout@v7, actions/setup-node@v6, actions/upload-artifact@v4 — the SAME deliberate @vN convention as ci.yml's own checkout@v7/setup-node@v6 and every other workflow (see _scanner_harden_workflows_2026_06_16 + _zizmor_rebaseline_2026_06_20_ci_build_artifact_reuse). SHA-pinning only this workflow would violate the convention. The workflow-lint ratchet does NOT run on PR->release fast-gates, so it surfaced only on the release PR; measured locally via `npm run check:workflows -- --ratchet` = 155. No new template-injection/artipacked/cache-poisoning.",
-      "_rebaseline_2026_07_13_v3847_release_preflight": "159 -> 169 (+10). Findings from cycle-merged workflow changes: #6716 (PR gate restructure), #6781 (unit fast-path shard 2->4), #6788 (TIA tsx loader split), #6881 (electron-updater latest.yml manifests in release assets) — same deliberate @vN unpinned-uses convention as prior rebaselines; no new template-injection/artipacked/cache-poisoning classes. Measured via `npm run check:workflows -- --ratchet` = 169 on the v3.8.47 release pre-flight.",
-      "_rebaseline_2026_07_28_v3849_release_preflight": "176 -> 189 (+13). Pre-flight de fechamento da v3.8.49 (934 commits no ciclo). Deriva de workflow: 1 workflow novo (build-rinseaid-image.yml) mais os bumps de action do Dependabot ao longo do ciclo — todos da MESMA classe unpinned-uses @vN, convenção deliberada do repo (ver _scanner_harden_workflows_2026_06_16); fixar por SHA só estes violaria a convenção. Nenhuma classe nova de template-injection / artipacked / cache-poisoning / dangerous-triggers. Nesta mesma passada foram CORRIGIDAS 3 diretivas shellcheck malformadas (SC1125: `# shellcheck disable=SC2086 — texto`, em que o travessão invalida o par key=value) em ci.yml e nightly-release-green.yml. Medido com zizmor 1.25.2 via `npm run check:workflows -- --ratchet` = 189.",
-      "_rebaseline_2026_07_28_ci_runner_delta": "189 -> 190 (+1). Medido 189 no devbox e 190 no runner do GitHub no MESMO commit (run 30396592013, job Quality Gates (Extended)) — mesma classe já registrada em _rebaseline_2026_07_20_aliasresolver_hook_split_7808: a versão do zizmor no runner enxerga uma finding a mais que a local, sempre da classe unpinned-uses @vN. O valor do runner é o que o gate compara, então a baseline segue o runner."
+      "_rebaseline_2026_07_13_v3847_release_preflight": "159 -> 169 (+10). Findings from cycle-merged workflow changes: #6716 (PR gate restructure), #6781 (unit fast-path shard 2->4), #6788 (TIA tsx loader split), #6881 (electron-updater latest.yml manifests in release assets) — same deliberate @vN unpinned-uses convention as prior rebaselines; no new template-injection/artipacked/cache-poisoning classes. Measured via `npm run check:workflows -- --ratchet` = 169 on the v3.8.47 release pre-flight."
     },
     "vulnCount": {
       "value": 10,
@@ -189,12 +176,10 @@
       "dedicatedGate": true
     },
     "bundleSize": {
-      "value": 7666,
+      "value": 6534,
       "direction": "down",
       "dedicatedGate": true,
-      "_rebaseline_2026_07_07_v3846_release_close": "5601->6534 (+933). v3.8.46 release close: gzip of the 4 bin/*.mjs entrypoints (size-limit + @size-limit/file) grew from this cycle's feature/fix merges pulled transitively into the CLI entrypoints (new providers, combo pipeline strategy #6396, effort/thinking standardization #6241, catalog cache-invalidation #6408). Measured 6534 locally via `check:bundle-size --ratchet` (deterministic gzip, matches CI). Legitimate cycle growth; shrink is separate debt.",
-      "_rebaseline_2026_07_19_7808_codeql_alias_resolver_hook": "6534->6762 (+228). PR #7808 (CodeQL js/incomplete-url-substring-sanitization fix): the ESM loader hook source moved out of the inline `HOOK_SOURCE` template literal in bin/aliasResolver.mjs into a real file bin/aliasResolverHook.mjs, loaded via pathToFileURL() instead of a dynamically-built `data:text/javascript,...` URL. The new file is now counted by size-limit as a 5th bin/*.mjs entrypoint. Net +228 = the hook's gzip size (previously hidden inside aliasResolver.mjs because the template literal was compressed away). Security-driven; no shrink opportunity.",
-      "_rebaseline_2026_07_28_v3849_release_preflight": "6762 -> 7666 (+904). Fechamento do ciclo v3.8.49: gzip dos entrypoints bin/*.mjs (size-limit + @size-limit/file) cresceu com o que os merges do ciclo puxam transitivamente para o CLI (novos provedores — 271->290, seletor de protocolo por conexão #8861, catálogos de busca #8814, resiliência). Crescimento legítimo de ciclo, medido localmente com `npm run check:bundle-size` = 7666 (gzip determinístico, bate com o CI). Encolher é dívida separada."
+      "_rebaseline_2026_07_07_v3846_release_close": "5601->6534 (+933). v3.8.46 release close: gzip of the 4 bin/*.mjs entrypoints (size-limit + @size-limit/file) grew from this cycle's feature/fix merges pulled transitively into the CLI entrypoints (new providers, combo pipeline strategy #6396, effort/thinking standardization #6241, catalog cache-invalidation #6408). Measured 6534 locally via `check:bundle-size --ratchet` (deterministic gzip, matches CI). Legitimate cycle growth; shrink is separate debt."
     },
     "openapiBreaking": {
       "value": 0,
@@ -202,6 +187,12 @@
       "dedicatedGate": true,
       "_note": "oasdiff breaking-change gate (Fase 9 Onda 0). Blocks any breaking change vs base spec."
     },
+    "semgrepFindings": {
+      "value": 0,
+      "direction": "down",
+      "dedicatedGate": true,
+      "_note": "semgrep owasp/secrets findings. ADVISORY until first CI value is frozen, then flip blocking (Fase 9)."
+    },
     "mutationScore.src/sse/services/auth.ts": {
       "value": 52.57,
       "direction": "up",
@@ -392,7 +383,5 @@
   "_comment_mutationScore": "Per-module COVERED mutation score floors (detected/(detected+survived)), seeded ~2pt below the first full measurement (run 27823984918: split batches a1/a2/b1/b2/c1/c2/d + e/f/g/h/i). direction:up + dedicatedGate:true -> enforced ONLY by check-mutation-ratchet.mjs (the generic check-quality-ratchet skips dedicatedGate metrics), in the nightly-mutation aggregation job.",
   "_zizmor_rebaseline_2026_06_19_r1_redundancy": "zizmorFindings 139 -> 145. Quebra: +3 drift PRE-EXISTENTE da base release/v3.8.30 a23d0d678 (medido com minhas mudancas stashed = 142 > 139; o fast-path do release nao roda check:workflows --ratchet) + 3 do novo workflow mutation-redundancy.yml (R1 disableBail): exatamente 3 unpinned-uses de actions/checkout@v7, actions/setup-node@v6, actions/upload-artifact@v7 — a MESMA convencao @vN deliberada e INTOCADA de todos os workflows (ver _scanner_harden_workflows_2026_06_16), identica ao nightly-mutation.yml. SHA-pinar so este workflow violaria a convencao. NOTA DE COLISAO CROSS-PR: o PR #4321 (a11y) tambem rebaselina este metric 139->145 (+3 do job a11y) off a MESMA base — se ambos mergearem, o total real vira 148 (142 base + 3 a11y + 3 r1) e o segundo a mergear precisa reconciliar zizmorFindings -> 148 (mesmo padrao release-volatil dos baselines de complexity/eslint).",
   "_zizmor_rebaseline_2026_06_19_a11y_148_reconcile": "RECONCILIACAO CROSS-PR (release-volatil) ao mergear #4321 (a11y) APOS #4322 (R1): zizmorFindings 145 -> 148. O #4322 ja rebaselinou 139->145 (drift base 142 + 3 unpinned-uses do mutation-redundancy.yml). Este PR adiciona +3 unpinned-uses @vN do novo job 'a11y' (nightly-resilience.yml): actions/checkout@v7, actions/setup-node@v6, actions/cache@v5.0.5 — MESMA convencao @vN deliberada e INTOCADA de todos os workflows (ver _scanner_harden_workflows_2026_06_16). Total = 142 base + 3 r1 + 3 a11y = 148, MEDIDO com `node scripts/check/check-workflows.mjs --ratchet` na arvore release(com #4322)+#4321 = 148 exato. Nenhum template-injection/artipacked/cache-poisoning novo.",
-  "_zizmor_rebaseline_2026_06_20_ci_build_artifact_reuse": "zizmorFindings 148 -> 152. Drift legitimo deste PR ao reutilizar o artefato next-build do job Build em package-artifact/electron-package-smoke e ao separar o build de compatibilidade Node 26: +4 unpinned-uses novos (2x actions/download-artifact@v8, actions/checkout@v7, actions/setup-node@v6). Mantida a convencao deliberada @vN dos workflows (sem SHA-pinning/manual update burden), conforme precedentes _scanner_harden_workflows_2026_06_16 e _zizmor_rebaseline_2026_06_19_*. Sem novos findings de template-injection/artipacked/cache-poisoning; medido localmente com zizmor 1.25.2 via `npm run check:workflows -- --ratchet` = 152.",
-  "_cognitive_rebaseline_2026_07_27_3850_relax_v2_20pct": "cognitiveComplexity 971->1223 (+252, +26.0% over pristine 971). OWNER-APPROVED TEMPORARY relax for v3.8.50-3.8.54 PREPARE phase (docs/ROADMAP.md). v1 was +48 on 2026-07-27; v2 = v1 +20% buffer = +58 → +252 total (cycle 971 measured pristine → 1223 ceiling). Justification: same as complexity v2 — the v3.8.50 release cut coincides with high-merge activity; owner accepted enlarging the headroom to cover the entire PREPARE phase (5 minor cycles .50-.54) without per-PR rebaseline noise, given that re-tightening is mechanical at v3.8.51 via the combo.ts/chatCore.ts decomposition work scheduled in .51/.52 (ROADMAP.md). RE-TIGHTENING MANDATORY in v3.8.51: target 1009 (shrink of 214 from structural extraction during the decomposition campaigns, or via npm run quality:ratchet -- --update if natural shrink appears earlier). The 1009 floor still gives 38 units of post-tighten headroom vs the current pristine 971. Tracked via same roadmap issue as complexity v2. Window: v3.8.50 (release cut) → v3.8.54 close (RE-TIGHTEN at v3.8.51 prep merge per ROADMAP.md). Last entry unless measured regression. v1 entry retained below for audit trail.",
-  "_cognitive_rebaseline_2026_07_27_3850_relax": "cognitiveComplexity 971->1019 (+48). OWNER-APPROVED TEMPORARY relax for v3.8.50-3.8.54 PREPARE phase (docs/ROADMAP.md). +48 covers Train 1D (+15) + headroom for 3.8.50/.51 batches. RE-TIGHTENING MANDATORY in v3.8.51: target 1009 (from combo.ts/chatCore.ts decomposition scheduled in .51/.52 per ROADMAP.md phases). Tracked via same roadmap issue as complexity. SUPERSEDED by _cognitive_rebaseline_2026_07_27_3850_relax_v2_20pct (v1 +20% buffer) — retained for audit. Last entry unless measured regression."
+  "_zizmor_rebaseline_2026_06_20_ci_build_artifact_reuse": "zizmorFindings 148 -> 152. Drift legitimo deste PR ao reutilizar o artefato next-build do job Build em package-artifact/electron-package-smoke e ao separar o build de compatibilidade Node 26: +4 unpinned-uses novos (2x actions/download-artifact@v8, actions/checkout@v7, actions/setup-node@v6). Mantida a convencao deliberada @vN dos workflows (sem SHA-pinning/manual update burden), conforme precedentes _scanner_harden_workflows_2026_06_16 e _zizmor_rebaseline_2026_06_19_*. Sem novos findings de template-injection/artipacked/cache-poisoning; medido localmente com zizmor 1.25.2 via `npm run check:workflows -- --ratchet` = 152."
 }

config/quality/test-discovery-baseline.json

@@ -41,6 +41,9 @@
     "tests/unit/dashboard/batch/concept-cards.test.tsx",
     "tests/unit/dashboard/batch/list-regression.test.tsx",
     "tests/unit/dashboard/batch/sanitization.test.tsx",
+    "tests/unit/free-budget-card.test.tsx",
+    "tests/unit/free-pool-tab.test.tsx",
+    "tests/unit/guardrails/visionBridgeRouter.test.tsx",
     "tests/unit/omni-skills-page.test.tsx",
     "tests/unit/shared-clipboard.test.tsx",
     "tests/unit/shared/components/AutoRoutingBanner.test.tsx",

config/quality/test-masking-allowlist.json

@@ -36,65 +36,10 @@
     "tests/unit/free-provider-rankings-configured-filter.test.ts": {
       "replacement": "tests/unit/freeProviderRankings-filters.test.ts",
       "reason": "v3.8.45 #6251 supersede #6245: a página Free Provider Rankings migrou do toggle client-side 'Configured Only' (#6245, configuredProviderIds no cliente) para filtros server-side configuredOnly/availableOnly (#6251). O teste antigo pinava a implementação removida (7 asserts quebrados contra código que não existe); o replacement cobre o contrato novo com 11 casos (server-side, lib helper). Verificado legítimo — supersessão documentada no CHANGELOG do #6251."
-    },
-    "tests/unit/video-dashscope.test.ts": {
-      "replacement": "tests/unit/alibaba-video-media.test.ts",
-      "reason": "v3.8.49 #8266 reorganized the Alibaba video catalog: the flat wan2.7-t2v id moved out of the plain \"alibaba\" provider (which now only exposes the dated wan2.7-t2v-2026-06-12) and lives only under \"qwen-cloud\" today. All 6 tests in the deleted file built requests against alibaba/wan2.7-t2v, which the new allowlist now rejects with HTTP 400 (verified directly against VIDEO_PROVIDERS in open-sse/config/videoRegistry.ts before deletion). Coverage for this exact id already exists and was confirmed green pre-deletion in tests/unit/alibaba-video-media.test.ts (including an explicit \"Alibaba rejects video models outside its own allowlist\" case for alibaba/wan2.7-t2v) and tests/unit/qwen-cloud-video-media.test.ts (covers the same flat id under qwen-cloud/wan2.7-t2v). Verified legitimate, not masking."
-    },
-    "tests/unit/usage-analytics-route-extra.test.ts": {
-      "replacement": "tests/unit/usage-analytics-route.test.ts",
-      "reason": "v3.8.49 base-red reconcile: the file was a 100% duplicate — all 10 of its test names exist verbatim (comm -12 verified) among the 22 in tests/unit/usage-analytics-route.test.ts, created by #7700 before #7300 fixed the retention-cutoff fixture only in the main file (reads getUserDatabaseSettings().retention.usageHistory live instead of hardcoding 30d). The stale copy red-failed 'does not double-count raw and aggregated rows' (1 !== 2) against correct production behavior. Zero unique coverage lost; the maintained main file passes 22/22. Verified legitimate, not masking."
-    },
-    "tests/unit/free-budget-card.test.tsx": {
-      "replacement": "tests/unit/ui/free-budget-card.test.tsx",
-      "reason": "v3.8.49 #7840: feat(catalog) map unmapped free tiers — o arquivo foi MOVIDO de tests/unit/ para tests/unit/ui/ junto com a expansão do catálogo (o -M do git não detectou o rename porque o conteúdo mudou junto). O componente FreeBudgetCard continua em src/app/(dashboard)/dashboard/usage/components/ e o teste no novo path cobre o mesmo contrato. Relocação, não deleção."
-    },
-    "tests/unit/guardrails/visionBridgeRouter.test.tsx": {
-      "replacement": "tests/unit/guardrails/visionBridgeRouter.test.ts",
-      "reason": "v3.8.49 #8433: fix(guardrails) Vision Bridge describe-fallback ignora candidatos inalcançáveis — o teste migrou de .tsx para .ts (não renderiza nada, era TSX por engano) no mesmo diretório, com a cobertura do novo comportamento de fallback. Troca de extensão, não perda de cobertura."
-    },
-    "tests/unit/qwen-api-key-auto-create.test.ts": {
-      "replacement": "tests/unit/qwen-settings-route.test.ts",
-      "reason": "v3.8.49 #7866: refactor(qwen) remove o provider OAuth legado — a superfície testada foi DELETADA junto (open-sse/config/providers/registry/qwen/index.ts, open-sse/services/tokenRefresh/providers/qwen.ts, src/lib/oauth/providers/qwen.ts). O fluxo guide-settings que sobrou é coberto pelo replacement (POST escreve o contrato V4 e preserva credenciais alheias; DELETE remove só o que é do OmniRoute)."
-    },
-    "tests/unit/qwen-strip-stream-options-claude-code-port663.test.ts": {
-      "replacement": "tests/unit/qwen-code-config.test.ts",
-      "reason": "v3.8.49 #7866: refactor(qwen) remove o provider OAuth legado — o executor cujo stream_options o teste pinava não existe mais. A integração Qwen Code foi RECONSTRUÍDA para o upstream V4 e o replacement guarda o contrato novo, incluindo a migração da forma root-array da integração removida e a limpeza das credenciais legadas de security.auth."
-    },
-    "tests/unit/ui/provider-plan-config.test.tsx": {
-      "replacement": "tests/unit/quota-plans-route-retired.test.ts",
-      "reason": "v3.8.49 #7127: fix(tests) suíte vitest UI de volta ao verde — a rota Plans e o ProviderPlanConfigClient foram APOSENTADOS; o replacement inverte a asserção e guarda a aposentadoria (o arquivo da rota e o ProviderPlanConfigClient não existem mais, costs-quota-plans saiu do sidebarVisibility e da navegação)."
     }
   },
   "tests/unit/catalog-updates-v3x.test.ts": "v3.8.45 #6248: fix(providers) remove deprecated MiMo V2 entries — os 5 asserts removidos pinavam specs de modelos mimo-v2-* que deixaram de existir no catálogo (54→49). Asserts seguem a remoção dos modelos, não enfraquecimento. Verificado legítimo. Prune após v3.8.45 mergear para main.",
   "tests/unit/xiaomi-mimo-provider.test.ts": "v3.8.45 #6248: fix(providers) remove deprecated MiMo V2 entries — 2 asserts sobre mimo-v2-pro/omni/flash removidos junto com os modelos (21→19). Verificado legítimo, não mascaramento. Prune após v3.8.45 mergear para main.",
   "tests/unit/provider-models-route.test.ts": "v3.8.45 #6170: fix(providers) correct Kiro model catalog to real upstream ids — 3 assert.ok positivos de ids fabricados (claude-opus-4.7/sonnet-4.6) substituídos por 1 assert positivo de conjunto + 1 assert NEGATIVO garantindo que os ids fabricados sumiram (310→309). Asserts migrados ao catálogo real, não enfraquecidos. Verificado legítimo. Prune após v3.8.45 mergear para main.",
-  "tests/unit/copilot-gemini-claude-route-no-responses.test.ts": "v3.8.45 #6154: fix(providers) refresh GitHub Copilot catalog — 2 asserts combinados (registry-exists + par claude/gemini) reescritos como loop per-model com assert.ok individual por id do catálogo novo (7→6). Asserts reestruturados ao catálogo atualizado, não enfraquecidos. Verificado legítimo. Prune após v3.8.45 mergear para main.",
-  "tests/unit/agy-gemini-3696-tier-passthrough.test.ts": "v3.8.49 #8013: refactor(antigravity) align official clients and callable catalog — o id gemini-3.1-pro-high foi aposentado do catálogo público (o upstream rejeita a discovery slot com 400) e a tier High passou a usar o id distinto gemini-pro-agent, então o assert de passthrough do id aposentado foi removido (net 3→2). Superfície verificada inexistente em open-sse/config/antigravityModelAliases.ts; cobertura de gemini-pro-agent mantida em antigravity-retired-public-models.test.ts e agy-provider.test.ts. Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/agy-gemini-400-3229.test.ts": "v3.8.49 #8013: mesma causa do #3696 — gemini-3.1-pro-high aposentado em favor de gemini-pro-agent; o assert de passthrough do id aposentado saiu, restando gemini-3.1-pro-low e o plain id (net 9→8). Verificado contra open-sse/config/antigravityModelAliases.ts. Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/anthropic-cache-fingerprint.test.ts": "v3.8.49 #8464: feat(anthropic) add Claude Opus 5 support — o billing header nativo passou a usar CLAUDE_CODE_CLIENT_BILLING_VERSION, um valor capturado do binário assinado (src/shared/constants/claudeCodeClient.ts), no lugar do cálculo homebrew de fingerprint sha256 por dia/mensagem. O teste antigo REIMPLEMENTAVA o algoritmo inline sem nunca importar o código de produção; virou 1 assert que importa a constante real (net 8→1) — mais forte, não mais fraco. O fingerprint dinâmico por dia sobrevive só no caminho CC-bridge e está coberto em cc-bridge-transforms.test.ts (versionFormat ex-machina/omniroute-daystamp). Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/antigravity-client-profile.test.ts": "v3.8.49 #8013: o modelo de perfil harness/sdk/cli virou ide/cli unificado; getAntigravityBootstrapHeaders, antigravityHarnessUserAgent, deriveAntigravityMachineId e seedAntigravityVersionCache/clearAntigravityVersionCache foram removidos (grep confirma ausência) e substituídos por getAntigravityEnvelopeUserAgent + seedAntigravityIdeVersionCache/seedAntigravityCliVersionCache. O arquivo foi reescrito cobrindo o contrato novo inteiro (normalização de perfis legados, validação Zod, headers de identidade para ide e cli); net 29→26 é a consolidação. Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/antigravity-model-aliases.test.ts": "v3.8.49 #8013: os aliases de remapeamento de gemini-3-pro-preview, gemini-2.5-computer-use-preview-10-2025 e dos tiers de gemini-3.5-flash saíram de ANTIGRAVITY_MODEL_ALIASES (restam 4 entradas), então esses ids passam verbatim; claude-sonnet-5 e gemini-2.5-pro saíram de ANTIGRAVITY_PUBLIC_MODELS e isUserCallableAntigravityModelId retorna false para eles de fato. Dezenas de asserts individuais foram consolidados em loops sobre EXPECTED_FLASH_TIERS/RETIRED_FLASH_IDS, com cobertura NOVA para ids aposentados (net 73→62). Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/antigravity-tool-cloaking.test.ts": "v3.8.49 #8013: fix(antigravity) preserve protocol fidelity and fail closed — o mecanismo de cloaking (AG_DECOY_TOOLS, AG_TOOL_SUFFIX, cloakAntigravityToolPayload: renomeava tools do cliente com sufixo e injetava tools-chamariz) foi removido do código (grep confirma ausência total) e substituído por sanitizeAntigravityToolPayload, que preserva nome/ordem/identidade e só remove enumDescriptions (rejeitado com 400 pelo upstream). Os asserts do cloaking testavam código morto; o arquivo novo cobre a sanitização real com casos a mais (anyOf/allOf/$defs/additionalProperties). Net 23→12. Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/cache-control-claude-providers.test.ts": "v3.8.49 #7866: refactor(qwen) remove o provider OAuth legado — qwen não existe mais em CACHING_PROVIDERS nem em src/shared/constants/providers.ts (grep confirma), então o assert providerSupportsCaching(\"qwen\",\"openai\")===true testava um provider extinto (net 22→21). Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/cache-control-policy.test.ts": "v3.8.49 #8705 + #7866: a estratégia de combo deixou de gatear shouldPreserveCacheControl — a doc-string em open-sse/utils/cacheControlPolicy.ts documenta a mudança de política (reescrever breakpoints por requisição derrubava o prompt cache upstream, ~200k cache_write tokens/turn em produção). Os 8 testes \"rejeita combo com estratégia X\" (false) viraram um loop sobre 8 estratégias incluindo a nova quota-share (true), mais 2 testes negativos NOVOS (provider sem cache, cliente não caching-aware); 1 assert a menos vem do qwen removido pelo #7866. Net 96→91 é consolidação sobre superfície MAIOR. Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/codex-failover.test.ts": "v3.8.49 #7866: o assert getMaxAttempts(\"qwen\")===3 exercitava um ramo do helper LOCAL do teste (a fonte real, chatCore.ts, nunca especializou qwen) para um provider agora extinto; removido junto (net 30→29). Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/executor-claude-identity.test.ts": "v3.8.49 #8464: buildHashFor (hash do billing header) foi removida de claudeIdentity.ts sem call sites remanescentes — a lógica equivalente migrou para ccBridgeTransforms.ts (rota CC-bridge separada) e o path nativo usa placeholder cch=00000. Os 2 testes do describe morto (3 asserts) saem e 1 assert novo cobre selectBetaFlags para Opus 5 (net 47→45). Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/executor-default-base.test.ts": "v3.8.49 #7866 + #8464: o provider \"qwen\" (distinto de qwen-cloud/qwen-web) saiu do DefaultExecutor — não há mais case \"qwen\" em open-sse/executors/default.ts —, então os 3 testes que o exercitavam (9 asserts) foram removidos; o #8464 acrescentou 4 asserts de Opus 5/Stainless/billing no mesmo arquivo. Net 214→209. Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/executor-kimi-web-decoder.test.ts": "v3.8.49 #7531: o protocolo Connect do kimi-web trocou isEndOfStream (que silenciava JSON inválido e mensagens tool/function) por getConnectEndStreamError, e foldMessages agora LANÇA em vez de descartar conteúdo não suportado — endurecimento, não enfraquecimento. Os 4 testes do describe antigo (5 asserts) foram consolidados em 1 teste do decoder (net 40→35). Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/guide-settings-route.test.ts": "v3.8.49 #7866: saveQwenConfig foi removida do route.ts de guide-settings e o switch(toolId) não trata mais \"qwen\" (cai no default \"not supported\"), como parte da remoção da integração Qwen Code legada. Os 2 testes daquele fluxo (12 asserts) saíram porque a feature deixou de existir (net 35→23). Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/kimi-web-models-discovery.test.ts": "v3.8.49 #7531: kimi-web migrou de descoberta remota (HTTP a GetAvailableModels) para catálogo estático curado — KIMI_WEB_STATIC_MODELS=[k3,k2d6] em registry/kimi/web/index.ts. O teste foi reescrito para validar source=\"local_catalog\" e ZERO chamadas de fetch, no lugar de validar payload/headers de uma chamada remota que não existe mais (net 9→4). Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/oauth-providers-config.test.ts": "v3.8.49 #7866: QWEN_CONFIG/QWEN_OAUTH_CLIENT_ID saíram das configs OAuth (zero refs a qwen em src/lib/oauth/). O teste dedicado de hostname (4 asserts) e 3 asserts de qwenMapped no teste combinado foram removidos; +2 asserts novos de outras PRs do ciclo (clientProfile do Antigravity #8013, device-model Windows do Kimi #7531). Net 121→116. Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/oauth-providers-error-handling.test.ts": "v3.8.49 #7866: o teste \"P2: refreshQwenToken handles invalid_grant\" (3 asserts) saiu — refreshQwenToken não existe mais em open-sse/services/tokenRefresh/. Os demais testes só tiveram o path de leitura do source atualizado pela decomposição de tokenRefresh.ts (#8547/#7817) e tokenHealthCheck.ts (#7719), sem perda de asserts. Net 43→40. Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/perplexity-key-validation-models.test.ts": "v3.8.49 #7687: o registry da Perplexity separou modelsUrl (catálogo Agent, agora undefined) de testKeyModelsUrl (validação de chave, mantém /v1/models). O 2º teste antigo (3 asserts de shape estático de string) virou um teste COMPORTAMENTAL que mocka fetch e valida a chamada real de validateProviderApiKey — mais forte (net 7→6). Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/provider-header-profiles.test.ts": "v3.8.49 #7866: getQwenOauthHeaders() foi removida por completo de open-sse/config/providerHeaderProfiles.ts (grep confirma zero ocorrências); os 8 asserts perdidos testavam função extinta e 2 asserts novos cobrem getQoderDashscopeCompatHeaders (que reaproveita getQwenCliUserAgent, ainda existente). Net 29→23. Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/provider-request-capture-toolname-antigravity-4181.test.ts": "v3.8.49 #8013: o cloak _ide/AG_TOOL_SUFFIX foi removido — o Antigravity passou a usar o catálogo oficial de nomes de ferramentas, sem disfarce (grep confirma que cloakAntigravityToolPayload e AG_TOOL_SUFFIX não existem mais). O arquivo virou 1 teste do novo sanitizeAntigravityToolPayload; a cobertura do comportamento novo foi ampliada em antigravity-tool-cloaking.test.ts (3 testes dedicados). Net 13→5. Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/public-client-ids-3493.test.ts": "v3.8.49 #7866: QWEN_CONFIG saiu de src/lib/oauth/constants/oauth.ts (zero ocorrências); o único assert perdido validava QWEN_CONFIG.clientId (net 5→4). Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/search-handler-extended.test.ts": "v3.8.49 #7687: a cobertura de handleSearch/Perplexity migrou para tests/unit/search-handler-perplexity-options.test.ts (arquivo novo: cobre os mesmos campos + filtros de locale e acrescenta um caso de validação que não existia — allowlist/denylist de domínio mistos). Net 150→143. Destino verificado existente. Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/token-refresh-route-service.test.ts": "v3.8.49 #7866: refreshQwenToken e OAUTH_ENDPOINTS.qwen saíram do código (zero ocorrências); o assert perdido (qwen.providerSpecificData.resourceUrl) testava um fluxo de refresh inexistente e o contador de chamadas foi ajustado de >=8 para >=7 (uma chamada HTTP a menos). Net 50→49. Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/translator-openai-to-kiro.test.ts": "v3.8.49 #8565: auto-kiro passou a ser REJEITADO com erro (KIRO_REMOVED_AUTO_ALIAS_MESSAGE, \"not a real Kiro upstream model\") em vez de mapeado silenciosamente para \"auto\"; o teste do comportamento antigo foi removido porque hoje ele asseriria o comportamento errado. A rejeição está coberta em kiro-model-aliases.test.ts (assert.throws /not a real Kiro/) e kiro-available-models.test.ts. Net 119→118. Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/usage-providers.test.ts": "v3.8.49 #7866: o case \"qwen\" saiu de getUsageForProvider (não há mais case \"qwen\" no switch de open-sse/services/usage.ts); o teste cobria esse ramo extinto (net 20→19). Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/usage-service-hardening.test.ts": "v3.8.49 #7866/#8565/#8013: qwen removido (−3 asserts); o Kimi/Kiro builder-id (uso profileless) passou a ter SUCESSO real em vez de erro de ARN — supportsProfilelessKiroUsage(\"builder-id\") retorna true —, trocando 1 assert de regex de erro por 3 asserts de valor; e os ids de bucket de quota do Antigravity foram atualizados para o catálogo atual. Rodado no HEAD: 23/23 passam. Net 210→209. Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "tests/unit/virtual-auto-combo.test.ts": "v3.8.49 #7928/#8183: o pooling de contas passou a agrupar conexões web-session do mesmo provider numa entrada lógica com allowedConnectionIds (campo confirmado em open-sse/services/autoCombo/virtualFactory.ts), e o pool no-auth virou uma allowlist fixa (AUTO_COMBO_NOAUTH_ALLOWLIST = opencode, felo-web) — os testes antigos esperavam duplicatas e a inclusão de duckduckgo-web/theoldllm/chipotle, que hoje são corretamente excluídos. Guard dedicado em noauth-autocombo-allowlist.test.ts. Rodado no HEAD: 10/10 passam. Net 39→31. Verificado legítimo. Prune após v3.8.49 mergear para main.",
-  "open-sse/services/__tests__/tierResolver.test.ts": "v3.8.49 #7866: refactor(qwen) remove o provider OAuth legado — o teste \"classifies Qwen as free\" e a entrada de qwen na lista do batch saíram junto com o provider, e os índices do batch desceram de 10 para 9 elementos (net 61→59). Superfície extinta, não enfraquecimento. Verificado legítimo. Prune após v3.8.49 mergear para main."
+  "tests/unit/copilot-gemini-claude-route-no-responses.test.ts": "v3.8.45 #6154: fix(providers) refresh GitHub Copilot catalog — 2 asserts combinados (registry-exists + par claude/gemini) reescritos como loop per-model com assert.ok individual por id do catálogo novo (7→6). Asserts reestruturados ao catálogo atualizado, não enfraquecidos. Verificado legítimo. Prune após v3.8.45 mergear para main."
 }

contrib/podman/README.md

@@ -1,24 +1,10 @@
 # Podman Deployment
 
-Run OmniRoute with **podman compose** on Linux, macOS, or Windows, or with
-**Quadlet** on a Linux host that runs systemd.
+Run OmniRoute with Podman via **Quadlet** (systemd integration) or **podman compose**.
 
 ---
 
-## Choose the deployment path
-
-- **Linux with a local Podman engine and user systemd:** Compose or Quadlet.
-- **macOS or Windows:** Compose. Podman runs containers in a remote Linux VM
-  managed by Podman Machine; host-side `systemctl` and `podman unshare` do not
-  operate on that engine.
-- **Any other remote Podman connection (including an optional Linux Podman
-  Machine):** treat it like Podman Machine, not like a local rootless engine.
-
-## Option A: Quadlet (Linux + systemd only)
-
-Use this option only when the Podman engine and user systemd instance run on the
-same Linux host. The `systemctl --user` commands below do not configure a Podman
-Machine from a macOS or Windows host.
+## Option A: Quadlet (recommended)
 
 ### 1. Build the image
 
@@ -75,19 +61,34 @@ To follow logs:
 journalctl --user -u omniroute -f
 ```
 
-The checked-in Quadlet files already contain `[Install]` sections with
-`WantedBy=default.target`. The Quadlet generator applies those sections during
-`systemctl --user daemon-reload`. Generated Quadlet services are transient
-systemd units and must not be enabled with `systemctl enable`.
+### 6. Enable on boot
+
+```bash
+systemctl --user enable omniroute-redis
+systemctl --user enable omniroute
+```
 
 ---
 
-## Option B: podman compose (all supported host platforms)
+## Option B: podman compose
 
 The project's `docker-compose.yml` now works with both Docker and Podman.
 Just set `CONTAINER_HOST=podman` in `.env` before starting.
 
-### 1. Set the runtime in `.env`
+### 1. Prepare the data directory
+
+Rootless Podman maps container UIDs into a subordinate range. The
+`node` user (UID 1000) inside the container maps to a different UID
+on the host, so it cannot write to `./data` owned by your host user.
+
+Fix the ownership **before** starting:
+
+```bash
+mkdir -p data
+podman unshare chown 1000:1000 ./data
+```
+
+### 2. Set the runtime in `.env`
 
 Make sure `.env` contains:
 
@@ -95,88 +96,23 @@ Make sure `.env` contains:
 CONTAINER_HOST=podman
 ```
 
-### 2. Prepare the data directory
-
-The Compose profiles bind-mount `./data` at `/app/data`. Create the directory,
-then use the permission guidance for your engine topology below.
+### 3. Start
 
 ```bash
-mkdir -p data
-```
-
-### 3. Build and start
-
-The application profiles use local image names such as `omniroute:base`; those
-are build outputs, not published Docker Hub tags. On the first run, have Compose
-build the selected profile:
-
-```bash
-podman compose --profile base up -d --build
-```
-
-Alternatively, build the matching target explicitly and tell Compose to reuse
-that local image:
-
-```bash
-podman build --target runner-base -t omniroute:base .
-podman compose --profile base up -d --no-build
+podman compose --profile base up -d
 ```
 
 ### Profiles
 
 Same profiles as `docker compose`:
 
-| Profile                        | First-run command                             |
-| ------------------------------ | --------------------------------------------- |
-| `base` (no CLIs)               | `podman compose --profile base up -d --build` |
-| `web` (+Chromium/Playwright)   | `podman compose --profile web up -d --build`  |
-| `cli` (+CLI tools)             | `podman compose --profile cli up -d --build`  |
-| `host` (host-mounted binaries) | `podman compose --profile host up -d --build` |
-| `cliproxyapi` (sidecar)        | `podman compose --profile cliproxyapi up -d`  |
-
----
-
-## Data directory permissions by topology
-
-### Linux with a local rootless Podman engine
-
-Rootless Podman maps container UIDs into a subordinate range. If the container
-cannot write to the bind-mounted `./data`, run this **on the Linux host whose
-local engine will run the container**:
-
-```bash
-podman unshare chown 1000:1000 ./data
-```
-
-Use this only when the CLI is connected to a local, non-remote Podman engine.
-`podman unshare` is not available with a remote Podman client.
-
-### macOS or Windows with Podman Machine
-
-Podman on macOS and Windows runs the engine inside a Linux VM. The host CLI is a
-remote client, so do **not** run `podman unshare` on the macOS or Windows host.
-Create `./data` in the host directory shared with the machine and try the
-Compose start command above; no ownership change is needed when that mount is
-already writable.
-
-If the bind mount is not writable and you do not need direct host access to the
-database files, use a Podman-managed named volume with the published image.
-Named volumes avoid host-directory UID translation:
-
-```bash
-podman volume create omniroute-data
-podman run -d --name omniroute \
-  --env-file .env \
-  -e DATA_DIR=/app/data \
-  -p 20128:20128 \
-  -v omniroute-data:/app/data \
-  docker.io/diegosouzapw/omniroute:latest
-```
-
-For a bind mount that still fails, inspect or repair the shared path from the
-Podman Machine side (for example with `podman machine ssh`) according to the
-machine provider's mount configuration. A container cannot reliably determine
-or repair that host/VM topology for you.
+| Profile                        | Command                                              |
+| ------------------------------ | ---------------------------------------------------- |
+| `base` (no CLIs)               | `podman compose --profile base up -d`                |
+| `web` (+Chromium/Playwright)   | `podman compose --profile web up -d`                 |
+| `cli` (+CLI tools)             | `podman compose --profile cli up -d`                 |
+| `host` (host-mounted binaries) | `podman compose --profile host up -d`                |
+| `cliproxyapi` (sidecar)        | `podman compose --profile cliproxyapi up -d`         |
 
 ---
 
@@ -187,9 +123,6 @@ The `docker-compose.yml` uses fully-qualified image names
 works with both Docker and Podman without a separate compose file.
 
 The entrypoint script (`check-permissions.sh`) reads `CONTAINER_HOST`
-from `.env` to choose the runtime guidance:
-
+from `.env` to give the correct fix instructions:
 - **docker**: `sudo chown -R ... ./data`
-- **podman**: a topology-neutral warning that points back to this guide, because
-  the container cannot tell whether its engine is local or reached through
-  Podman Machine.
+- **podman**: `podman unshare chown 1000:1000 ./data`

contrib/podman/omniroute.container

@@ -6,10 +6,10 @@ Requires=omniroute-redis.service
 After=omniroute-redis.service
 
 [Container]
-# Use this image after building locally
+# Use this image if your building locally
 Image=localhost/omniroute:base
-# Or use the fully qualified published image (there is no published :base tag)
-# Image=docker.io/diegosouzapw/omniroute:latest
+# Use this image if you are pulling from Docker Hub
+# Image=diegosouzapw/omniroute:base
 
 ContainerName=omniroute
 

docker-compose.prod.yml

@@ -49,8 +49,6 @@ services:
     build:
       context: .
       target: runner-cli
-      args:
-        OMNIROUTE_BASE_PATH: ${OMNIROUTE_BASE_PATH:-}
     image: omniroute:prod
     restart: unless-stopped
     stop_grace_period: 40s
@@ -66,7 +64,6 @@ services:
       - API_HOST=${API_HOST:-0.0.0.0}
       - HOSTNAME=0.0.0.0
       - DATA_DIR=/app/data
-      - OMNIROUTE_BASE_PATH=${OMNIROUTE_BASE_PATH:-}
     ports:
       - "${PROD_DASHBOARD_PORT:-20130}:${DASHBOARD_PORT:-${PORT:-20128}}"
       - "${PROD_API_PORT:-20131}:${API_PORT:-20129}"