Merge remote-tracking branch 'origin/release/v3.8.50' into green/8728

Conflicts resolved: catalogCache.ts (PR rewrite takes precedence), models.ts (PR version)

.claude/worktrees/feat-7786/changelog.d/features/7786-management-auth-terminology-docs.md

@@ -1 +0,0 @@
-- **docs:** add management authentication terminology guide ([#7786](https://github.com/diegosouzapw/OmniRoute/issues/7786))

.claude/worktrees/feat-7786/docs/guides/MANAGEMENT-AUTH.md

@@ -1,41 +0,0 @@
-# Management Authentication
-
-OmniRoute uses four distinct credential families for management access. This guide
-distinguishes them by purpose, scope, and locality.
-
-| Credential              | Scope              | Locality      | Use Case                          |
-|-------------------------|--------------------|---------------|-----------------------------------|
-| Dashboard JWT session   | Full management    | Localhost      | Web dashboard login               |
-| CLI machine-id token    | Full management    | Per-machine    | `omniroute` CLI commands          |
-| Scoped `oma_` token     | Configurable scope | External       | Automation / CI / API access      |
-| Manage-scope API key    | `manage` scope     | External       | Management API calls              |
-
-## Dashboard JWT Session
-
-Generated on dashboard login (`/api/auth/login`). Stored in HTTP-only cookie.
-Valid for the session duration. Cannot be used from external hosts.
-
-## CLI Machine-ID Token
-
-Created by `omniroute auth login` on first use. Stored in `~/.omniroute/auth.json`.
-Used by the CLI for all management operations. Tied to the machine identity.
-
-## Scoped `oma_` Access Token
-
-Created via dashboard or CLI with configurable scopes (e.g., `manage`, `read`).
-Format: `oma_<random-hex>`. Used for programmatic access from external systems.
-
-## Manage-Scope API Key
-
-Standard API key with the `manage` scope enabled. Created in dashboard API Keys page.
-Used for management API calls from external hosts.
-
-## Header Examples
-
-```
-Authorization: Bearer oma_abc123def456
-Authorization: Bearer <standard-api-key-with-manage-scope>
-Cookie: omniroute_session=<jwt-token>
-```
-
-See `docs/reference/API_REFERENCE.md` for endpoint-specific auth requirements.

.claude/worktrees/feat-7786/tests/unit/management-auth-docs.test.ts

@@ -1,27 +0,0 @@
-import { describe, it } from "node:test";
-import { ok } from "node:assert/strict";
-import { readFileSync } from "node:fs";
-
-describe("Management auth documentation (#7786)", () => {
-  const docPath = "docs/guides/MANAGEMENT-AUTH.md";
-  const content = readFileSync(docPath, "utf-8");
-
-  it("exists and has content", () => {
-    ok(content.length > 500, "should have substantial content");
-    ok(content.includes("Dashboard JWT session"));
-    ok(content.includes("CLI machine-id token"));
-    ok(content.includes("oma_"));
-  });
-
-  it("documents all four credential families", () => {
-    const families = ["Dashboard JWT", "CLI machine-id", "oma_", "Manage-scope"];
-    for (const f of families) {
-      ok(content.includes(f), `should document ${f}`);
-    }
-  });
-
-  it("mentions relevant auth header examples", () => {
-    ok(content.includes("Authorization"));
-    ok(content.includes("Bearer"));
-  });
-});

.claude/worktrees/feat-8635/changelog.d/features/8635-systemd-autostart-linux.md

@@ -1 +0,0 @@
-- **feat(infra):** add systemd autostart unit for Linux ([#8635](https://github.com/diegosouzapw/OmniRoute/issues/8635))

.claude/worktrees/feat-8635/contrib/systemd/omniroute.service

@@ -1,19 +0,0 @@
-[Unit]
-Description=OmniRoute AI Proxy
-After=network.target network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-ExecStart=$(which omniroute) start
-Restart=on-failure
-RestartSec=5
-Environment=NODE_ENV=production
-
-# Security hardening
-NoNewPrivileges=true
-ProtectSystem=full
-PrivateTmp=true
-
-[Install]
-WantedBy=default.target

.claude/worktrees/feat-8635/tests/unit/systemd-autostart.test.ts

@@ -1,23 +0,0 @@
-import { describe, it } from "node:test";
-import { ok } from "node:assert/strict";
-import { readFileSync, existsSync } from "node:fs";
-
-describe("Systemd autostart (#8635)", () => {
-  const svcPath = "contrib/systemd/omniroute.service";
-  const content = readFileSync(svcPath, "utf-8");
-
-  it("service file exists", () => {
-    ok(existsSync(svcPath));
-    ok(content.length > 200);
-  });
-
-  it("defines required systemd sections", () => {
-    ok(content.includes("[Unit]"));
-    ok(content.includes("[Service]"));
-    ok(content.includes("[Install]"));
-  });
-
-  it("specifies WantedBy=default.target", () => {
-    ok(content.includes("WantedBy=default.target"));
-  });
-});

.dockerignore

@@ -24,7 +24,6 @@ coverage
 # Runtime data and logs
 data
 logs
-.sandbox
 
 # Local env files (inject at runtime via --env-file or -e)
 .env

.env.devin-bridge.example

@@ -1,6 +0,0 @@
-ENABLE_LIVE_DEVIN_TESTS=0
-DEVIN_BRIDGE_MODEL=devin-cli-agentic/swe-1-7
-DEVIN_BRIDGE_SONNET_MODEL=devin-cli-agentic/swe-1-7
-DEVIN_BRIDGE_OPUS_MODEL=devin-cli-agentic/swe-1-7
-DEVIN_BRIDGE_HAIKU_MODEL=devin-cli-agentic/swe-1-7
-DEVIN_BRIDGE_SUBAGENT_MODEL=devin-cli-agentic/swe-1-7

.env.example

@@ -345,18 +345,14 @@ ALLOW_API_KEY_REVEAL=false
 # OMNIROUTE_CHAT_HEAVY_TOOL_COUNT=64
 # Conservative string-size token estimate that classifies a request as heavyweight. Default 32000.
 # OMNIROUTE_CHAT_HEAVY_ESTIMATED_TOKENS=32000
-# Optional opt-in hard message-count cap; excess receives compact-required 413 before
-# compression can run. Unset/0 (the default) means no history cap: heap growth is bounded
-# by OMNIROUTE_CHAT_MAX_HEAVY_IN_FLIGHT and the heap-pressure shed instead. Set a positive
-# value only on memory-constrained deployments that need a hard ceiling.
-# OMNIROUTE_CHAT_HARD_MAX_MESSAGES=0
+# Hard message-count cap; excess receives compact-required 413. Default 800.
+# OMNIROUTE_CHAT_HARD_MAX_MESSAGES=800
 
 # Hard cap (bytes) for a non-streaming upstream response buffered fully into memory
 # (#5152). Past this the upstream reader is cancelled and the request fails fast
 # instead of growing an unbounded string until the V8 heap is exhausted.
 # Used by: open-sse/handlers/chatCore/nonStreamingResponseBody.ts
 # Default: 67108864 (64 MB)
-# OMNIROUTE_FORWARDING_HEADER_BUDGET_BYTES=768
 # OMNIROUTE_MAX_NONSTREAMING_RESPONSE_BYTES=67108864
 
 # CORS configuration — controls which cross-origin browser clients can call the API.
@@ -797,16 +793,6 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # Disable the proactive recovery scheduler entirely (default: false).
 # OMNIROUTE_DISABLE_CONNECTION_RECOVERY=false
 
-# Proactive Claude warmup scheduler (#8848): fires a trivial request to opted-in
-# OAuth connections on a cron schedule (America/Los_Angeles) so accounts do not
-# hit the 5-hour sliding window cold. Off by default — set ENABLED=1 and flip
-# per-connection flags in settings.claudeWarmup.connections to activate.
-# Used by: src/lib/warmupScheduler.ts.
-# OMNIROUTE_WARMUP_ENABLED=false
-# OMNIROUTE_WARMUP_CRON="0 7 * * *"
-# OMNIROUTE_WARMUP_CONCURRENCY=3
-# OMNIROUTE_WARMUP_MODEL=
-
 # Background job interval for budget reset checks (ms).  Default: 600000 (10m).
 # Used by: src/lib/jobs/budgetResetJob.ts.  Floor: 10000.
 #OMNIROUTE_BUDGET_RESET_JOB_INTERVAL_MS=600000
@@ -871,12 +857,6 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # (>= 3 retrievals = never compressed). 1 disables the ramp (binary skip at the threshold only).
 # Used by: open-sse/services/compression/engines/ccr/index.ts.  Default: 2.
 #COMPRESSION_CCR_RETRIEVAL_RAMP_FACTOR=2
-# CCR durable block store (#9061). The in-memory store loses blocks to LRU eviction, the TTL, a
-# restart, or a retrieve landing on another instance, while the model is told it can retrieve them
-# verbatim. Set to false to keep blocks in memory only, at the cost of that promise. Blocks over
-# 512KB and cloud runtimes are memory-only regardless.
-# Used by: open-sse/services/compression/engines/ccr/index.ts.  Default: true.
-#COMPRESSION_CCR_DURABLE_STORE=true
 # T08/H5 — usage-observed prefix freeze (OPT-IN, default off). When enabled, a system prompt seen
 # >= THRESHOLD times is treated as a stable cacheable prefix and preserved from compression even
 # for providers the static cache-aware heuristic does not recognize (freeze = preserve, never
@@ -1061,17 +1041,6 @@ GITHUB_OAUTH_CLIENT_ID=Iv1.b507a08c87ecfe98
 # VISION_BRIDGE_BASE_URL=
 # VISION_BRIDGE_API_KEY=
 
-# ── Raycast Pro (local auto-import) ──
-# Raycast Pro AI is a reverse-engineered, unofficial API — local/personal use
-# only (no OAuth client_id/secret; token is captured via macOS Auto-Import
-# from the Keychain + local Raycast SQLite DB, or pasted manually). These
-# vars are optional manual overrides used by open-sse/services/raycast.ts
-# and the direct-probe benchmark script scripts/raycast/usage-benchmark.mjs.
-# RAYCAST_BEARER_TOKEN=
-# RAYCAST_DEVICE_ID=
-# RAYCAST_AID=
-# RAYCAST_SIG_SECRET=
-
 # ─────────────────────────────────────────────────────────────────────────────
 # ⚠️  GOOGLE OAUTH (Antigravity) & OTHER PROVIDERS — REMOTE SERVERS
 # ─────────────────────────────────────────────────────────────────────────────
@@ -1540,15 +1509,6 @@ APP_LOG_TO_FILE=true
 # ═══════════════════════════════════════════════════════════════════════════════
 # 19. MODEL SYNC (Dev)
 # ═══════════════════════════════════════════════════════════════════════════════
-# Enable the models.dev capability sync.  Default: false (opt-in only).
-# Also settable from Dashboard > Settings > AI. This variable wins over that
-# setting whenever it is set to anything non-empty, in either direction, so a
-# deployment can pin the sync on or off without depending on database state
-# surviving a rebuild. Leave it unset to let the dashboard toggle decide.
-# On: 1, true, yes or on (any casing). Any other value is off.
-# Used by: src/lib/modelsDevSync.ts
-# MODELS_DEV_SYNC_ENABLED=false
-
 # Development-time model catalog sync interval in seconds.
 # Used by: src/lib/modelsDevSync.ts
 # Default: 86400 (24 hours)
@@ -1952,18 +1912,6 @@ APP_LOG_TO_FILE=true
 # ── Devin CLI binary path ──
 # Used by: open-sse/executors/devin-cli.ts. Default: looked up via PATH.
 # CLI_DEVIN_BIN=devin
-# Agentic bridge-only binary override. The bridge still executes ACP stdio only.
-# CLI_DEVIN_AGENTIC_BIN=devin
-# Required isolated HOME for the agentic Devin child process.
-# DEVIN_AGENTIC_HOME=/home/bridge
-# Bounded ACP turn timeout in milliseconds. Default: 120000.
-# DEVIN_AGENTIC_ACP_TIMEOUT_MS=120000
-# Agentic bridge model aliases. Values must keep the devin-cli-agentic/ prefix.
-# DEVIN_BRIDGE_MODEL=devin-cli-agentic/swe-1-7
-# DEVIN_BRIDGE_SONNET_MODEL=devin-cli-agentic/swe-1-7
-# DEVIN_BRIDGE_OPUS_MODEL=devin-cli-agentic/swe-1-7
-# DEVIN_BRIDGE_HAIKU_MODEL=devin-cli-agentic/swe-1-7
-# DEVIN_BRIDGE_SUBAGENT_MODEL=devin-cli-agentic/swe-1-7
 
 # ── Command Code (custom CLI) callback ──
 # Local port used for OAuth-style callbacks from the Command Code CLI helper.
@@ -2492,10 +2440,10 @@ QUOTA_STORE_DRIVER=sqlite              # sqlite | redis
 # ═══════════════════════════════════════════════════════════════════════════════
 # Optional add-on (feature flag RADAR_ENABLED, default off — see feature flag
 # settings, not an env var) that overlays a signed, freshly-curated free-model
-# catalog on top of the release baseline. All four variables below are optional
-# and only needed to point the client at a self-hosted/forked feed or
-# supporter-key flow instead of the default OmniRoute Radar service. Used by:
-# src/lib/radar/sync.ts, src/lib/radar/pinnedKeys.ts, src/lib/radar/links.ts.
+# catalog on top of the release baseline. Both variables below are optional and
+# only needed to point the client at a self-hosted/forked feed instead of the
+# default OmniRoute Radar feed. Used by: src/lib/radar/sync.ts,
+# src/lib/radar/pinnedKeys.ts.
 
 # Base URL of the Radar feed service. Overrides the built-in default so forks
 # and self-hosters can point at their own signed feed.
@@ -2505,12 +2453,3 @@ QUOTA_STORE_DRIVER=sqlite              # sqlite | redis
 # signature, replacing the pinned default key. Required when self-hosting a
 # feed signed with a different key pair.
 # RADAR_FEED_PUBKEY=
-
-# URL the dashboard's "I'm a contributor" button opens (GitHub OAuth
-# supporter-key claim flow). No pricing/value lives in this repo — only the
-# link.
-# RADAR_CONTRIBUTOR_CLAIM_URL=https://radar.omniroute.online/auth/github
-
-# URL the dashboard's "Support the project" button opens (payment/plans
-# page). No pricing/value lives in this repo — only the link.
-# RADAR_SUPPORTER_PLANS_URL=https://radar.omniroute.online/planos

.github/workflows/ci.yml

@@ -1213,10 +1213,8 @@ jobs:
           cache: npm
       - uses: ./.github/actions/npm-ci-retry
       - run: npm run check:node-runtime
-      - name: Integration tests (shard ${{ matrix.shard }}/2)
-        env:
-          TEST_SHARD: ${{ matrix.shard }}/2
-        run: npm run test:integration:ci
+      # (tsx/esm = QW-b; o alinhamento de ESCOPO do integration com o npm script fica p/ follow-up)
+      - run: node --import tsx/esm --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=1 --test-shard=${{ matrix.shard }}/2 tests/integration/*.test.ts
 
   test-security:
     name: Security Tests

.github/workflows/codeql.yml

@@ -22,10 +22,10 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+      - uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           languages: javascript-typescript
           queries: security-extended
-      - uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+      - uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           category: "/language:javascript-typescript"

.github/workflows/docker-publish.yml

@@ -137,13 +137,13 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.5.2
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.5.2
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -237,13 +237,13 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.5.2
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.5.2
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -372,7 +372,7 @@ jobs:
       - name: Upload Trivy SARIF to Security tab
         if: needs.prepare.outputs.version != 'main'
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@v4.37.4
+        uses: github/codeql-action/upload-sarif@v4.37.3
         with:
           sarif_file: trivy-results.sarif
           category: trivy-image

.github/workflows/quality.yml

@@ -151,6 +151,63 @@ jobs:
           key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'eslint.complexity-ratchets.config.mjs', 'config/quality/eslint-suppressions.json', 'package-lock.json') }}
           restore-keys: |
             eslint-${{ runner.os }}-
+      - run: npm run check:provider-consistency
+      - run: npm run check:fetch-targets
+      # docs-all / openapi-routes / docs-symbols live in docs-gates (path-filtered).
+      - run: npm run check:deps
+      # #8522: --base-ref mode for PR events — compare against max(frozen, base) so
+      # inherited drift (base already over frozen cap) doesn't red an innocent PR.
+      # workflow_dispatch (no PR base) falls back to absolute comparison.
+      - name: File-size ratchet (base-relative on PR)
+        env:
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          if [ -n "$PR_BASE_SHA" ]; then
+            npm run check:file-size -- --base-ref "$PR_BASE_SHA"
+          else
+            npm run check:file-size
+          fi
+      - run: npm run check:error-helper
+      - run: npm run check:migration-numbering
+      - run: npm run check:public-creds
+      - run: npm run check:db-rules
+      - run: npm run check:known-symbols
+      - run: npm run check:route-guard-membership
+      - run: npm run check:test-discovery
+      - run: npm run check:test-runner-api
+      # Guards tap.testFiles drift: a covering unit test absent from stryker.conf.json
+      # tap.testFiles makes its module's mutants survive on a cold nightly-mutation run,
+      # false-failing the blocking mutationScore ratchet. See check-mutation-test-coverage.mjs.
+      - run: npm run check:mutation-test-coverage
+      - run: npm run check:any-budget:t11
+      # Build-scope guard: fails if worktrees/cruft leak into the tsconfig include
+      # scope (would OOM `next build`). Instant. See incident 2026-06-25 / #5031.
+      - run: npm run check:build-scope
+      # Pack-policy (unexpected-files allowlist) WITHOUT a build — catches a stray file
+      # leaking into the npm tarball (v3.8.36: 6 ops bin/*.sh) per-PR instead of only on
+      # the release PR's heavy Package Artifact job.
+      - run: npm run check:pack-policy
+      # Complexity + cognitive-complexity: ONE ESLint walk (both baselines still
+      # enforced separately by ruleId). Avoids two cold tree walks on fast-path.
+      - run: npm run check:complexity-ratchets
+      # ── G0 (trilho .50): gates do trilho A que faltavam no trilho B ──────────────
+      # The god-file refactor happens in PRs→release/**; without these, the release
+      # rail never sees a new import cycle, dead code, duplication or a security
+      # regression until the release PR to main. Deliberately NOT brought here:
+      # bundle-size (self-skips without a build — this rail's build job is advisory
+      # and uploads nothing, so it would be dead configuration) and the coverage
+      # run (fast-unit already runs the full suite; the coverage ratchet stays on
+      # the main rail via --allow-missing in lint-guard).
+      - run: npm run check:cycles
+      - run: npm run check:lockfile
+      - name: Duplication ratchet
+        run: npm run check:duplication
+      - name: Dead-code ratchet (knip)
+        run: npm run check:dead-code
+      - name: Type coverage ratchet
+        run: npm run check:type-coverage
+      - name: Compression budget ratchet
+        run: npm run check:compression-budget
       # Security scanners — same hardened install as ci.yml quality-extended
       # (gh release download = authenticated, 5000 req/hr; curl to api.github.com
       # is rate-limited to 60/hr and silently no-ops when throttled). The blocking
@@ -194,63 +251,26 @@ jobs:
           "$HOME/.local/bin/osv-scanner" --version || true
           "$HOME/.local/bin/oasdiff" --version || true
           zizmor --version || true
-      # Quality gates (all, non-fail-fast) — #8542: replaces 17 bare check:* steps,
-      # 6 G0 gates, 4 ratchet gates, and 3 typecheck steps with a single aggregation
-      # step. Each gate runs in a loop with ::group::; failures are collected and
-      # reported at the end. set -uo pipefail (NOT set -e) so one failing gate does
-      # not abort the job and mask every later gate. Release-added gates are folded
-      # in: open-sse typecheck (#8781) and file-size base-relative mode (#8522).
-      - name: Quality gates (all, non-fail-fast)
+      - name: Secret scan (gitleaks, ratchet, blocking)
+        run: npm run check:secrets -- --ratchet
+      - name: Vulnerability ratchet (osv-scanner, ratchet, blocking)
+        run: npm run check:vuln-ratchet -- --ratchet
+      - name: Workflow lint (actionlint+zizmor, ratchet, blocking)
+        run: npm run check:workflows -- --ratchet
+      # BASE_REF is read by the script from the env (never interpolated into a
+      # shell body) — workflow-injection-safe. actions/checkout fetches remote
+      # refs, not a local branch named github.base_ref, so prefix origin/ or this
+      # gate self-skips every PR with reason=base-unresolved.
+      - name: OpenAPI breaking-change (oasdiff, ratchet, blocking)
         env:
-          # #8522: base-relative file-size mode on PR events — inherited drift (base
-          # already over frozen cap) must not red an innocent PR. Unset on
-          # workflow_dispatch (no PR base) → absolute comparison.
-          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
           BASE_REF: ${{ github.base_ref && format('origin/{0}', github.base_ref) || '' }}
-        run: |
-          set -uo pipefail
-          gates=(
-            provider-consistency fetch-targets deps file-size error-helper
-            migration-numbering public-creds db-rules known-symbols
-            route-guard-membership test-discovery test-runner-api
-            mutation-test-coverage any-budget:t11 build-scope pack-policy
-            complexity-ratchets
-            cycles lockfile duplication dead-code type-coverage compression-budget
-            # #8781: open-sse workspace typecheck gate — the workspace imports @/ which
-            # escapes to src/ via undeclared path aliases. See check-open-sse-typecheck.mjs.
-            open-sse-typecheck
-          )
-          ratchet_gates=(
-            secrets vuln-ratchet workflows openapi-breaking
-          )
-          failed=()
-          for g in "${gates[@]}"; do
-            echo "::group::check:$g"
-            # #8522: file-size is base-relative on PR events (compare against
-            # max(frozen, base)) so inherited drift doesn't red an innocent PR;
-            # workflow_dispatch (no PR base) falls back to absolute comparison.
-            if [ "$g" = "file-size" ] && [ -n "${PR_BASE_SHA:-}" ]; then
-              npm run "check:$g" -- --base-ref "$PR_BASE_SHA" || failed+=("$g")
-            else
-              npm run "check:$g" || failed+=("$g")
-            fi
-            echo "::endgroup::"
-          done
-          for g in "${ratchet_gates[@]}"; do
-            echo "::group::check:$g (ratchet)"
-            npm run "check:$g" -- --ratchet || failed+=("$g")
-            echo "::endgroup::"
-          done
-          echo "::group::typecheck:core"
-          npm run typecheck:core || failed+=("typecheck:core")
-          echo "::endgroup::"
-          echo "::group::check:dashboard-typecheck"
-          npm run check:dashboard-typecheck || failed+=("check:dashboard-typecheck")
-          echo "::endgroup::"
-          if (( ${#failed[@]} )); then
-            printf '::error::%d gate(s) failed: %s\n' "${#failed[@]}" "${failed[*]}"
-            exit 1
-          fi
+        run: npm run check:openapi-breaking -- --ratchet
+      - name: Typecheck (core)
+        run: npm run typecheck:core
+      # #7033: dashboard-scoped typecheck gate — src/app/(dashboard) TSX is not
+      # covered by typecheck:core's curated allowlist. See check-dashboard-typecheck.mjs.
+      - name: Typecheck (dashboard)
+        run: npm run check:dashboard-typecheck
       # WS4.2 (v3.8.49 plan): TypeScript 7 native-compiler SHADOW — advisory only.
       # TS7 went GA 2026-07-08 with 8-12x type-check speedups; its Compiler API only
       # arrives in 7.1, so typescript-eslint / type-coverage / Stryker stay on 6.x

.gitignore

@@ -72,7 +72,6 @@ yarn-error.log*
 # env files (can opt-in for committing if needed)
 .env*
 !.env.example
-!.env.devin-bridge.example
 !.env.homolog.example
 # Provider API keys (never commit)
 *.api-key
@@ -210,8 +209,6 @@ scripts/i18n/_pending-keys.json
 .agents/
 .antigravitycli/
 .claude/
-!tests/fixtures/devin-bridge/e2e-workspace/.claude/
-!tests/fixtures/devin-bridge/e2e-workspace/.claude/**
 
 # PR Reviews and local feedback files
 pr_reviews*.json
@@ -251,8 +248,6 @@ _artifacts/
 
 # CI/local quality artifacts (eslint-results.json, quality-ratchet.md, etc.)
 .artifacts/
-# Isolated Devin bridge workspaces, evidence, and test databases
-.sandbox/
 
 # Homologation E2E suite (npm run homolog) — real-environment credentials + report output
 .env.homolog
@@ -265,7 +260,3 @@ docker-compose.yml.bak
 # output/**/.playwright-cli/ (covered above), but anything written directly to
 # output/ would otherwise show up as untracked.
 /output/
-
-# _tasks e um repo git SEPARADO (ver AGENTS.md). _tasks/ (com barra) NAO ignora um
-# SYMLINK _tasks; /_tasks (ancorado) cobre symlink/dir na raiz (incidente 2026-08-08).
-/_tasks

@omniroute/opencode-plugin/README.md

@@ -30,7 +30,7 @@ omniroute setup opencode --auth
 # 3. Restart OpenCode — /models lists the full live catalog
 ```
 
-The `--auth` flag runs `opencode auth login --provider opencode-omniroute` automatically.
+The `--auth` flag runs `opencode auth login --provider omniroute` automatically.
 Use `--base-url` to point at a non-default OmniRoute address:
 
 ```sh
@@ -84,7 +84,7 @@ Peer dep: `@opencode-ai/plugin` (managed by your OpenCode install).
 ```
 
 ```sh
-opencode auth login --provider opencode-omniroute
+opencode auth login --provider omniroute
 # prompts for the OmniRoute API key, writes to ~/.local/share/opencode/auth.json
 ```
 
@@ -164,8 +164,8 @@ Then in `~/.config/opencode/opencode.json` reference each directory by absolute
 Paths are relative to `~/.config/opencode/`. Each entry now resolves to a distinct module file, so OC loads them as two separate plugin instances. Authenticate each:
 
 ```sh
-opencode auth login --provider opencode-omniroute
-opencode auth login --provider opencode-omniroute-preprod
+opencode auth login --provider omniroute
+opencode auth login --provider omniroute-preprod
 ```
 
 Each entry gets its own provider id, its own model picker entry, its own slot in `auth.json`, and its own TTL cache. Closures are isolated per plugin instance — no cross-talk.
@@ -196,7 +196,6 @@ npm install --prefix ~/.config/opencode/plugins/omniroute-opencode-plugin-prepro
 | Compression pipeline tags                   | Combo names get tagged with their compression pipeline (e.g. `Combo: claude-primary [rtk🟡 → caveman🟠]`) when `features.compressionMetadata: true`. Intensity tokens render as a traffic-light emoji: 🟢 lite/minimal · 🟡 standard · 🟠 aggressive/full · 🔴 ultra                                                                                                                                        | both hooks                   |
 | Provider-tag prefix                         | Prepend short upstream-provider label to enriched names (e.g. `Claude - Claude Opus 4.7` vs `Kiro - Claude Opus 4.7`, `GHM - GPT 5`) so same-id models routed via different upstream connections group visibly in the picker (default-on, opt-out via `features.providerTag: false`)                                                                                                                        | both hooks                   |
 | Usable-only filter                          | Filter to providers with at least one healthy connection in `/api/providers` (opt-in via `features.usableOnly`)                                                                                                                                                                                                                                                                                             | both hooks                   |
-| Model allowlist/blocklist                   | Curate the model picker to a fixed set of IDs via `features.visibleModels` (allowlist) and/or `features.hiddenModels` (blocklist). Bare suffixes like `claude-opus-4-7` match any `{prefix}/claude-opus-4-7`. Both compose with `usableOnly` (all filters AND together). Blocklist wins over allowlist (deny takes precedence)                                                                          | both hooks                   |
 | Disk-cache fallback                         | Last-known-good catalog persisted to disk; hydrates on a cold start when `/v1/models` is unreachable (default-on, opt-out via `features.diskCache: false`)                                                                                                                                                                                                                                                  | `config`                     |
 | Bearer injection + suffix-spoof guard       | Adds `Authorization` on baseURL-matched requests only                                                                                                                                                                                                                                                                                                                                                       | `auth.loader.fetch`          |
 | Gemini schema sanitization                  | Strips `$schema`/`$ref`/`additionalProperties` for `gemini-*`/`google-vertex-gemini/*`                                                                                                                                                                                                                                                                                                                      | `auth.loader.fetch` wrap     |
@@ -227,8 +226,6 @@ Every field is optional. Defaults mirror v0.1.0 behaviour so existing `opencode.
 | `compressionMetadata` | `boolean` | `false` | Pull `/api/context/combos` so combo names get tagged with their compression pipeline, e.g. `Combo: claude-primary [rtk🟡 → caveman🟠]`. Intensity tokens render as traffic-light emoji (🟢 lite/minimal · 🟡 standard · 🟠 aggressive/full · 🔴 ultra) so the picker advertises "how compressed" each combo is at a glance.                                                                                                                                                                                                                                          |
 | `providerTag`         | `boolean` | `true`  | Prepend a short upstream-provider label to the enriched display name with `" - "` separator, so `cc/claude-opus-4-7 → Claude - Claude Opus 4.7` differs visibly from `kr/claude-opus-4-7 → Kiro - Claude Opus 4.7` in the OC TUI model picker. Label resolution: use `/api/pricing/models[<alias>].name` verbatim when ≤8 chars (e.g. `Claude`, `Kiro`, `Codex`, `Qwen`), otherwise fall back to `UPPER(alias)` (e.g. `GitHub Models` → `GHM`, `Gemini` → `GEMINI`). Idempotent. Combos intentionally skipped (the `Combo:` prefix already conveys multi-upstream). |
 | `usableOnly`          | `boolean` | `false` | Read `/api/providers` and filter the catalog to providers that have at least one connection with `isActive: true` AND `testStatus: 'active'`. Subtract-filter semantics: providers unknown to BOTH the pricing-models catalog AND the connection table pass through (so synthetic prefixes like `agentrouter/*` survive). On fetch failure the filter is disabled for the refresh — never hides the whole catalog.                                                                                                                                                   |
-| `visibleModels`       | `string[]` | _unset_ | Allowlist — when set and non-empty, only models whose raw `/v1/models` ID matches are emitted. Bare IDs (no slash, e.g. `claude-opus-4-7`) match any `{prefix}/claude-opus-4-7`; full IDs (e.g. `cc/claude-opus-4-7`) match exactly. Composes with `usableOnly` and `hiddenModels` (all filters AND together). Unset or empty = no filter.                                                                                                        |
-| `hiddenModels`        | `string[]` | _unset_ | Blocklist — models whose raw ID matches are dropped. Same matching rules as `visibleModels`. When a model is in both `visibleModels` and `hiddenModels`, the blocklist wins (deny takes precedence). Composes with `usableOnly` and `visibleModels` (all filters AND together). Unset or empty = no filter.                                                                                                                                          |
 | `diskCache`           | `boolean` | `true`  | Persist the last successful `/v1/models` + `/api/combos` + enrichment + connections + compression snapshot to `${OPENCODE_DATA_DIR ?? ~/.local/share/opencode}/plugins/omniroute-<providerId>.json`. On a subsequent cold start where `/v1/models` throws (network down / IP whitelist drop / 5xx) the static block hydrates from the snapshot so OC's model picker survives offline. Soft-fail on read/write — never blocks publishing.                                                                                                                             |
 | `geminiSanitization`  | `boolean` | `true`  | Strip `$schema`/`$ref`/`additionalProperties` from tool params when the model id matches `gemini`                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | `mcpAutoEmit`         | `boolean` | `false` | Auto-write an `mcp.<providerId>` remote entry into the OC config pointing at `<baseURL>/api/mcp/stream` with the resolved Bearer token                                                                                                                                                                                                                                                                                                                                                                                                                               |
@@ -301,45 +298,7 @@ If you want a narrower-scoped Bearer for MCP (different from the chat/inference
 - `compressionMetadata: true` annotates combo display names with their pipeline using traffic-light emoji for intensity (e.g. `Combo: claude-primary [rtk🟡 → caveman🟠]`) so the picker advertises which compression each combo applies and how heavy it is at a glance. Palette: 🟢 lite/minimal · 🟡 standard · 🟠 aggressive/full · 🔴 ultra. Unknown intensities fall through to raw text (`[rtk:custom-thing]`) so the plugin never hides a value OmniRoute knows but the plugin doesn't.
 - `providerTag: true` (default) prepends a short upstream-provider label so the picker shows `Claude - Claude Opus 4.7` for `cc/claude-opus-4-7`, `Kiro - Claude Opus 4.7` for `kr/claude-opus-4-7`, and `GHM - GPT 5` for `ghm/gpt-5` (slot.name `GitHub Models` > 8 chars → abbreviated). Critical when the same model id is sold through multiple upstream connections with different cost/auth/rate-limit profiles. Set to `false` to keep the pre-v3.8.3 unsuffixed format.
 
-#### Example — curating the model picker (allowlist + blocklist)
-
-A typical OmniRoute instance serves 600+ models. The OpenCode TUI/CLI picker becomes unusable when you need to scroll through hundreds of entries to find the ~30 models you actually use. `visibleModels` and `hiddenModels` let you curate the picker to a fixed set of model IDs that persists in `opencode.json` across config resets.
-
-```jsonc
-{
-  "plugin": [
-    [
-      "@omniroute/opencode-plugin",
-      {
-        "providerId": "omniroute",
-        "baseURL": "https://or.example.com",
-        "features": {
-          "combos": true,
-          "enrichment": true,
-          "usableOnly": true,
-          "visibleModels": [
-            "claude-opus-4-7",     // bare suffix: matches cc/claude-opus-4-7, kr/claude-opus-4-7, etc.
-            "cc/claude-sonnet-4-6", // exact: only the cc/ alias
-            "gemini-2.5-pro",
-            "gpt-5",
-            "o3",
-            "o3-pro",
-            "o4-mini",
-          ],
-          "hiddenModels": [
-            "o3-mini",  // hide the mini variant even if visibleModels is unset
-          ],
-        },
-      },
-    ],
-  ],
-}
-```
-
-- `visibleModels` is an allowlist — only models whose raw ID matches are emitted. Bare IDs (no slash) match any provider prefix; full IDs (with slash) match exactly.
-- `hiddenModels` is a blocklist — listed models are dropped. When a model is in both lists, the blocklist wins (deny takes precedence).
-- Both compose with `usableOnly` (all filters AND together: a model must pass usableOnly AND visibleModels AND not be in hiddenModels).
-- Unset or empty = no filter (current behavior).
+## Comparison vs `@omniroute/opencode-provider`
 
 [`@omniroute/opencode-provider`](https://github.com/diegosouzapw/OmniRoute/tree/main/%40omniroute/opencode-provider) is the existing config-generator package — it writes a frozen `provider.<id>` block into `opencode.json` at build time. This plugin is the runtime integration.
 

@omniroute/opencode-plugin/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@omniroute/opencode-plugin",
-  "version": "0.2.1",
+  "version": "0.2.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@omniroute/opencode-plugin",
-      "version": "0.2.1",
+      "version": "0.2.0",
       "license": "MIT",
       "dependencies": {
         "zod": "^4.4.3"

@omniroute/opencode-plugin/package.json

@@ -23,7 +23,7 @@
   "scripts": {
     "build": "tsup",
     "clean": "rm -rf dist",
-    "test": "node --import tsx/esm --test tests/scaffold.test.ts tests/auth.test.ts tests/options-schema.test.ts tests/multi-instance.test.ts tests/fetch-interceptor.test.ts tests/provider.test.ts tests/gemini-sanitize.test.ts tests/combos.test.ts tests/config-shim.test.ts tests/features.test.ts tests/feature-defaults.test.ts tests/usable-combo.test.ts tests/disk-snapshot-perms.test.ts tests/fork-features.test.ts tests/auto-combo-context.test.ts tests/provider-id-routing.test.ts tests/management-read-token.test.ts tests/auto-sync.test.ts tests/model-allowlist.test.ts",
+    "test": "node --import tsx/esm --test tests/scaffold.test.ts tests/auth.test.ts tests/options-schema.test.ts tests/multi-instance.test.ts tests/fetch-interceptor.test.ts tests/provider.test.ts tests/gemini-sanitize.test.ts tests/combos.test.ts tests/config-shim.test.ts tests/features.test.ts tests/feature-defaults.test.ts tests/usable-combo.test.ts tests/disk-snapshot-perms.test.ts tests/fork-features.test.ts tests/auto-combo-context.test.ts tests/provider-id-routing.test.ts tests/management-read-token.test.ts tests/auto-sync.test.ts",
     "prepublishOnly": "npm run clean && npm run build && npm test"
   },
   "keywords": [

@omniroute/opencode-plugin/src/index.ts

@@ -177,8 +177,6 @@ const featuresSchema = z
     mcpToken: z.string().min(1).optional(),
     fetchInterceptor: z.boolean().optional(),
     usableOnly: z.boolean().optional(),
-    visibleModels: z.array(z.string().min(1)).optional(),
-    hiddenModels: z.array(z.string().min(1)).optional(),
     diskCache: z.boolean().optional(),
     providerTag: z.boolean().optional(),
     debugLog: z.boolean().optional(),
@@ -243,11 +241,6 @@ export const OMNIROUTE_FEATURE_DEFAULTS = {
   // default-OFF (read sites use `features.X === true`)
   compressionMetadata: false,
   usableOnly: false,
-  // Array flags: unset/empty = no filter. These are not boolean toggles —
-  // they are operator-curated model-ID lists applied in the dynamic and static
-  // hooks alongside usableOnly (all filters AND together).
-  // visibleModels: undefined,  // allowlist — only listed IDs pass
-  // hiddenModels: undefined,  // blocklist — listed IDs are dropped
   mcpAutoEmit: false,
   debugLog: false,
   startupDebug: false,
@@ -1033,11 +1026,7 @@ export const OmniRoutePlugin: Plugin = async (_input, options) => {
   // Config hook: keep existing catalog shim, and register slash command
   // templates that ask the agent to call the force-sync tool (OpenCode has no
   // Pi-style registerCommand API; tools + command templates are the native path).
-  const baseConfigHook = createOmniRouteConfigHook(resolved, {
-    cache: sharedCache,
-    diskSnapshotReader: defaultDiskSnapshotReader,
-    diskSnapshotWriter: defaultDiskSnapshotWriter,
-  });
+  const baseConfigHook = createOmniRouteConfigHook(resolved, { cache: sharedCache });
   const configWithSyncCommand = async (input: Config) => {
     await baseConfigHook(input);
     const cfg = input as Config & {
@@ -2837,118 +2826,6 @@ export function isUsableCombo(
   return false;
 }
 
-// ─────────────────────────────────────────────────────────────────────────
-// #9473 — Model allowlist / blocklist filter helpers
-// ─────────────────────────────────────────────────────────────────────────
-
-/**
- * Pre-compiled filter structure for the model allowlist/blocklist.
- *
- * "exact" holds full raw IDs (e.g. "cc/claude-opus-4-7") for O(1) match.
- * "suffixes" holds bare model IDs (e.g. "claude-opus-4-7") that match any
- * "{prefix}/claude-opus-4-7" — so operators can curate by model name without
- * knowing the provider prefix.
- */
-export interface ModelListFilter {
-  exact: Set<string>;
-  suffixes: Set<string>;
-}
-
-/**
- * Compile a string[] of model IDs into a pre-computed filter structure.
- * Returns undefined when the list is empty or undefined — the "no filter"
- * state that callers use as a passthrough.
- *
- * IDs containing a "/" are stored in "exact"; bare IDs (no slash) go into
- * "suffixes" and match any "{prefix}/<suffix>" at check time.
- */
-export function compileModelListFilter(list?: string[]): ModelListFilter | undefined {
-  if (!list || list.length === 0) return undefined;
-  const exact = new Set<string>();
-  const suffixes = new Set<string>();
-  for (const id of list) {
-    if (id.includes("/")) {
-      exact.add(id);
-    } else {
-      suffixes.add(id);
-    }
-  }
-  if (exact.size === 0 && suffixes.size === 0) return undefined;
-  return { exact, suffixes };
-}
-
-/**
- * Decide whether a raw model ID passes the allowlist/blocklist filter.
- *
- * Rules (all filters AND together with usableOnly):
- *   - No visible filter and no hidden filter → keep (passthrough).
- *   - Visible filter set: id must match either the exact set or the suffix
- *     set (bare suffix "claude-opus-4-7" matches any "{prefix}/claude-opus-4-7").
- *   - Hidden filter set: id must NOT match either the exact or suffix set.
- *   - If id is in BOTH visible and hidden → DROP (deny wins — safer).
- *   - No-slash ids (e.g. combo names like "claude-primary") are checked
- *     against the exact set directly, and against the suffix set as a bare
- *     match.
- *
- * Pure function — exported so static + dynamic hooks share the same
- * verdict logic without divergence.
- */
-export function passesModelAllowlist(
-  id: string,
-  visible?: ModelListFilter,
-  hidden?: ModelListFilter
-): boolean {
-  // Hidden filter takes precedence (deny wins over allow).
-  if (hidden) {
-    if (hidden.exact.has(id) || matchesSuffix(id, hidden.suffixes)) return false;
-  }
-  // Visible filter: if set, id must match.
-  if (visible) {
-    if (!visible.exact.has(id) && !matchesSuffix(id, visible.suffixes)) return false;
-  }
-  return true;
-}
-
-/**
- * Decide whether a combo passes the allowlist filter. A combo keeps when
- * AT LEAST ONE of its members matches the visible filter. When no visible
- * filter is set, all combos pass. Combos with zero resolvable members pass
- * (mirrors `isUsableCombo` semantics).
- */
-export function passesComboAllowlist(
-  combo: OmniRouteRawCombo,
-  visible?: ModelListFilter
-): boolean {
-  if (!visible) return true;
-  const steps = Array.isArray(combo.models) ? combo.models : [];
-  if (steps.length === 0) return true;
-  let sawResolvableMember = false;
-  for (const step of steps) {
-    if (step?.kind === "combo-ref") continue;
-    const modelId = typeof step?.model === "string" ? step.model : "";
-    if (modelId.length === 0) continue;
-    sawResolvableMember = true;
-    if (visible.exact.has(modelId) || matchesSuffix(modelId, visible.suffixes)) return true;
-  }
-  // No resolvable member → can't prove it should be hidden; keep.
-  if (!sawResolvableMember) return true;
-  // Every resolvable member failed the allowlist → drop.
-  return false;
-}
-
-/**
- * Check whether a raw model ID matches any suffix in the set.
- * For an id like `cc/claude-opus-4-7`, the suffix after the first `/`
- * is checked against the suffixes set. For a bare id like `claude-primary`,
- * the id itself is checked against the suffixes set.
- */
-function matchesSuffix(id: string, suffixes: Set<string>): boolean {
-  if (suffixes.size === 0) return false;
-  const slash = id.indexOf("/");
-  const suffix = slash > 0 ? id.slice(slash + 1) : id;
-  return suffixes.has(suffix);
-}
-
 /**
  * Slugify a combo display name into a copy/paste-friendly URL-safe segment.
  * Lowercases, replaces any run of non-alphanumeric chars with a single dash,
@@ -3132,9 +3009,6 @@ export function createOmniRouteProviderHook(
   const wantCompressionMeta = features.compressionMetadata === true;
   const wantUsableOnly = features.usableOnly === true;
   const wantProviderTag = features.providerTag !== false;
-  // #9473: model allowlist/blocklist — compile once per hook instance.
-  const visibleFilter = compileModelListFilter(features.visibleModels);
-  const hiddenFilter = compileModelListFilter(features.hiddenModels);
   const now = deps.now ?? Date.now;
   // T-07: cache holds RAW fetch results (not pre-derived ModelV2) so that
   // the config-shim hook can share the same cache and derive its stripped
@@ -3369,8 +3243,6 @@ export function createOmniRouteProviderHook(
         if (!entry.id) continue;
         if (canonicalDedup.has(entry.id)) continue;
         if (usable && !isUsableRawModelId(entry.id, usable, rawEnrichment)) continue;
-        // #9473: allowlist/blocklist filter (AND with usableOnly).
-        if (!passesModelAllowlist(entry.id, visibleFilter, hiddenFilter)) continue;
         const model = mapRawModelToModelV2(entry, {
           // #6859: server-facing id — NOT the OC-gate-prefixed `resolved.providerId`.
           providerId: resolved.omnirouteProviderId,
@@ -3446,8 +3318,6 @@ export function createOmniRouteProviderHook(
         if (!combo.id) return false;
         if (combo.isHidden === true) return false;
         if (usable && !isUsableCombo(combo, usable)) return false;
-        // #9473: combo allowlist — drop when no member matches visible filter.
-        if (visibleFilter && !passesComboAllowlist(combo, visibleFilter)) return false;
         return true;
       });
       // Resolved nested combos keyed by their friendly name, so parent
@@ -4265,9 +4135,6 @@ export function buildStaticProviderEntry(
     wantUsableOnly && connections && connections.length > 0
       ? usableProviderAliasSet(connections, enrichment)
       : undefined;
-  // #9473: model allowlist/blocklist — compile once per static-block build.
-  const visibleFilter = compileModelListFilter(opts.features?.visibleModels);
-  const hiddenFilter = compileModelListFilter(opts.features?.hiddenModels);
   // Provider-tag suffix — default-on, opt-out via `features.providerTag: false`.
   // Prepends e.g. `Claude - ` to enriched raw-model names so the picker
   // can tell `cc/claude-opus-4-7` (Anthropic) apart from `kr/claude-opus-4-7`
@@ -4305,8 +4172,6 @@ export function buildStaticProviderEntry(
     // Skip canonical-named twins when the alias-keyed enriched row exists.
     if (canonicalDedup.has(raw.id)) continue;
     if (usable && !isUsableRawModelId(raw.id, usable, enrichment)) continue;
-    // #9473: allowlist/blocklist filter (AND with usableOnly).
-    if (!passesModelAllowlist(raw.id, visibleFilter, hiddenFilter)) continue;
     const caps = raw.capabilities ?? {};
     // Enrichment overlay: `/api/pricing/models` carries human display names
     // (e.g. "Claude Opus 4.7" for raw id "cc/claude-opus-4-7"). The OC TUI
@@ -4407,11 +4272,11 @@ export function buildStaticProviderEntry(
       entry.release_date = raw.release_date;
     }
 
-    // #9175: OC's `getModel` looks the model up by BARE id — the part after
-    // the first `/` in the user's request — so a dict key with an embedded
-    // provider prefix (`<providerId>/<raw-id>`) is unreachable. Keys are the
-    // raw id verbatim; ids that already contain `/` (e.g. `cc/claude-opus-4-7`)
-    // keep it because the slash is part of the upstream model id itself.
+    // OC's static-catalog reader parses each key on `/` and rejects the
+    // entire provider block if ANY key resolves to a parsed providerID that
+    // has no corresponding provider block. So bare keys (no `/`) MUST be
+    // prefixed with the resolved providerId. Already-prefixed keys
+    // (e.g. `cc/claude-opus-4-7`) are left as-is to avoid double-prefixing.
     models[raw.id] = entry;
   }
 
@@ -4459,8 +4324,6 @@ export function buildStaticProviderEntry(
     if (!combo.id) return false;
     if (combo.isHidden === true) return false;
     if (usable && !isUsableCombo(combo, usable)) return false;
-    // #9473: combo allowlist — drop when no member matches visible filter.
-    if (visibleFilter && !passesComboAllowlist(combo, visibleFilter)) return false;
     return true;
   });
 
@@ -4745,7 +4608,7 @@ export type OmniRouteDiskSnapshotWriter = (
 export type OmniRouteDiskSnapshotReader = (
   providerId: string,
   identityFingerprint: string
-) => Promise<(Omit<OmniRouteFetchCacheEntry, "expiresAt"> & { writtenAt?: number }) | undefined>;
+) => Promise<Omit<OmniRouteFetchCacheEntry, "expiresAt"> | undefined>;
 
 /**
  * Bind a snapshot to the endpoint and effective credential tuple without
@@ -4828,36 +4691,15 @@ export const defaultDiskSnapshotReader: OmniRouteDiskSnapshotReader = async (
         ? parsed.rawCompressionCombos
         : [],
       rawConnections: Array.isArray(parsed.rawConnections) ? parsed.rawConnections : [],
-      writtenAt: typeof parsed.writtenAt === "number" ? parsed.writtenAt : undefined,
     };
   } catch {
     return undefined;
   }
 };
 
-/** No-op disk-cache pair — used by tests to avoid filesystem side effects.
- * Also used as the default in createOmniRouteConfigHook so that tests
- * that don't pass a diskSnapshotReader don't read real snapshot files
- * from the user's ~/.local/share/opencode/plugins/ directory.
- * The OmniRoutePlugin function passes the real defaultDiskSnapshotReader
- * explicitly. */
-export const noopDiskSnapshotReader: OmniRouteDiskSnapshotReader = async () => undefined;
+/** No-op disk-cache pair — used by tests to avoid filesystem side effects. */
 export const noopDiskSnapshotWriter: OmniRouteDiskSnapshotWriter = async () => {};
 
-/**
- * In-flight refresh guard: prevents concurrent refreshes for the same
- * cacheKey. When a warm snapshot is served, the refresh runs detached; if
- * a second hook invocation arrives before the refresh completes, it should
- * piggyback on the in-flight promise rather than starting a second one.
- * Cleared on settle so it doesn't leak.
- */
-const _inflightRefresh: Map<string, Promise<void>> = new Map();
-
-/** Reset the in-flight refresh guard (for test isolation). */
-export function _resetInflightRefresh(): void {
-  _inflightRefresh.clear();
-}
-
 // ────────────────────────────────────────────────────────────────────────────
 // Debug logging (features.debugLog)
 // ────────────────────────────────────────────────────────────────────────────
@@ -5092,6 +4934,7 @@ export function createDebugLoggingFetch(
     }
   };
 }
+export const noopDiskSnapshotReader: OmniRouteDiskSnapshotReader = async () => undefined;
 
 export type OmniRouteReadAuthJson = () => Promise<AuthJsonShape | undefined | null>;
 
@@ -5194,8 +5037,8 @@ export function createOmniRouteConfigHook(
   const compressionMetaFetcher =
     deps.compressionMetaFetcher ?? defaultOmniRouteCompressionMetaFetcher;
   const providersFetcher = deps.providersFetcher ?? defaultOmniRouteProvidersFetcher;
-  const diskSnapshotReader = deps.diskSnapshotReader ?? noopDiskSnapshotReader;
-  const diskSnapshotWriter = deps.diskSnapshotWriter ?? noopDiskSnapshotWriter;
+  const diskSnapshotReader = deps.diskSnapshotReader ?? defaultDiskSnapshotReader;
+  const diskSnapshotWriter = deps.diskSnapshotWriter ?? defaultDiskSnapshotWriter;
   const now = deps.now ?? Date.now;
   const cache: OmniRouteFetchCache = deps.cache ?? new Map();
   const logger = deps.logger ?? console;
@@ -5290,12 +5133,12 @@ export function createOmniRouteConfigHook(
     const t = now();
     const cached = cache.get(cacheKey);
 
-    let rawModels: OmniRouteRawModelEntry[] = [];
-    let rawCombos: OmniRouteRawCombo[] = [];
-    let rawAutoCombos: OmniRouteRawAutoCombo[] = [];
-    let rawEnrichment: OmniRouteEnrichmentMap = new Map();
-    let rawCompressionCombos: OmniRouteCompressionCombo[] = [];
-    let rawConnections: OmniRouteProviderConnection[] = [];
+    let rawModels: OmniRouteRawModelEntry[];
+    let rawCombos: OmniRouteRawCombo[];
+    let rawAutoCombos: OmniRouteRawAutoCombo[];
+    let rawEnrichment: OmniRouteEnrichmentMap;
+    let rawCompressionCombos: OmniRouteCompressionCombo[];
+    let rawConnections: OmniRouteProviderConnection[];
 
     if (cached && cached.expiresAt > t) {
       rawModels = cached.rawModels;
@@ -5305,275 +5148,160 @@ export function createOmniRouteConfigHook(
       rawCompressionCombos = cached.rawCompressionCombos;
       rawConnections = cached.rawConnections;
     } else {
-      // ─────────────────────────────────────────────────────────────────────
-      // Warm startup: read the disk snapshot before fetching so the provider
-      // registers immediately with the last-known-good catalog. The live
-      // fetch then refreshes in the background (detached) and updates the
-      // cache + snapshot. Gated by features.diskCache (default-on).
-      // ─────────────────────────────────────────────────────────────────────
-      let warmSnapshot: Omit<OmniRouteFetchCacheEntry, "expiresAt"> | undefined;
-      if (wantDiskCache) {
-        const snapshotResult = await diskSnapshotReader(resolved.providerId, snapshotFingerprint);
-        if (snapshotResult && snapshotResult.rawModels.length > 0) {
-          warmSnapshot = snapshotResult;
-          // Log snapshot age (accept any age — instant beats empty).
-          const age = (snapshotResult as { writtenAt?: number }).writtenAt;
-          const ageLabel = typeof age === "number" ? `${Math.round((Date.now() - age) / 3_600_000)}h` : "unknown";
+      // Fail-open fetcher errors: on /v1/models throw, fall back to empty
+      // catalog (still publish a stub block so OC has a complete-shape
+      // entry); on /api/combos throw, publish models-only. Disk-cache
+      // fallback below recovers the last-known-good catalog when the
+      // fetcher threw (network down / 403 / timeout) AND features.diskCache
+      // !== false. A 0-entry SUCCESS (fresh tenant) does NOT trigger
+      // disk fallback — that's a valid empty catalog.
+      let modelsFetchThrew = false;
+      try {
+        rawModels = await fetcher(baseURL, apiKey, 10_000);
+      } catch (err) {
+        logger.warn(
+          "[omniroute-plugin] config shim: /v1/models fetch failed; publishing stub provider entry",
+          err
+        );
+        rawModels = [];
+        modelsFetchThrew = true;
+      }
+      const modelsFetchOk = !modelsFetchThrew && rawModels.length > 0;
+
+      rawCombos = [];
+      try {
+        rawCombos = await combosFetcher(baseURL, managementReadToken, 10_000);
+      } catch (err) {
+        logger.warn(
+          "[omniroute-plugin] config shim: /api/combos fetch failed; publishing models-only static catalog",
+          err
+        );
+      }
+
+      rawAutoCombos = [];
+      if (wantAutoCombos) {
+        try {
+          rawAutoCombos = await autoCombosFetcher(baseURL, managementReadToken, 5_000);
+        } catch {
+          // Already handled inside the default fetcher
+        }
+      }
+
+      // Eagerly fetch enrichment so the static block can overlay human
+      // display names on raw model ids. On OC ≤1.15.5 the dynamic
+      // `provider.models` hook never fires in `serve` mode, so the static
+      // block IS what reaches `/provider` and the TUI model picker.
+      // Gated by `features.enrichment` (default-on). Soft-fail on error —
+      // we still publish a name-less catalog if /api/pricing/models is
+      // unreachable.
+      rawEnrichment = new Map();
+      if (wantEnrichment) {
+        try {
+          rawEnrichment = await enrichmentFetcher(baseURL, managementReadToken, 10_000);
+        } catch (err) {
           logger.warn(
-            `[omniroute-plugin] config shim: warm startup from disk snapshot (${snapshotResult.rawModels.length} models, age ${ageLabel})`
+            "[omniroute-plugin] config shim: /api/pricing/models fetch failed; publishing raw-id static catalog",
+            err
           );
         }
       }
 
-      // ─────────────────────────────────────────────────────────────────────
-      // Parallel refresh: all six fetchers run concurrently via
-      // Promise.allSettled. Each wrapper never rejects (catches internally)
-      // so partial failure is tolerated — same soft-fail semantics as the
-      // old sequential chain, but ~6x faster.
-      // ─────────────────────────────────────────────────────────────────────
-      const doRefresh = async (): Promise<void> => {
-        let modelsFetchThrew = false;
-        let localRawModels: OmniRouteRawModelEntry[] = [];
-        let localRawCombos: OmniRouteRawCombo[] = [];
-        let localRawAutoCombos: OmniRouteRawAutoCombo[] = [];
-        let localRawEnrichment: OmniRouteEnrichmentMap = new Map();
-        let localRawCompressionCombos: OmniRouteCompressionCombo[] = [];
-        let localRawConnections: OmniRouteProviderConnection[] = [];
-
-        // Each wrapper keeps the existing try/catch, default value, and
-        // exact warn message so per-endpoint fallbacks are preserved.
-        const doModels = async (): Promise<void> => {
-          try {
-            localRawModels = await fetcher(baseURL, apiKey, 10_000);
-          } catch (err) {
-            logger.warn(
-              "[omniroute-plugin] config shim: /v1/models fetch failed; publishing stub provider entry",
-              err
-            );
-            localRawModels = [];
-            modelsFetchThrew = true;
-          }
-        };
-
-        const doCombos = async (): Promise<void> => {
-          try {
-            localRawCombos = await combosFetcher(baseURL, managementReadToken, 10_000);
-          } catch (err) {
-            logger.warn(
-              "[omniroute-plugin] config shim: /api/combos fetch failed; publishing models-only static catalog",
-              err
-            );
-          }
-        };
-
-        const doAutoCombos = async (): Promise<void> => {
-          if (!wantAutoCombos) return;
-          try {
-            localRawAutoCombos = await autoCombosFetcher(baseURL, managementReadToken, 5_000);
-          } catch {
-            // Already handled inside the default fetcher
-          }
-        };
-
-        const doEnrichment = async (): Promise<void> => {
-          if (!wantEnrichment) return;
-          try {
-            localRawEnrichment = await enrichmentFetcher(baseURL, managementReadToken, 10_000);
-          } catch (err) {
-            logger.warn(
-              "[omniroute-plugin] config shim: /api/pricing/models fetch failed; publishing raw-id static catalog",
-              err
-            );
-          }
-        };
-
-        const doCompression = async (): Promise<void> => {
-          if (!wantCompressionMeta) return;
-          try {
-            localRawCompressionCombos = await compressionMetaFetcher(baseURL, managementReadToken, 10_000);
-          } catch (err) {
-            logger.warn(
-              "[omniroute-plugin] config shim: /api/context/combos fetch failed; publishing combos without compression suffix",
-              err
-            );
-          }
-        };
-
-        const doConnections = async (): Promise<void> => {
-          if (!wantUsableOnly) return;
-          try {
-            localRawConnections = await providersFetcher(baseURL, managementReadToken, 10_000);
-          } catch (err) {
-            logger.warn(
-              "[omniroute-plugin] config shim: /api/providers fetch failed; usableOnly filter disabled for this refresh",
-              err
-            );
-          }
-        };
-
-        await Promise.allSettled([
-          doModels(),
-          doCombos(),
-          doAutoCombos(),
-          doEnrichment(),
-          doCompression(),
-          doConnections(),
-        ]);
-
-        const modelsFetchOk = !modelsFetchThrew && localRawModels.length > 0;
-
-        // Disk-cache fallback (cold first run, no warm snapshot): when the
-        // live fetch returned no models AND features.diskCache !== false,
-        // hydrate from the last-known-good snapshot so OC still surfaces a
-        // usable catalog (e.g. IP whitelist drop, offline laptop).
-        if (modelsFetchThrew && wantDiskCache && !warmSnapshot) {
-          const snapshot = await diskSnapshotReader(resolved.providerId, snapshotFingerprint);
-          if (snapshot && snapshot.rawModels.length > 0) {
-            logger.warn(
-              `[omniroute-plugin] config shim: /v1/models unreachable; using stale disk cache (${snapshot.rawModels.length} models)`
-            );
-            localRawModels = snapshot.rawModels;
-            localRawCombos = snapshot.rawCombos;
-            localRawAutoCombos = snapshot.rawAutoCombos ?? [];
-            localRawEnrichment = snapshot.rawEnrichment;
-            localRawCompressionCombos = snapshot.rawCompressionCombos;
-            localRawConnections = snapshot.rawConnections;
-          }
+      // Compression-metadata fetch — opt-in via features.compressionMetadata.
+      // When on, the default pipeline is appended to every combo `name` so
+      // the TUI picker advertises which compression a combo applies.
+      rawCompressionCombos = [];
+      if (wantCompressionMeta) {
+        try {
+          rawCompressionCombos = await compressionMetaFetcher(baseURL, managementReadToken, 10_000);
+        } catch (err) {
+          logger.warn(
+            "[omniroute-plugin] config shim: /api/context/combos fetch failed; publishing combos without compression suffix",
+            err
+          );
         }
+      }
 
-        // Cache even partial results — a subsequent provider-hook call should
-        // not re-burn the timeout window on the same broken endpoint.
-        cache.set(cacheKey, {
-          rawModels: localRawModels,
-          rawCombos: localRawCombos,
-          rawAutoCombos: localRawAutoCombos,
-          rawEnrichment: localRawEnrichment,
-          rawCompressionCombos: localRawCompressionCombos,
-          rawConnections: localRawConnections,
-          expiresAt: now() + resolved.modelCacheTtl,
+      // Provider-connections fetch — opt-in via features.usableOnly. When
+      // on, the static catalog filters out models/combos whose canonical
+      // provider has no active connection. Soft-fail (empty list) disables
+      // the filter for this refresh, never hiding the whole catalog.
+      rawConnections = [];
+      if (wantUsableOnly) {
+        try {
+          rawConnections = await providersFetcher(baseURL, managementReadToken, 10_000);
+        } catch (err) {
+          logger.warn(
+            "[omniroute-plugin] config shim: /api/providers fetch failed; usableOnly filter disabled for this refresh",
+            err
+          );
+        }
+      }
+
+      // Disk-cache fallback: when the live fetch returned no models AND
+      // features.diskCache !== false, hydrate from the last-known-good
+      // snapshot so OC still surfaces a usable catalog (e.g. IP whitelist
+      // drop, offline laptop). The snapshot is whatever we last wrote on
+      // a healthy refresh; staleness is bounded only by how recently the
+      // user was online.
+      if (modelsFetchThrew && wantDiskCache) {
+        const snapshot = await diskSnapshotReader(resolved.providerId, snapshotFingerprint);
+        if (snapshot && snapshot.rawModels.length > 0) {
+          logger.warn(
+            `[omniroute-plugin] config shim: /v1/models unreachable; using stale disk cache (${snapshot.rawModels.length} models)`
+          );
+          rawModels = snapshot.rawModels;
+          rawCombos = snapshot.rawCombos;
+          rawAutoCombos = snapshot.rawAutoCombos ?? [];
+          rawEnrichment = snapshot.rawEnrichment;
+          rawCompressionCombos = snapshot.rawCompressionCombos;
+          rawConnections = snapshot.rawConnections;
+        }
+      }
+
+      // Cache even partial results — a subsequent provider-hook call should
+      // not re-burn the timeout window on the same broken endpoint.
+      cache.set(cacheKey, {
+        rawModels,
+        rawCombos,
+        rawAutoCombos,
+        rawEnrichment,
+        rawCompressionCombos,
+        rawConnections,
+        expiresAt: t + resolved.modelCacheTtl,
+      });
+
+      // Startup diagnostics (file-based) — fires at startup via config hook
+      if (resolved.features?.startupDebug === true) {
+        await writeStartupDiagnostics({
+          providerId: resolved.providerId,
+          baseURL,
+          modelCount: rawModels.length,
+          comboCount: rawCombos.length,
+          enrichmentSize: rawEnrichment.size,
+          autoComboCount: rawAutoCombos.length,
+          enrichment: rawEnrichment,
+          autoCombos: rawAutoCombos,
+          features: resolved.features,
         });
+      }
 
-        // Startup diagnostics (file-based) — fires at startup via config hook
-        if (resolved.features?.startupDebug === true) {
-          await writeStartupDiagnostics({
-            providerId: resolved.providerId,
-            baseURL,
-            modelCount: localRawModels.length,
-            comboCount: localRawCombos.length,
-            enrichmentSize: localRawEnrichment.size,
-            autoComboCount: localRawAutoCombos.length,
-            enrichment: localRawEnrichment,
-            autoCombos: localRawAutoCombos,
-            features: resolved.features,
-          });
-        }
-
-        // Disk-cache write: persist the last successful (or any non-empty)
-        // catalog so a subsequent cold start with a failed fetch can recover.
-        // Best-effort; soft-fail keeps us moving when the data dir isn't
-        // writable (e.g. read-only container). A failed refresh never
-        // overwrites the snapshot (modelsFetchOk gate).
-        if (modelsFetchOk && wantDiskCache) {
-          await diskSnapshotWriter(
-            resolved.providerId,
-            {
-              rawModels: localRawModels,
-              rawCombos: localRawCombos,
-              rawAutoCombos: localRawAutoCombos,
-              rawEnrichment: localRawEnrichment,
-              rawCompressionCombos: localRawCompressionCombos,
-              rawConnections: localRawConnections,
-            },
-            snapshotFingerprint
-          );
-        }
-
-        // Re-publish a fresh block via the shared cache so OC >=1.14.49's
-        // dynamic provider hook picks it up from the cache. When the models
-        // fetch threw and a warm snapshot was served, keep the warm block
-        // (no downgrade to stub).
-        if (modelsFetchOk || !warmSnapshot) {
-          const freshBlock = buildStaticProviderEntry(
-            localRawModels,
-            localRawCombos,
-            resolved,
-            baseURL,
-            apiKey,
-            localRawEnrichment,
-            localRawCompressionCombos,
-            localRawConnections,
-            localRawAutoCombos
-          );
-          const inputWithProvider2 = input as { provider?: Record<string, unknown> };
-          if (inputWithProvider2.provider) {
-            inputWithProvider2.provider[resolved.providerId] = freshBlock;
-          }
-        }
-      };
-
-      if (warmSnapshot) {
-        // Warm startup: publish the snapshot block immediately, then run
-        // the refresh detached (never a floating unhandled rejection).
-        rawModels = warmSnapshot.rawModels;
-        rawCombos = warmSnapshot.rawCombos;
-        rawAutoCombos = warmSnapshot.rawAutoCombos ?? [];
-        rawEnrichment = warmSnapshot.rawEnrichment;
-        rawCompressionCombos = warmSnapshot.rawCompressionCombos;
-        rawConnections = warmSnapshot.rawConnections;
-
-        // In-flight guard: if a refresh is already running for this
-        // cacheKey, piggyback on it instead of starting a second one.
-        const existing = _inflightRefresh.get(cacheKey);
-        if (existing) {
-          // Another refresh is in-flight — don't start a second one.
-          // The existing refresh will update the cache when it completes.
-        } else {
-          const refreshP = doRefresh()
-            .catch((err: unknown) => {
-              logger.warn("[omniroute-plugin] config shim: background refresh failed", err);
-            })
-            .finally(() => {
-              _inflightRefresh.delete(cacheKey);
-            });
-          _inflightRefresh.set(cacheKey, refreshP);
-        }
-      } else {
-        // Cold first run (no warm snapshot): await the refresh so the
-        // first publish is always correct. In-flight guard still applies.
-        const existing = _inflightRefresh.get(cacheKey);
-        if (existing) {
-          await existing;
-          // After the in-flight refresh completes, the cache has the data.
-          const fresh = cache.get(cacheKey);
-          if (fresh) {
-            rawModels = fresh.rawModels;
-            rawCombos = fresh.rawCombos;
-            rawAutoCombos = fresh.rawAutoCombos;
-            rawEnrichment = fresh.rawEnrichment;
-            rawCompressionCombos = fresh.rawCompressionCombos;
-            rawConnections = fresh.rawConnections;
-          }
-        } else {
-          const refreshP = doRefresh()
-            .catch((err: unknown) => {
-              logger.warn("[omniroute-plugin] config shim: refresh failed", err);
-            })
-            .finally(() => {
-              _inflightRefresh.delete(cacheKey);
-            });
-          _inflightRefresh.set(cacheKey, refreshP);
-          await refreshP;
-          // After the refresh, the cache has the data.
-          const fresh = cache.get(cacheKey);
-          if (fresh) {
-            rawModels = fresh.rawModels;
-            rawCombos = fresh.rawCombos;
-            rawAutoCombos = fresh.rawAutoCombos;
-            rawEnrichment = fresh.rawEnrichment;
-            rawCompressionCombos = fresh.rawCompressionCombos;
-            rawConnections = fresh.rawConnections;
-          }
-        }
+      // Disk-cache write: persist the last successful (or any non-empty)
+      // catalog so a subsequent cold start with a failed fetch can recover.
+      // Best-effort; soft-fail keeps us moving when the data dir isn't
+      // writable (e.g. read-only container).
+      if (modelsFetchOk && wantDiskCache) {
+        await diskSnapshotWriter(
+          resolved.providerId,
+          {
+            rawModels,
+            rawCombos,
+            rawAutoCombos,
+            rawEnrichment,
+            rawCompressionCombos,
+            rawConnections,
+          },
+          snapshotFingerprint
+        );
       }
     }
 

@omniroute/opencode-plugin/tests/config-shim.test.ts

@@ -33,7 +33,6 @@ import {
   createOmniRouteProviderHook,
   OmniRoutePlugin,
   resolveOmniRoutePluginOptions,
-  _resetInflightRefresh,
   type OmniRouteCombosFetcher,
   type OmniRouteEnrichmentEntry,
   type OmniRouteEnrichmentFetcher,
@@ -48,16 +47,6 @@ import {
   type OmniRouteStaticProviderEntry,
 } from "../src/index.js";
 
-// ────────────────────────────────────────────────────────────────────────────
-// Test isolation: reset the module-level in-flight refresh guard between
-// tests so a detached refresh from a previous test doesn't leak into the
-// next one.
-// ────────────────────────────────────────────────────────────────────────────
-
-test.beforeEach(() => {
-  _resetInflightRefresh();
-});
-
 // ────────────────────────────────────────────────────────────────────────────
 // Fixtures
 // ────────────────────────────────────────────────────────────────────────────
@@ -238,7 +227,7 @@ test("config: with valid auth.json + apiKey + baseURL → mutates input.provider
   // Stripped per-model shape: name + cap flags + modalities + (optional)
   // cost. OC's SDK static schema accepts only `limit.{context,output}` —
   // `limit.input` is NOT in the SDK shape and gets dropped silently.
-  const claude = entry.models["claude-sonnet-4-6"];
+  const claude = entry.models["opencode-omniroute/claude-sonnet-4-6"];
   assert.ok(claude, "claude model surfaced");
   assert.equal(claude.name, "claude-sonnet-4-6");
   assert.equal(claude.attachment, true);
@@ -259,7 +248,7 @@ test("config: with valid auth.json + apiKey + baseURL → mutates input.provider
 
   // Combo surfaces under bare key + LCD'd
   // (gemini's reasoning=false → combo reasoning=false).
-  const combo = entry.models["claude-tier"];
+  const combo = entry.models["omniroute/claude-tier"];
   assert.ok(combo, "combo surfaced under bare key");
   assert.equal(combo.name, "Claude Tier");
   assert.equal(combo.reasoning, false, "LCD: any member reasoning=false → combo reasoning=false");
@@ -482,10 +471,10 @@ test("config: combos fetcher throws → emit models-only catalog (no combos in m
   assert.ok(entry);
   const ids = Object.keys(entry.models).sort();
   assert.deepEqual(ids, [
-    "claude-sonnet-4-6",
-    "gemini-3-flash",
+    "opencode-omniroute/claude-sonnet-4-6",
+    "opencode-omniroute/gemini-3-flash",
   ]);
-  assert.equal(entry.models["claude-tier"], undefined, "no combo entry");
+  assert.equal(entry.models["omniroute/claude-tier"], undefined, "no combo entry");
   assert.ok(
     logger.entries.some((e) => String(e[0]).includes("/api/combos fetch failed")),
     "combos-fetch breadcrumb emitted"
@@ -734,7 +723,7 @@ test("buildStaticProviderEntry: stripped per-model shape matches sibling @omniro
   }
 
   // Sanity: claude entry has all expected stripped fields.
-  const claude = block.models["claude-sonnet-4-6"];
+  const claude = block.models["opencode-omniroute/claude-sonnet-4-6"];
   assert.equal(typeof claude.name, "string");
   assert.equal(typeof claude.attachment, "boolean");
   assert.equal(typeof claude.reasoning, "boolean");
@@ -759,8 +748,8 @@ test("buildStaticProviderEntry: hidden combos are excluded", () => {
     "https://or.example/v1",
     "sk-test"
   );
-  assert.equal(block.models["claude-tier"], undefined);
-  assert.ok(block.models["claude-sonnet-4-6"]);
+  assert.equal(block.models["omniroute/claude-tier"], undefined);
+  assert.ok(block.models["opencode-omniroute/claude-sonnet-4-6"]);
 });
 
 // ────────────────────────────────────────────────────────────────────────────
@@ -776,7 +765,7 @@ test("buildStaticProviderEntry: emits modalities.input from raw.input_modalities
     "https://or.example/v1",
     "sk-test"
   );
-  const claude = block.models["claude-sonnet-4-6"];
+  const claude = block.models["opencode-omniroute/claude-sonnet-4-6"];
   assert.deepEqual(claude.modalities?.input, ["text", "image"]);
   assert.deepEqual(claude.modalities?.output, ["text"]);
 });
@@ -790,7 +779,7 @@ test("buildStaticProviderEntry: never emits limit.input (OC SDK rejects it)", ()
     "https://or.example/v1",
     "sk-test"
   );
-  const claude = block.models["claude-sonnet-4-6"];
+  const claude = block.models["opencode-omniroute/claude-sonnet-4-6"];
   assert.equal((claude.limit as Record<string, unknown>).input, undefined);
   assert.equal(typeof claude.limit?.context, "number");
   assert.equal(typeof claude.limit?.output, "number");
@@ -818,7 +807,7 @@ test("buildStaticProviderEntry: emits cost when enrichment carries pricing", ()
     "sk-test",
     enrichment
   );
-  const claude = block.models["claude-sonnet-4-6"];
+  const claude = block.models["opencode-omniroute/claude-sonnet-4-6"];
   assert.equal(claude.cost?.input, 3);
   assert.equal(claude.cost?.output, 15);
   assert.equal(claude.cost?.cache_read, 0.3);
@@ -839,8 +828,8 @@ test("buildStaticProviderEntry: emits release_date when raw carries it; omits wh
     "https://or.example/v1",
     "sk-test"
   );
-  assert.equal(block.models["claude-with-date"].release_date, "2026-02-19");
-  assert.equal(block.models["gemini-3-flash"].release_date, undefined);
+  assert.equal(block.models["opencode-omniroute/claude-with-date"].release_date, "2026-02-19");
+  assert.equal(block.models["opencode-omniroute/gemini-3-flash"].release_date, undefined);
 });
 
 test("buildStaticProviderEntry: combo modalities = intersection of members (LCD)", () => {
@@ -869,7 +858,7 @@ test("buildStaticProviderEntry: combo modalities = intersection of members (LCD)
     "https://or.example/v1",
     "sk-test"
   );
-  const combo = block.models["mixed-tier"];
+  const combo = block.models["omniroute/mixed-tier"];
   assert.ok(combo, "combo emitted under slug key");
   // claude has text+image, text-only has text → intersection drops image.
   assert.deepEqual(combo.modalities?.input, ["text"]);
@@ -978,10 +967,10 @@ test("config: enrichment fetched + name overlaid on raw-model entries", async ()
     "opencode-omniroute"
   ];
   assert.ok(entry);
-  assert.equal(entry.models["claude-sonnet-4-6"].name, "Claude Sonnet 4.6");
-  assert.equal(entry.models["gemini-3-flash"].name, "Gemini 3 Flash");
+  assert.equal(entry.models["opencode-omniroute/claude-sonnet-4-6"].name, "Claude Sonnet 4.6");
+  assert.equal(entry.models["opencode-omniroute/gemini-3-flash"].name, "Gemini 3 Flash");
   // Combo names still come from /api/combos — enrichment overlay does NOT touch combos.
-  assert.equal(entry.models["claude-tier"].name, "Claude Tier");
+  assert.equal(entry.models["omniroute/claude-tier"].name, "Claude Tier");
   assert.equal(enrichmentFetcher.callCount(), 1);
 });
 
@@ -1011,7 +1000,7 @@ test("config: features.enrichment=false skips enrichment fetch + keeps raw-id na
   assert.ok(entry);
   assert.equal(enrichmentFetcher.callCount(), 0, "enrichment fetch suppressed by feature flag");
   assert.equal(
-    entry.models["claude-sonnet-4-6"].name,
+    entry.models["opencode-omniroute/claude-sonnet-4-6"].name,
     "claude-sonnet-4-6",
     "raw id retained"
   );
@@ -1038,7 +1027,7 @@ test("config: enrichment fetcher throws → soft-fail (warn + raw-id static cata
   ];
   assert.ok(entry, "static block still published on enrichment failure");
   assert.equal(
-    entry.models["claude-sonnet-4-6"].name,
+    entry.models["opencode-omniroute/claude-sonnet-4-6"].name,
     "claude-sonnet-4-6",
     "raw id retained"
   );
@@ -1240,20 +1229,17 @@ test("config: diskCache hydrates stale snapshot when /v1/models throws", async (
     "opencode-omniroute"
   ];
   assert.ok(
-    entry.models["claude-sonnet-4-6"],
+    entry.models["opencode-omniroute/claude-sonnet-4-6"],
     "stale snapshot hydrated into static block"
   );
   assert.equal(
-    entry.models["claude-sonnet-4-6"].name,
+    entry.models["opencode-omniroute/claude-sonnet-4-6"].name,
     "Claude Sonnet 4.6 (cached)",
     "stale enrichment also reused"
   );
   assert.equal(writes, 0, "disk write skipped when live fetch failed");
   assert.ok(
-    logger.entries.some((e) =>
-      String(e[0]).includes("using stale disk cache") ||
-      String(e[0]).includes("warm startup from disk snapshot")
-    ),
+    logger.entries.some((e) => String(e[0]).includes("using stale disk cache")),
     "disk-cache hydration breadcrumb emitted"
   );
 });
@@ -1295,7 +1281,7 @@ test("config: cached rawEnrichment from earlier provider hook is reused (no refe
   const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
     "opencode-omniroute"
   ];
-  assert.equal(entry.models["claude-sonnet-4-6"].name, "Claude Sonnet 4.6");
+  assert.equal(entry.models["opencode-omniroute/claude-sonnet-4-6"].name, "Claude Sonnet 4.6");
 });
 
 // ─────────────────────────────────────────────────────────────────────
@@ -1346,12 +1332,12 @@ test("config: providerTag (default-on) prepends '<provider> - ' to enriched raw-
   ];
   assert.ok(entry);
   assert.equal(
-    entry.models["claude-sonnet-4-6"].name,
+    entry.models["opencode-omniroute/claude-sonnet-4-6"].name,
     "Claude - Claude Sonnet 4.6"
   );
-  assert.equal(entry.models["gemini-3-flash"].name, "Gemini - Gemini 3 Flash");
+  assert.equal(entry.models["opencode-omniroute/gemini-3-flash"].name, "Gemini - Gemini 3 Flash");
   // Combos stay untouched — `Combo: ` prefix already conveys multi-upstream.
-  assert.equal(entry.models["claude-tier"].name, "Claude Tier");
+  assert.equal(entry.models["omniroute/claude-tier"].name, "Claude Tier");
 });
 
 test("config: providerTag=false suppresses the suffix", async () => {
@@ -1378,7 +1364,7 @@ test("config: providerTag=false suppresses the suffix", async () => {
     "opencode-omniroute"
   ];
   assert.equal(
-    entry.models["claude-sonnet-4-6"].name,
+    entry.models["opencode-omniroute/claude-sonnet-4-6"].name,
     "Claude Sonnet 4.6",
     "enriched name kept, provider tag suppressed"
   );
@@ -1410,7 +1396,7 @@ test("config: providerTag falls back to UPPER(alias) when providerDisplayName mi
   const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
     "opencode-omniroute"
   ];
-  assert.equal(entry.models["claude-sonnet-4-6"].name, "CC - Claude Sonnet 4.6");
+  assert.equal(entry.models["opencode-omniroute/claude-sonnet-4-6"].name, "CC - Claude Sonnet 4.6");
 });
 
 test("config: providerTag skipped entirely when neither providerDisplayName nor providerAlias set", async () => {
@@ -1437,7 +1423,7 @@ test("config: providerTag skipped entirely when neither providerDisplayName nor
   const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
     "opencode-omniroute"
   ];
-  assert.equal(entry.models["claude-sonnet-4-6"].name, "Claude Sonnet 4.6");
+  assert.equal(entry.models["opencode-omniroute/claude-sonnet-4-6"].name, "Claude Sonnet 4.6");
 });
 
 test("config: providerTag is idempotent — second hook call doesn't double-suffix", async () => {
@@ -1465,7 +1451,7 @@ test("config: providerTag is idempotent — second hook call doesn't double-suff
     "opencode-omniroute"
   ];
   assert.equal(
-    entryA.models["claude-sonnet-4-6"].name,
+    entryA.models["opencode-omniroute/claude-sonnet-4-6"].name,
     "Claude - Claude Sonnet 4.6"
   );
 
@@ -1476,7 +1462,7 @@ test("config: providerTag is idempotent — second hook call doesn't double-suff
     "opencode-omniroute"
   ];
   assert.equal(
-    entryB.models["claude-sonnet-4-6"].name,
+    entryB.models["opencode-omniroute/claude-sonnet-4-6"].name,
     "Claude - Claude Sonnet 4.6"
   );
 });
@@ -1530,7 +1516,7 @@ test("buildStaticProviderEntry: nested combo-ref context is the bottleneck acros
   );
   // Pre-fix: Parent would advertise 200_000 (only raw-big counted).
   // Post-fix: Parent should advertise 8_000 (TinyCombo bottleneck).
-  const parent = block.models["parent"];
+  const parent = block.models["omniroute/parent"];
   assert.ok(parent, "Parent combo must be in the static catalog");
   assert.equal(parent.limit?.context, 8_000);
 });

@omniroute/opencode-plugin/tests/model-allowlist.test.ts

@@ -1,317 +0,0 @@
-/**
- * #9473 — Model allowlist/blocklist for the opencode-plugin.
- *
- * Tests for the pure filter helpers (`compileModelListFilter`,
- * `passesModelAllowlist`, `passesComboAllowlist`) and the schema + hook-level
- * integration. The allowlist/blocklist composes with `usableOnly` (all filters
- * AND together), blocklist wins over allowlist (deny takes precedence), and
- * bare-suffix entries (e.g. "claude-opus-4-7") match any "{prefix}/claude-opus-4-7".
- */
-
-import test from "node:test";
-import assert from "node:assert/strict";
-
-import {
-  compileModelListFilter,
-  passesModelAllowlist,
-  passesComboAllowlist,
-  parseOmniRoutePluginOptions,
-  buildStaticProviderEntry,
-  resolveOmniRoutePluginOptions,
-  type OmniRouteRawCombo,
-  type OmniRouteRawModelEntry,
-} from "../src/index.js";
-
-// ─────────────────────────────────────────────────────────────────────────
-// compileModelListFilter
-// ─────────────────────────────────────────────────────────────────────────
-
-test("compileModelListFilter: undefined list → undefined", () => {
-  assert.equal(compileModelListFilter(undefined), undefined);
-});
-
-test("compileModelListFilter: empty array → undefined", () => {
-  assert.equal(compileModelListFilter([]), undefined);
-});
-
-test("compileModelListFilter: raw IDs with slash → exact set populated", () => {
-  const f = compileModelListFilter(["cc/claude-opus-4-7", "glm/gpt-5"]);
-  assert.ok(f);
-  assert.equal(f.exact.has("cc/claude-opus-4-7"), true);
-  assert.equal(f.exact.has("glm/gpt-5"), true);
-  assert.equal(f.suffixes.size, 0);
-});
-
-test("compileModelListFilter: bare IDs (no slash) → suffixes set populated", () => {
-  const f = compileModelListFilter(["claude-opus-4-7", "gpt-5"]);
-  assert.ok(f);
-  assert.equal(f.suffixes.has("claude-opus-4-7"), true);
-  assert.equal(f.suffixes.has("gpt-5"), true);
-  assert.equal(f.exact.size, 0);
-});
-
-test("compileModelListFilter: mixed raw + bare → both sets populated", () => {
-  const f = compileModelListFilter(["cc/claude-opus-4-7", "gpt-5"]);
-  assert.ok(f);
-  assert.equal(f.exact.has("cc/claude-opus-4-7"), true);
-  assert.equal(f.suffixes.has("gpt-5"), true);
-});
-
-// ─────────────────────────────────────────────────────────────────────────
-// passesModelAllowlist
-// ─────────────────────────────────────────────────────────────────────────
-
-test("passesModelAllowlist: no visible, no hidden → keep (passthrough)", () => {
-  assert.equal(passesModelAllowlist("cc/claude-opus-4-7", undefined, undefined), true);
-});
-
-test("passesModelAllowlist: visible undefined, hidden undefined → keep", () => {
-  assert.equal(passesModelAllowlist("cc/claude-opus-4-7", undefined, undefined), true);
-});
-
-test("passesModelAllowlist: visible set, id matches exact → keep", () => {
-  const vis = compileModelListFilter(["cc/claude-opus-4-7"]);
-  assert.equal(passesModelAllowlist("cc/claude-opus-4-7", vis, undefined), true);
-});
-
-test("passesModelAllowlist: visible set, id matches suffix → keep", () => {
-  const vis = compileModelListFilter(["claude-opus-4-7"]);
-  assert.equal(passesModelAllowlist("cc/claude-opus-4-7", vis, undefined), true);
-});
-
-test("passesModelAllowlist: visible set, id does NOT match → drop", () => {
-  const vis = compileModelListFilter(["cc/claude-opus-4-7"]);
-  assert.equal(passesModelAllowlist("glm/gpt-5", vis, undefined), false);
-});
-
-test("passesModelAllowlist: visible set, bare suffix matches different prefix → keep", () => {
-  const vis = compileModelListFilter(["claude-opus-4-7"]);
-  assert.equal(passesModelAllowlist("kr/claude-opus-4-7", vis, undefined), true);
-});
-
-test("passesModelAllowlist: hidden set, id matches exact → drop", () => {
-  const hid = compileModelListFilter(["cc/claude-opus-4-7"]);
-  assert.equal(passesModelAllowlist("cc/claude-opus-4-7", undefined, hid), false);
-});
-
-test("passesModelAllowlist: hidden set, id matches suffix → drop", () => {
-  const hid = compileModelListFilter(["claude-opus-4-7"]);
-  assert.equal(passesModelAllowlist("cc/claude-opus-4-7", undefined, hid), false);
-});
-
-test("passesModelAllowlist: hidden set, id does NOT match → keep", () => {
-  const hid = compileModelListFilter(["cc/claude-opus-4-7"]);
-  assert.equal(passesModelAllowlist("glm/gpt-5", undefined, hid), true);
-});
-
-test("passesModelAllowlist: id in BOTH visible and hidden → DROP (deny wins)", () => {
-  const vis = compileModelListFilter(["cc/claude-opus-4-7"]);
-  const hid = compileModelListFilter(["cc/claude-opus-4-7"]);
-  assert.equal(passesModelAllowlist("cc/claude-opus-4-7", vis, hid), false);
-});
-
-test("passesModelAllowlist: visible allows, hidden blocks different id → keep the visible one", () => {
-  const vis = compileModelListFilter(["cc/claude-opus-4-7"]);
-  const hid = compileModelListFilter(["glm/gpt-5"]);
-  assert.equal(passesModelAllowlist("cc/claude-opus-4-7", vis, hid), true);
-  assert.equal(passesModelAllowlist("glm/gpt-5", vis, hid), false);
-});
-
-test("passesModelAllowlist: bare-suffix hidden blocks exact match too", () => {
-  const hid = compileModelListFilter(["claude-opus-4-7"]);
-  assert.equal(passesModelAllowlist("cc/claude-opus-4-7", undefined, hid), false);
-  assert.equal(passesModelAllowlist("kr/claude-opus-4-7", undefined, hid), false);
-});
-
-test("passesModelAllowlist: no-slash id, visible set has bare match → keep", () => {
-  const vis = compileModelListFilter(["claude-primary"]);
-  assert.equal(passesModelAllowlist("claude-primary", vis, undefined), true);
-});
-
-test("passesModelAllowlist: no-slash id, visible set has no match → drop", () => {
-  const vis = compileModelListFilter(["cc/claude-opus-4-7"]);
-  assert.equal(passesModelAllowlist("claude-primary", vis, undefined), false);
-});
-
-// ─────────────────────────────────────────────────────────────────────────
-// passesComboAllowlist
-// ─────────────────────────────────────────────────────────────────────────
-
-function combo(models: OmniRouteRawCombo["models"]): OmniRouteRawCombo {
-  return { id: "c1", name: "Test Combo", models };
-}
-
-test("passesComboAllowlist: visible undefined → keep", () => {
-  const c = combo([{ kind: "model", model: "cc/claude-opus-4-7" }]);
-  assert.equal(passesComboAllowlist(c, undefined), true);
-});
-
-test("passesComboAllowlist: ≥1 member matches visible → keep", () => {
-  const vis = compileModelListFilter(["cc/claude-opus-4-7"]);
-  const c = combo([
-    { kind: "model", model: "dead/legacy" },
-    { kind: "model", model: "cc/claude-opus-4-7" },
-  ]);
-  assert.equal(passesComboAllowlist(c, vis), true);
-});
-
-test("passesComboAllowlist: zero members match visible → drop", () => {
-  const vis = compileModelListFilter(["cc/claude-opus-4-7"]);
-  const c = combo([
-    { kind: "model", model: "glm/gpt-5" },
-    { kind: "model", model: "kr/claude-opus-4-7" },
-  ]);
-  assert.equal(passesComboAllowlist(c, vis), false);
-});
-
-test("passesComboAllowlist: bare suffix matches any prefix → keep", () => {
-  const vis = compileModelListFilter(["claude-opus-4-7"]);
-  const c = combo([{ kind: "model", model: "kr/claude-opus-4-7" }]);
-  assert.equal(passesComboAllowlist(c, vis), true);
-});
-
-test("passesComboAllowlist: zero members → keep", () => {
-  const vis = compileModelListFilter(["cc/claude-opus-4-7"]);
-  assert.equal(passesComboAllowlist(combo([]), vis), true);
-  assert.equal(passesComboAllowlist(combo(undefined), vis), true);
-});
-
-test("passesComboAllowlist: only combo-ref steps → keep", () => {
-  const vis = compileModelListFilter(["cc/claude-opus-4-7"]);
-  const c = combo([{ kind: "combo-ref", comboName: "nested" }]);
-  assert.equal(passesComboAllowlist(c, vis), true);
-});
-
-// ─────────────────────────────────────────────────────────────────────────
-// Schema — visibleModels / hiddenModels
-// ─────────────────────────────────────────────────────────────────────────
-
-test("parseOmniRoutePluginOptions: visibleModels string[] → preserved", () => {
-  const r = parseOmniRoutePluginOptions({
-    features: { visibleModels: ["cc/claude-opus-4-7", "gpt-5"] },
-  });
-  assert.deepEqual(r.features?.visibleModels, ["cc/claude-opus-4-7", "gpt-5"]);
-});
-
-test("parseOmniRoutePluginOptions: hiddenModels string[] → preserved", () => {
-  const r = parseOmniRoutePluginOptions({
-    features: { hiddenModels: ["glm/gpt-5"] },
-  });
-  assert.deepEqual(r.features?.hiddenModels, ["glm/gpt-5"]);
-});
-
-test("parseOmniRoutePluginOptions: both lists together → preserved", () => {
-  const r = parseOmniRoutePluginOptions({
-    features: {
-      visibleModels: ["cc/claude-opus-4-7"],
-      hiddenModels: ["glm/gpt-5"],
-    },
-  });
-  assert.deepEqual(r.features?.visibleModels, ["cc/claude-opus-4-7"]);
-  assert.deepEqual(r.features?.hiddenModels, ["glm/gpt-5"]);
-});
-
-test("parseOmniRoutePluginOptions: empty string in visibleModels → rejects", () => {
-  assert.throws(
-    () =>
-      parseOmniRoutePluginOptions({
-        features: { visibleModels: [""] },
-      }),
-    /Invalid @omniroute\/opencode-plugin options/
-  );
-});
-
-test("parseOmniRoutePluginOptions: empty string in hiddenModels → rejects", () => {
-  assert.throws(
-    () =>
-      parseOmniRoutePluginOptions({
-        features: { hiddenModels: [""] },
-      }),
-    /Invalid @omniroute\/opencode-plugin options/
-  );
-});
-
-test("parseOmniRoutePluginOptions: unknown features key still rejects (strict invariant)", () => {
-  assert.throws(
-    () =>
-      parseOmniRoutePluginOptions({
-        features: { visibleModels: ["x"], unknownKey: true },
-      }),
-    /Invalid @omniroute\/opencode-plugin options/
-  );
-});
-
-// ─────────────────────────────────────────────────────────────────────────
-// buildStaticProviderEntry — allowlist/blocklist integration
-// ─────────────────────────────────────────────────────────────────────────
-
-const FAKE_RAW_MODELS: OmniRouteRawModelEntry[] = [
-  { id: "cc/claude-opus-4-7", owned_by: "anthropic" },
-  { id: "glm/gpt-5", owned_by: "openai" },
-  { id: "kr/claude-opus-4-7", owned_by: "anthropic" },
-  { id: "claude-primary", owned_by: "combo" },
-];
-
-test("buildStaticProviderEntry: no allowlist → all models emitted", () => {
-  const opts = resolveOmniRoutePluginOptions({ features: {} });
-  const entry = buildStaticProviderEntry(FAKE_RAW_MODELS, [], opts, "http://localhost:20128/v1", "sk-test");
-  const ids = Object.keys(entry.models);
-  assert.ok(ids.includes("cc/claude-opus-4-7"), "cc/claude-opus-4-7 should be present");
-  assert.ok(ids.includes("glm/gpt-5"), "glm/gpt-5 should be present");
-  assert.ok(ids.includes("kr/claude-opus-4-7"), "kr/claude-opus-4-7 should be present");
-});
-
-test("buildStaticProviderEntry: visibleModels filters to only listed IDs", () => {
-  const opts = resolveOmniRoutePluginOptions({
-    features: { visibleModels: ["cc/claude-opus-4-7"] },
-  });
-  const entry = buildStaticProviderEntry(FAKE_RAW_MODELS, [], opts, "http://localhost:20128/v1", "sk-test");
-  const ids = Object.keys(entry.models);
-  assert.ok(ids.includes("cc/claude-opus-4-7"), "cc/claude-opus-4-7 should be present");
-  assert.equal(ids.includes("glm/gpt-5"), false, "glm/gpt-5 should be filtered out");
-  assert.equal(ids.includes("kr/claude-opus-4-7"), false, "kr/claude-opus-4-7 should be filtered out");
-});
-
-test("buildStaticProviderEntry: hiddenModels drops listed IDs", () => {
-  const opts = resolveOmniRoutePluginOptions({
-    features: { hiddenModels: ["glm/gpt-5"] },
-  });
-  const entry = buildStaticProviderEntry(FAKE_RAW_MODELS, [], opts, "http://localhost:20128/v1", "sk-test");
-  const ids = Object.keys(entry.models);
-  assert.ok(ids.includes("cc/claude-opus-4-7"), "cc/claude-opus-4-7 should be present");
-  assert.equal(ids.includes("glm/gpt-5"), false, "glm/gpt-5 should be hidden");
-  assert.ok(ids.includes("kr/claude-opus-4-7"), "kr/claude-opus-4-7 should be present");
-});
-
-test("buildStaticProviderEntry: bare-suffix visibleModels matches any prefix", () => {
-  const opts = resolveOmniRoutePluginOptions({
-    features: { visibleModels: ["claude-opus-4-7"] },
-  });
-  const entry = buildStaticProviderEntry(FAKE_RAW_MODELS, [], opts, "http://localhost:20128/v1", "sk-test");
-  const ids = Object.keys(entry.models);
-  assert.ok(ids.includes("cc/claude-opus-4-7"), "cc/claude-opus-4-7 should match via suffix");
-  assert.ok(ids.includes("kr/claude-opus-4-7"), "kr/claude-opus-4-7 should match via suffix");
-  assert.equal(ids.includes("glm/gpt-5"), false, "glm/gpt-5 should be filtered out");
-});
-
-test("buildStaticProviderEntry: id in both visible and hidden → hidden wins", () => {
-  const opts = resolveOmniRoutePluginOptions({
-    features: {
-      visibleModels: ["cc/claude-opus-4-7"],
-      hiddenModels: ["cc/claude-opus-4-7"],
-    },
-  });
-  const entry = buildStaticProviderEntry(FAKE_RAW_MODELS, [], opts, "http://localhost:20128/v1", "sk-test");
-  const ids = Object.keys(entry.models);
-  assert.equal(ids.includes("cc/claude-opus-4-7"), false, "deny takes precedence");
-});
-
-test("buildStaticProviderEntry: empty visibleModels → no filter (passthrough)", () => {
-  const opts = resolveOmniRoutePluginOptions({
-    features: { visibleModels: [] },
-  });
-  const entry = buildStaticProviderEntry(FAKE_RAW_MODELS, [], opts, "http://localhost:20128/v1", "sk-test");
-  const ids = Object.keys(entry.models);
-  assert.ok(ids.includes("cc/claude-opus-4-7"), "empty visibleModels should not filter");
-  assert.ok(ids.includes("glm/gpt-5"), "empty visibleModels should not filter");
-});

@omniroute/opencode-plugin/tests/provider-id-routing.test.ts

@@ -111,9 +111,7 @@ test("#6859: createOmniRouteProviderHook end-to-end — catalog keys/providerID
 // `opencode-omniroute`. Confirmed against the issue's own curl repro
 // (`model: "opencode-omniroute/hermes-smart-stack"` → "No active
 // credentials for provider: opencode-omniroute").
-// #9175 tightened this further: OC's `getModel` looks models up by BARE id,
-// so combo dict keys now carry NO prefix at all (not even `omniroute/`).
-test("#7976/#9175: buildStaticProviderEntry keys combos by bare slug (no prefix at all — never the OC-gate providerId)", () => {
+test("#7976: buildStaticProviderEntry keys bare-slug combo ids with the unprefixed omnirouteProviderId (no double OC-gate prefix)", () => {
   const resolved = resolveOmniRoutePluginOptions({ providerId: "omniroute" });
   assert.equal(resolved.providerId, "opencode-omniroute");
   assert.equal(resolved.omnirouteProviderId, "omniroute");
@@ -133,7 +131,7 @@ test("#7976/#9175: buildStaticProviderEntry keys combos by bare slug (no prefix
     "sk-test"
   );
 
-  assert.deepEqual(Object.keys(block.models), ["hermes-smart-stack"]);
+  assert.deepEqual(Object.keys(block.models), ["omniroute/hermes-smart-stack"]);
   assert.equal(
     block.models["opencode-omniroute/hermes-smart-stack"],
     undefined,

@omniroute/opencode-plugin/tests/warm-startup.test.ts

@@ -1,827 +0,0 @@
-/**
- * Warm-startup + parallel-refresh tests for the opencode-plugin config shim.
- *
- * Covers `createOmniRouteConfigHook(opts, deps)`:
- *   - (a) Warm startup: cache miss + matching snapshot → provider block
- *     populated from snapshot data (not live fetch data).
- *   - (b) Fingerprint mismatch: reader returns undefined → no warm publish,
- *     falls through to awaited fetch (cold-start behavior).
- *   - (c) Successful parallel refresh: all fetchers resolve → cache updated,
- *     disk snapshot written.
- *   - (d) Failed refresh keeps the snapshot: warm-served + models fetcher
- *     rejects → no disk overwrite, block stays at warm-snapshot shape.
- *   - (e) Parallelism: all six fetchers start concurrently (not sequential).
- *   - (f) Soft-fail parity under Promise.allSettled: per-endpoint
- *     fallbacks + logger.warn breadcrumbs preserved.
- *   - (g) No double-refresh: concurrent hook invocations on the same cacheKey
- *     trigger only one refresh (in-flight guard).
- *   - (h) features.diskCache: false disables the warm read entirely.
- *
- * Mocking strategy: every dependency is DI-injected at hook construction
- * (same pattern as config-shim.test.ts). No global monkey-patching.
- */
-
-import test from "node:test";
-import assert from "node:assert/strict";
-import type { Config } from "@opencode-ai/plugin";
-
-import {
-  createOmniRouteConfigHook,
-  resolveOmniRoutePluginOptions,
-  _resetInflightRefresh,
-  type OmniRouteAutoCombosFetcher,
-  type OmniRouteCombosFetcher,
-  type OmniRouteCompressionMetaFetcher,
-  type OmniRouteEnrichmentEntry,
-  type OmniRouteEnrichmentFetcher,
-  type OmniRouteEnrichmentMap,
-  type OmniRouteFetchCache,
-  type OmniRouteModelsFetcher,
-  type OmniRouteProviderConnection,
-  type OmniRouteProvidersFetcher,
-  type OmniRouteRawAutoCombo,
-  type OmniRouteRawCombo,
-  type OmniRouteRawModelEntry,
-  type OmniRouteReadAuthJson,
-  type OmniRouteStaticProviderEntry,
-  type OmniRouteDiskSnapshotReader,
-  type OmniRouteDiskSnapshotWriter,
-  type OmniRouteCompressionCombo,
-} from "../src/index.js";
-
-// ────────────────────────────────────────────────────────────────────────────
-// Test isolation: reset the module-level in-flight refresh guard between
-// tests so a detached refresh from a previous test doesn't leak into the
-// next one (same cacheKey, different cache instance).
-// ────────────────────────────────────────────────────────────────────────────
-
-test.beforeEach(() => {
-  _resetInflightRefresh();
-});
-
-// ────────────────────────────────────────────────────────────────────────────
-// Fixtures
-// ────────────────────────────────────────────────────────────────────────────
-
-const MODEL_CLAUDE: OmniRouteRawModelEntry = {
-  id: "claude-sonnet-4-6",
-  capabilities: {
-    tool_calling: true,
-    reasoning: true,
-    vision: true,
-    thinking: false,
-    temperature: true,
-  },
-  context_length: 200_000,
-  max_output_tokens: 64_000,
-  max_input_tokens: 180_000,
-  input_modalities: ["text", "image"],
-  output_modalities: ["text"],
-};
-
-const MODEL_GEMINI: OmniRouteRawModelEntry = {
-  id: "gemini-3-flash",
-  capabilities: { tool_calling: true, reasoning: false, vision: true, thinking: false },
-  context_length: 1_000_000,
-  max_output_tokens: 8_192,
-  input_modalities: ["text", "image"],
-  output_modalities: ["text"],
-};
-
-const COMBO_CLAUDE_TIER: OmniRouteRawCombo = {
-  id: "combo-claude-tier",
-  name: "Claude Tier",
-  models: [
-    { id: "s1", kind: "model", model: "claude-sonnet-4-6", weight: 100 },
-    { id: "s2", kind: "model", model: "gemini-3-flash", weight: 50 },
-  ],
-};
-
-const AUTO_COMBO: OmniRouteRawAutoCombo = {
-  id: "auto",
-  name: "Auto",
-};
-
-const COMPRESSION_COMBO: OmniRouteCompressionCombo = {
-  id: "ctx-combo-1",
-  name: "Context Combo",
-  pipeline: "gzip",
-};
-
-const CONNECTION_CLAUDE: OmniRouteProviderConnection = {
-  id: "c1",
-  provider: "claude",
-  isActive: true,
-  testStatus: "active",
-};
-
-// ────────────────────────────────────────────────────────────────────────────
-// DI stub helpers
-// ────────────────────────────────────────────────────────────────────────────
-
-function stubReadAuthJson(
-  value: Record<string, unknown> | undefined | null
-): OmniRouteReadAuthJson {
-  return async () => value as never;
-}
-
-function immediateFetcher<T extends (...args: unknown[]) => Promise<unknown>>(
-  payload: ReturnType<T> extends Promise<infer U> ? U : never
-): T & { callCount: () => number; startedAt: () => number | undefined } {
-  let n = 0;
-  let start: number | undefined;
-  const f = async (..._args: unknown[]) => {
-    start = Date.now();
-    n++;
-    return payload;
-  };
-  return Object.assign(f as T, { callCount: () => n, startedAt: () => start });
-}
-
-function throwingFetcher<T extends (...args: unknown[]) => Promise<unknown>>(
-  msg = "ECONNREFUSED"
-): T & { callCount: () => number } {
-  let n = 0;
-  const f = async (..._args: unknown[]) => {
-    n++;
-    throw new Error(msg);
-  };
-  return Object.assign(f as T, { callCount: () => n });
-}
-
-interface WarnCapture {
-  warn: (...args: unknown[]) => void;
-  entries: unknown[][];
-}
-
-function captureWarn(): WarnCapture {
-  const entries: unknown[][] = [];
-  return {
-    warn: (...args: unknown[]) => {
-      entries.push(args);
-    },
-    entries,
-  };
-}
-
-function makeInput(initialProvider: Record<string, unknown> = {}): Config {
-  return { provider: initialProvider } as unknown as Config;
-}
-
-/** Build a valid auth.json stub for the default providerId. */
-function authStub() {
-  return stubReadAuthJson({
-    "opencode-omniroute": {
-      type: "api",
-      key: "sk-test",
-      baseURL: "https://or.example.com/v1",
-    },
-  });
-}
-
-// ────────────────────────────────────────────────────────────────────────────
-// (a) Warm startup: cache miss + matching snapshot → provider block populated
-//     from snapshot data (not live fetch data)
-// ────────────────────────────────────────────────────────────────────────────
-
-test("warm-startup: snapshot data used when snapshot is present", async () => {
-  // Live fetch returns MODEL_CLAUDE, but snapshot has MODEL_GEMINI.
-  // With warm startup, the block should contain the snapshot data.
-  const fetcher = immediateFetcher<OmniRouteModelsFetcher>([MODEL_CLAUDE]);
-  const combosFetcher = immediateFetcher<OmniRouteCombosFetcher>([]);
-  const autoCombosFetcher = immediateFetcher<OmniRouteAutoCombosFetcher>([]);
-  const enrichmentFetcher = immediateFetcher<OmniRouteEnrichmentFetcher>(new Map());
-  const compressionMetaFetcher = immediateFetcher<OmniRouteCompressionMetaFetcher>([]);
-  const providersFetcher = immediateFetcher<OmniRouteProvidersFetcher>([]);
-  const logger = captureWarn();
-
-  const snapshot: Omit<import("../src/index.js").OmniRouteFetchCacheEntry, "expiresAt"> = {
-    rawModels: [MODEL_GEMINI],
-    rawCombos: [],
-    rawAutoCombos: [],
-    rawEnrichment: new Map(),
-    rawCompressionCombos: [],
-    rawConnections: [],
-  };
-
-  const diskSnapshotReader: OmniRouteDiskSnapshotReader = async () => snapshot;
-  const diskSnapshotWriter: OmniRouteDiskSnapshotWriter = async () => {};
-
-  const hook = createOmniRouteConfigHook(
-    { providerId: "omniroute" },
-    {
-      readAuthJson: authStub(),
-      fetcher,
-      combosFetcher,
-      autoCombosFetcher,
-      enrichmentFetcher,
-      compressionMetaFetcher,
-      providersFetcher,
-      diskSnapshotReader,
-      diskSnapshotWriter,
-      logger,
-    }
-  );
-
-  const input = makeInput();
-  await hook(input);
-
-  const provider = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider;
-  const entry = provider["opencode-omniroute"];
-  assert.ok(entry, "provider entry published");
-
-  // With warm startup, the block should contain the snapshot data (GEMINI),
-  // not the live fetch data (CLAUDE). This is the key assertion: the warm
-  // snapshot is served first, and the live refresh updates the cache in the
-  // background. On the next hook invocation, the cache will have the fresh data.
-  const hasGemini = entry.models["opencode-omniroute/gemini-3-flash"] !== undefined;
-  const hasClaude = entry.models["opencode-omniroute/claude-sonnet-4-6"] !== undefined;
-  assert.ok(
-    hasGemini || hasClaude,
-    "provider block has at least one model"
-  );
-
-  // The warm-startup breadcrumb should be emitted.
-  assert.ok(
-    logger.entries.some((e) =>
-      String(e[0]).includes("warm startup from disk snapshot")
-    ),
-    "warm-startup breadcrumb emitted"
-  );
-});
-
-// ────────────────────────────────────────────────────────────────────────────
-// (b) Fingerprint mismatch: reader returns undefined → no warm publish,
-//     falls through to awaited fetch
-// ────────────────────────────────────────────────────────────────────────────
-
-test("warm-startup: fingerprint mismatch → no warm publish, awaited fetch", async () => {
-  const fetcher = immediateFetcher<OmniRouteModelsFetcher>([MODEL_CLAUDE]);
-  const combosFetcher = immediateFetcher<OmniRouteCombosFetcher>([]);
-  const logger = captureWarn();
-
-  // Reader returns undefined → fingerprint mismatch or missing snapshot.
-  const diskSnapshotReader: OmniRouteDiskSnapshotReader = async () => undefined;
-  const diskSnapshotWriter: OmniRouteDiskSnapshotWriter = async () => {};
-
-  const hook = createOmniRouteConfigHook(
-    { providerId: "omniroute" },
-    {
-      readAuthJson: authStub(),
-      fetcher,
-      combosFetcher,
-      diskSnapshotReader,
-      diskSnapshotWriter,
-      logger,
-    }
-  );
-
-  const input = makeInput();
-  await hook(input);
-
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
-  assert.ok(entry, "provider entry published from live fetch");
-  // Live fetch data, not snapshot data.
-  assert.ok(
-    entry.models["opencode-omniroute/claude-sonnet-4-6"],
-    "live fetch model present"
-  );
-  assert.equal(fetcher.callCount(), 1, "fetcher was called (awaited cold path)");
-  // No warm-startup breadcrumb when no snapshot.
-  assert.ok(
-    !logger.entries.some((e) =>
-      String(e[0]).includes("warm startup from disk snapshot")
-    ),
-    "no warm-startup breadcrumb when no snapshot"
-  );
-});
-
-// ────────────────────────────────────────────────────────────────────────────
-// (c) Successful parallel refresh: all fetchers resolve → cache updated,
-//     disk snapshot written, block re-published with fresh data
-// ────────────────────────────────────────────────────────────────────────────
-
-test("warm-startup: parallel refresh updates cache + writes snapshot", async () => {
-  const fetcher = immediateFetcher<OmniRouteModelsFetcher>([MODEL_CLAUDE]);
-  const combosFetcher = immediateFetcher<OmniRouteCombosFetcher>([COMBO_CLAUDE_TIER]);
-  const autoCombosFetcher = immediateFetcher<OmniRouteAutoCombosFetcher>([AUTO_COMBO]);
-  const enrichmentFetcher = immediateFetcher<OmniRouteEnrichmentFetcher>(
-    new Map<string, OmniRouteEnrichmentEntry>([
-      ["claude-sonnet-4-6", { name: "Claude Sonnet 4.6" }],
-    ])
-  );
-  const compressionMetaFetcher = immediateFetcher<OmniRouteCompressionMetaFetcher>([
-    COMPRESSION_COMBO,
-  ]);
-  const providersFetcher = immediateFetcher<OmniRouteProvidersFetcher>([CONNECTION_CLAUDE]);
-  const logger = captureWarn();
-
-  const snapshot: Omit<import("../src/index.js").OmniRouteFetchCacheEntry, "expiresAt"> = {
-    rawModels: [MODEL_GEMINI],
-    rawCombos: [],
-    rawAutoCombos: [],
-    rawEnrichment: new Map(),
-    rawCompressionCombos: [],
-    rawConnections: [],
-  };
-
-  const diskSnapshotReader: OmniRouteDiskSnapshotReader = async () => snapshot;
-  let snapshotWrites = 0;
-  const diskSnapshotWriter: OmniRouteDiskSnapshotWriter = async () => {
-    snapshotWrites++;
-  };
-
-  const sharedCache: OmniRouteFetchCache = new Map();
-
-  const hook = createOmniRouteConfigHook(
-    { providerId: "omniroute", modelCacheTtl: 60_000 },
-    {
-      readAuthJson: authStub(),
-      fetcher,
-      combosFetcher,
-      autoCombosFetcher,
-      enrichmentFetcher,
-      compressionMetaFetcher,
-      providersFetcher,
-      diskSnapshotReader,
-      diskSnapshotWriter,
-      cache: sharedCache,
-      logger,
-    }
-  );
-
-  const input = makeInput();
-  await hook(input);
-
-  // Warm block should have been published.
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
-  assert.ok(entry, "warm provider entry published");
-
-  // Give detached refresh time to complete.
-  await new Promise((r) => setTimeout(r, 100));
-
-  // After parallel refresh, the cache should have the fresh data.
-  const cacheKey = Array.from(sharedCache.keys())[0];
-  assert.ok(cacheKey, "cache entry created");
-  const cached = sharedCache.get(cacheKey)!;
-  assert.ok(cached.expiresAt > 0, "cache entry has expiresAt");
-  // Fresh data from the live fetchers (not the stale snapshot).
-  assert.equal(cached.rawModels.length, 1, "cache has fresh models");
-  assert.equal(cached.rawModels[0].id, "claude-sonnet-4-6", "cache has correct model");
-
-  // Disk snapshot should have been written.
-  assert.equal(snapshotWrites, 1, "disk snapshot written after successful refresh");
-});
-
-// ────────────────────────────────────────────────────────────────────────────
-// (d) Failed refresh keeps the snapshot: warm-served + models fetcher
-//     rejects → no disk overwrite, block stays at warm-snapshot shape
-// ────────────────────────────────────────────────────────────────────────────
-
-test("warm-startup: failed refresh keeps the snapshot, no disk overwrite", async () => {
-  const fetcher = throwingFetcher<OmniRouteModelsFetcher>();
-  const combosFetcher = throwingFetcher<OmniRouteCombosFetcher>();
-  const logger = captureWarn();
-
-  const snapshot: Omit<import("../src/index.js").OmniRouteFetchCacheEntry, "expiresAt"> = {
-    rawModels: [MODEL_GEMINI],
-    rawCombos: [COMBO_CLAUDE_TIER],
-    rawAutoCombos: [],
-    rawEnrichment: new Map(),
-    rawCompressionCombos: [],
-    rawConnections: [],
-  };
-
-  const diskSnapshotReader: OmniRouteDiskSnapshotReader = async () => snapshot;
-  let snapshotWrites = 0;
-  const diskSnapshotWriter: OmniRouteDiskSnapshotWriter = async () => {
-    snapshotWrites++;
-  };
-
-  const hook = createOmniRouteConfigHook(
-    { providerId: "omniroute" },
-    {
-      readAuthJson: authStub(),
-      fetcher,
-      combosFetcher,
-      diskSnapshotReader,
-      diskSnapshotWriter,
-      logger,
-    }
-  );
-
-  const input = makeInput();
-  await hook(input);
-
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
-  assert.ok(entry, "warm provider entry published");
-
-  // The block should contain the warm snapshot data (gemini), not be
-  // downgraded to a stub.
-  assert.ok(
-    entry.models["opencode-omniroute/gemini-3-flash"],
-    "warm snapshot model preserved (not downgraded to stub)"
-  );
-
-  // Give detached refresh time to complete.
-  await new Promise((r) => setTimeout(r, 100));
-
-  // No disk write on failed refresh.
-  assert.equal(snapshotWrites, 0, "no disk snapshot written when models fetch failed");
-});
-
-// ────────────────────────────────────────────────────────────────────────────
-// (e) Parallelism: all six fetchers start concurrently (not sequential)
-// ────────────────────────────────────────────────────────────────────────────
-
-test("warm-startup: all fetchers start concurrently (parallel fan-out)", async () => {
-  const startTimes: number[] = [];
-  const barrier = new Promise<void>((r) => {
-    setTimeout(r, 30);
-  });
-
-  function instrumentedFetcher<T extends (...args: unknown[]) => Promise<unknown>>(
-    payload: ReturnType<T> extends Promise<infer U> ? U : never
-  ): T & { callCount: () => number } {
-    let n = 0;
-    const f = async (..._args: unknown[]) => {
-      startTimes.push(Date.now());
-      n++;
-      await barrier;
-      return payload;
-    };
-    return Object.assign(f as T, { callCount: () => n });
-  }
-
-  const fetcher = instrumentedFetcher<OmniRouteModelsFetcher>([MODEL_CLAUDE]);
-  const combosFetcher = instrumentedFetcher<OmniRouteCombosFetcher>([]);
-  const autoCombosFetcher = instrumentedFetcher<OmniRouteAutoCombosFetcher>([]);
-  const enrichmentFetcher = instrumentedFetcher<OmniRouteEnrichmentFetcher>(new Map());
-  const compressionMetaFetcher = instrumentedFetcher<OmniRouteCompressionMetaFetcher>([]);
-  const providersFetcher = instrumentedFetcher<OmniRouteProvidersFetcher>([]);
-  const logger = captureWarn();
-
-  // No snapshot → cold path (awaited). All fetchers must still start
-  // concurrently.
-  const diskSnapshotReader: OmniRouteDiskSnapshotReader = async () => undefined;
-  const diskSnapshotWriter: OmniRouteDiskSnapshotWriter = async () => {};
-
-  const hook = createOmniRouteConfigHook(
-    { providerId: "omniroute", features: { enrichment: true, compressionMetadata: true, usableOnly: true } },
-    {
-      readAuthJson: authStub(),
-      fetcher,
-      combosFetcher,
-      autoCombosFetcher,
-      enrichmentFetcher,
-      compressionMetaFetcher,
-      providersFetcher,
-      diskSnapshotReader,
-      diskSnapshotWriter,
-      logger,
-    }
-  );
-
-  const input = makeInput();
-  await hook(input);
-
-  // All fetchers should have been called.
-  assert.equal(fetcher.callCount(), 1, "models fetcher called");
-  assert.equal(combosFetcher.callCount(), 1, "combos fetcher called");
-  assert.equal(autoCombosFetcher.callCount(), 1, "autoCombos fetcher called");
-  assert.equal(enrichmentFetcher.callCount(), 1, "enrichment fetcher called");
-  assert.equal(compressionMetaFetcher.callCount(), 1, "compressionMeta fetcher called");
-  assert.equal(providersFetcher.callCount(), 1, "providers fetcher called");
-
-  // All start times should be within 20ms of each other (parallel fan-out),
-  // NOT sequential (which would show ~30ms gaps between each).
-  assert.ok(startTimes.length >= 6, "all 6 fetchers started");
-  const minStart = Math.min(...startTimes);
-  const maxStart = Math.max(...startTimes);
-  assert.ok(
-    maxStart - minStart < 20,
-    `all fetchers started within 20ms (spread: ${maxStart - minStart}ms) — parallel fan-out confirmed`
-  );
-});
-
-// ────────────────────────────────────────────────────────────────────────────
-// (f) Soft-fail parity under Promise.allSettled: per-endpoint fallbacks +
-//     logger.warn breadcrumbs preserved
-// ────────────────────────────────────────────────────────────────────────────
-
-test("warm-startup: combos reject → models-only catalog with warn", async () => {
-  const fetcher = immediateFetcher<OmniRouteModelsFetcher>([MODEL_CLAUDE]);
-  const combosFetcher = throwingFetcher<OmniRouteCombosFetcher>("403 Forbidden");
-  const logger = captureWarn();
-
-  const diskSnapshotReader: OmniRouteDiskSnapshotReader = async () => undefined;
-  const diskSnapshotWriter: OmniRouteDiskSnapshotWriter = async () => {};
-
-  const hook = createOmniRouteConfigHook(
-    { providerId: "omniroute" },
-    {
-      readAuthJson: authStub(),
-      fetcher,
-      combosFetcher,
-      diskSnapshotReader,
-      diskSnapshotWriter,
-      logger,
-    }
-  );
-
-  const input = makeInput();
-  await hook(input);
-
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
-  assert.ok(entry, "provider entry published");
-  assert.ok(
-    entry.models["opencode-omniroute/claude-sonnet-4-6"],
-    "models-only catalog (no combos)"
-  );
-  assert.ok(
-    logger.entries.some((e) => String(e[0]).includes("/api/combos fetch failed")),
-    "combos-fetch breadcrumb emitted"
-  );
-});
-
-test("warm-startup: enrichment rejects → raw-id catalog with warn", async () => {
-  const fetcher = immediateFetcher<OmniRouteModelsFetcher>([MODEL_CLAUDE]);
-  const combosFetcher = immediateFetcher<OmniRouteCombosFetcher>([]);
-  const enrichmentFetcher = throwingFetcher<OmniRouteEnrichmentFetcher>("ETIMEDOUT");
-  const logger = captureWarn();
-
-  const diskSnapshotReader: OmniRouteDiskSnapshotReader = async () => undefined;
-  const diskSnapshotWriter: OmniRouteDiskSnapshotWriter = async () => {};
-
-  const hook = createOmniRouteConfigHook(
-    { providerId: "omniroute" },
-    {
-      readAuthJson: authStub(),
-      fetcher,
-      combosFetcher,
-      enrichmentFetcher,
-      diskSnapshotReader,
-      diskSnapshotWriter,
-      logger,
-    }
-  );
-
-  const input = makeInput();
-  await hook(input);
-
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
-  assert.ok(entry, "provider entry published");
-  assert.equal(
-    entry.models["opencode-omniroute/claude-sonnet-4-6"].name,
-    "claude-sonnet-4-6",
-    "raw id retained (no enrichment)"
-  );
-  assert.ok(
-    logger.entries.some((e) => String(e[0]).includes("/api/pricing/models fetch failed")),
-    "enrichment-fetch breadcrumb emitted"
-  );
-});
-
-test("warm-startup: providers reject → usableOnly filter disabled with warn", async () => {
-  const fetcher = immediateFetcher<OmniRouteModelsFetcher>([MODEL_CLAUDE]);
-  const combosFetcher = immediateFetcher<OmniRouteCombosFetcher>([]);
-  const providersFetcher = throwingFetcher<OmniRouteProvidersFetcher>("ETIMEDOUT");
-  const logger = captureWarn();
-
-  const diskSnapshotReader: OmniRouteDiskSnapshotReader = async () => undefined;
-  const diskSnapshotWriter: OmniRouteDiskSnapshotWriter = async () => {};
-
-  const hook = createOmniRouteConfigHook(
-    { providerId: "omniroute", features: { usableOnly: true } },
-    {
-      readAuthJson: authStub(),
-      fetcher,
-      combosFetcher,
-      providersFetcher,
-      diskSnapshotReader,
-      diskSnapshotWriter,
-      logger,
-    }
-  );
-
-  const input = makeInput();
-  await hook(input);
-
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
-  assert.ok(entry, "provider entry published");
-  // Soft-fail: model kept (filter disabled).
-  assert.ok(
-    entry.models["opencode-omniroute/claude-sonnet-4-6"],
-    "model kept (usableOnly filter disabled)"
-  );
-  assert.ok(
-    logger.entries.some((e) => String(e[0]).includes("/api/providers fetch failed")),
-    "providers-fetch breadcrumb emitted"
-  );
-});
-
-// ────────────────────────────────────────────────────────────────────────────
-// (g) No double-refresh: concurrent hook invocations on the same cacheKey
-//     trigger only one refresh (in-flight guard)
-// ────────────────────────────────────────────────────────────────────────────
-
-test("warm-startup: concurrent hook invocations dedupe refresh", async () => {
-  let fetchCount = 0;
-  const slowResolve = new Promise<void>((r) => {
-    setTimeout(r, 100);
-  });
-
-  const fetcher: OmniRouteModelsFetcher = async () => {
-    fetchCount++;
-    await slowResolve;
-    return [MODEL_CLAUDE];
-  };
-  const combosFetcher = immediateFetcher<OmniRouteCombosFetcher>([]);
-  const logger = captureWarn();
-
-  const diskSnapshotReader: OmniRouteDiskSnapshotReader = async () => undefined;
-  const diskSnapshotWriter: OmniRouteDiskSnapshotWriter = async () => {};
-
-  const sharedCache: OmniRouteFetchCache = new Map();
-
-  const hook = createOmniRouteConfigHook(
-    { providerId: "omniroute", modelCacheTtl: 60_000 },
-    {
-      readAuthJson: authStub(),
-      fetcher,
-      combosFetcher,
-      diskSnapshotReader,
-      diskSnapshotWriter,
-      cache: sharedCache,
-      logger,
-    }
-  );
-
-  // Fire two concurrent hook invocations on the same cache.
-  const inputA = makeInput();
-  const inputB = makeInput();
-  await Promise.all([hook(inputA), hook(inputB)]);
-
-  // Both should have published, but the refresh should only run once.
-  assert.equal(
-    fetchCount,
-    1,
-    "models fetcher called only once across concurrent invocations (in-flight guard)"
-  );
-});
-
-// ────────────────────────────────────────────────────────────────────────────
-// (h) features.diskCache: false disables the warm read entirely
-// ────────────────────────────────────────────────────────────────────────────
-
-test("warm-startup: diskCache=false disables warm read, falls through to awaited fetch", async () => {
-  const fetcher = immediateFetcher<OmniRouteModelsFetcher>([MODEL_CLAUDE]);
-  const combosFetcher = immediateFetcher<OmniRouteCombosFetcher>([]);
-  const logger = captureWarn();
-
-  let readerCalled = false;
-  const diskSnapshotReader: OmniRouteDiskSnapshotReader = async () => {
-    readerCalled = true;
-    return {
-      rawModels: [MODEL_GEMINI],
-      rawCombos: [],
-      rawAutoCombos: [],
-      rawEnrichment: new Map(),
-      rawCompressionCombos: [],
-      rawConnections: [],
-    };
-  };
-  const diskSnapshotWriter: OmniRouteDiskSnapshotWriter = async () => {};
-
-  const hook = createOmniRouteConfigHook(
-    { providerId: "omniroute", features: { diskCache: false } },
-    {
-      readAuthJson: authStub(),
-      fetcher,
-      combosFetcher,
-      diskSnapshotReader,
-      diskSnapshotWriter,
-      logger,
-    }
-  );
-
-  const input = makeInput();
-  await hook(input);
-
-  assert.equal(readerCalled, false, "disk snapshot reader NOT called when diskCache=false");
-
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
-  assert.ok(entry, "provider entry published from live fetch");
-  assert.ok(
-    entry.models["opencode-omniroute/claude-sonnet-4-6"],
-    "live fetch model present (not snapshot)"
-  );
-});
-
-// ────────────────────────────────────────────────────────────────────────────
-// Warm startup: snapshot age logged
-// ────────────────────────────────────────────────────────────────────────────
-
-test("warm-startup: snapshot age is logged when warm-starting from disk", async () => {
-  const fetcher = immediateFetcher<OmniRouteModelsFetcher>([MODEL_CLAUDE]);
-  const combosFetcher = immediateFetcher<OmniRouteCombosFetcher>([]);
-  const logger = captureWarn();
-
-  const snapshot: Omit<import("../src/index.js").OmniRouteFetchCacheEntry, "expiresAt"> & {
-    writtenAt?: number;
-  } = {
-    rawModels: [MODEL_GEMINI],
-    rawCombos: [],
-    rawAutoCombos: [],
-    rawEnrichment: new Map(),
-    rawCompressionCombos: [],
-    rawConnections: [],
-    writtenAt: Date.now() - 3_600_000, // 1 hour ago
-  };
-
-  const diskSnapshotReader: OmniRouteDiskSnapshotReader = async () => snapshot;
-  const diskSnapshotWriter: OmniRouteDiskSnapshotWriter = async () => {};
-
-  const hook = createOmniRouteConfigHook(
-    { providerId: "omniroute" },
-    {
-      readAuthJson: authStub(),
-      fetcher,
-      combosFetcher,
-      diskSnapshotReader,
-      diskSnapshotWriter,
-      logger,
-    }
-  );
-
-  const input = makeInput();
-  await hook(input);
-
-  // The log should mention "warm startup from disk snapshot".
-  assert.ok(
-    logger.entries.some((e) =>
-      String(e[0]).includes("warm startup from disk snapshot")
-    ),
-    "warm-startup breadcrumb emitted"
-  );
-});
-
-// ────────────────────────────────────────────────────────────────────────────
-// Warm startup: empty snapshot (rawModels.length === 0) is skipped
-// ────────────────────────────────────────────────────────────────────────────
-
-test("warm-startup: empty snapshot (rawModels.length=0) is skipped, falls through to fetch", async () => {
-  const fetcher = immediateFetcher<OmniRouteModelsFetcher>([MODEL_CLAUDE]);
-  const combosFetcher = immediateFetcher<OmniRouteCombosFetcher>([]);
-  const logger = captureWarn();
-
-  const diskSnapshotReader: OmniRouteDiskSnapshotReader = async () => ({
-    rawModels: [],
-    rawCombos: [],
-    rawAutoCombos: [],
-    rawEnrichment: new Map(),
-    rawCompressionCombos: [],
-    rawConnections: [],
-  });
-  const diskSnapshotWriter: OmniRouteDiskSnapshotWriter = async () => {};
-
-  const hook = createOmniRouteConfigHook(
-    { providerId: "omniroute" },
-    {
-      readAuthJson: authStub(),
-      fetcher,
-      combosFetcher,
-      diskSnapshotReader,
-      diskSnapshotWriter,
-      logger,
-    }
-  );
-
-  const input = makeInput();
-  await hook(input);
-
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
-  assert.ok(entry, "provider entry published from live fetch");
-  // Live data, not empty snapshot.
-  assert.ok(
-    entry.models["opencode-omniroute/claude-sonnet-4-6"],
-    "live fetch model present (empty snapshot skipped)"
-  );
-  assert.equal(fetcher.callCount(), 1, "fetcher was called (awaited cold path)");
-});

AGENTS.md

@@ -58,7 +58,7 @@ Repository map and Reference Documentation sections below.
 | Services      | `open-sse/services/`    | Combo routing, rate limits, caching, etc                                                                                                                |
 | Database      | `src/lib/db/`           | SQLite domain modules (130 migrations)                                                                                                                  |
 | Domain/Policy | `src/domain/`           | Policy engine, cost rules, fallback logic                                                                                                               |
-| MCP Server    | `open-sse/mcp-server/`  | 105 tools (42 base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules), 3 transports (stdio / SSE / Streamable HTTP), 31 scopes |
+| MCP Server    | `open-sse/mcp-server/`  | 104 tools (42 base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules), 3 transports (stdio / SSE / Streamable HTTP), 31 scopes |
 | A2A Server    | `src/lib/a2a/`          | JSON-RPC 2.0 agent protocol                                                                                                                             |
 | Skills        | `src/lib/skills/`       | Extensible skill framework                                                                                                                              |
 | Memory        | `src/lib/memory/`       | Persistent conversational memory                                                                                                                        |

README.md

@@ -188,7 +188,7 @@ curl http://localhost:20128/v1/chat/completions \
 
 </div>
 
-<img src="./docs/diagrams/promise-pillars.svg" width="100%" alt="The Promise — One endpoint. 291 providers. Never stop building — OmniRoute picks the cheapest one that works. Six pillars: Never hit limits (auto-fallback across 291 providers in milliseconds, zero downtime) · Save up to 95% tokens (RTK + Caveman stacked compression cuts 15–95%, ~89% avg on tool-heavy sessions) · $0 to start (90+ free tiers, 40+ free forever — no card needed) · Every tool works (33 coding agents through one config) · One endpoint (OpenAI ↔ Claude ↔ Gemini ↔ Responses API at /v1) · Production-grade (circuit breakers, TLS stealth, MCP 105 tools, A2A, memory, guardrails, evals — 25,000+ tests)."/>
+<img src="./docs/diagrams/promise-pillars.svg" width="100%" alt="The Promise — One endpoint. 291 providers. Never stop building — OmniRoute picks the cheapest one that works. Six pillars: Never hit limits (auto-fallback across 291 providers in milliseconds, zero downtime) · Save up to 95% tokens (RTK + Caveman stacked compression cuts 15–95%, ~89% avg on tool-heavy sessions) · $0 to start (90+ free tiers, 40+ free forever — no card needed) · Every tool works (33 coding agents through one config) · One endpoint (OpenAI ↔ Claude ↔ Gemini ↔ Responses API at /v1) · Production-grade (circuit breakers, TLS stealth, MCP 104 tools, A2A, memory, guardrails, evals — 25,000+ tests)."/>
 
 <br/>
 <br/>
@@ -439,7 +439,7 @@ All **19** strategies — mix & match per combo step:
 
 </div>
 
-<img src="./docs/diagrams/comparison-table.svg" width="100%" alt="What sets OmniRoute apart — comparison table vs 9router, OpenRouter, CLIProxyAPI and LiteLLM across 13 capabilities. OmniRoute: 291 providers, 90+ free providers built-in, 19 routing strategies, 12-engine token compression, built-in MCP server with 105 tools, A2A agent protocol, persistent memory, guardrails, cloud agents, TLS fingerprint stealth, Desktop/Termux/PWA, 43 i18n UI locales, 100% MIT self-hosted. OmniRoute is the only one with the full set; competitors show a mix of checks, partials and crosses. Verified from each project&apos;s docs."/>
+<img src="./docs/diagrams/comparison-table.svg" width="100%" alt="What sets OmniRoute apart — comparison table vs 9router, OpenRouter, CLIProxyAPI and LiteLLM across 13 capabilities. OmniRoute: 291 providers, 90+ free providers built-in, 19 routing strategies, 12-engine token compression, built-in MCP server with 104 tools, A2A agent protocol, persistent memory, guardrails, cloud agents, TLS fingerprint stealth, Desktop/Termux/PWA, 43 i18n UI locales, 100% MIT self-hosted. OmniRoute is the only one with the full set; competitors show a mix of checks, partials and crosses. Verified from each project&apos;s docs."/>
 
 <sub>📊 Full methodology &amp; per-feature detail vs 9router, OpenRouter, CLIProxyAPI &amp; LiteLLM → [`docs/comparison/OMNIROUTE_VS_ALTERNATIVES.md`](docs/comparison/OMNIROUTE_VS_ALTERNATIVES.md)</sub>
 
@@ -723,7 +723,7 @@ Expose OmniRoute over **MCP**, **A2A**, a **REST API**, **webhooks** or a **remo
 <table>
   <tr><th align="left">Interface</th><th align="left">Endpoint / command</th><th align="left">Use it for</th></tr>
   <tr><td align="left" nowrap>🧰 <b>MCP (stdio)</b></td><td align="left" nowrap><code>omniroute --mcp</code></td><td align="left">Plug into Claude Desktop, Cursor, any MCP client</td></tr>
-  <tr><td align="left" nowrap>🌊 <b>MCP (HTTP)</b></td><td align="left" nowrap><code>/api/mcp/stream</code></td><td align="left">Remote MCP — <b>105 tools</b>, 31 scopes, full audit trail</td></tr>
+  <tr><td align="left" nowrap>🌊 <b>MCP (HTTP)</b></td><td align="left" nowrap><code>/api/mcp/stream</code></td><td align="left">Remote MCP — <b>104 tools</b>, 31 scopes, full audit trail</td></tr>
   <tr><td align="left" nowrap>📡 <b>MCP (SSE)</b></td><td align="left" nowrap><code>/api/mcp/sse</code></td><td align="left">Streaming MCP transport</td></tr>
   <tr><td align="left" nowrap>🤝 <b>A2A</b></td><td align="left" nowrap><code>/.well-known/agent.json</code></td><td align="left">Agent-to-agent, <b>JSON-RPC 2.0</b> + SSE, 6 skills</td></tr>
   <tr><td align="left" nowrap>🌐 <b>REST API</b></td><td align="left" nowrap><code>/v1/*</code></td><td align="left">OpenAI-compatible — chat, embeddings, images, audio, OCR</td></tr>

bin/cli/commands/setup-open-code.mjs

@@ -218,26 +218,6 @@ function registerPluginInOpenCodeConfig({
  * a clear "could not run opencode" message instead of a hard import
  * failure.
  */
-/**
- * Resolve the provider id used for `opencode auth login --provider <id>`.
- *
- * The bundled @omniroute/opencode-plugin registers its provider under
- * `opencode-<id>` (the `opencode-` prefix is required by OpenCode >=1.17.8's
- * native-adapter gate). The auth login command must use the prefixed form
- * because OpenCode resolves `--provider <id>` against the provider id the
- * plugin actually registered.
- *
- * Idempotent: if the id already starts with `opencode-`, it passes through
- * unchanged. This protects users who manually worked around the bug with
- * `--provider opencode-omniroute`.
- *
- * @param {string} providerId
- * @returns {string}
- */
-export function resolveOpenCodeAuthProviderId(providerId) {
-  return providerId.startsWith("opencode-") ? providerId : `opencode-${providerId}`;
-}
-
 /**
  * Pure resolver for the `opencode auth login` spawn descriptor. Extracted so the
  * platform-branching logic is unit-testable without mocking child_process or
@@ -251,23 +231,21 @@ export function resolveOpenCodeAuthProviderId(providerId) {
  */
 export function resolveOpenCodeAuthSpawn(providerId, platform = process.platform) {
   const isWin = platform === "win32";
-  const authProviderId = resolveOpenCodeAuthProviderId(providerId);
   return {
     command: isWin ? "opencode.cmd" : "opencode",
-    args: ["auth", "login", "--provider", authProviderId],
+    args: ["auth", "login", "--provider", providerId],
     options: { stdio: "inherit", shell: isWin },
   };
 }
 
 export function runOpenCodeAuth(providerId) {
-  const authProviderId = resolveOpenCodeAuthProviderId(providerId);
   const { command, args, options } = resolveOpenCodeAuthSpawn(providerId);
   const res = spawnSync(command, args, options);
   if (res.error) {
     // ENOENT = opencode is not on PATH
     if (res.error.code === "ENOENT") {
       printInfo(
-        `opencode CLI not found on PATH. Run \`opencode auth login --provider ${authProviderId}\` manually after installing OpenCode.`
+        `opencode CLI not found on PATH. Run \`opencode auth login --provider ${providerId}\` manually after installing OpenCode.`
       );
       return 1;
     }
@@ -365,8 +343,7 @@ export async function runSetupOpenCodeCommand(opts = {}) {
   if (wantsAuth) {
     if (nonInteractive) {
       printInfo(`Skipping \`opencode auth login\` (non-interactive mode).`);
-      const authProviderId = resolveOpenCodeAuthProviderId(providerId);
-      printInfo(`Run manually: opencode auth login --provider ${authProviderId}`);
+      printInfo(`Run manually: opencode auth login --provider ${providerId}`);
     } else {
       printHeading("Authenticating with OpenCode");
       const authExit = runOpenCodeAuth(providerId);
@@ -375,9 +352,8 @@ export async function runSetupOpenCodeCommand(opts = {}) {
       }
     }
   } else {
-    const authProviderId = resolveOpenCodeAuthProviderId(providerId);
     printInfo(
-      `Next step: opencode auth login --provider ${authProviderId}   (pass --auth to do this automatically)`
+      `Next step: opencode auth login --provider ${providerId}   (pass --auth to do this automatically)`
     );
   }
 

bin/cli/runtime/processSupervisor.mjs

@@ -52,11 +52,8 @@ export class ServerSupervisor {
     // silently, so a boot that never becomes ready looked like a dead hang with zero
     // output even at APP_LOG_LEVEL=debug. Pipe stdout too and buffer it alongside
     // stderr so a readiness timeout can surface what the child actually printed.
-    // #9156: macOS launchd cannot resolve bare "node" because its PATH is
-    // minimal. Always use process.execPath (the absolute path to the running
-    // Node.js binary) so the supervisor never depends on PATH resolution.
     this.child = spawn(
-      process.execPath,
+      process.versions.bun ? process.execPath : "node",
       process.versions.bun
         ? [this.serverPath]
         : buildNodeRuntimeArgs(process.env, this.memoryLimit, this.serverPath),

bin/cli/runtime/trayRuntime.ts

@@ -17,7 +17,7 @@ export const SYSTRAY_VERSION = "2.1.4";
 const SYSTRAY_SPEC = `${SYSTRAY_PACKAGE}@${SYSTRAY_VERSION}`;
 
 export function resolveSystrayBinName(platform: NodeJS.Platform): string | null {
-  if (platform === "win32") return "tray_windows_release.exe";
+  if (platform === "win32") return null;
   if (platform === "darwin") return "tray_darwin_release";
   return "tray_linux_release";
 }
@@ -45,6 +45,7 @@ export function chmodSystrayBinAt(runtimeRoot: string, platform: NodeJS.Platform
 }
 
 export async function loadSystray(): Promise<(new (...args: unknown[]) => unknown) | null> {
+  if (process.platform === "win32") return null; // Windows uses tray.ps1 instead
   ensureRuntimeDir();
   if (!isInstalled()) {
     try {

bin/cli/sqlite.mjs

@@ -130,7 +130,7 @@ async function openSqliteDatabase(dbPath, options = {}) {
   try {
     return new loaded.Database(dbPath, options);
   } catch (error) {
-    return openWithSyncDriverFallback(dbPath, options, error);
+    throw createSqliteNativeError(error);
   }
 }
 

bin/cli/tray/autostart.mjs

@@ -167,10 +167,6 @@ export function getAutostartStatus() {
       linger: tryReadLingerEnabled(),
     };
   }
-  if (process.platform === "win32") {
-    const winMechanism = isAutostartEnabled() ? "vbs-startup" : null;
-    return { enabled: isAutostartEnabled(), mechanism: winMechanism };
-  }
   return { enabled: isAutostartEnabled(), mechanism: null };
 }
 

bin/cli/tray/index.mjs

@@ -1,4 +1,5 @@
 import { isTraySupported, initSystrayUnix, killSystrayUnix } from "./traySystray.mjs";
+import { initWinTray, killWinTray } from "./trayWindows.mjs";
 
 let active = null;
 
@@ -9,17 +10,15 @@ export async function initTray({ port, onQuit, onOpenDashboard, onShowLogs }) {
   const ctx = { port, onQuit, onOpenDashboard, onShowLogs };
   // initSystrayUnix is async: it lazily installs/loads systray2 from the runtime
   // dir (trayRuntime.ts) rather than from node_modules. (#4605)
-  // Use systray2 on all platforms including Windows — the tarball ships
-  // tray_windows_release.exe, avoiding the Norton/AVG IDP.HELU.PSE85 heuristic
-  // that fires on temp-dir PowerShell scripts. (#8609)
-  active = await initSystrayUnix(ctx);
+  active = process.platform === "win32" ? initWinTray(ctx) : await initSystrayUnix(ctx);
   return active;
 }
 
 export function killTray() {
   if (!active) return;
   try {
-    killSystrayUnix(active);
+    if (process.platform === "win32") killWinTray(active);
+    else killSystrayUnix(active);
   } catch {}
   active = null;
 }

bin/mcp-server.mjs

@@ -3,7 +3,7 @@
 import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -43,15 +43,7 @@ export async function startMcpCli(rootDir = ROOT) {
   }
 
   // `tsx` loader is only required for local `.ts` fallback; JS entry works without it.
-  const tsxLoaderArgs = mcpEntry.endsWith(".ts") ? ["--import", "tsx"] : [];
-  // Preload the stdout/stderr console guard before mcpEntry's own module graph evaluates —
-  // DB init (a side effect of createMcpServer()'s tool registration) logs via plain
-  // console.log, and by the time any code inside mcpEntry itself could redirect it, that
-  // module's own (hoisted) imports have already run. Loading the guard first, in a separate
-  // module, is the only point early enough to guarantee it never leaks into the JSON-RPC
-  // stream on stdout.
-  const consoleGuard = pathToFileURL(join(__dirname, "mcpStdioConsoleGuard.mjs")).href;
-  const loaderArgs = ["--import", consoleGuard, ...tsxLoaderArgs];
+  const loaderArgs = mcpEntry.endsWith(".ts") ? ["--import", "tsx"] : [];
 
   await new Promise((resolve, reject) => {
     const child = spawn(process.execPath, [...loaderArgs, mcpEntry], {

bin/mcpStdioConsoleGuard.mjs

@@ -1,16 +0,0 @@
-// Preloaded (via `node --import`) before open-sse/mcp-server/server.ts and its entire
-// import graph evaluate. The stdio MCP transport uses stdout exclusively for JSON-RPC
-// messages, but DB init (getDbInstance(), triggered as a side effect of evaluating the
-// server's module graph — e.g. tool registration reading compression settings) logs via
-// plain console.log. A redirect placed *inside* server.ts (even at the top of its first
-// executed function) is too late: static imports are hoisted and fully evaluated before
-// any of that function's own code runs, so earlier console.log calls during import-time
-// side effects already escaped to the real stdout by then. Redirecting here, in a module
-// that loads before server.ts is even requested, is the only point early enough to
-// guarantee no startup output leaks into the JSON-RPC stream and corrupts it client-side
-// (e.g. Claude Desktop: "Unexpected token 'D', \"[DB] Changi\"... is not valid JSON").
-import { Console } from "node:console";
-
-const stderrConsole = new Console({ stdout: process.stderr, stderr: process.stderr });
-console.log = stderrConsole.log.bind(stderrConsole);
-console.warn = stderrConsole.warn.bind(stderrConsole);

bin/omniroute.mjs

@@ -43,19 +43,6 @@ if (isVersionFastPath(process.argv)) {
   process.exit(0);
 }
 
-// MCP stdio transport uses stdout exclusively for JSON-RPC messages. Redirect
-// console.log/warn to stderr before anything else runs — including the tsx/esm and
-// polyfill imports below, since those (and their transitive module graphs, e.g. DB
-// init) can themselves log during evaluation. Redirecting after those imports let
-// early output leak straight into the JSON-RPC stream and corrupt it client-side
-// (e.g. Claude Desktop: "Unexpected token 'D', \"[DB] Changi\"... is not valid JSON").
-if (process.argv.includes("--mcp")) {
-  const { Console } = await import("node:console");
-  const stderrConsole = new Console({ stdout: process.stderr, stderr: process.stderr });
-  console.log = stderrConsole.log.bind(stderrConsole);
-  console.warn = stderrConsole.warn.bind(stderrConsole);
-}
-
 // Register tsx so dynamic imports of .ts source files (referenced as .js per
 // TypeScript conventions) resolve correctly. The build never emits .js for
 // src/lib/cli-helper/, so tsx handles the .ts → .js resolution at runtime.
@@ -71,6 +58,16 @@ await import("../open-sse/utils/setupPolyfill.ts");
 const { registerAliasResolver } = await import("./aliasResolver.mjs");
 await registerAliasResolver(ROOT);
 
+// MCP stdio transport uses stdout exclusively for JSON-RPC messages.
+// Redirect console.log/warn to stderr early (before loadEnvFile and DB init)
+// so no startup output corrupts the protocol.
+if (process.argv.includes("--mcp")) {
+  const { Console } = await import("node:console");
+  const stderrConsole = new Console({ stdout: process.stderr, stderr: process.stderr });
+  console.log = stderrConsole.log.bind(stderrConsole);
+  console.warn = stderrConsole.warn.bind(stderrConsole);
+}
+
 // Electron persists secrets (JWT_SECRET, API_KEY_SECRET, STORAGE_ENCRYPTION_KEY) to
 // `<DATA_DIR>/server.env` (electron/main.js), never `.env`. Migrating an existing
 // install (storage.sqlite + server.env) to the CLI left those secrets undiscoverable —

bin/restore-policies.sh

@@ -39,8 +39,7 @@ snap="$(ops_find_snapshot "$ID")"
 
 # Policy definition tables present in BOTH the snapshot and the live DB. GLOB
 # keeps `_` literal; we drop usage counters / logs so accounting isn't rewound.
-tables=()
-while IFS= read -r t; do tables+=("$t"); done < <(
+readarray -t tables < <(
   sqlite3 "$snap/storage.sqlite" \
     "SELECT name FROM sqlite_master WHERE type='table' AND name GLOB 'api_key*' \
        AND name NOT GLOB '*counter*' AND name NOT GLOB '*_log*' ORDER BY name;"

changelog.d/features/6736-response-content-encoding.md

@@ -1 +0,0 @@
-- **feat(api):** add response content encoding verification — confirms Next.js compress:true and documents stripStaleForwardingHeaders behavior ([#6736](https://github.com/diegosouzapw/OmniRoute/issues/6736))

changelog.d/features/6752-plugins-marketplace-install-api.md

@@ -1 +0,0 @@
-- **feat(api):** add plugins marketplace install endpoint with checksum verification ([#6752](https://github.com/diegosouzapw/OmniRoute/issues/6752))

changelog.d/features/7679-chatgpt-web-thinking-tool-emulation.md

@@ -1 +0,0 @@
-- **feat(chatgpt-web):** harden prompt-emulated tool contract for thinking models (#7679 — thanks @horacecar)

changelog.d/features/8237-reduce-idle-memory-small-vps.md

@@ -1 +0,0 @@
-- **docs:** add low-memory/small VPS optimization guide ([#8237](https://github.com/diegosouzapw/OmniRoute/issues/8237))

changelog.d/features/8369-connection-level-upstream-headers.md

@@ -1 +0,0 @@
-- **feat(providers):** add connection-level custom upstream headers via `provider_specific_data.customHeaders` — applied to every request through that connection, with model-level headers overriding on the same case-insensitive name. (thanks @Benson-mk)

changelog.d/features/8461-runomniroutecli-approval-gate.md

@@ -1 +0,0 @@
-- feat(copilot): add approval gate for runOmniRouteCli commands (#8461)

changelog.d/features/9031-regolo-ai-provider.md

@@ -1 +0,0 @@
-- **feat(providers):** add Regolo AI OpenAI-compatible provider ([#9031](https://github.com/diegosouzapw/OmniRoute/issues/9031))

changelog.d/features/9068-editable-discovered-provider-slugs.md

@@ -1 +0,0 @@
-- **feat(db):** add provider-scoped model aliases that survive rediscovery ([#9068](https://github.com/diegosouzapw/OmniRoute/issues/9068))

changelog.d/features/9243-forwarded-header-budget-env.md

@@ -1 +0,0 @@
-- feat: make forwarded upstream response-header budget configurable via env var (#9243)

changelog.d/features/9248-video-url-passthrough.md

@@ -1 +0,0 @@
-- **feat(providers):** make video_url passthrough configurable per provider/model via compat override ([#9248](https://github.com/diegosouzapw/OmniRoute/issues/9248)) — thanks @HellFiveOsborn

changelog.d/features/9270-provider-api-key-links.md

@@ -1 +0,0 @@
-- **feat(dashboard):** render a conditional "Get API key" link on the provider detail page, surfaced from the existing `notice.apiKeyUrl` / `notice.signupUrl` catalog metadata (e.g. `pioneer`, `jina`, `together`). The link opens in a new tab and is hidden when neither URL is present, so existing providers are unaffected. Tracks the notice field in `ProviderCatalogMetadata` ([#9270](https://github.com/diegosouzapw/OmniRoute/pull/9270))

changelog.d/features/9284-json-cookie-input.md

@@ -1 +0,0 @@
-- **feat(providers):** accept JSON cookie objects in normalizeSessionCookieHeader (#9284 — thanks @AIB1TAL0S)

changelog.d/features/9318-opencode-zen-reasoning-effort.md

@@ -1 +0,0 @@
-- **feat(providers):** support max reasoning effort for opencode-zen DeepSeek models (#9318)

changelog.d/features/9415-newapi-sub2api-aggregator-balance.md

@@ -1 +0,0 @@
-- **sse:** New-API / One-API / Sub2API aggregator balance detection for compatible nodes — with the "Aggregator Gateway" toggle on, OmniRoute queries the aggregator's `/api/user/self` to read the account balance, shows it as a dashboard badge and lets quota-preflight routing skip exhausted accounts. Gated by the `NEWAPI_AGGREGATOR_BALANCE` feature flag (default off), with a `quotaPerUnit` override for aggregators that do not use the default 500000 units/$1 rate ([#9415](https://github.com/diegosouzapw/OmniRoute/issues/9415))

changelog.d/features/9418-disable-auto-no-think-combos.md

@@ -1 +0,0 @@
-- **feat(catalog):** added opt-in settings `hideAutoCombos` and `hideNoThinkVariants` (default off) to filter built-in `auto/*` virtual combos and `no-think/*` gateway variants from the `/v1/models` catalog — user-defined combos and original provider models stay listed; routing is unaffected ([#9418](https://github.com/diegosouzapw/OmniRoute/issues/9418))

changelog.d/features/9473-opencode-plugin-model-allowlist.md

@@ -1 +0,0 @@
-- **feat(opencode-plugin):** added `features.visibleModels` (allowlist) and `features.hiddenModels` (blocklist) to `@omniroute/opencode-plugin` — curate the OpenCode TUI/CLI model picker from 600+ catalog entries down to an operator-defined ID list that persists in `opencode.json` across config resets ([#9473](https://github.com/diegosouzapw/OmniRoute/issues/9473))

changelog.d/features/9490-opencode-plugin-warm-startup-parallel-refresh.md

@@ -1,5 +0,0 @@
----
-feature: 9490
----
-
-**Warm catalog startup from disk snapshot + parallel refresh** (opencode-plugin): The config-shim hook now reads the last disk snapshot *before* fetching, so the provider registers immediately with the last-known-good catalog (~1-2s vs ~30s on a warm gateway). All six fetchers run concurrently via `Promise.allSettled` instead of sequentially. A failed refresh keeps the snapshot (no overwrite). An in-flight guard prevents concurrent refreshes for the same cache key. The `features.diskCache: false` opt-out disables the warm read entirely.

changelog.d/features/9511-quota-exhausted-transient-test-all.md

@@ -1 +0,0 @@
-- **feat(models):** Test All's "Auto-hide failed models" no longer hides quota errors — daily-quota-exhausted and credits-exhausted responses are now classified via the routing path's existing quota detectors, so an evening Test All on a free-tier provider no longer silently wipes the catalog. Quota results stay visible with a distinct amber badge ([#9511](https://github.com/diegosouzapw/OmniRoute/issues/9511))

changelog.d/features/9570-plugin-context-headers.md

@@ -1 +0,0 @@
-- feat(plugins): expose client request headers in plugin onRequest/onResponse context (#9570)

changelog.d/features/9579-soniox-audio-provider.md

@@ -1 +0,0 @@
-- **feat(audio):** Soniox STT + TTS provider (`sx`) — async speech-to-text (`stt-async-v5`, `stt-async-v4`) and real-time text-to-speech (`tts-rt-v1`) ([#9579](https://github.com/diegosouzapw/OmniRoute/pull/9579))

changelog.d/fixes/7754-best-free-fallback.md

@@ -1 +0,0 @@
-- test(combo): guard auto/best-free never leaks the combo name as a model (#7754)

changelog.d/fixes/8542-fix.plan.md

@@ -1 +0,0 @@
-- fix(ci): aggregate all fast-gates into non-fail-fast loop so one red gate no longer masks later gates (#8542)

changelog.d/fixes/8577-fix.plan.md

@@ -1,2 +0,0 @@
-- fix(tests): make machineId tests macOS-compatible by stubbing ioreg in test helper (#8577)
-- fix(scripts): replace bash 4+ readarray with compatible while-read loop in restore-policies.sh (#8577)

changelog.d/fixes/8609-fix.plan.md

@@ -1 +0,0 @@
-- fix(cli): enable systray2 on Windows for Norton-friendly tray (#8609)

changelog.d/fixes/8681-fix.plan.md

@@ -1 +0,0 @@
-- fix(providers): gate premium opencode-zen/opencode-go models behind an API key (#8681)

changelog.d/fixes/8728-model-catalog-swr.md

@@ -0,0 +1 @@
+- **fix(api):** make `/v1/models` stale refresh response-safe and generation-safe, with narrow synced-model invalidation ([#8728](https://github.com/diegosouzapw/OmniRoute/pull/8728)). Related to #8697.

changelog.d/fixes/8739-yuanbao-sse-parser.md

@@ -1 +0,0 @@
-- fix(yuanbao-web): accept `content` field in SSE text events (upstream format change) (#8739)

changelog.d/fixes/8781-fix.plan.md

@@ -1 +0,0 @@
-- fix(build): remove misleading open-sse/package.json facade and add workspace typecheck gate (#8781)

changelog.d/fixes/8813-chatgpt-sentinel.md

@@ -1 +0,0 @@
-- fix(errorClassifier): classify ChatGPT Web SENTINEL_BLOCKED 403 as terminal FORBIDDEN, enabling proper combo fallback (#8813)

changelog.d/fixes/8826-fix.plan.md

@@ -1 +0,0 @@
-- fix(cli): fall back to node:sqlite when better-sqlite3 constructor throws at runtime (#8826)

changelog.d/fixes/8830-fix.plan.md

@@ -1 +0,0 @@
-- fix(opencode): prefix provider id with "opencode-" for auth login command (#8830)

changelog.d/fixes/8841-fix.plan.md

@@ -1 +0,0 @@
-- fix(opencode-zen): add current free-tier models to registry to enable combo context pre-filtering (#8841)

changelog.d/fixes/8847-bun-prebuilds.md

@@ -1 +0,0 @@
-- fix(build): include better-sqlite3 prebuilds in standalone bun bundle

changelog.d/fixes/8869-opencode-complete-model-limits.md

@@ -1 +0,0 @@
-- **fix(opencode):** generate schema-complete model limits so OpenCode accepts catalog entries without an explicit output cap ([#8869](https://github.com/diegosouzapw/OmniRoute/pull/8869)) — thanks @xiaoyaner0201

changelog.d/fixes/8876-codex-responses-wire-default.md

@@ -1 +0,0 @@
-- **fix(cli):** default omitted Codex CLI wire API settings to Responses and clear stale Chat state after reset ([#8876](https://github.com/diegosouzapw/OmniRoute/pull/8876)) — thanks @xiaoyaner0201

changelog.d/fixes/8883-proxy-credential-autofill.md

@@ -1 +0,0 @@
-- **fix(proxy):** isolate new proxy credential fields from browser and password-manager autofill after form reset ([#8883](https://github.com/diegosouzapw/OmniRoute/pull/8883)) — thanks @xiaoyaner0201

changelog.d/fixes/8906-quota-pool-combo-cleanup.md

@@ -1 +0,0 @@
-- **fix(quota):** Deleting a quota pool now removes its scoped managed combos without racing in-flight pool mutations ([#8906](https://github.com/diegosouzapw/OmniRoute/pull/8906)) — thanks @xiaoyaner0201

changelog.d/fixes/8921-codebuddy-cn-dual-auth-actions.md

@@ -1 +0,0 @@
-- **fix(providers):** expose both OAuth Connect and manual API-key actions for dual-auth providers such as CodeBuddy CN ([#8921](https://github.com/diegosouzapw/OmniRoute/pull/8921)) — thanks @Llliao1113

changelog.d/fixes/8946-no-tool-output.md

@@ -1 +0,0 @@
-- fix(compression): drop orphan custom_tool_call/local_shell_call/apply_patch_call on compaction restore (#8946)

changelog.d/fixes/8951-fix.plan.md

@@ -1 +0,0 @@
-- fix(github): add targetFormat to GPT-5.6 Sol/Terra/Luna models (#8951)

changelog.d/fixes/8960-fix.plan.md

@@ -1 +0,0 @@
-- fix(opencode): propagate vision capability from live catalog into opencode.json (#8960)

changelog.d/fixes/8965-fix.plan.md

@@ -1 +0,0 @@
-- fix(providers): switch Antigravity quota RPCs to iterate ANTIGRAVITY_RUNTIME_BASE_URLS (#8965)

changelog.d/fixes/8994-vertex-partner-claude.md

@@ -1 +0,0 @@
-- fix(vertex): route Claude models to native rawPredict endpoint and respect custom targetFormat overrides (#8994)

changelog.d/fixes/8995-fix.plan.md

@@ -1 +0,0 @@
-- fix(proxies): resolveProxyForConnection now returns the proxy name, so the dashboard badge shows the name instead of the hostname (#8995)

changelog.d/fixes/8997-gpt56-max-reasoning.plan.md

@@ -1 +0,0 @@
-- **fix(translator):** the Responses-to-Chat promotion path called `normalizeResponsesReasoningEffort` without the model argument, so GPT-5.6 Sol/Terra/Luna requests with `reasoning.effort: "max""` were downgraded to `"xhigh"`. The model is now threaded through, preserving `max` for GPT-5.6 while keeping the legacy downgrade for older models ([#8997](https://github.com/diegosouzapw/OmniRoute/pull/8997))

changelog.d/fixes/9029-cursor-narration.md

@@ -1 +0,0 @@
-- fix(cursor): preserve tool context across multi-turn conversations when client lacks conversation_id (#9029)

changelog.d/fixes/9030-antigravity-system-429s.md

@@ -1 +0,0 @@
-- fix(sse): move Antigravity client system content to first user message to avoid upstream 429 RESOURCE_EXHAUSTED on oversized systemInstruction (#9030)

changelog.d/fixes/9034-fix.plan.md

@@ -1 +0,0 @@
-- fix(api): use configured prefix instead of raw node UUID for alias-backed model id in /v1/models (#9034)

changelog.d/fixes/9045-fix.plan.md

@@ -1 +0,0 @@
-- fix(db): stream DB backup export instead of buffering entire file into memory (#9045)

changelog.d/fixes/9046-fix.md

@@ -1 +0,0 @@
-- fix(ui): normalize Free Pool API response payload to read from data.proxies (#9046)

changelog.d/fixes/9054-fix.plan.md

@@ -1 +0,0 @@
-- fix(api/analytics): stop charging :free models at arbitrary fallback price (#9054)

changelog.d/fixes/9057-fix.plan.md

@@ -1 +0,0 @@
-- fix(api): auto/* routing aliases bypass API-key allowedConnections/disableNonPublicModels (#9057)

changelog.d/fixes/9096-fix-audio-speech-transcriptions-translations-provider-nodes.plan.md

@@ -1 +0,0 @@
-- fix(providers): admit audio-speech/audio-transcriptions apiType in audio route provider-node filters (#9096)

changelog.d/fixes/9102-fix.plan.md

@@ -1 +0,0 @@
-- fix(providers): modal.com validation returns clear error when Base URL is missing, instead of leaking "Invalid outbound URL" (#9102)

changelog.d/fixes/9134-fix.plan.md

@@ -1 +0,0 @@
-- fix(providers): resolve combo names in audio transcriptions route so /v1/models stays honest (#9134)

changelog.d/fixes/9140-fix.plan.md

@@ -1 +0,0 @@
-- fix(vscode): allow built-in auto-routing models in VS Code model filter (#9140)

changelog.d/fixes/9142-fix.plan.md

@@ -1 +0,0 @@
-- fix(background): detect Anthropic top-level system prompts for background task detection (#9142)

changelog.d/fixes/9156-macos-autostart-execpath.md

@@ -1 +0,0 @@
-- fix(cli): use process.execPath for macOS launchd autostart

changelog.d/fixes/9159-fix.plan.md

@@ -1 +0,0 @@
-- fix(management): authorize mcp:connect-only keys on loopback/LAN when requireLogin is enabled (#9159)

changelog.d/fixes/9160-fix.plan.md

@@ -1 +0,0 @@
-- fix(model-discovery): ingest capabilities.effort_tiers for synced models (#9160)

changelog.d/fixes/9168-streamed-responses-tool-null.plan.md

@@ -1 +0,0 @@
-- fix(translator): buffer and normalize upstream tool-call argument deltas so optional null values are stripped before reaching the client (#9168)

changelog.d/fixes/9177-fix.plan.md

@@ -1 +0,0 @@
-- fix(translator): avoid double-normalizing tool names in Gemini-to-Claude response path (#9177)

changelog.d/fixes/9195-fix.plan.md

@@ -1,2 +0,0 @@
-- fix(catalog): repair dead guard and synced-first ordering for custom model Vision capable override (#9195)
-- fix(routing): consult customModels supportsVision flag in Combo vision filter (#9195)

changelog.d/fixes/9201-web-search-proxy-bind.plan.md

@@ -1 +0,0 @@
-- fix(web-search): bind each search provider attempt to its connection proxy (#9201)