Merge remote-tracking branch 'origin/release/v3.8.50' into green/8728

Merge branch 'origin/release/v3.8.50' into green/8728
Conflicts resolved: catalogCache.ts (PR rewrite takes precedence), models.ts (PR version)
2026-08-09 00:32:13 +03:00 · 2026-08-06 07:50:15 -03:00 · 2026-08-06 06:51:48 -03:00 · 2026-07-31 10:28:45 -05:00 · 2026-07-31 09:50:25 -05:00
761 changed files with 8719 additions and 47395 deletions
--- a/.claude/worktrees/feat-7786/changelog.d/features/7786-management-auth-terminology-docs.md
+++ b/.claude/worktrees/feat-7786/changelog.d/features/7786-management-auth-terminology-docs.md
@@ -1 +0,0 @@
- **docs:** add management authentication terminology guide ([#7786](https://github.com/diegosouzapw/OmniRoute/issues/7786))
--- a/.claude/worktrees/feat-7786/docs/guides/MANAGEMENT-AUTH.md
+++ b/.claude/worktrees/feat-7786/docs/guides/MANAGEMENT-AUTH.md
@@ -1,41 +0,0 @@
-# Management Authentication
-
-OmniRoute uses four distinct credential families for management access. This guide
-distinguishes them by purpose, scope, and locality.
-
-| Credential              | Scope              | Locality      | Use Case                          |
-|-------------------------|--------------------|---------------|-----------------------------------|
-| Dashboard JWT session   | Full management    | Localhost      | Web dashboard login               |
-| CLI machine-id token    | Full management    | Per-machine    | `omniroute` CLI commands          |
-| Scoped `oma_` token     | Configurable scope | External       | Automation / CI / API access      |
-| Manage-scope API key    | `manage` scope     | External       | Management API calls              |
-
-## Dashboard JWT Session
-
-Generated on dashboard login (`/api/auth/login`). Stored in HTTP-only cookie.
-Valid for the session duration. Cannot be used from external hosts.
-
-## CLI Machine-ID Token
-
-Created by `omniroute auth login` on first use. Stored in `~/.omniroute/auth.json`.
-Used by the CLI for all management operations. Tied to the machine identity.
-
-## Scoped `oma_` Access Token
-
-Created via dashboard or CLI with configurable scopes (e.g., `manage`, `read`).
-Format: `oma_<random-hex>`. Used for programmatic access from external systems.
-
-## Manage-Scope API Key
-
-Standard API key with the `manage` scope enabled. Created in dashboard API Keys page.
-Used for management API calls from external hosts.
-
-## Header Examples
-
-```
-Authorization: Bearer oma_abc123def456
-Authorization: Bearer <standard-api-key-with-manage-scope>
-Cookie: omniroute_session=<jwt-token>
-```
-
-See `docs/reference/API_REFERENCE.md` for endpoint-specific auth requirements.
--- a/.claude/worktrees/feat-7786/tests/unit/management-auth-docs.test.ts
+++ b/.claude/worktrees/feat-7786/tests/unit/management-auth-docs.test.ts
@@ -1,27 +0,0 @@
-import { describe, it } from "node:test";
-import { ok } from "node:assert/strict";
-import { readFileSync } from "node:fs";
-
-describe("Management auth documentation (#7786)", () => {
-  const docPath = "docs/guides/MANAGEMENT-AUTH.md";
-  const content = readFileSync(docPath, "utf-8");
-
-  it("exists and has content", () => {
-    ok(content.length > 500, "should have substantial content");
-    ok(content.includes("Dashboard JWT session"));
-    ok(content.includes("CLI machine-id token"));
-    ok(content.includes("oma_"));
-  });
-
-  it("documents all four credential families", () => {
-    const families = ["Dashboard JWT", "CLI machine-id", "oma_", "Manage-scope"];
-    for (const f of families) {
-      ok(content.includes(f), `should document ${f}`);
-    }
-  });
-
-  it("mentions relevant auth header examples", () => {
-    ok(content.includes("Authorization"));
-    ok(content.includes("Bearer"));
-  });
-});
--- a/.claude/worktrees/feat-8635/changelog.d/features/8635-systemd-autostart-linux.md
+++ b/.claude/worktrees/feat-8635/changelog.d/features/8635-systemd-autostart-linux.md
@@ -1 +0,0 @@
- **feat(infra):** add systemd autostart unit for Linux ([#8635](https://github.com/diegosouzapw/OmniRoute/issues/8635))
--- a/.claude/worktrees/feat-8635/contrib/systemd/omniroute.service
+++ b/.claude/worktrees/feat-8635/contrib/systemd/omniroute.service
@@ -1,19 +0,0 @@
-[Unit]
-Description=OmniRoute AI Proxy
-After=network.target network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-ExecStart=$(which omniroute) start
-Restart=on-failure
-RestartSec=5
-Environment=NODE_ENV=production
-
-# Security hardening
-NoNewPrivileges=true
-ProtectSystem=full
-PrivateTmp=true
-
-[Install]
-WantedBy=default.target
--- a/.claude/worktrees/feat-8635/tests/unit/systemd-autostart.test.ts
+++ b/.claude/worktrees/feat-8635/tests/unit/systemd-autostart.test.ts
@@ -1,23 +0,0 @@
-import { describe, it } from "node:test";
-import { ok } from "node:assert/strict";
-import { readFileSync, existsSync } from "node:fs";
-
-describe("Systemd autostart (#8635)", () => {
-  const svcPath = "contrib/systemd/omniroute.service";
-  const content = readFileSync(svcPath, "utf-8");
-
-  it("service file exists", () => {
-    ok(existsSync(svcPath));
-    ok(content.length > 200);
-  });
-
-  it("defines required systemd sections", () => {
-    ok(content.includes("[Unit]"));
-    ok(content.includes("[Service]"));
-    ok(content.includes("[Install]"));
-  });
-
-  it("specifies WantedBy=default.target", () => {
-    ok(content.includes("WantedBy=default.target"));
-  });
-});
--- a/.dockerignore
+++ b/.dockerignore
@@ -24,7 +24,6 @@ coverage
 # Runtime data and logs
 data
 logs
-.sandbox

 # Local env files (inject at runtime via --env-file or -e)
 .env
--- a/.env.devin-bridge.example
+++ b/.env.devin-bridge.example
@@ -1,6 +0,0 @@
-ENABLE_LIVE_DEVIN_TESTS=0
-DEVIN_BRIDGE_MODEL=devin-cli-agentic/swe-1-7
-DEVIN_BRIDGE_SONNET_MODEL=devin-cli-agentic/swe-1-7
-DEVIN_BRIDGE_OPUS_MODEL=devin-cli-agentic/swe-1-7
-DEVIN_BRIDGE_HAIKU_MODEL=devin-cli-agentic/swe-1-7
-DEVIN_BRIDGE_SUBAGENT_MODEL=devin-cli-agentic/swe-1-7
--- a/.env.example
+++ b/.env.example
@@ -345,18 +345,14 @@ ALLOW_API_KEY_REVEAL=false
 # OMNIROUTE_CHAT_HEAVY_TOOL_COUNT=64
 # Conservative string-size token estimate that classifies a request as heavyweight. Default 32000.
 # OMNIROUTE_CHAT_HEAVY_ESTIMATED_TOKENS=32000
-# Optional opt-in hard message-count cap; excess receives compact-required 413 before
-# compression can run. Unset/0 (the default) means no history cap: heap growth is bounded
-# by OMNIROUTE_CHAT_MAX_HEAVY_IN_FLIGHT and the heap-pressure shed instead. Set a positive
-# value only on memory-constrained deployments that need a hard ceiling.
-# OMNIROUTE_CHAT_HARD_MAX_MESSAGES=0
+# Hard message-count cap; excess receives compact-required 413. Default 800.
+# OMNIROUTE_CHAT_HARD_MAX_MESSAGES=800

 # Hard cap (bytes) for a non-streaming upstream response buffered fully into memory
 # (#5152). Past this the upstream reader is cancelled and the request fails fast
 # instead of growing an unbounded string until the V8 heap is exhausted.
 # Used by: open-sse/handlers/chatCore/nonStreamingResponseBody.ts
 # Default: 67108864 (64 MB)
-# OMNIROUTE_FORWARDING_HEADER_BUDGET_BYTES=768
 # OMNIROUTE_MAX_NONSTREAMING_RESPONSE_BYTES=67108864

 # CORS configuration — controls which cross-origin browser clients can call the API.
@@ -797,16 +793,6 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # Disable the proactive recovery scheduler entirely (default: false).
 # OMNIROUTE_DISABLE_CONNECTION_RECOVERY=false

-# Proactive Claude warmup scheduler (#8848): fires a trivial request to opted-in
-# OAuth connections on a cron schedule (America/Los_Angeles) so accounts do not
-# hit the 5-hour sliding window cold. Off by default — set ENABLED=1 and flip
-# per-connection flags in settings.claudeWarmup.connections to activate.
-# Used by: src/lib/warmupScheduler.ts.
-# OMNIROUTE_WARMUP_ENABLED=false
-# OMNIROUTE_WARMUP_CRON="0 7 * * *"
-# OMNIROUTE_WARMUP_CONCURRENCY=3
-# OMNIROUTE_WARMUP_MODEL=
-
 # Background job interval for budget reset checks (ms).  Default: 600000 (10m).
 # Used by: src/lib/jobs/budgetResetJob.ts.  Floor: 10000.
 #OMNIROUTE_BUDGET_RESET_JOB_INTERVAL_MS=600000
@@ -871,12 +857,6 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # (>= 3 retrievals = never compressed). 1 disables the ramp (binary skip at the threshold only).
 # Used by: open-sse/services/compression/engines/ccr/index.ts.  Default: 2.
 #COMPRESSION_CCR_RETRIEVAL_RAMP_FACTOR=2
-# CCR durable block store (#9061). The in-memory store loses blocks to LRU eviction, the TTL, a
-# restart, or a retrieve landing on another instance, while the model is told it can retrieve them
-# verbatim. Set to false to keep blocks in memory only, at the cost of that promise. Blocks over
-# 512KB and cloud runtimes are memory-only regardless.
-# Used by: open-sse/services/compression/engines/ccr/index.ts.  Default: true.
-#COMPRESSION_CCR_DURABLE_STORE=true
 # T08/H5 — usage-observed prefix freeze (OPT-IN, default off). When enabled, a system prompt seen
 # >= THRESHOLD times is treated as a stable cacheable prefix and preserved from compression even
 # for providers the static cache-aware heuristic does not recognize (freeze = preserve, never
@@ -1061,17 +1041,6 @@ GITHUB_OAUTH_CLIENT_ID=Iv1.b507a08c87ecfe98
 # VISION_BRIDGE_BASE_URL=
 # VISION_BRIDGE_API_KEY=

-# ── Raycast Pro (local auto-import) ──
-# Raycast Pro AI is a reverse-engineered, unofficial API — local/personal use
-# only (no OAuth client_id/secret; token is captured via macOS Auto-Import
-# from the Keychain + local Raycast SQLite DB, or pasted manually). These
-# vars are optional manual overrides used by open-sse/services/raycast.ts
-# and the direct-probe benchmark script scripts/raycast/usage-benchmark.mjs.
-# RAYCAST_BEARER_TOKEN=
-# RAYCAST_DEVICE_ID=
-# RAYCAST_AID=
-# RAYCAST_SIG_SECRET=
-
 # ─────────────────────────────────────────────────────────────────────────────
 # ⚠️  GOOGLE OAUTH (Antigravity) & OTHER PROVIDERS — REMOTE SERVERS
 # ─────────────────────────────────────────────────────────────────────────────
@@ -1540,15 +1509,6 @@ APP_LOG_TO_FILE=true
 # ═══════════════════════════════════════════════════════════════════════════════
 # 19. MODEL SYNC (Dev)
 # ═══════════════════════════════════════════════════════════════════════════════
-# Enable the models.dev capability sync.  Default: false (opt-in only).
-# Also settable from Dashboard > Settings > AI. This variable wins over that
-# setting whenever it is set to anything non-empty, in either direction, so a
-# deployment can pin the sync on or off without depending on database state
-# surviving a rebuild. Leave it unset to let the dashboard toggle decide.
-# On: 1, true, yes or on (any casing). Any other value is off.
-# Used by: src/lib/modelsDevSync.ts
-# MODELS_DEV_SYNC_ENABLED=false
-
 # Development-time model catalog sync interval in seconds.
 # Used by: src/lib/modelsDevSync.ts
 # Default: 86400 (24 hours)
@@ -1952,18 +1912,6 @@ APP_LOG_TO_FILE=true
 # ── Devin CLI binary path ──
 # Used by: open-sse/executors/devin-cli.ts. Default: looked up via PATH.
 # CLI_DEVIN_BIN=devin
-# Agentic bridge-only binary override. The bridge still executes ACP stdio only.
-# CLI_DEVIN_AGENTIC_BIN=devin
-# Required isolated HOME for the agentic Devin child process.
-# DEVIN_AGENTIC_HOME=/home/bridge
-# Bounded ACP turn timeout in milliseconds. Default: 120000.
-# DEVIN_AGENTIC_ACP_TIMEOUT_MS=120000
-# Agentic bridge model aliases. Values must keep the devin-cli-agentic/ prefix.
-# DEVIN_BRIDGE_MODEL=devin-cli-agentic/swe-1-7
-# DEVIN_BRIDGE_SONNET_MODEL=devin-cli-agentic/swe-1-7
-# DEVIN_BRIDGE_OPUS_MODEL=devin-cli-agentic/swe-1-7
-# DEVIN_BRIDGE_HAIKU_MODEL=devin-cli-agentic/swe-1-7
-# DEVIN_BRIDGE_SUBAGENT_MODEL=devin-cli-agentic/swe-1-7

 # ── Command Code (custom CLI) callback ──
 # Local port used for OAuth-style callbacks from the Command Code CLI helper.
@@ -2492,10 +2440,10 @@ QUOTA_STORE_DRIVER=sqlite              # sqlite | redis
 # ═══════════════════════════════════════════════════════════════════════════════
 # Optional add-on (feature flag RADAR_ENABLED, default off — see feature flag
 # settings, not an env var) that overlays a signed, freshly-curated free-model
-# catalog on top of the release baseline. All four variables below are optional
-# and only needed to point the client at a self-hosted/forked feed or
-# supporter-key flow instead of the default OmniRoute Radar service. Used by:
-# src/lib/radar/sync.ts, src/lib/radar/pinnedKeys.ts, src/lib/radar/links.ts.
+# catalog on top of the release baseline. Both variables below are optional and
+# only needed to point the client at a self-hosted/forked feed instead of the
+# default OmniRoute Radar feed. Used by: src/lib/radar/sync.ts,
+# src/lib/radar/pinnedKeys.ts.

 # Base URL of the Radar feed service. Overrides the built-in default so forks
 # and self-hosters can point at their own signed feed.
@@ -2505,12 +2453,3 @@ QUOTA_STORE_DRIVER=sqlite              # sqlite | redis
 # signature, replacing the pinned default key. Required when self-hosting a
 # feed signed with a different key pair.
 # RADAR_FEED_PUBKEY=
-
-# URL the dashboard's "I'm a contributor" button opens (GitHub OAuth
-# supporter-key claim flow). No pricing/value lives in this repo — only the
-# link.
-# RADAR_CONTRIBUTOR_CLAIM_URL=https://radar.omniroute.online/auth/github
-
-# URL the dashboard's "Support the project" button opens (payment/plans
-# page). No pricing/value lives in this repo — only the link.
-# RADAR_SUPPORTER_PLANS_URL=https://radar.omniroute.online/planos
--- a/.eslintcache-probe
+++ b/.eslintcache-probe
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1213,10 +1213,8 @@ jobs:
          cache: npm
      - uses: ./.github/actions/npm-ci-retry
      - run: npm run check:node-runtime
-      - name: Integration tests (shard ${{ matrix.shard }}/2)
-        env:
-          TEST_SHARD: ${{ matrix.shard }}/2
-        run: npm run test:integration:ci
+      # (tsx/esm = QW-b; o alinhamento de ESCOPO do integration com o npm script fica p/ follow-up)
+      - run: node --import tsx/esm --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=1 --test-shard=${{ matrix.shard }}/2 tests/integration/*.test.ts

  test-security:
    name: Security Tests
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -22,10 +22,10 @@ jobs:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
-      - uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+      - uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
        with:
          languages: javascript-typescript
          queries: security-extended
-      - uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+      - uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
        with:
          category: "/language:javascript-typescript"
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -137,13 +137,13 @@ jobs:
        uses: docker/setup-buildx-action@v4

      - name: Login to Docker Hub
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.5.2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.5.2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -237,13 +237,13 @@ jobs:
        uses: docker/setup-buildx-action@v4

      - name: Login to Docker Hub
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.5.2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.5.2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -372,7 +372,7 @@ jobs:
      - name: Upload Trivy SARIF to Security tab
        if: needs.prepare.outputs.version != 'main'
        continue-on-error: true
-        uses: github/codeql-action/upload-sarif@v4.37.4
+        uses: github/codeql-action/upload-sarif@v4.37.3
        with:
          sarif_file: trivy-results.sarif
          category: trivy-image
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -271,10 +271,6 @@ jobs:
      # covered by typecheck:core's curated allowlist. See check-dashboard-typecheck.mjs.
      - name: Typecheck (dashboard)
        run: npm run check:dashboard-typecheck
-      # #8781: open-sse workspace typecheck gate — the workspace imports @/ which
-      # escapes to src/ via undeclared path aliases. See check-open-sse-typecheck.mjs.
-      - name: Typecheck (open-sse)
-        run: npm run check:open-sse-typecheck
      # WS4.2 (v3.8.49 plan): TypeScript 7 native-compiler SHADOW — advisory only.
      # TS7 went GA 2026-07-08 with 8-12x type-check speedups; its Compiler API only
      # arrives in 7.1, so typescript-eslint / type-coverage / Stryker stay on 6.x
--- a/.gitignore
+++ b/.gitignore
@@ -72,7 +72,6 @@ yarn-error.log*
 # env files (can opt-in for committing if needed)
 .env*
 !.env.example
-!.env.devin-bridge.example
 !.env.homolog.example
 # Provider API keys (never commit)
 *.api-key
@@ -210,8 +209,6 @@ scripts/i18n/_pending-keys.json
 .agents/
 .antigravitycli/
 .claude/
-!tests/fixtures/devin-bridge/e2e-workspace/.claude/
-!tests/fixtures/devin-bridge/e2e-workspace/.claude/**

 # PR Reviews and local feedback files
 pr_reviews*.json
@@ -251,8 +248,6 @@ _artifacts/

 # CI/local quality artifacts (eslint-results.json, quality-ratchet.md, etc.)
 .artifacts/
-# Isolated Devin bridge workspaces, evidence, and test databases
-.sandbox/

 # Homologation E2E suite (npm run homolog) — real-environment credentials + report output
 .env.homolog
@@ -265,7 +260,3 @@ docker-compose.yml.bak
 # output/**/.playwright-cli/ (covered above), but anything written directly to
 # output/ would otherwise show up as untracked.
 /output/
-
-# _tasks e um repo git SEPARADO (ver AGENTS.md). _tasks/ (com barra) NAO ignora um
-# SYMLINK _tasks; /_tasks (ancorado) cobre symlink/dir na raiz (incidente 2026-08-08).
-/_tasks
--- a/@omniroute/opencode-plugin/README.md
+++ b/@omniroute/opencode-plugin/README.md
@@ -30,7 +30,7 @@ omniroute setup opencode --auth
 # 3. Restart OpenCode — /models lists the full live catalog
 ```

-The `--auth` flag runs `opencode auth login --provider opencode-omniroute` automatically.
+The `--auth` flag runs `opencode auth login --provider omniroute` automatically.
 Use `--base-url` to point at a non-default OmniRoute address:

 ```sh
@@ -84,7 +84,7 @@ Peer dep: `@opencode-ai/plugin` (managed by your OpenCode install).
 ```

 ```sh
-opencode auth login --provider opencode-omniroute
+opencode auth login --provider omniroute
 # prompts for the OmniRoute API key, writes to ~/.local/share/opencode/auth.json
 ```

@@ -164,8 +164,8 @@ Then in `~/.config/opencode/opencode.json` reference each directory by absolute
 Paths are relative to `~/.config/opencode/`. Each entry now resolves to a distinct module file, so OC loads them as two separate plugin instances. Authenticate each:

 ```sh
-opencode auth login --provider opencode-omniroute
-opencode auth login --provider opencode-omniroute-preprod
+opencode auth login --provider omniroute
+opencode auth login --provider omniroute-preprod
 ```

 Each entry gets its own provider id, its own model picker entry, its own slot in `auth.json`, and its own TTL cache. Closures are isolated per plugin instance — no cross-talk.
@@ -196,7 +196,6 @@ npm install --prefix ~/.config/opencode/plugins/omniroute-opencode-plugin-prepro
 | Compression pipeline tags                   | Combo names get tagged with their compression pipeline (e.g. `Combo: claude-primary [rtk🟡 → caveman🟠]`) when `features.compressionMetadata: true`. Intensity tokens render as a traffic-light emoji: 🟢 lite/minimal · 🟡 standard · 🟠 aggressive/full · 🔴 ultra                                                                                                                                        | both hooks                   |
 | Provider-tag prefix                         | Prepend short upstream-provider label to enriched names (e.g. `Claude - Claude Opus 4.7` vs `Kiro - Claude Opus 4.7`, `GHM - GPT 5`) so same-id models routed via different upstream connections group visibly in the picker (default-on, opt-out via `features.providerTag: false`)                                                                                                                        | both hooks                   |
 | Usable-only filter                          | Filter to providers with at least one healthy connection in `/api/providers` (opt-in via `features.usableOnly`)                                                                                                                                                                                                                                                                                             | both hooks                   |
-| Model allowlist/blocklist                   | Curate the model picker to a fixed set of IDs via `features.visibleModels` (allowlist) and/or `features.hiddenModels` (blocklist). Bare suffixes like `claude-opus-4-7` match any `{prefix}/claude-opus-4-7`. Both compose with `usableOnly` (all filters AND together). Blocklist wins over allowlist (deny takes precedence)                                                                          | both hooks                   |
 | Disk-cache fallback                         | Last-known-good catalog persisted to disk; hydrates on a cold start when `/v1/models` is unreachable (default-on, opt-out via `features.diskCache: false`)                                                                                                                                                                                                                                                  | `config`                     |
 | Bearer injection + suffix-spoof guard       | Adds `Authorization` on baseURL-matched requests only                                                                                                                                                                                                                                                                                                                                                       | `auth.loader.fetch`          |
 | Gemini schema sanitization                  | Strips `$schema`/`$ref`/`additionalProperties` for `gemini-*`/`google-vertex-gemini/*`                                                                                                                                                                                                                                                                                                                      | `auth.loader.fetch` wrap     |
@@ -227,8 +226,6 @@ Every field is optional. Defaults mirror v0.1.0 behaviour so existing `opencode.
 | `compressionMetadata` | `boolean` | `false` | Pull `/api/context/combos` so combo names get tagged with their compression pipeline, e.g. `Combo: claude-primary [rtk🟡 → caveman🟠]`. Intensity tokens render as traffic-light emoji (🟢 lite/minimal · 🟡 standard · 🟠 aggressive/full · 🔴 ultra) so the picker advertises "how compressed" each combo is at a glance.                                                                                                                                                                                                                                          |
 | `providerTag`         | `boolean` | `true`  | Prepend a short upstream-provider label to the enriched display name with `" - "` separator, so `cc/claude-opus-4-7 → Claude - Claude Opus 4.7` differs visibly from `kr/claude-opus-4-7 → Kiro - Claude Opus 4.7` in the OC TUI model picker. Label resolution: use `/api/pricing/models[<alias>].name` verbatim when ≤8 chars (e.g. `Claude`, `Kiro`, `Codex`, `Qwen`), otherwise fall back to `UPPER(alias)` (e.g. `GitHub Models` → `GHM`, `Gemini` → `GEMINI`). Idempotent. Combos intentionally skipped (the `Combo:` prefix already conveys multi-upstream). |
 | `usableOnly`          | `boolean` | `false` | Read `/api/providers` and filter the catalog to providers that have at least one connection with `isActive: true` AND `testStatus: 'active'`. Subtract-filter semantics: providers unknown to BOTH the pricing-models catalog AND the connection table pass through (so synthetic prefixes like `agentrouter/*` survive). On fetch failure the filter is disabled for the refresh — never hides the whole catalog.                                                                                                                                                   |
-| `visibleModels`       | `string[]` | _unset_ | Allowlist — when set and non-empty, only models whose raw `/v1/models` ID matches are emitted. Bare IDs (no slash, e.g. `claude-opus-4-7`) match any `{prefix}/claude-opus-4-7`; full IDs (e.g. `cc/claude-opus-4-7`) match exactly. Composes with `usableOnly` and `hiddenModels` (all filters AND together). Unset or empty = no filter.                                                                                                        |
-| `hiddenModels`        | `string[]` | _unset_ | Blocklist — models whose raw ID matches are dropped. Same matching rules as `visibleModels`. When a model is in both `visibleModels` and `hiddenModels`, the blocklist wins (deny takes precedence). Composes with `usableOnly` and `visibleModels` (all filters AND together). Unset or empty = no filter.                                                                                                                                          |
 | `diskCache`           | `boolean` | `true`  | Persist the last successful `/v1/models` + `/api/combos` + enrichment + connections + compression snapshot to `${OPENCODE_DATA_DIR ?? ~/.local/share/opencode}/plugins/omniroute-<providerId>.json`. On a subsequent cold start where `/v1/models` throws (network down / IP whitelist drop / 5xx) the static block hydrates from the snapshot so OC's model picker survives offline. Soft-fail on read/write — never blocks publishing.                                                                                                                             |
 | `geminiSanitization`  | `boolean` | `true`  | Strip `$schema`/`$ref`/`additionalProperties` from tool params when the model id matches `gemini`                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | `mcpAutoEmit`         | `boolean` | `false` | Auto-write an `mcp.<providerId>` remote entry into the OC config pointing at `<baseURL>/api/mcp/stream` with the resolved Bearer token                                                                                                                                                                                                                                                                                                                                                                                                                               |
@@ -301,45 +298,7 @@ If you want a narrower-scoped Bearer for MCP (different from the chat/inference
 - `compressionMetadata: true` annotates combo display names with their pipeline using traffic-light emoji for intensity (e.g. `Combo: claude-primary [rtk🟡 → caveman🟠]`) so the picker advertises which compression each combo applies and how heavy it is at a glance. Palette: 🟢 lite/minimal · 🟡 standard · 🟠 aggressive/full · 🔴 ultra. Unknown intensities fall through to raw text (`[rtk:custom-thing]`) so the plugin never hides a value OmniRoute knows but the plugin doesn't.
 - `providerTag: true` (default) prepends a short upstream-provider label so the picker shows `Claude - Claude Opus 4.7` for `cc/claude-opus-4-7`, `Kiro - Claude Opus 4.7` for `kr/claude-opus-4-7`, and `GHM - GPT 5` for `ghm/gpt-5` (slot.name `GitHub Models` > 8 chars → abbreviated). Critical when the same model id is sold through multiple upstream connections with different cost/auth/rate-limit profiles. Set to `false` to keep the pre-v3.8.3 unsuffixed format.

-#### Example — curating the model picker (allowlist + blocklist)
-
-A typical OmniRoute instance serves 600+ models. The OpenCode TUI/CLI picker becomes unusable when you need to scroll through hundreds of entries to find the ~30 models you actually use. `visibleModels` and `hiddenModels` let you curate the picker to a fixed set of model IDs that persists in `opencode.json` across config resets.
-
-```jsonc
-{
-  "plugin": [
-    [
-      "@omniroute/opencode-plugin",
-      {
-        "providerId": "omniroute",
-        "baseURL": "https://or.example.com",
-        "features": {
-          "combos": true,
-          "enrichment": true,
-          "usableOnly": true,
-          "visibleModels": [
-            "claude-opus-4-7",     // bare suffix: matches cc/claude-opus-4-7, kr/claude-opus-4-7, etc.
-            "cc/claude-sonnet-4-6", // exact: only the cc/ alias
-            "gemini-2.5-pro",
-            "gpt-5",
-            "o3",
-            "o3-pro",
-            "o4-mini",
-          ],
-          "hiddenModels": [
-            "o3-mini",  // hide the mini variant even if visibleModels is unset
-          ],
-        },
-      },
-    ],
-  ],
-}
-```
-
- `visibleModels` is an allowlist — only models whose raw ID matches are emitted. Bare IDs (no slash) match any provider prefix; full IDs (with slash) match exactly.
- `hiddenModels` is a blocklist — listed models are dropped. When a model is in both lists, the blocklist wins (deny takes precedence).
- Both compose with `usableOnly` (all filters AND together: a model must pass usableOnly AND visibleModels AND not be in hiddenModels).
- Unset or empty = no filter (current behavior).
+## Comparison vs `@omniroute/opencode-provider`

 [`@omniroute/opencode-provider`](https://github.com/diegosouzapw/OmniRoute/tree/main/%40omniroute/opencode-provider) is the existing config-generator package — it writes a frozen `provider.<id>` block into `opencode.json` at build time. This plugin is the runtime integration.

--- a/@omniroute/opencode-plugin/package-lock.json
+++ b/@omniroute/opencode-plugin/package-lock.json
@@ -1,12 +1,12 @@
 {
  "name": "@omniroute/opencode-plugin",
-  "version": "0.2.1",
+  "version": "0.2.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@omniroute/opencode-plugin",
-      "version": "0.2.1",
+      "version": "0.2.0",
      "license": "MIT",
      "dependencies": {
        "zod": "^4.4.3"
--- a/@omniroute/opencode-plugin/package.json
+++ b/@omniroute/opencode-plugin/package.json
@@ -23,7 +23,7 @@
  "scripts": {
    "build": "tsup",
    "clean": "rm -rf dist",
-    "test": "node --import tsx/esm --test tests/scaffold.test.ts tests/auth.test.ts tests/options-schema.test.ts tests/multi-instance.test.ts tests/fetch-interceptor.test.ts tests/provider.test.ts tests/gemini-sanitize.test.ts tests/combos.test.ts tests/config-shim.test.ts tests/features.test.ts tests/feature-defaults.test.ts tests/usable-combo.test.ts tests/disk-snapshot-perms.test.ts tests/fork-features.test.ts tests/auto-combo-context.test.ts tests/provider-id-routing.test.ts tests/management-read-token.test.ts tests/auto-sync.test.ts tests/model-allowlist.test.ts",
+    "test": "node --import tsx/esm --test tests/scaffold.test.ts tests/auth.test.ts tests/options-schema.test.ts tests/multi-instance.test.ts tests/fetch-interceptor.test.ts tests/provider.test.ts tests/gemini-sanitize.test.ts tests/combos.test.ts tests/config-shim.test.ts tests/features.test.ts tests/feature-defaults.test.ts tests/usable-combo.test.ts tests/disk-snapshot-perms.test.ts tests/fork-features.test.ts tests/auto-combo-context.test.ts tests/provider-id-routing.test.ts tests/management-read-token.test.ts tests/auto-sync.test.ts",
    "prepublishOnly": "npm run clean && npm run build && npm test"
  },
  "keywords": [
--- a/@omniroute/opencode-plugin/src/index.ts
+++ b/@omniroute/opencode-plugin/src/index.ts
@@ -177,8 +177,6 @@ const featuresSchema = z
    mcpToken: z.string().min(1).optional(),
    fetchInterceptor: z.boolean().optional(),
    usableOnly: z.boolean().optional(),
-    visibleModels: z.array(z.string().min(1)).optional(),
-    hiddenModels: z.array(z.string().min(1)).optional(),
    diskCache: z.boolean().optional(),
    providerTag: z.boolean().optional(),
    debugLog: z.boolean().optional(),
@@ -243,11 +241,6 @@ export const OMNIROUTE_FEATURE_DEFAULTS = {
  // default-OFF (read sites use `features.X === true`)
  compressionMetadata: false,
  usableOnly: false,
-  // Array flags: unset/empty = no filter. These are not boolean toggles —
-  // they are operator-curated model-ID lists applied in the dynamic and static
-  // hooks alongside usableOnly (all filters AND together).
-  // visibleModels: undefined,  // allowlist — only listed IDs pass
-  // hiddenModels: undefined,  // blocklist — listed IDs are dropped
  mcpAutoEmit: false,
  debugLog: false,
  startupDebug: false,
@@ -2833,118 +2826,6 @@ export function isUsableCombo(
  return false;
 }

-// ─────────────────────────────────────────────────────────────────────────
-// #9473 — Model allowlist / blocklist filter helpers
-// ─────────────────────────────────────────────────────────────────────────
-
-/**
- * Pre-compiled filter structure for the model allowlist/blocklist.
- *
- * "exact" holds full raw IDs (e.g. "cc/claude-opus-4-7") for O(1) match.
- * "suffixes" holds bare model IDs (e.g. "claude-opus-4-7") that match any
- * "{prefix}/claude-opus-4-7" — so operators can curate by model name without
- * knowing the provider prefix.
- */
-export interface ModelListFilter {
-  exact: Set<string>;
-  suffixes: Set<string>;
-}
-
-/**
- * Compile a string[] of model IDs into a pre-computed filter structure.
- * Returns undefined when the list is empty or undefined — the "no filter"
- * state that callers use as a passthrough.
- *
- * IDs containing a "/" are stored in "exact"; bare IDs (no slash) go into
- * "suffixes" and match any "{prefix}/<suffix>" at check time.
- */
-export function compileModelListFilter(list?: string[]): ModelListFilter | undefined {
-  if (!list || list.length === 0) return undefined;
-  const exact = new Set<string>();
-  const suffixes = new Set<string>();
-  for (const id of list) {
-    if (id.includes("/")) {
-      exact.add(id);
-    } else {
-      suffixes.add(id);
-    }
-  }
-  if (exact.size === 0 && suffixes.size === 0) return undefined;
-  return { exact, suffixes };
-}
-
-/**
- * Decide whether a raw model ID passes the allowlist/blocklist filter.
- *
- * Rules (all filters AND together with usableOnly):
- *   - No visible filter and no hidden filter → keep (passthrough).
- *   - Visible filter set: id must match either the exact set or the suffix
- *     set (bare suffix "claude-opus-4-7" matches any "{prefix}/claude-opus-4-7").
- *   - Hidden filter set: id must NOT match either the exact or suffix set.
- *   - If id is in BOTH visible and hidden → DROP (deny wins — safer).
- *   - No-slash ids (e.g. combo names like "claude-primary") are checked
- *     against the exact set directly, and against the suffix set as a bare
- *     match.
- *
- * Pure function — exported so static + dynamic hooks share the same
- * verdict logic without divergence.
- */
-export function passesModelAllowlist(
-  id: string,
-  visible?: ModelListFilter,
-  hidden?: ModelListFilter
-): boolean {
-  // Hidden filter takes precedence (deny wins over allow).
-  if (hidden) {
-    if (hidden.exact.has(id) || matchesSuffix(id, hidden.suffixes)) return false;
-  }
-  // Visible filter: if set, id must match.
-  if (visible) {
-    if (!visible.exact.has(id) && !matchesSuffix(id, visible.suffixes)) return false;
-  }
-  return true;
-}
-
-/**
- * Decide whether a combo passes the allowlist filter. A combo keeps when
- * AT LEAST ONE of its members matches the visible filter. When no visible
- * filter is set, all combos pass. Combos with zero resolvable members pass
- * (mirrors `isUsableCombo` semantics).
- */
-export function passesComboAllowlist(
-  combo: OmniRouteRawCombo,
-  visible?: ModelListFilter
-): boolean {
-  if (!visible) return true;
-  const steps = Array.isArray(combo.models) ? combo.models : [];
-  if (steps.length === 0) return true;
-  let sawResolvableMember = false;
-  for (const step of steps) {
-    if (step?.kind === "combo-ref") continue;
-    const modelId = typeof step?.model === "string" ? step.model : "";
-    if (modelId.length === 0) continue;
-    sawResolvableMember = true;
-    if (visible.exact.has(modelId) || matchesSuffix(modelId, visible.suffixes)) return true;
-  }
-  // No resolvable member → can't prove it should be hidden; keep.
-  if (!sawResolvableMember) return true;
-  // Every resolvable member failed the allowlist → drop.
-  return false;
-}
-
-/**
- * Check whether a raw model ID matches any suffix in the set.
- * For an id like `cc/claude-opus-4-7`, the suffix after the first `/`
- * is checked against the suffixes set. For a bare id like `claude-primary`,
- * the id itself is checked against the suffixes set.
- */
-function matchesSuffix(id: string, suffixes: Set<string>): boolean {
-  if (suffixes.size === 0) return false;
-  const slash = id.indexOf("/");
-  const suffix = slash > 0 ? id.slice(slash + 1) : id;
-  return suffixes.has(suffix);
-}
-
 /**
 * Slugify a combo display name into a copy/paste-friendly URL-safe segment.
 * Lowercases, replaces any run of non-alphanumeric chars with a single dash,
@@ -3128,9 +3009,6 @@ export function createOmniRouteProviderHook(
  const wantCompressionMeta = features.compressionMetadata === true;
  const wantUsableOnly = features.usableOnly === true;
  const wantProviderTag = features.providerTag !== false;
-  // #9473: model allowlist/blocklist — compile once per hook instance.
-  const visibleFilter = compileModelListFilter(features.visibleModels);
-  const hiddenFilter = compileModelListFilter(features.hiddenModels);
  const now = deps.now ?? Date.now;
  // T-07: cache holds RAW fetch results (not pre-derived ModelV2) so that
  // the config-shim hook can share the same cache and derive its stripped
@@ -3365,8 +3243,6 @@ export function createOmniRouteProviderHook(
        if (!entry.id) continue;
        if (canonicalDedup.has(entry.id)) continue;
        if (usable && !isUsableRawModelId(entry.id, usable, rawEnrichment)) continue;
-        // #9473: allowlist/blocklist filter (AND with usableOnly).
-        if (!passesModelAllowlist(entry.id, visibleFilter, hiddenFilter)) continue;
        const model = mapRawModelToModelV2(entry, {
          // #6859: server-facing id — NOT the OC-gate-prefixed `resolved.providerId`.
          providerId: resolved.omnirouteProviderId,
@@ -3442,8 +3318,6 @@ export function createOmniRouteProviderHook(
        if (!combo.id) return false;
        if (combo.isHidden === true) return false;
        if (usable && !isUsableCombo(combo, usable)) return false;
-        // #9473: combo allowlist — drop when no member matches visible filter.
-        if (visibleFilter && !passesComboAllowlist(combo, visibleFilter)) return false;
        return true;
      });
      // Resolved nested combos keyed by their friendly name, so parent
@@ -4261,9 +4135,6 @@ export function buildStaticProviderEntry(
    wantUsableOnly && connections && connections.length > 0
      ? usableProviderAliasSet(connections, enrichment)
      : undefined;
-  // #9473: model allowlist/blocklist — compile once per static-block build.
-  const visibleFilter = compileModelListFilter(opts.features?.visibleModels);
-  const hiddenFilter = compileModelListFilter(opts.features?.hiddenModels);
  // Provider-tag suffix — default-on, opt-out via `features.providerTag: false`.
  // Prepends e.g. `Claude - ` to enriched raw-model names so the picker
  // can tell `cc/claude-opus-4-7` (Anthropic) apart from `kr/claude-opus-4-7`
@@ -4301,8 +4172,6 @@ export function buildStaticProviderEntry(
    // Skip canonical-named twins when the alias-keyed enriched row exists.
    if (canonicalDedup.has(raw.id)) continue;
    if (usable && !isUsableRawModelId(raw.id, usable, enrichment)) continue;
-    // #9473: allowlist/blocklist filter (AND with usableOnly).
-    if (!passesModelAllowlist(raw.id, visibleFilter, hiddenFilter)) continue;
    const caps = raw.capabilities ?? {};
    // Enrichment overlay: `/api/pricing/models` carries human display names
    // (e.g. "Claude Opus 4.7" for raw id "cc/claude-opus-4-7"). The OC TUI
@@ -4455,8 +4324,6 @@ export function buildStaticProviderEntry(
    if (!combo.id) return false;
    if (combo.isHidden === true) return false;
    if (usable && !isUsableCombo(combo, usable)) return false;
-    // #9473: combo allowlist — drop when no member matches visible filter.
-    if (visibleFilter && !passesComboAllowlist(combo, visibleFilter)) return false;
    return true;
  });

--- a/@omniroute/opencode-plugin/tests/model-allowlist.test.ts
+++ b/@omniroute/opencode-plugin/tests/model-allowlist.test.ts
@@ -1,317 +0,0 @@
-/**
- * #9473 — Model allowlist/blocklist for the opencode-plugin.
- *
- * Tests for the pure filter helpers (`compileModelListFilter`,
- * `passesModelAllowlist`, `passesComboAllowlist`) and the schema + hook-level
- * integration. The allowlist/blocklist composes with `usableOnly` (all filters
- * AND together), blocklist wins over allowlist (deny takes precedence), and
- * bare-suffix entries (e.g. "claude-opus-4-7") match any "{prefix}/claude-opus-4-7".
- */
-
-import test from "node:test";
-import assert from "node:assert/strict";
-
-import {
-  compileModelListFilter,
-  passesModelAllowlist,
-  passesComboAllowlist,
-  parseOmniRoutePluginOptions,
-  buildStaticProviderEntry,
-  resolveOmniRoutePluginOptions,
-  type OmniRouteRawCombo,
-  type OmniRouteRawModelEntry,
-} from "../src/index.js";
-
-// ─────────────────────────────────────────────────────────────────────────
-// compileModelListFilter
-// ─────────────────────────────────────────────────────────────────────────
-
-test("compileModelListFilter: undefined list → undefined", () => {
-  assert.equal(compileModelListFilter(undefined), undefined);
-});
-
-test("compileModelListFilter: empty array → undefined", () => {
-  assert.equal(compileModelListFilter([]), undefined);
-});
-
-test("compileModelListFilter: raw IDs with slash → exact set populated", () => {
-  const f = compileModelListFilter(["cc/claude-opus-4-7", "glm/gpt-5"]);
-  assert.ok(f);
-  assert.equal(f.exact.has("cc/claude-opus-4-7"), true);
-  assert.equal(f.exact.has("glm/gpt-5"), true);
-  assert.equal(f.suffixes.size, 0);
-});
-
-test("compileModelListFilter: bare IDs (no slash) → suffixes set populated", () => {
-  const f = compileModelListFilter(["claude-opus-4-7", "gpt-5"]);
-  assert.ok(f);
-  assert.equal(f.suffixes.has("claude-opus-4-7"), true);
-  assert.equal(f.suffixes.has("gpt-5"), true);
-  assert.equal(f.exact.size, 0);
-});
-
-test("compileModelListFilter: mixed raw + bare → both sets populated", () => {
-  const f = compileModelListFilter(["cc/claude-opus-4-7", "gpt-5"]);
-  assert.ok(f);
-  assert.equal(f.exact.has("cc/claude-opus-4-7"), true);
-  assert.equal(f.suffixes.has("gpt-5"), true);
-});
-
-// ─────────────────────────────────────────────────────────────────────────
-// passesModelAllowlist
-// ─────────────────────────────────────────────────────────────────────────
-
-test("passesModelAllowlist: no visible, no hidden → keep (passthrough)", () => {
-  assert.equal(passesModelAllowlist("cc/claude-opus-4-7", undefined, undefined), true);
-});
-
-test("passesModelAllowlist: visible undefined, hidden undefined → keep", () => {
-  assert.equal(passesModelAllowlist("cc/claude-opus-4-7", undefined, undefined), true);
-});
-
-test("passesModelAllowlist: visible set, id matches exact → keep", () => {
-  const vis = compileModelListFilter(["cc/claude-opus-4-7"]);
-  assert.equal(passesModelAllowlist("cc/claude-opus-4-7", vis, undefined), true);
-});
-
-test("passesModelAllowlist: visible set, id matches suffix → keep", () => {
-  const vis = compileModelListFilter(["claude-opus-4-7"]);
-  assert.equal(passesModelAllowlist("cc/claude-opus-4-7", vis, undefined), true);
-});
-
-test("passesModelAllowlist: visible set, id does NOT match → drop", () => {
-  const vis = compileModelListFilter(["cc/claude-opus-4-7"]);
-  assert.equal(passesModelAllowlist("glm/gpt-5", vis, undefined), false);
-});
-
-test("passesModelAllowlist: visible set, bare suffix matches different prefix → keep", () => {
-  const vis = compileModelListFilter(["claude-opus-4-7"]);
-  assert.equal(passesModelAllowlist("kr/claude-opus-4-7", vis, undefined), true);
-});
-
-test("passesModelAllowlist: hidden set, id matches exact → drop", () => {
-  const hid = compileModelListFilter(["cc/claude-opus-4-7"]);
-  assert.equal(passesModelAllowlist("cc/claude-opus-4-7", undefined, hid), false);
-});
-
-test("passesModelAllowlist: hidden set, id matches suffix → drop", () => {
-  const hid = compileModelListFilter(["claude-opus-4-7"]);
-  assert.equal(passesModelAllowlist("cc/claude-opus-4-7", undefined, hid), false);
-});
-
-test("passesModelAllowlist: hidden set, id does NOT match → keep", () => {
-  const hid = compileModelListFilter(["cc/claude-opus-4-7"]);
-  assert.equal(passesModelAllowlist("glm/gpt-5", undefined, hid), true);
-});
-
-test("passesModelAllowlist: id in BOTH visible and hidden → DROP (deny wins)", () => {
-  const vis = compileModelListFilter(["cc/claude-opus-4-7"]);
-  const hid = compileModelListFilter(["cc/claude-opus-4-7"]);
-  assert.equal(passesModelAllowlist("cc/claude-opus-4-7", vis, hid), false);
-});
-
-test("passesModelAllowlist: visible allows, hidden blocks different id → keep the visible one", () => {
-  const vis = compileModelListFilter(["cc/claude-opus-4-7"]);
-  const hid = compileModelListFilter(["glm/gpt-5"]);
-  assert.equal(passesModelAllowlist("cc/claude-opus-4-7", vis, hid), true);
-  assert.equal(passesModelAllowlist("glm/gpt-5", vis, hid), false);
-});
-
-test("passesModelAllowlist: bare-suffix hidden blocks exact match too", () => {
-  const hid = compileModelListFilter(["claude-opus-4-7"]);
-  assert.equal(passesModelAllowlist("cc/claude-opus-4-7", undefined, hid), false);
-  assert.equal(passesModelAllowlist("kr/claude-opus-4-7", undefined, hid), false);
-});
-
-test("passesModelAllowlist: no-slash id, visible set has bare match → keep", () => {
-  const vis = compileModelListFilter(["claude-primary"]);
-  assert.equal(passesModelAllowlist("claude-primary", vis, undefined), true);
-});
-
-test("passesModelAllowlist: no-slash id, visible set has no match → drop", () => {
-  const vis = compileModelListFilter(["cc/claude-opus-4-7"]);
-  assert.equal(passesModelAllowlist("claude-primary", vis, undefined), false);
-});
-
-// ─────────────────────────────────────────────────────────────────────────
-// passesComboAllowlist
-// ─────────────────────────────────────────────────────────────────────────
-
-function combo(models: OmniRouteRawCombo["models"]): OmniRouteRawCombo {
-  return { id: "c1", name: "Test Combo", models };
-}
-
-test("passesComboAllowlist: visible undefined → keep", () => {
-  const c = combo([{ kind: "model", model: "cc/claude-opus-4-7" }]);
-  assert.equal(passesComboAllowlist(c, undefined), true);
-});
-
-test("passesComboAllowlist: ≥1 member matches visible → keep", () => {
-  const vis = compileModelListFilter(["cc/claude-opus-4-7"]);
-  const c = combo([
-    { kind: "model", model: "dead/legacy" },
-    { kind: "model", model: "cc/claude-opus-4-7" },
-  ]);
-  assert.equal(passesComboAllowlist(c, vis), true);
-});
-
-test("passesComboAllowlist: zero members match visible → drop", () => {
-  const vis = compileModelListFilter(["cc/claude-opus-4-7"]);
-  const c = combo([
-    { kind: "model", model: "glm/gpt-5" },
-    { kind: "model", model: "kr/claude-opus-4-7" },
-  ]);
-  assert.equal(passesComboAllowlist(c, vis), false);
-});
-
-test("passesComboAllowlist: bare suffix matches any prefix → keep", () => {
-  const vis = compileModelListFilter(["claude-opus-4-7"]);
-  const c = combo([{ kind: "model", model: "kr/claude-opus-4-7" }]);
-  assert.equal(passesComboAllowlist(c, vis), true);
-});
-
-test("passesComboAllowlist: zero members → keep", () => {
-  const vis = compileModelListFilter(["cc/claude-opus-4-7"]);
-  assert.equal(passesComboAllowlist(combo([]), vis), true);
-  assert.equal(passesComboAllowlist(combo(undefined), vis), true);
-});
-
-test("passesComboAllowlist: only combo-ref steps → keep", () => {
-  const vis = compileModelListFilter(["cc/claude-opus-4-7"]);
-  const c = combo([{ kind: "combo-ref", comboName: "nested" }]);
-  assert.equal(passesComboAllowlist(c, vis), true);
-});
-
-// ─────────────────────────────────────────────────────────────────────────
-// Schema — visibleModels / hiddenModels
-// ─────────────────────────────────────────────────────────────────────────
-
-test("parseOmniRoutePluginOptions: visibleModels string[] → preserved", () => {
-  const r = parseOmniRoutePluginOptions({
-    features: { visibleModels: ["cc/claude-opus-4-7", "gpt-5"] },
-  });
-  assert.deepEqual(r.features?.visibleModels, ["cc/claude-opus-4-7", "gpt-5"]);
-});
-
-test("parseOmniRoutePluginOptions: hiddenModels string[] → preserved", () => {
-  const r = parseOmniRoutePluginOptions({
-    features: { hiddenModels: ["glm/gpt-5"] },
-  });
-  assert.deepEqual(r.features?.hiddenModels, ["glm/gpt-5"]);
-});
-
-test("parseOmniRoutePluginOptions: both lists together → preserved", () => {
-  const r = parseOmniRoutePluginOptions({
-    features: {
-      visibleModels: ["cc/claude-opus-4-7"],
-      hiddenModels: ["glm/gpt-5"],
-    },
-  });
-  assert.deepEqual(r.features?.visibleModels, ["cc/claude-opus-4-7"]);
-  assert.deepEqual(r.features?.hiddenModels, ["glm/gpt-5"]);
-});
-
-test("parseOmniRoutePluginOptions: empty string in visibleModels → rejects", () => {
-  assert.throws(
-    () =>
-      parseOmniRoutePluginOptions({
-        features: { visibleModels: [""] },
-      }),
-    /Invalid @omniroute\/opencode-plugin options/
-  );
-});
-
-test("parseOmniRoutePluginOptions: empty string in hiddenModels → rejects", () => {
-  assert.throws(
-    () =>
-      parseOmniRoutePluginOptions({
-        features: { hiddenModels: [""] },
-      }),
-    /Invalid @omniroute\/opencode-plugin options/
-  );
-});
-
-test("parseOmniRoutePluginOptions: unknown features key still rejects (strict invariant)", () => {
-  assert.throws(
-    () =>
-      parseOmniRoutePluginOptions({
-        features: { visibleModels: ["x"], unknownKey: true },
-      }),
-    /Invalid @omniroute\/opencode-plugin options/
-  );
-});
-
-// ─────────────────────────────────────────────────────────────────────────
-// buildStaticProviderEntry — allowlist/blocklist integration
-// ─────────────────────────────────────────────────────────────────────────
-
-const FAKE_RAW_MODELS: OmniRouteRawModelEntry[] = [
-  { id: "cc/claude-opus-4-7", owned_by: "anthropic" },
-  { id: "glm/gpt-5", owned_by: "openai" },
-  { id: "kr/claude-opus-4-7", owned_by: "anthropic" },
-  { id: "claude-primary", owned_by: "combo" },
-];
-
-test("buildStaticProviderEntry: no allowlist → all models emitted", () => {
-  const opts = resolveOmniRoutePluginOptions({ features: {} });
-  const entry = buildStaticProviderEntry(FAKE_RAW_MODELS, [], opts, "http://localhost:20128/v1", "sk-test");
-  const ids = Object.keys(entry.models);
-  assert.ok(ids.includes("cc/claude-opus-4-7"), "cc/claude-opus-4-7 should be present");
-  assert.ok(ids.includes("glm/gpt-5"), "glm/gpt-5 should be present");
-  assert.ok(ids.includes("kr/claude-opus-4-7"), "kr/claude-opus-4-7 should be present");
-});
-
-test("buildStaticProviderEntry: visibleModels filters to only listed IDs", () => {
-  const opts = resolveOmniRoutePluginOptions({
-    features: { visibleModels: ["cc/claude-opus-4-7"] },
-  });
-  const entry = buildStaticProviderEntry(FAKE_RAW_MODELS, [], opts, "http://localhost:20128/v1", "sk-test");
-  const ids = Object.keys(entry.models);
-  assert.ok(ids.includes("cc/claude-opus-4-7"), "cc/claude-opus-4-7 should be present");
-  assert.equal(ids.includes("glm/gpt-5"), false, "glm/gpt-5 should be filtered out");
-  assert.equal(ids.includes("kr/claude-opus-4-7"), false, "kr/claude-opus-4-7 should be filtered out");
-});
-
-test("buildStaticProviderEntry: hiddenModels drops listed IDs", () => {
-  const opts = resolveOmniRoutePluginOptions({
-    features: { hiddenModels: ["glm/gpt-5"] },
-  });
-  const entry = buildStaticProviderEntry(FAKE_RAW_MODELS, [], opts, "http://localhost:20128/v1", "sk-test");
-  const ids = Object.keys(entry.models);
-  assert.ok(ids.includes("cc/claude-opus-4-7"), "cc/claude-opus-4-7 should be present");
-  assert.equal(ids.includes("glm/gpt-5"), false, "glm/gpt-5 should be hidden");
-  assert.ok(ids.includes("kr/claude-opus-4-7"), "kr/claude-opus-4-7 should be present");
-});
-
-test("buildStaticProviderEntry: bare-suffix visibleModels matches any prefix", () => {
-  const opts = resolveOmniRoutePluginOptions({
-    features: { visibleModels: ["claude-opus-4-7"] },
-  });
-  const entry = buildStaticProviderEntry(FAKE_RAW_MODELS, [], opts, "http://localhost:20128/v1", "sk-test");
-  const ids = Object.keys(entry.models);
-  assert.ok(ids.includes("cc/claude-opus-4-7"), "cc/claude-opus-4-7 should match via suffix");
-  assert.ok(ids.includes("kr/claude-opus-4-7"), "kr/claude-opus-4-7 should match via suffix");
-  assert.equal(ids.includes("glm/gpt-5"), false, "glm/gpt-5 should be filtered out");
-});
-
-test("buildStaticProviderEntry: id in both visible and hidden → hidden wins", () => {
-  const opts = resolveOmniRoutePluginOptions({
-    features: {
-      visibleModels: ["cc/claude-opus-4-7"],
-      hiddenModels: ["cc/claude-opus-4-7"],
-    },
-  });
-  const entry = buildStaticProviderEntry(FAKE_RAW_MODELS, [], opts, "http://localhost:20128/v1", "sk-test");
-  const ids = Object.keys(entry.models);
-  assert.equal(ids.includes("cc/claude-opus-4-7"), false, "deny takes precedence");
-});
-
-test("buildStaticProviderEntry: empty visibleModels → no filter (passthrough)", () => {
-  const opts = resolveOmniRoutePluginOptions({
-    features: { visibleModels: [] },
-  });
-  const entry = buildStaticProviderEntry(FAKE_RAW_MODELS, [], opts, "http://localhost:20128/v1", "sk-test");
-  const ids = Object.keys(entry.models);
-  assert.ok(ids.includes("cc/claude-opus-4-7"), "empty visibleModels should not filter");
-  assert.ok(ids.includes("glm/gpt-5"), "empty visibleModels should not filter");
-});
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -58,7 +58,7 @@ Repository map and Reference Documentation sections below.
 | Services      | `open-sse/services/`    | Combo routing, rate limits, caching, etc                                                                                                                |
 | Database      | `src/lib/db/`           | SQLite domain modules (130 migrations)                                                                                                                  |
 | Domain/Policy | `src/domain/`           | Policy engine, cost rules, fallback logic                                                                                                               |
-| MCP Server    | `open-sse/mcp-server/`  | 105 tools (42 base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules), 3 transports (stdio / SSE / Streamable HTTP), 31 scopes |
+| MCP Server    | `open-sse/mcp-server/`  | 104 tools (42 base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules), 3 transports (stdio / SSE / Streamable HTTP), 31 scopes |
 | A2A Server    | `src/lib/a2a/`          | JSON-RPC 2.0 agent protocol                                                                                                                             |
 | Skills        | `src/lib/skills/`       | Extensible skill framework                                                                                                                              |
 | Memory        | `src/lib/memory/`       | Persistent conversational memory                                                                                                                        |
--- a/0
+++ b/0
--- a/README.md
+++ b/README.md
@@ -188,7 +188,7 @@ curl http://localhost:20128/v1/chat/completions \

 </div>

-<img src="./docs/diagrams/promise-pillars.svg" width="100%" alt="The Promise — One endpoint. 291 providers. Never stop building — OmniRoute picks the cheapest one that works. Six pillars: Never hit limits (auto-fallback across 291 providers in milliseconds, zero downtime) · Save up to 95% tokens (RTK + Caveman stacked compression cuts 15–95%, ~89% avg on tool-heavy sessions) · $0 to start (90+ free tiers, 40+ free forever — no card needed) · Every tool works (33 coding agents through one config) · One endpoint (OpenAI ↔ Claude ↔ Gemini ↔ Responses API at /v1) · Production-grade (circuit breakers, TLS stealth, MCP 105 tools, A2A, memory, guardrails, evals — 25,000+ tests)."/>
+<img src="./docs/diagrams/promise-pillars.svg" width="100%" alt="The Promise — One endpoint. 291 providers. Never stop building — OmniRoute picks the cheapest one that works. Six pillars: Never hit limits (auto-fallback across 291 providers in milliseconds, zero downtime) · Save up to 95% tokens (RTK + Caveman stacked compression cuts 15–95%, ~89% avg on tool-heavy sessions) · $0 to start (90+ free tiers, 40+ free forever — no card needed) · Every tool works (33 coding agents through one config) · One endpoint (OpenAI ↔ Claude ↔ Gemini ↔ Responses API at /v1) · Production-grade (circuit breakers, TLS stealth, MCP 104 tools, A2A, memory, guardrails, evals — 25,000+ tests)."/>

 <br/>
 <br/>
@@ -439,7 +439,7 @@ All **19** strategies — mix & match per combo step:

 </div>

-<img src="./docs/diagrams/comparison-table.svg" width="100%" alt="What sets OmniRoute apart — comparison table vs 9router, OpenRouter, CLIProxyAPI and LiteLLM across 13 capabilities. OmniRoute: 291 providers, 90+ free providers built-in, 19 routing strategies, 12-engine token compression, built-in MCP server with 105 tools, A2A agent protocol, persistent memory, guardrails, cloud agents, TLS fingerprint stealth, Desktop/Termux/PWA, 43 i18n UI locales, 100% MIT self-hosted. OmniRoute is the only one with the full set; competitors show a mix of checks, partials and crosses. Verified from each project&apos;s docs."/>
+<img src="./docs/diagrams/comparison-table.svg" width="100%" alt="What sets OmniRoute apart — comparison table vs 9router, OpenRouter, CLIProxyAPI and LiteLLM across 13 capabilities. OmniRoute: 291 providers, 90+ free providers built-in, 19 routing strategies, 12-engine token compression, built-in MCP server with 104 tools, A2A agent protocol, persistent memory, guardrails, cloud agents, TLS fingerprint stealth, Desktop/Termux/PWA, 43 i18n UI locales, 100% MIT self-hosted. OmniRoute is the only one with the full set; competitors show a mix of checks, partials and crosses. Verified from each project&apos;s docs."/>

 <sub>📊 Full methodology &amp; per-feature detail vs 9router, OpenRouter, CLIProxyAPI &amp; LiteLLM → [`docs/comparison/OMNIROUTE_VS_ALTERNATIVES.md`](docs/comparison/OMNIROUTE_VS_ALTERNATIVES.md)</sub>

@@ -723,7 +723,7 @@ Expose OmniRoute over **MCP**, **A2A**, a **REST API**, **webhooks** or a **remo
 <table>
  <tr><th align="left">Interface</th><th align="left">Endpoint / command</th><th align="left">Use it for</th></tr>
  <tr><td align="left" nowrap>🧰 <b>MCP (stdio)</b></td><td align="left" nowrap><code>omniroute --mcp</code></td><td align="left">Plug into Claude Desktop, Cursor, any MCP client</td></tr>
-  <tr><td align="left" nowrap>🌊 <b>MCP (HTTP)</b></td><td align="left" nowrap><code>/api/mcp/stream</code></td><td align="left">Remote MCP — <b>105 tools</b>, 31 scopes, full audit trail</td></tr>
+  <tr><td align="left" nowrap>🌊 <b>MCP (HTTP)</b></td><td align="left" nowrap><code>/api/mcp/stream</code></td><td align="left">Remote MCP — <b>104 tools</b>, 31 scopes, full audit trail</td></tr>
  <tr><td align="left" nowrap>📡 <b>MCP (SSE)</b></td><td align="left" nowrap><code>/api/mcp/sse</code></td><td align="left">Streaming MCP transport</td></tr>
  <tr><td align="left" nowrap>🤝 <b>A2A</b></td><td align="left" nowrap><code>/.well-known/agent.json</code></td><td align="left">Agent-to-agent, <b>JSON-RPC 2.0</b> + SSE, 6 skills</td></tr>
  <tr><td align="left" nowrap>🌐 <b>REST API</b></td><td align="left" nowrap><code>/v1/*</code></td><td align="left">OpenAI-compatible — chat, embeddings, images, audio, OCR</td></tr>
--- a/bin/cli/commands/setup-open-code.mjs
+++ b/bin/cli/commands/setup-open-code.mjs
@@ -218,26 +218,6 @@ function registerPluginInOpenCodeConfig({
 * a clear "could not run opencode" message instead of a hard import
 * failure.
 */
-/**
- * Resolve the provider id used for `opencode auth login --provider <id>`.
- *
- * The bundled @omniroute/opencode-plugin registers its provider under
- * `opencode-<id>` (the `opencode-` prefix is required by OpenCode >=1.17.8's
- * native-adapter gate). The auth login command must use the prefixed form
- * because OpenCode resolves `--provider <id>` against the provider id the
- * plugin actually registered.
- *
- * Idempotent: if the id already starts with `opencode-`, it passes through
- * unchanged. This protects users who manually worked around the bug with
- * `--provider opencode-omniroute`.
- *
- * @param {string} providerId
- * @returns {string}
- */
-export function resolveOpenCodeAuthProviderId(providerId) {
-  return providerId.startsWith("opencode-") ? providerId : `opencode-${providerId}`;
-}
-
 /**
 * Pure resolver for the `opencode auth login` spawn descriptor. Extracted so the
 * platform-branching logic is unit-testable without mocking child_process or
@@ -251,23 +231,21 @@ export function resolveOpenCodeAuthProviderId(providerId) {
 */
 export function resolveOpenCodeAuthSpawn(providerId, platform = process.platform) {
  const isWin = platform === "win32";
-  const authProviderId = resolveOpenCodeAuthProviderId(providerId);
  return {
    command: isWin ? "opencode.cmd" : "opencode",
-    args: ["auth", "login", "--provider", authProviderId],
+    args: ["auth", "login", "--provider", providerId],
    options: { stdio: "inherit", shell: isWin },
  };
 }

 export function runOpenCodeAuth(providerId) {
-  const authProviderId = resolveOpenCodeAuthProviderId(providerId);
  const { command, args, options } = resolveOpenCodeAuthSpawn(providerId);
  const res = spawnSync(command, args, options);
  if (res.error) {
    // ENOENT = opencode is not on PATH
    if (res.error.code === "ENOENT") {
      printInfo(
-        `opencode CLI not found on PATH. Run \`opencode auth login --provider ${authProviderId}\` manually after installing OpenCode.`
+        `opencode CLI not found on PATH. Run \`opencode auth login --provider ${providerId}\` manually after installing OpenCode.`
      );
      return 1;
    }
@@ -365,8 +343,7 @@ export async function runSetupOpenCodeCommand(opts = {}) {
  if (wantsAuth) {
    if (nonInteractive) {
      printInfo(`Skipping \`opencode auth login\` (non-interactive mode).`);
-      const authProviderId = resolveOpenCodeAuthProviderId(providerId);
-      printInfo(`Run manually: opencode auth login --provider ${authProviderId}`);
+      printInfo(`Run manually: opencode auth login --provider ${providerId}`);
    } else {
      printHeading("Authenticating with OpenCode");
      const authExit = runOpenCodeAuth(providerId);
@@ -375,9 +352,8 @@ export async function runSetupOpenCodeCommand(opts = {}) {
      }
    }
  } else {
-    const authProviderId = resolveOpenCodeAuthProviderId(providerId);
    printInfo(
-      `Next step: opencode auth login --provider ${authProviderId}   (pass --auth to do this automatically)`
+      `Next step: opencode auth login --provider ${providerId}   (pass --auth to do this automatically)`
    );
  }

--- a/bin/cli/runtime/trayRuntime.ts
+++ b/bin/cli/runtime/trayRuntime.ts
@@ -17,7 +17,7 @@ export const SYSTRAY_VERSION = "2.1.4";
 const SYSTRAY_SPEC = `${SYSTRAY_PACKAGE}@${SYSTRAY_VERSION}`;

 export function resolveSystrayBinName(platform: NodeJS.Platform): string | null {
-  if (platform === "win32") return "tray_windows_release.exe";
+  if (platform === "win32") return null;
  if (platform === "darwin") return "tray_darwin_release";
  return "tray_linux_release";
 }
@@ -45,6 +45,7 @@ export function chmodSystrayBinAt(runtimeRoot: string, platform: NodeJS.Platform
 }

 export async function loadSystray(): Promise<(new (...args: unknown[]) => unknown) | null> {
+  if (process.platform === "win32") return null; // Windows uses tray.ps1 instead
  ensureRuntimeDir();
  if (!isInstalled()) {
    try {
--- a/bin/cli/sqlite.mjs
+++ b/bin/cli/sqlite.mjs
@@ -130,7 +130,7 @@ async function openSqliteDatabase(dbPath, options = {}) {
  try {
    return new loaded.Database(dbPath, options);
  } catch (error) {
-    return openWithSyncDriverFallback(dbPath, options, error);
+    throw createSqliteNativeError(error);
  }
 }

--- a/bin/cli/tray/autostart.mjs
+++ b/bin/cli/tray/autostart.mjs
@@ -167,10 +167,6 @@ export function getAutostartStatus() {
      linger: tryReadLingerEnabled(),
    };
  }
-  if (process.platform === "win32") {
-    const winMechanism = isAutostartEnabled() ? "vbs-startup" : null;
-    return { enabled: isAutostartEnabled(), mechanism: winMechanism };
-  }
  return { enabled: isAutostartEnabled(), mechanism: null };
 }

--- a/bin/cli/tray/index.mjs
+++ b/bin/cli/tray/index.mjs
@@ -1,4 +1,5 @@
 import { isTraySupported, initSystrayUnix, killSystrayUnix } from "./traySystray.mjs";
+import { initWinTray, killWinTray } from "./trayWindows.mjs";

 let active = null;

@@ -9,17 +10,15 @@ export async function initTray({ port, onQuit, onOpenDashboard, onShowLogs }) {
  const ctx = { port, onQuit, onOpenDashboard, onShowLogs };
  // initSystrayUnix is async: it lazily installs/loads systray2 from the runtime
  // dir (trayRuntime.ts) rather than from node_modules. (#4605)
-  // Use systray2 on all platforms including Windows — the tarball ships
-  // tray_windows_release.exe, avoiding the Norton/AVG IDP.HELU.PSE85 heuristic
-  // that fires on temp-dir PowerShell scripts. (#8609)
-  active = await initSystrayUnix(ctx);
+  active = process.platform === "win32" ? initWinTray(ctx) : await initSystrayUnix(ctx);
  return active;
 }

 export function killTray() {
  if (!active) return;
  try {
-    killSystrayUnix(active);
+    if (process.platform === "win32") killWinTray(active);
+    else killSystrayUnix(active);
  } catch {}
  active = null;
 }
--- a/bin/mcp-server.mjs
+++ b/bin/mcp-server.mjs
@@ -3,7 +3,7 @@
 import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";

 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -43,15 +43,7 @@ export async function startMcpCli(rootDir = ROOT) {
  }

  // `tsx` loader is only required for local `.ts` fallback; JS entry works without it.
-  const tsxLoaderArgs = mcpEntry.endsWith(".ts") ? ["--import", "tsx"] : [];
-  // Preload the stdout/stderr console guard before mcpEntry's own module graph evaluates —
-  // DB init (a side effect of createMcpServer()'s tool registration) logs via plain
-  // console.log, and by the time any code inside mcpEntry itself could redirect it, that
-  // module's own (hoisted) imports have already run. Loading the guard first, in a separate
-  // module, is the only point early enough to guarantee it never leaks into the JSON-RPC
-  // stream on stdout.
-  const consoleGuard = pathToFileURL(join(__dirname, "mcpStdioConsoleGuard.mjs")).href;
-  const loaderArgs = ["--import", consoleGuard, ...tsxLoaderArgs];
+  const loaderArgs = mcpEntry.endsWith(".ts") ? ["--import", "tsx"] : [];

  await new Promise((resolve, reject) => {
    const child = spawn(process.execPath, [...loaderArgs, mcpEntry], {
--- a/bin/mcpStdioConsoleGuard.mjs
+++ b/bin/mcpStdioConsoleGuard.mjs
@@ -1,16 +0,0 @@
-// Preloaded (via `node --import`) before open-sse/mcp-server/server.ts and its entire
-// import graph evaluate. The stdio MCP transport uses stdout exclusively for JSON-RPC
-// messages, but DB init (getDbInstance(), triggered as a side effect of evaluating the
-// server's module graph — e.g. tool registration reading compression settings) logs via
-// plain console.log. A redirect placed *inside* server.ts (even at the top of its first
-// executed function) is too late: static imports are hoisted and fully evaluated before
-// any of that function's own code runs, so earlier console.log calls during import-time
-// side effects already escaped to the real stdout by then. Redirecting here, in a module
-// that loads before server.ts is even requested, is the only point early enough to
-// guarantee no startup output leaks into the JSON-RPC stream and corrupts it client-side
-// (e.g. Claude Desktop: "Unexpected token 'D', \"[DB] Changi\"... is not valid JSON").
-import { Console } from "node:console";
-
-const stderrConsole = new Console({ stdout: process.stderr, stderr: process.stderr });
-console.log = stderrConsole.log.bind(stderrConsole);
-console.warn = stderrConsole.warn.bind(stderrConsole);
--- a/bin/omniroute.mjs
+++ b/bin/omniroute.mjs
@@ -43,19 +43,6 @@ if (isVersionFastPath(process.argv)) {
  process.exit(0);
 }

-// MCP stdio transport uses stdout exclusively for JSON-RPC messages. Redirect
-// console.log/warn to stderr before anything else runs — including the tsx/esm and
-// polyfill imports below, since those (and their transitive module graphs, e.g. DB
-// init) can themselves log during evaluation. Redirecting after those imports let
-// early output leak straight into the JSON-RPC stream and corrupt it client-side
-// (e.g. Claude Desktop: "Unexpected token 'D', \"[DB] Changi\"... is not valid JSON").
-if (process.argv.includes("--mcp")) {
-  const { Console } = await import("node:console");
-  const stderrConsole = new Console({ stdout: process.stderr, stderr: process.stderr });
-  console.log = stderrConsole.log.bind(stderrConsole);
-  console.warn = stderrConsole.warn.bind(stderrConsole);
-}
-
 // Register tsx so dynamic imports of .ts source files (referenced as .js per
 // TypeScript conventions) resolve correctly. The build never emits .js for
 // src/lib/cli-helper/, so tsx handles the .ts → .js resolution at runtime.
@@ -71,6 +58,16 @@ await import("../open-sse/utils/setupPolyfill.ts");
 const { registerAliasResolver } = await import("./aliasResolver.mjs");
 await registerAliasResolver(ROOT);

+// MCP stdio transport uses stdout exclusively for JSON-RPC messages.
+// Redirect console.log/warn to stderr early (before loadEnvFile and DB init)
+// so no startup output corrupts the protocol.
+if (process.argv.includes("--mcp")) {
+  const { Console } = await import("node:console");
+  const stderrConsole = new Console({ stdout: process.stderr, stderr: process.stderr });
+  console.log = stderrConsole.log.bind(stderrConsole);
+  console.warn = stderrConsole.warn.bind(stderrConsole);
+}
+
 // Electron persists secrets (JWT_SECRET, API_KEY_SECRET, STORAGE_ENCRYPTION_KEY) to
 // `<DATA_DIR>/server.env` (electron/main.js), never `.env`. Migrating an existing
 // install (storage.sqlite + server.env) to the CLI left those secrets undiscoverable —
--- a/bin/restore-policies.sh
+++ b/bin/restore-policies.sh
@@ -39,8 +39,7 @@ snap="$(ops_find_snapshot "$ID")"

 # Policy definition tables present in BOTH the snapshot and the live DB. GLOB
 # keeps `_` literal; we drop usage counters / logs so accounting isn't rewound.
-tables=()
-while IFS= read -r t; do tables+=("$t"); done < <(
+readarray -t tables < <(
  sqlite3 "$snap/storage.sqlite" \
    "SELECT name FROM sqlite_master WHERE type='table' AND name GLOB 'api_key*' \
       AND name NOT GLOB '*counter*' AND name NOT GLOB '*_log*' ORDER BY name;"
--- a/changelog.d/features/6736-response-content-encoding.md
+++ b/changelog.d/features/6736-response-content-encoding.md
@@ -1 +0,0 @@
- **feat(api):** add response content encoding verification — confirms Next.js compress:true and documents stripStaleForwardingHeaders behavior ([#6736](https://github.com/diegosouzapw/OmniRoute/issues/6736))
--- a/changelog.d/features/6752-plugins-marketplace-install-api.md
+++ b/changelog.d/features/6752-plugins-marketplace-install-api.md
@@ -1 +0,0 @@
- **feat(api):** add plugins marketplace install endpoint with checksum verification ([#6752](https://github.com/diegosouzapw/OmniRoute/issues/6752))
--- a/changelog.d/features/7679-chatgpt-web-thinking-tool-emulation.md
+++ b/changelog.d/features/7679-chatgpt-web-thinking-tool-emulation.md
@@ -1 +0,0 @@
- **feat(chatgpt-web):** harden prompt-emulated tool contract for thinking models (#7679 — thanks @horacecar)
--- a/changelog.d/features/8237-reduce-idle-memory-small-vps.md
+++ b/changelog.d/features/8237-reduce-idle-memory-small-vps.md
@@ -1 +0,0 @@
- **docs:** add low-memory/small VPS optimization guide ([#8237](https://github.com/diegosouzapw/OmniRoute/issues/8237))
--- a/changelog.d/features/8369-connection-level-upstream-headers.md
+++ b/changelog.d/features/8369-connection-level-upstream-headers.md
@@ -1 +0,0 @@
- **feat(providers):** add connection-level custom upstream headers via `provider_specific_data.customHeaders` — applied to every request through that connection, with model-level headers overriding on the same case-insensitive name. (thanks @Benson-mk)
--- a/changelog.d/features/8461-runomniroutecli-approval-gate.md
+++ b/changelog.d/features/8461-runomniroutecli-approval-gate.md
@@ -1 +0,0 @@
- feat(copilot): add approval gate for runOmniRouteCli commands (#8461)
--- a/changelog.d/features/9031-regolo-ai-provider.md
+++ b/changelog.d/features/9031-regolo-ai-provider.md
@@ -1 +0,0 @@
- **feat(providers):** add Regolo AI OpenAI-compatible provider ([#9031](https://github.com/diegosouzapw/OmniRoute/issues/9031))
--- a/changelog.d/features/9068-editable-discovered-provider-slugs.md
+++ b/changelog.d/features/9068-editable-discovered-provider-slugs.md
@@ -1 +0,0 @@
- **feat(db):** add provider-scoped model aliases that survive rediscovery ([#9068](https://github.com/diegosouzapw/OmniRoute/issues/9068))
--- a/changelog.d/features/9243-forwarded-header-budget-env.md
+++ b/changelog.d/features/9243-forwarded-header-budget-env.md
@@ -1 +0,0 @@
- feat: make forwarded upstream response-header budget configurable via env var (#9243)
--- a/changelog.d/features/9248-video-url-passthrough.md
+++ b/changelog.d/features/9248-video-url-passthrough.md
@@ -1 +0,0 @@
- **feat(providers):** make video_url passthrough configurable per provider/model via compat override ([#9248](https://github.com/diegosouzapw/OmniRoute/issues/9248)) — thanks @HellFiveOsborn
--- a/changelog.d/features/9270-provider-api-key-links.md
+++ b/changelog.d/features/9270-provider-api-key-links.md
@@ -1 +0,0 @@
- **feat(dashboard):** render a conditional "Get API key" link on the provider detail page, surfaced from the existing `notice.apiKeyUrl` / `notice.signupUrl` catalog metadata (e.g. `pioneer`, `jina`, `together`). The link opens in a new tab and is hidden when neither URL is present, so existing providers are unaffected. Tracks the notice field in `ProviderCatalogMetadata` ([#9270](https://github.com/diegosouzapw/OmniRoute/pull/9270))
--- a/changelog.d/features/9284-json-cookie-input.md
+++ b/changelog.d/features/9284-json-cookie-input.md
@@ -1 +0,0 @@
- **feat(providers):** accept JSON cookie objects in normalizeSessionCookieHeader (#9284 — thanks @AIB1TAL0S)
--- a/changelog.d/features/9318-opencode-zen-reasoning-effort.md
+++ b/changelog.d/features/9318-opencode-zen-reasoning-effort.md
@@ -1 +0,0 @@
- **feat(providers):** support max reasoning effort for opencode-zen DeepSeek models (#9318)
--- a/changelog.d/features/9415-newapi-sub2api-aggregator-balance.md
+++ b/changelog.d/features/9415-newapi-sub2api-aggregator-balance.md
@@ -1 +0,0 @@
- **sse:** New-API / One-API / Sub2API aggregator balance detection for compatible nodes — with the "Aggregator Gateway" toggle on, OmniRoute queries the aggregator's `/api/user/self` to read the account balance, shows it as a dashboard badge and lets quota-preflight routing skip exhausted accounts. Gated by the `NEWAPI_AGGREGATOR_BALANCE` feature flag (default off), with a `quotaPerUnit` override for aggregators that do not use the default 500000 units/$1 rate ([#9415](https://github.com/diegosouzapw/OmniRoute/issues/9415))
--- a/changelog.d/features/9418-disable-auto-no-think-combos.md
+++ b/changelog.d/features/9418-disable-auto-no-think-combos.md
@@ -1 +0,0 @@
- **feat(catalog):** added opt-in settings `hideAutoCombos` and `hideNoThinkVariants` (default off) to filter built-in `auto/*` virtual combos and `no-think/*` gateway variants from the `/v1/models` catalog — user-defined combos and original provider models stay listed; routing is unaffected ([#9418](https://github.com/diegosouzapw/OmniRoute/issues/9418))
--- a/changelog.d/features/9473-opencode-plugin-model-allowlist.md
+++ b/changelog.d/features/9473-opencode-plugin-model-allowlist.md
@@ -1 +0,0 @@
- **feat(opencode-plugin):** added `features.visibleModels` (allowlist) and `features.hiddenModels` (blocklist) to `@omniroute/opencode-plugin` — curate the OpenCode TUI/CLI model picker from 600+ catalog entries down to an operator-defined ID list that persists in `opencode.json` across config resets ([#9473](https://github.com/diegosouzapw/OmniRoute/issues/9473))
--- a/changelog.d/features/9511-quota-exhausted-transient-test-all.md
+++ b/changelog.d/features/9511-quota-exhausted-transient-test-all.md
@@ -1 +0,0 @@
- **feat(models):** Test All's "Auto-hide failed models" no longer hides quota errors — daily-quota-exhausted and credits-exhausted responses are now classified via the routing path's existing quota detectors, so an evening Test All on a free-tier provider no longer silently wipes the catalog. Quota results stay visible with a distinct amber badge ([#9511](https://github.com/diegosouzapw/OmniRoute/issues/9511))
--- a/changelog.d/features/9570-plugin-context-headers.md
+++ b/changelog.d/features/9570-plugin-context-headers.md
@@ -1 +0,0 @@
- feat(plugins): expose client request headers in plugin onRequest/onResponse context (#9570)
--- a/changelog.d/features/9579-soniox-audio-provider.md
+++ b/changelog.d/features/9579-soniox-audio-provider.md
@@ -1 +0,0 @@
- **feat(audio):** Soniox STT + TTS provider (`sx`) — async speech-to-text (`stt-async-v5`, `stt-async-v4`) and real-time text-to-speech (`tts-rt-v1`) ([#9579](https://github.com/diegosouzapw/OmniRoute/pull/9579))
--- a/changelog.d/fixes/8577-fix.plan.md
+++ b/changelog.d/fixes/8577-fix.plan.md
@@ -1,2 +0,0 @@
- fix(tests): make machineId tests macOS-compatible by stubbing ioreg in test helper (#8577)
- fix(scripts): replace bash 4+ readarray with compatible while-read loop in restore-policies.sh (#8577)
--- a/changelog.d/fixes/8609-fix.plan.md
+++ b/changelog.d/fixes/8609-fix.plan.md
@@ -1 +0,0 @@
- fix(cli): enable systray2 on Windows for Norton-friendly tray (#8609)
--- a/changelog.d/fixes/8681-fix.plan.md
+++ b/changelog.d/fixes/8681-fix.plan.md
@@ -1 +0,0 @@
- fix(providers): gate premium opencode-zen/opencode-go models behind an API key (#8681)
--- a/changelog.d/fixes/8728-model-catalog-swr.md
+++ b/changelog.d/fixes/8728-model-catalog-swr.md
@@ -0,0 +1 @@
+- **fix(api):** make `/v1/models` stale refresh response-safe and generation-safe, with narrow synced-model invalidation ([#8728](https://github.com/diegosouzapw/OmniRoute/pull/8728)). Related to #8697.
--- a/changelog.d/fixes/8739-yuanbao-sse-parser.md
+++ b/changelog.d/fixes/8739-yuanbao-sse-parser.md
@@ -1 +0,0 @@
- fix(yuanbao-web): accept `content` field in SSE text events (upstream format change) (#8739)
--- a/changelog.d/fixes/8781-fix.plan.md
+++ b/changelog.d/fixes/8781-fix.plan.md
@@ -1 +0,0 @@
- fix(build): remove misleading open-sse/package.json facade and add workspace typecheck gate (#8781)
--- a/changelog.d/fixes/8813-chatgpt-sentinel.md
+++ b/changelog.d/fixes/8813-chatgpt-sentinel.md
@@ -1 +0,0 @@
- fix(errorClassifier): classify ChatGPT Web SENTINEL_BLOCKED 403 as terminal FORBIDDEN, enabling proper combo fallback (#8813)
--- a/changelog.d/fixes/8826-fix.plan.md
+++ b/changelog.d/fixes/8826-fix.plan.md
@@ -1 +0,0 @@
- fix(cli): fall back to node:sqlite when better-sqlite3 constructor throws at runtime (#8826)
--- a/changelog.d/fixes/8830-fix.plan.md
+++ b/changelog.d/fixes/8830-fix.plan.md
@@ -1 +0,0 @@
- fix(opencode): prefix provider id with "opencode-" for auth login command (#8830)
--- a/changelog.d/fixes/8841-fix.plan.md
+++ b/changelog.d/fixes/8841-fix.plan.md
@@ -1 +0,0 @@
- fix(opencode-zen): add current free-tier models to registry to enable combo context pre-filtering (#8841)
--- a/changelog.d/fixes/8869-opencode-complete-model-limits.md
+++ b/changelog.d/fixes/8869-opencode-complete-model-limits.md
@@ -1 +0,0 @@
- **fix(opencode):** generate schema-complete model limits so OpenCode accepts catalog entries without an explicit output cap ([#8869](https://github.com/diegosouzapw/OmniRoute/pull/8869)) — thanks @xiaoyaner0201
--- a/changelog.d/fixes/8876-codex-responses-wire-default.md
+++ b/changelog.d/fixes/8876-codex-responses-wire-default.md
@@ -1 +0,0 @@
- **fix(cli):** default omitted Codex CLI wire API settings to Responses and clear stale Chat state after reset ([#8876](https://github.com/diegosouzapw/OmniRoute/pull/8876)) — thanks @xiaoyaner0201
--- a/changelog.d/fixes/8883-proxy-credential-autofill.md
+++ b/changelog.d/fixes/8883-proxy-credential-autofill.md
@@ -1 +0,0 @@
- **fix(proxy):** isolate new proxy credential fields from browser and password-manager autofill after form reset ([#8883](https://github.com/diegosouzapw/OmniRoute/pull/8883)) — thanks @xiaoyaner0201
--- a/changelog.d/fixes/8921-codebuddy-cn-dual-auth-actions.md
+++ b/changelog.d/fixes/8921-codebuddy-cn-dual-auth-actions.md
@@ -1 +0,0 @@
- **fix(providers):** expose both OAuth Connect and manual API-key actions for dual-auth providers such as CodeBuddy CN ([#8921](https://github.com/diegosouzapw/OmniRoute/pull/8921)) — thanks @Llliao1113
--- a/changelog.d/fixes/8946-no-tool-output.md
+++ b/changelog.d/fixes/8946-no-tool-output.md
@@ -1 +0,0 @@
- fix(compression): drop orphan custom_tool_call/local_shell_call/apply_patch_call on compaction restore (#8946)
--- a/changelog.d/fixes/8960-fix.plan.md
+++ b/changelog.d/fixes/8960-fix.plan.md
@@ -1 +0,0 @@
- fix(opencode): propagate vision capability from live catalog into opencode.json (#8960)
--- a/changelog.d/fixes/8965-fix.plan.md
+++ b/changelog.d/fixes/8965-fix.plan.md
@@ -1 +0,0 @@
- fix(providers): switch Antigravity quota RPCs to iterate ANTIGRAVITY_RUNTIME_BASE_URLS (#8965)
--- a/changelog.d/fixes/8994-vertex-partner-claude.md
+++ b/changelog.d/fixes/8994-vertex-partner-claude.md
@@ -1 +0,0 @@
- fix(vertex): route Claude models to native rawPredict endpoint and respect custom targetFormat overrides (#8994)
--- a/changelog.d/fixes/8995-fix.plan.md
+++ b/changelog.d/fixes/8995-fix.plan.md
@@ -1 +0,0 @@
- fix(proxies): resolveProxyForConnection now returns the proxy name, so the dashboard badge shows the name instead of the hostname (#8995)
--- a/changelog.d/fixes/9029-cursor-narration.md
+++ b/changelog.d/fixes/9029-cursor-narration.md
@@ -1 +0,0 @@
- fix(cursor): preserve tool context across multi-turn conversations when client lacks conversation_id (#9029)
--- a/changelog.d/fixes/9030-antigravity-system-429s.md
+++ b/changelog.d/fixes/9030-antigravity-system-429s.md
@@ -1 +0,0 @@
- fix(sse): move Antigravity client system content to first user message to avoid upstream 429 RESOURCE_EXHAUSTED on oversized systemInstruction (#9030)
--- a/changelog.d/fixes/9045-fix.plan.md
+++ b/changelog.d/fixes/9045-fix.plan.md
@@ -1 +0,0 @@
- fix(db): stream DB backup export instead of buffering entire file into memory (#9045)
--- a/changelog.d/fixes/9046-fix.md
+++ b/changelog.d/fixes/9046-fix.md
@@ -1 +0,0 @@
- fix(ui): normalize Free Pool API response payload to read from data.proxies (#9046)
--- a/changelog.d/fixes/9054-fix.plan.md
+++ b/changelog.d/fixes/9054-fix.plan.md
@@ -1 +0,0 @@
- fix(api/analytics): stop charging :free models at arbitrary fallback price (#9054)
--- a/changelog.d/fixes/9102-fix.plan.md
+++ b/changelog.d/fixes/9102-fix.plan.md
@@ -1 +0,0 @@
- fix(providers): modal.com validation returns clear error when Base URL is missing, instead of leaking "Invalid outbound URL" (#9102)
--- a/changelog.d/fixes/9159-fix.plan.md
+++ b/changelog.d/fixes/9159-fix.plan.md
@@ -1 +0,0 @@
- fix(management): authorize mcp:connect-only keys on loopback/LAN when requireLogin is enabled (#9159)
--- a/changelog.d/fixes/9195-fix.plan.md
+++ b/changelog.d/fixes/9195-fix.plan.md
@@ -1,2 +0,0 @@
- fix(catalog): repair dead guard and synced-first ordering for custom model Vision capable override (#9195)
- fix(routing): consult customModels supportsVision flag in Combo vision filter (#9195)
--- a/changelog.d/fixes/9201-web-search-proxy-bind.plan.md
+++ b/changelog.d/fixes/9201-web-search-proxy-bind.plan.md
@@ -1 +0,0 @@
- fix(web-search): bind each search provider attempt to its connection proxy (#9201)
--- a/changelog.d/fixes/9204-fix.plan.md
+++ b/changelog.d/fixes/9204-fix.plan.md
@@ -1 +0,0 @@
- fix(auth): make antigravity and agy equivalent in credential selection (#9204)
--- a/changelog.d/fixes/9237-fix.plan.md
+++ b/changelog.d/fixes/9237-fix.plan.md
@@ -1 +0,0 @@
- fix(lmarena): emit Uint8Array SSE chunks instead of strings to satisfy shared pipeline contract (#9237)
--- a/changelog.d/fixes/9259-rolling-rpm-leases.md
+++ b/changelog.d/fixes/9259-rolling-rpm-leases.md
@@ -1 +0,0 @@
- **fix(resilience):** Enforce RPM limits with rolling leases and atomic global/provider/account admission ([#9259](https://github.com/diegosouzapw/OmniRoute/pull/9259)). The configured global RPM budget is shared across all enabled provider connections within one process; provider/account overrides add narrower scopes.
--- a/changelog.d/fixes/9277-fix.plan.md
+++ b/changelog.d/fixes/9277-fix.plan.md
@@ -1 +0,0 @@
- fix(qoder): include actionable CLI_QODER_BIN hint in connection test when qodercli is not found (#9277)
--- a/changelog.d/fixes/9279-fix.plan.md
+++ b/changelog.d/fixes/9279-fix.plan.md
@@ -1 +0,0 @@
- **fix(providers):** the web search fallback detector in `webSearchFallback.ts` used an exact `Set` (`web_search`, `web_search_preview`) that missed Anthropic's date-suffixed server-tool variant `web_search_20250305` (sent by Claude Code 2.1.220+). Changed to prefix regex `/^web_search/`, matching the two other detectors in the codebase, so the fallback intercepts versioned web search tools for OpenAI-compatible upstreams ([#9279](https://github.com/diegosouzapw/OmniRoute/pull/9279))
--- a/changelog.d/fixes/9289-fix.plan.md
+++ b/changelog.d/fixes/9289-fix.plan.md
@@ -1 +0,0 @@
- fix(credential-health): scheduler never retries failed connections due to static interval comparison (#9289)
--- a/changelog.d/fixes/9293-fix.plan.md
+++ b/changelog.d/fixes/9293-fix.plan.md
@@ -1 +0,0 @@
- fix(api): specialty model catalog ignores hidden OpenRouter model flags (#9293)
--- a/changelog.d/fixes/9300-fix.plan.md
+++ b/changelog.d/fixes/9300-fix.plan.md
@@ -1 +0,0 @@
- fix(catalog): cache getModelsDevPricing() to prevent OOM at startup (#9300)
--- a/changelog.d/fixes/9304-fix.plan.md
+++ b/changelog.d/fixes/9304-fix.plan.md
@@ -1 +0,0 @@
- fix(providers): bump qwen-web SPA version header from 0.2.66 to 0.2.81 (#9304)
--- a/changelog.d/fixes/9315-fix.plan.md
+++ b/changelog.d/fixes/9315-fix.plan.md
@@ -1 +0,0 @@
- fix(backend): use accumulated responseBody for provider payload in dashboard log viewer to avoid stale data from truncated SSE events (#9315)
--- a/changelog.d/fixes/9319-fix.plan.md
+++ b/changelog.d/fixes/9319-fix.plan.md
@@ -1 +0,0 @@
- fix(qoder): surface qodercli stderr in error message instead of generic 502 (#9319)
--- a/changelog.d/fixes/9431-codex-gpt56-context.md
+++ b/changelog.d/fixes/9431-codex-gpt56-context.md
@@ -1 +0,0 @@
- **fix(providers):** Codex GPT-5.6 model metadata reports the 1M context window and 922K input limit ([#9431](https://github.com/diegosouzapw/OmniRoute/issues/9431)).
--- a/changelog.d/fixes/9435-kiro-import-overwrite.md
+++ b/changelog.d/fixes/9435-kiro-import-overwrite.md
@@ -1 +0,0 @@
- fix(oauth): Kiro import token endpoint no longer overwrites existing connection when using shared cached OIDC clientId (#9435)
--- a/changelog.d/fixes/9491-port-3005-auth-redirect-login.md
+++ b/changelog.d/fixes/9491-port-3005-auth-redirect-login.md
@@ -1 +0,0 @@
- **fix(auth):** redirect active sessions from /login by checking the session cookie before showing the login form. (thanks @DaDecky)
--- a/changelog.d/fixes/9494-chat-history-cap-opt-in.md
+++ b/changelog.d/fixes/9494-chat-history-cap-opt-in.md
@@ -1 +0,0 @@
- fix(api): make the 800-message chat history cap opt-in so long conversations reach compression instead of a terminal 413 (#9494)
--- a/changelog.d/fixes/9531-ci-combo-matrix.md
+++ b/changelog.d/fixes/9531-ci-combo-matrix.md
@@ -1 +0,0 @@
- fix(ci): include combo-matrix tests in test-integration job (#9531)
--- a/changelog.d/fixes/9534-modelsdevsync-timers.md
+++ b/changelog.d/fixes/9534-modelsdevsync-timers.md
@@ -1 +0,0 @@
- fix(test): prevent flaky modelsDevSync timer assertions by serializing test execution within the file (#9534)
--- a/changelog.d/fixes/9536-usage-misreporting.md
+++ b/changelog.d/fixes/9536-usage-misreporting.md
@@ -1 +0,0 @@
- fix(backend): map cache tokens in OpenAI-to-Claude non-streaming usage translation (#9536)
--- a/changelog.d/fixes/9541-fastpath-db-corruption.md
+++ b/changelog.d/fixes/9541-fastpath-db-corruption.md
@@ -1 +0,0 @@
- fix(db): add transient-error retry to corruption probe to prevent data loss under concurrent load (#9541)
--- a/changelog.d/fixes/9543-searxng-auto-select.md
+++ b/changelog.d/fixes/9543-searxng-auto-select.md
@@ -1 +0,0 @@
- fix(search): mark searxng-search as fallbackOnly to prevent auto-select without instance (#9543)
--- a/changelog.d/fixes/9545-gpt56-effort-tools.md
+++ b/changelog.d/fixes/9545-gpt56-effort-tools.md
@@ -1 +0,0 @@
- fix(providers): strip provider prefix in getModelTargetFormat to route GPT-5.6 models to /v1/responses (#9545)
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
diegosouzapw	657d7a30c7	Merge remote-tracking branch 'origin/release/v3.8.50' into green/8728	2026-08-06 07:50:15 -03:00
diegosouzapw	3dd8f52c00	Merge branch 'origin/release/v3.8.50' into green/8728 Conflicts resolved: catalogCache.ts (PR rewrite takes precedence), models.ts (PR version)	2026-08-06 06:51:48 -03:00
Erick Kinnee	69d6e59ef9	fix(api): invalidate model catalog mutation paths	2026-07-31 10:28:45 -05:00
Erick Kinnee	aca6e6adf7	fix(api): make model catalog refresh response-safe	2026-07-31 09:50:25 -05:00
				`@@ -1 +0,0 @@`
				`- docs: add management authentication terminology guide ([#7786](https://github.com/diegosouzapw/OmniRoute/issues/7786))`
				`@@ -1 +0,0 @@`
				`- feat(infra): add systemd autostart unit for Linux ([#8635](https://github.com/diegosouzapw/OmniRoute/issues/8635))`
				`@@ -1 +0,0 @@`
				`- feat(api): add response content encoding verification — confirms Next.js compress:true and documents stripStaleForwardingHeaders behavior ([#6736](https://github.com/diegosouzapw/OmniRoute/issues/6736))`
				`@@ -1 +0,0 @@`
				`- feat(api): add plugins marketplace install endpoint with checksum verification ([#6752](https://github.com/diegosouzapw/OmniRoute/issues/6752))`
				`@@ -1 +0,0 @@`
				`- feat(chatgpt-web): harden prompt-emulated tool contract for thinking models (#7679 — thanks @horacecar)`
				`@@ -1 +0,0 @@`
				`- docs: add low-memory/small VPS optimization guide ([#8237](https://github.com/diegosouzapw/OmniRoute/issues/8237))`
				`@@ -1 +0,0 @@`
				- feat(providers): add connection-level custom upstream headers via `provider_specific_data.customHeaders` — applied to every request through that connection, with model-level headers overriding on the same case-insensitive name. (thanks @Benson-mk)
				`@@ -1 +0,0 @@`
				`- feat(copilot): add approval gate for runOmniRouteCli commands (#8461)`
				`@@ -1 +0,0 @@`
				`- feat(providers): add Regolo AI OpenAI-compatible provider ([#9031](https://github.com/diegosouzapw/OmniRoute/issues/9031))`