docs(readme): use local SVG flags + convert doc-link tables to lists (#8317)

Flag emoji (regional-indicator) do not render on Windows and several
Safari/WebKit configs, breaking the 'In 42+ languages' table there.
Replace each emoji with a local SVG <img> from flag-icons (MIT), served
from docs/assets/flags/ so the language selector renders everywhere.

Also convert the 5 'Document | Description' reference tables to definition
lists — full-width and scroll-free on GitHub (tables are capped at
width:max-content and scroll horizontally on narrow viewports).

.env.example

@@ -40,11 +40,6 @@ INITIAL_PASSWORD=CHANGEME
 #       also if you want to share the same database as "npm run dev" use "./data"
 # DATA_DIR=/var/lib/omniroute
 
-# Fallback alias for DATA_DIR, checked only when DATA_DIR is unset.
-# Used by: open-sse/executors/promptql/threadSticky.ts — locates the PromptQL
-# executor's on-disk thread-sticky session cache. Leave unset to rely on DATA_DIR.
-# OMNIROUTE_DATA_DIR=/var/lib/omniroute
-
 # Encryption key for SQLite database encryption at rest.
 # Used by: src/lib/db/encryption.ts — encrypts the entire SQLite database.
 # Generate: openssl rand -hex 32  |  Leave empty to disable DB encryption.
@@ -93,14 +88,6 @@ PORT=20128
 # Used by: src/sse/utils/backpressure.ts — disabled when unset/0.
 # OMNI_MAX_CONCURRENT_CONNECTIONS=0
 
-# Optional OmniRoute-to-OmniRoute peer chaining guard. Give every instance a
-# unique ID and allowlist only the other OmniRoute base URLs it may call.
-# Requests to allowlisted peers carry X-OmniRoute-Peer-Trace; repeated instances
-# and exhausted hop budgets are rejected with HTTP 508 before provider routing.
-# OMNIROUTE_INSTANCE_ID=gateway-a
-# OMNIROUTE_PEER_URLS=http://gateway-b:20128/v1
-# OMNIROUTE_PEER_MAX_HOPS=4
-
 # Port for the real-time WebSocket live monitoring server.
 # Used by: src/server/ws/liveServer.ts, src/app/api/v1/ws/route.ts
 # Default: 20132
@@ -235,7 +222,7 @@ CONTAINER_HOST=docker
 # - orbstack: OrbStack (high-perf Linux VM + docker shim on macOS)
 # - podman:  Podman (rootless, daemonless)
 # - docker:  Docker (default fallback)
-# (defined under SKILLS & SANDBOXING section below)
+SKILLS_SANDBOX_RUNTIME=auto
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # 4. SECURITY & AUTHENTICATION
@@ -301,25 +288,18 @@ ALLOW_API_KEY_REVEAL=false
 # Default: 10485760 (10 MB)
 # MAX_BODY_SIZE_BYTES=10485760
 
-# Atomic admission for POST /v1/chat/completions (#7846). Large request bodies
-# amplify into multiple transient representations during parsing, compression, and
-# provider dispatch. Heavyweight capacity is reserved before parsing; excess work
-# receives 503 + Retry-After instead of overlapping until the process OOMs.
+# Heap-pressure-aware admission for POST /v1/chat/completions (#5152). A large
+# coding-agent "compact" body amplifies into hundreds of MB of transient JS objects
+# on the combo path; concurrent compacts can stack past the V8 heap ceiling and OOM
+# the process. These shed a LARGE body with 503 (Retry-After) only while the heap is
+# already under pressure — healthy heap admits every body untouched.
 # Used by: src/shared/middleware/chatBodyAdmission.ts
-# Actual bodies at or above this size require a heavyweight lease. Default 262144 (256 KB).
+# Bodies below this size skip the guard entirely (heap not even sampled). Default 262144 (256 KB).
 # OMNIROUTE_CHAT_LARGE_BODY_BYTES=262144
-# Actual-byte hard cap enforced during bounded ingestion. Default 52428800 (50 MB).
+# Hard cap — bodies above this are rejected with 413 before any clone/parse. Default 52428800 (50 MB).
 # OMNIROUTE_CHAT_HARD_MAX_BODY_BYTES=52428800
-# Maximum heavyweight requests simultaneously admitted in one process. Default 1.
-# OMNIROUTE_CHAT_MAX_HEAVY_IN_FLIGHT=1
-# Message count that classifies an otherwise small body as heavyweight. Default 200.
-# OMNIROUTE_CHAT_HEAVY_MESSAGE_COUNT=200
-# Tool count that classifies an otherwise small body as heavyweight. Default 64.
-# OMNIROUTE_CHAT_HEAVY_TOOL_COUNT=64
-# Conservative string-size token estimate that classifies a request as heavyweight. Default 32000.
-# OMNIROUTE_CHAT_HEAVY_ESTIMATED_TOKENS=32000
-# Hard message-count cap; excess receives compact-required 413. Default 800.
-# OMNIROUTE_CHAT_HARD_MAX_MESSAGES=800
+# Shed large bodies once heapUsed/heap_size_limit reaches this ratio (0<r<1). Default 0.75.
+# OMNIROUTE_CHAT_HEAP_SHED_RATIO=0.75
 
 # Hard cap (bytes) for a non-streaming upstream response buffered fully into memory
 # (#5152). Past this the upstream reader is cancelled and the request fails fast
@@ -360,24 +340,16 @@ ALLOW_API_KEY_REVEAL=false
 # ── Request-Side: Prompt Injection Guard ──
 # Scans incoming messages for prompt injection patterns before routing.
 # Used by: src/middleware/promptInjectionGuard.ts
-# Default ON when unset. Set to false/0/no/off to disable. Truthy: true/1/yes/on.
-# INPUT_SANITIZER_ENABLED=false
-# INPUT_SANITIZER_MODE=warn    # warn = log only | block = reject request | redact = legacy (does NOT strip injection; use PII_REDACTION_ENABLED for request PII)
-# INPUT_SANITIZER_BLOCK_THRESHOLD=high  # high (default) | medium | low — severities at/above this are blocked in block mode
+# INPUT_SANITIZER_ENABLED=true
+# INPUT_SANITIZER_MODE=warn    # warn = log only | block = reject request | redact = strip patterns
 
-# Legacy aliases for INPUT_SANITIZER_MODE / INPUT_SANITIZER_BLOCK_THRESHOLD (same effect).
+# Legacy alias for INPUT_SANITIZER_MODE (same effect).
 # INJECTION_GUARD_MODE=warn
-# INJECTION_GUARD_BLOCK_THRESHOLD=high
 
 # PII detection in incoming requests (emails, phone numbers, SSNs, etc.).
 # Used by: src/middleware/promptInjectionGuard.ts — extends injection guard.
 # PII_REDACTION_ENABLED=false
 
-# Redacts well-known API-key / secret-token patterns (OpenAI, Anthropic, GitHub,
-# Slack, etc.) from request/response payloads before they reach providers/clients.
-# Opt-in; mirrors PII_REDACTION_ENABLED. Used by: src/lib/guardrails/credentialMasker.ts.
-# CREDENTIAL_REDACTION_ENABLED=false
-
 # Minimum streaming window size for PII detection (bytes). Default: 200.
 # Used by: src/lib/streamingPiiTransform.ts.
 # PII_WINDOW_SIZE=200
@@ -677,15 +649,6 @@ NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
 # Legacy alias for OMNIROUTE_API_KEY.
 # ROUTER_API_KEY=
 
-# Enable the offline/local Issue Agent recorded-triage endpoint.
-# Used by: src/app/api/issue-agent/runs/route.ts. Default: disabled.
-# OMNIROUTE_ISSUE_AGENT_ENABLED=false
-
-# Timeout (ms) for a single Issue Agent recorded-triage run. Clamped to an internal
-# maximum; falls back to the built-in default when unset or invalid.
-# Used by: src/lib/issueAgent/execution.ts.
-# OMNIROUTE_ISSUE_AGENT_TIMEOUT_MS=
-
 # CLI remote-mode context/profile for `omniroute` commands (overrides the active
 # context in the local contexts store). Equivalent to the `--context <name>` flag.
 # Used by: bin/cli/program.mjs, bin/cli/api.mjs (remote mode).
@@ -854,11 +817,10 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # Used by: open-sse/executors/antigravity.ts — escape hatch for multi-project setups.
 # OMNIROUTE_ALLOW_BODY_PROJECT_OVERRIDE=0
 
-# Control Antigravity Google One AI credit usage. Used by:
-# open-sse/services/antigravityCredits.ts — accepts off, retry, or always.
-# off (default): never use credits; retry: use credits once after eligible quota 429;
-# always: use credits on the first request (higher account and spend risk).
-#ANTIGRAVITY_CREDITS=off
+# Adjust how Antigravity advertises remaining credits.  Used by:
+# open-sse/services/antigravityCredits.ts — accepts forced override strings.
+# Default: empty (use upstream-reported credits).
+#ANTIGRAVITY_CREDITS=
 
 # Override the path to the Antigravity CLI (agy) token file read by the
 # "auto-detect local login" import. Used by:
@@ -912,17 +874,15 @@ CODEX_OAUTH_CLIENT_ID=app_EMoamEEZ73f0CkXaXp7hrann
 # ANTIGRAVITY_OAUTH_CLIENT_SECRET=
 # WINDSURF_FIREBASE_API_KEY=
 
+# ── Qwen (Alibaba) ──
+QWEN_OAUTH_CLIENT_ID=f0304373b74a44d2b584a3fb70ca9e56
+
 # ── Kimi Coding (Moonshot) ──
 KIMI_CODING_OAUTH_CLIENT_ID=17e5f671-d194-4dfb-9706-5516cb48c098
 
 # ── GitHub Copilot ──
 GITHUB_OAUTH_CLIENT_ID=Iv1.b507a08c87ecfe98
 
-# ── GitHub Enterprise (GHE) Copilot ──
-# Optional override for GHE Copilot's OAuth client id. Falls back to the public
-# GITHUB_OAUTH_CLIENT_ID default when unset. Used by: src/lib/oauth/constants/oauth.ts.
-# GHE_COPILOT_OAUTH_CLIENT_ID=
-
 # ── GitLab Duo ──
 # Register an OAuth app at: https://gitlab.com/-/profile/applications
 # Set redirect URI to: http://localhost:20128/callback (or your NEXT_PUBLIC_BASE_URL + /callback)
@@ -1052,6 +1012,7 @@ KIRO_USER_AGENT="AWS-SDK-JS/3.0.0 kiro-ide/1.0.0"
 # Used by: open-sse/executors/kiro.ts
 # KIRO_VERIFY_FULL_CRC=false
 QODER_USER_AGENT="Qoder-Cli"
+QWEN_USER_AGENT="QwenCode/0.19.3 (linux; x64)"
 CURSOR_USER_AGENT="Cursor/3.4"
 
 # Override Codex client version sent in headers independently of the
@@ -1081,6 +1042,8 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # CLI_COMPAT_KIMI_CODING=1
 # CLI_COMPAT_KILOCODE=1
 # CLI_COMPAT_CLINE=1
+# CLI_COMPAT_QWEN=1
+
 # Or enable for all providers at once:
 # CLI_COMPAT_ALL=1
 
@@ -1206,13 +1169,6 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # PIN_DROP_BACKOFF_LEVEL=2
 # PIN_DROP_GRACE_MS=20000
 
-# Whether OmniRoute may emit SSE `:` comment lines (e.g. the `: keepalive` heartbeat).
-# Some strict OpenAI-compatible clients parse every SSE line as JSON and crash on `:`
-# comments. Set to `off` to suppress comment-shaped heartbeats (they become a no-op);
-# `data:` heartbeats are unaffected. Default: enabled.
-# Used by: open-sse/utils/sseHeartbeat.ts.
-# OMNIROUTE_SSE_COMMENTS=off
-
 # ── Stream idle detection ──
 # STREAM_IDLE_TIMEOUT_MS=600000      # Max silence between SSE chunks (default: 600000)
 #                                     # Extended-thinking models rarely pause >90s.
@@ -1469,12 +1425,6 @@ APP_LOG_TO_FILE=true
 # NANOBANANA_POLL_TIMEOUT_MS=120000    # Max wait for job completion (default: 120s)
 # NANOBANANA_POLL_INTERVAL_MS=2500     # Poll frequency (default: 2.5s)
 
-# ── Microsoft Designer Web (Image Generation) ──
-# Polling config for the microsoft-designer-web submit-then-poll image job.
-# Used by: open-sse/handlers/imageGeneration/providers/designerWeb.ts
-# DESIGNER_WEB_POLL_TIMEOUT_MS=60000   # Max wait for job completion (default: 60s)
-# DESIGNER_WEB_POLL_INTERVAL_MS=2000   # Poll frequency (default: 2s)
-
 # ── AWS Bedrock (Kiro / Audio) ──
 # Region used to construct AWS Bedrock endpoints. Used by:
 # src/lib/providers/validation.ts and open-sse/handlers/audioSpeech.ts.
@@ -1620,13 +1570,9 @@ APP_LOG_TO_FILE=true
 # Also configurable from Dashboard > Settings > Feature Flags.
 # OMNIROUTE_CONTROL_PLANE_PROXY_DIRECT_FALLBACK=false
 
-# Rate limit maximum wait time before failing a request (ms).  Default: 15000 (15s)
+# Rate limit maximum wait time before failing a request (ms).  Default: 120000 (2 min)
 # Used by: open-sse/services/rateLimitManager.ts
-# RATE_LIMIT_MAX_WAIT_MS=15000
-
-# Rate limit queue admission cap: reject with 429 queue_full once this many requests
-# are already queued (0 = disabled/unbounded, the default). Used by: open-sse/services/rateLimitManager.ts
-# RATE_LIMIT_MAX_QUEUE_DEPTH=0
+# RATE_LIMIT_MAX_WAIT_MS=120000
 
 # Force the auto-enable rate limit safety net on/off regardless of the persisted
 # Dashboard setting. Used by: open-sse/services/rateLimitManager.ts.
@@ -1675,17 +1621,6 @@ APP_LOG_TO_FILE=true
 # Used by: src/lib/tokenHealthCheck.ts.  Default: 3000.
 # HEALTHCHECK_STAGGER_MS=3000
 
-# Randomized jitter range (ms) added on top of HEALTHCHECK_STAGGER_MS between
-# provider token healthchecks, to prevent bursting (Issue #1220).
-# Used by: src/lib/tokenHealthCheck.ts.  Defaults: min=500, max=5000.
-# HEALTHCHECK_JITTER_MIN_MS=500
-# HEALTHCHECK_JITTER_MAX_MS=5000
-
-# Concurrent-check batch size for the startup token-healthcheck sweep. Larger
-# values check more connections in parallel; smaller values reduce burst load.
-# Used by: src/lib/tokenHealthCheck.ts.  Default: 20 (Issue #7875, regression of #7719).
-# HEALTHCHECK_BATCH_SIZE=20
-
 # ═══════════════════════════════════════════════════════════════════════════════
 # 22. DEBUGGING
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -1824,22 +1759,6 @@ APP_LOG_TO_FILE=true
 # for root-less / user-namespaced deployments (e.g. rootless Docker/Podman)
 # where the operator trusts the CA manually (e.g. via Node's extra-CA-certs mechanism).
 # OMNIROUTE_NO_SUDO=0
-# Explicit opt-out: skip provisioning /etc/hosts DNS entries for the Antigravity
-# proxy hostnames entirely (containers with no sudo/root available).
-# Used by: src/mitm/dns/provision.ts.
-# SKIP_ANTIGRAVITY_DNS=true
-# Skip writing to the hosts file when adding/removing DNS entries (e.g. sandboxed
-# or read-only test environments). Used by: src/mitm/dns/dnsConfig.ts.
-# OMNIROUTE_SKIP_DNS_WRITE=1
-# Opt in to the root-CA + per-host-leaf cert model for the MITM proxy (#6684).
-# Fresh installs and installs with this set to "true" get a persisted root CA that
-# signs per-host leaves; installs with a pre-existing trusted legacy leaf keep the
-# legacy fixed-SAN cert unless opted in. Used by: src/mitm/manager.ts.
-# MITM_ROOT_CA_ENABLED=true
-# Set BY the MITM manager for the spawned proxy process ("root-ca" | "legacy") —
-# reflects the migration decision above; not meant to be set manually.
-# Read by: src/mitm/server.cjs.
-# MITM_CERT_MODE=legacy
 
 # ── Test/CI-only guards (never needed in production) ──
 # Set automatically by tests/_setup/isolateDataDir.ts and the CI workflows: the
@@ -1859,14 +1778,6 @@ APP_LOG_TO_FILE=true
 # ONEPROXY_MAX_PROXIES=500
 # ONEPROXY_MIN_QUALITY_THRESHOLD=50
 
-# ── Free Proxy Pool (auto-sync scheduler) ──
-# Background refresh of the free-proxy pool. Opt-in, OFF by default (parallels
-# Hard Rule #20's default-off posture for data-mutating background features).
-# Used by: src/lib/freeProxyProviders/scheduler.ts
-# FREE_PROXY_AUTO_SYNC_ENABLED=true
-# Sync interval in ms (default: 1800000 = 30 min).
-# FREE_PROXY_AUTO_SYNC_INTERVAL_MS=1800000
-
 # ── Free Proxy Pool (1proxy source) ──
 # Used by: src/lib/freeProxyProviders/oneproxy.ts
 # Set FREE_PROXY_1PROXY_ENABLED=false to disable this source.
@@ -2222,49 +2133,3 @@ QUOTA_STORE_DRIVER=sqlite              # sqlite | redis
 # OMNIROUTE_ROTATE_ON_400=false
 # OMNIROUTE_ROTATE_400_THRESHOLD=1
 # OMNIROUTE_ROTATE_400_WINDOW_SECONDS=120
-
-# ─────────────────────────────────────────────────────────────────────────────
-# PromptQL playground provider (Unofficial/Experimental — src/shared/constants/providers/web-cookie.ts)
-# Reverse-engineered GraphQL session bridge for prompt.ql.app. All optional —
-# defaults point at the public playground endpoints; override only for a
-# self-hosted/alternate PromptQL deployment.
-# Used by: open-sse/executors/promptql.ts, open-sse/services/usage/promptql.ts
-# ─────────────────────────────────────────────────────────────────────────────
-# PROMPTQL_GRAPHQL_ENDPOINT=https://data.prompt.ql.app/promptql/playground-v2-hge/v1/graphql
-# PROMPTQL_CREDITS_ENDPOINT=https://data.pro.ql.app/v1/graphql
-# PROMPTQL_TOKEN_REFRESH_URL=https://auth.pro.ql.app/ddn/project/token
-# PROMPTQL_POLL_TIMEOUT_MS=180000
-
-# ─────────────────────────────────────────────────────────────────────────────
-# HyperAgent web provider (Unofficial/Experimental — src/shared/constants/providers/web-cookie.ts)
-# Reverse-engineered session bridge for hyperagent.com. Optional — defaults
-# point at the public billing/usage endpoint; override only for a
-# self-hosted/alternate HyperAgent deployment.
-# Used by: open-sse/services/usage/hyperagent.ts
-# ─────────────────────────────────────────────────────────────────────────────
-# HYPERAGENT_USAGE_URL=https://hyperagent.com/api/settings/billing/usage
-
-# ─────────────────────────────────────────────────────────────────────────────
-# Browser-login VNC sessions (optional — src/lib/vncSession/manifest.ts)
-# Containerized Chromium+VNC used for interactive browser-login credential
-# capture via /api/vnc-session. All optional — defaults target the bundled
-# `omniroute-vnc-chromium:local` image; override only for a custom image, ports,
-# or lifecycle tuning.
-# ─────────────────────────────────────────────────────────────────────────────
-# OMNIROUTE_VNC_IMAGE=omniroute-vnc-chromium:local
-# OMNIROUTE_DOCKER_BIN=docker# OMNIROUTE_VNC_CONTAINER_VNC_PORT=3000
-# OMNIROUTE_VNC_CONTAINER_CDP_PORT=9223
-# OMNIROUTE_VNC_CONTAINER_PROFILE_DIR=/config
-# OMNIROUTE_VNC_PROFILE_DIR=
-# OMNIROUTE_VNC_IDLE_MS=600000
-# OMNIROUTE_VNC_MAX_MS=1800000
-# OMNIROUTE_VNC_MAX_SESSIONS=4
-# OMNIROUTE_VNC_READY_MS=45000
-# OMNIROUTE_VNC_HARVEST_MS=20000
-# OMNIROUTE_VNC_CHROMIUM_ARGS=--remote-debugging-port=9222 --no-first-run --no-default-browser-check
-
-# ─────────────────────────────────────────────────────────────────────────────
-# Data-dir alias (optional — open-sse/services/notionThreadSessions.ts)
-# Legacy fallback for DATA_DIR, checked only after DATA_DIR and
-# OMNIROUTE_DATA_DIR are both unset. Locates the Notion web-thread session cache.# ─────────────────────────────────────────────────────────────────────────────
-# VIBEPROXY_DATA_DIR=

.github/workflows/ci.yml

@@ -39,7 +39,7 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
       - id: classify
@@ -82,7 +82,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -171,7 +171,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -280,7 +280,7 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -388,7 +388,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -424,7 +424,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -452,32 +452,13 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
       - uses: ./.github/actions/npm-ci-retry
       - run: node scripts/i18n/check-ui-keys-coverage.mjs --threshold=65
 
-  # #8038: cheap single-locale glossary/protected-terms consistency gate —
-  # complements i18n-ui-coverage (key parity) and the ICU `i18n` job below
-  # without needing app-boot/Playwright infra. Same gating as i18n-ui-coverage.
-  i18n-glossary-zhcn:
-    name: i18n Glossary (zh-CN)
-    runs-on: ubuntu-latest
-    needs: changes
-    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && (needs.changes.outputs.i18n == 'true' || needs.changes.outputs.code == 'true')) }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.CI_NODE_VERSION }}
-          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
-      - run: node scripts/i18n/check-glossary-consistency.mjs --locale=zh-CN
-
   # D4 (plano mestre testes+CI): a matrix de ~40 jobs de <1min por idioma saturava sozinha
   # a concorrência de jobs da conta (Free = 20 slots, compartilhados entre TODOS os repos)
   # e pagava spin-up + arredondamento de billing por idioma. Um único job itera os idiomas
@@ -534,7 +515,7 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
       - name: Fetch base branch
@@ -573,7 +554,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -621,7 +602,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -668,7 +649,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -729,7 +710,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -760,23 +741,6 @@ jobs:
           path: coverage-shard/*.json
           if-no-files-found: error
 
-  test-bun-sqlite:
-    name: Bun SQLite Compatibility
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    needs: changes
-    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.CI_NODE_VERSION }}
-          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
-      - run: npm run test:bun:db
-
   test-vitest:
     name: Vitest (MCP / autoCombo / UI components)
     # Same dynamic-runner rule as Build (own-origin only; fallback ubuntu-latest).
@@ -793,7 +757,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -838,7 +802,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -907,7 +871,7 @@ jobs:
       # (if-no-files-found: warn) — Sonar consumes the same file.
       - name: Upload coverage to Codecov (informational)
         if: always()
-        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5
+        uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 # v5
         with:
           files: coverage/lcov.info
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -1081,7 +1045,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -1151,7 +1115,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -1174,7 +1138,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -1191,7 +1155,6 @@ jobs:
       - lint
       - docs-sync-strict
       - i18n-ui-coverage
-      - i18n-glossary-zhcn
       - i18n
       - pr-test-policy
       - build
@@ -1237,7 +1200,6 @@ jobs:
           echo "| Lint | $(status '${{ needs.lint.result }}') |" >> "$GITHUB_STEP_SUMMARY"
           echo "| Docs Sync (Strict) | $(status '${{ needs.docs-sync-strict.result }}') |" >> "$GITHUB_STEP_SUMMARY"
           echo "| i18n UI Coverage | $(status '${{ needs.i18n-ui-coverage.result }}') |" >> "$GITHUB_STEP_SUMMARY"
-          echo "| i18n Glossary (zh-CN) | $(status '${{ needs.i18n-glossary-zhcn.result }}') |" >> "$GITHUB_STEP_SUMMARY"
           echo "| PR Test Policy | $(status '${{ needs.pr-test-policy.result }}') |" >> "$GITHUB_STEP_SUMMARY"
           echo "| SonarQube | $(status '${{ needs.sonarqube.result }}') |" >> "$GITHUB_STEP_SUMMARY"
 

.github/workflows/codeql.yml

@@ -22,10 +22,10 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           languages: javascript-typescript
           queries: security-extended
-      - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           category: "/language:javascript-typescript"

.github/workflows/dast-smoke.yml

@@ -21,14 +21,12 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "24"
           cache: npm
       - run: npm ci
       - name: Build CLI bundle
-        env:
-          OMNIROUTE_BUILD_BACKEND_ONLY: "1"
         run: npm run build:cli
       - name: Start OmniRoute
         env:

.github/workflows/electron-release.yml

@@ -88,7 +88,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v6
         with:
           node-version: 24
           cache: npm

.github/workflows/mutation-redundancy.yml

@@ -44,7 +44,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm

.github/workflows/nightly-compat.yml

@@ -66,7 +66,7 @@ jobs:
         with:
           ref: ${{ needs.resolve-branch.outputs.target }}
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "26"
           cache: npm
@@ -93,7 +93,7 @@ jobs:
         with:
           ref: ${{ needs.resolve-branch.outputs.target }}
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
           cache: npm

.github/workflows/nightly-llm-security.yml

@@ -15,13 +15,11 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with: { node-version: "24", cache: npm }
       - run: npm ci
       - name: Build CLI bundle
-        env:
-          JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
-          OMNIROUTE_BUILD_BACKEND_ONLY: "1"
+        env: { JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation }
         run: npm run build:cli
       - name: Start OmniRoute (block mode)
         env:
@@ -67,16 +65,14 @@ jobs:
         with:
           persist-credentials: false
         if: steps.gate.outputs.run == 'true'
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         if: steps.gate.outputs.run == 'true'
         with: { node-version: "24", cache: npm }
       - run: npm ci
         if: steps.gate.outputs.run == 'true'
       - name: Build CLI bundle
         if: steps.gate.outputs.run == 'true'
-        env:
-          JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
-          OMNIROUTE_BUILD_BACKEND_ONLY: "1"
+        env: { JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation }
         run: npm run build:cli
       - name: Start OmniRoute
         if: steps.gate.outputs.run == 'true'

.github/workflows/nightly-mutation.yml

@@ -107,7 +107,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm
@@ -151,7 +151,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
       - name: Download all mutation reports

.github/workflows/nightly-property.yml

@@ -13,7 +13,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm

.github/workflows/nightly-release-green.yml

@@ -116,7 +116,7 @@ jobs:
           git checkout "$TARGET"
           git log -1 --oneline
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm
@@ -228,7 +228,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm

.github/workflows/nightly-resilience.yml

@@ -15,7 +15,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm
@@ -29,7 +29,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm
@@ -43,7 +43,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm
@@ -51,7 +51,6 @@ jobs:
       - name: Build CLI bundle
         env:
           JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
-          OMNIROUTE_BUILD_BACKEND_ONLY: "1"
         run: npm run build:cli
       - name: Start OmniRoute (background)
         env:
@@ -95,7 +94,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm

.github/workflows/nightly-schemathesis.yml

@@ -16,13 +16,11 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with: { node-version: "24", cache: npm }
       - run: npm ci
       - name: Build CLI bundle
-        env:
-          JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
-          OMNIROUTE_BUILD_BACKEND_ONLY: "1"
+        env: { JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation }
         run: npm run build:cli
       - name: Start OmniRoute (background)
         env:

.github/workflows/npm-publish.yml

@@ -71,7 +71,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ env.NPM_PUBLISH_NODE_VERSION }}
           registry-url: https://registry.npmjs.org
@@ -265,7 +265,7 @@ jobs:
           # Full history needed for auto-bump: git diff against previous release tag
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ env.NPM_PUBLISH_NODE_VERSION }}
           registry-url: https://registry.npmjs.org

.github/workflows/opencode-plugin-ci.yml

@@ -35,7 +35,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
           cache: npm
@@ -52,7 +52,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "22"
           cache: npm

.github/workflows/opencode-provider-ci.yml

@@ -35,7 +35,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
           cache: npm
@@ -51,7 +51,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "20"
           cache: npm

.github/workflows/quality.yml

@@ -36,7 +36,7 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
       - id: classify
@@ -68,7 +68,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -99,7 +99,7 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -225,7 +225,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -265,7 +265,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -299,7 +299,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
@@ -343,7 +343,7 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm

.github/workflows/wiki-sync.yml

@@ -40,7 +40,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v6
         with:
           node-version: "24"
 

.gitignore

@@ -233,7 +233,7 @@ omniroute.md
 
 # mise configuration
 mise.toml
-_artifacts/          # release-green artifacts
+_artifacts/
 .claude-flow/
 
 # ESLint file cache (npm run lint --cache / complexity ratchets)
@@ -241,7 +241,7 @@ _artifacts/          # release-green artifacts
 .eslintcache-complexity
 
 
-# CI/local quality artifacts (eslint-results.json, quality-ratchet.md, etc.)
+# CI/local quality artifacts (eslint-results.json, etc.)
 .artifacts/
 
 # Homologation E2E suite (npm run homolog) — real-environment credentials + report output
@@ -249,4 +249,3 @@ _artifacts/          # release-green artifacts
 tests/homolog/.auth/
 tests/homolog/ui/.auth/
 homolog-report/
-docker-compose.yml.bak

@omniroute/opencode-plugin/README.md

@@ -165,7 +165,7 @@ npm install --prefix ~/.config/opencode/plugins/omniroute-opencode-plugin-prepro
 | Dynamic `/v1/models`                        | Pulls live catalog (455+ entries on prod) on each refresh, TTL-cached                                                                                                                                                                                                                                                                                                                                       | `provider.models`            |
 | Variants pass-through                       | `-low`/`-medium`/`-high`/`-thinking` ship as first-class IDs from OmniRoute (no client synthesis)                                                                                                                                                                                                                                                                                                           | `provider.models`            |
 | Combo LCD aggregation                       | Combos appear with intersected capabilities + min context/output across members                                                                                                                                                                                                                                                                                                                             | `provider.models` + `config` |
-| `combo/<slug>` namespace + `Combo:` prefix | Combos surface under `combo/claude-primary` (not the upstream UUID) and the picker shows `Combo: claude-primary` so they stand apart from raw provider/model pairs                                                                                                                                                                                                                                          | both hooks                   |
+| `combo/<slug>` namespace + `Combo: ` prefix | Combos surface under `combo/claude-primary` (not the upstream UUID) and the picker shows `Combo: claude-primary` so they stand apart from raw provider/model pairs                                                                                                                                                                                                                                          | both hooks                   |
 | Nice names + cost                           | `/api/pricing/models` display names AND `/api/pricing` per-million-token cost overlaid onto the live catalog                                                                                                                                                                                                                                                                                                | both hooks                   |
 | Canonical-twin dedup + alias-fallback       | `/v1/models` exposes the same upstream model under both short alias (`cc/claude-opus-4-7`) and canonical name (`claude/claude-opus-4-7`); the plugin drops the canonical twin when an alias twin exists (no duplicate rows in the picker) and reverse-maps canonical → alias to pick up enrichment for short aliases (`dg/nova-3 → Deepgram - Nova 3`) that `/api/pricing/models` only indexes by canonical | both hooks                   |
 | Compression pipeline tags                   | Combo names get tagged with their compression pipeline (e.g. `Combo: claude-primary [rtk🟡 → caveman🟠]`) when `features.compressionMetadata: true`. Intensity tokens render as a traffic-light emoji: 🟢 lite/minimal · 🟡 standard · 🟠 aggressive/full · 🔴 ultra                                                                                                                                        | both hooks                   |
@@ -179,33 +179,30 @@ npm install --prefix ~/.config/opencode/plugins/omniroute-opencode-plugin-prepro
 
 ## Plugin options
 
-| Option                | Type     | Default                                    | Description                                                                                           |
-| --------------------- | -------- | ------------------------------------------ | ----------------------------------------------------------------------------------------------------- |
-| `providerId`          | `string` | `"omniroute"`                              | OpenCode provider id; must be unique across plugin entries                                            |
-| `displayName`         | `string` | `"OmniRoute"` or `OmniRoute (<id>)`        | Label in the OC UI                                                                                    |
-| `modelCacheTtl`       | `number` | `300000` (5 min)                           | `/v1/models` TTL in ms                                                                                |
-| `baseURL`             | `string` | resolved from `auth.json` after `/connect` | Override OmniRoute base URL                                                                           |
-| `managementReadToken` | `string` | falls back to `apiKey`                     | Optional read-only token for management catalog GETs; `/v1` inference stays on the connected `apiKey` |
-| `features`            | `object` | see below                                  | Feature toggles (all opt-in/out, defaults preserve v0.1.0)                                            |
-
-For least-privilege deployments, set top-level `managementReadToken` to a read-only management token. It is sent only to catalog reads (`/api/combos`, `/api/combos/auto`, `/api/pricing/models`, `/api/pricing`, `/api/context/combos`, and `/api/providers`). Inference requests under `/v1`, including chat, continue to use the `apiKey` stored by OpenCode. `features.mcpToken` remains independent. If `managementReadToken` is omitted, catalog reads retain the previous `apiKey` behavior.
+| Option          | Type     | Default                                    | Description                                                |
+| --------------- | -------- | ------------------------------------------ | ---------------------------------------------------------- |
+| `providerId`    | `string` | `"omniroute"`                              | OpenCode provider id; must be unique across plugin entries |
+| `displayName`   | `string` | `"OmniRoute"` or `OmniRoute (<id>)`        | Label in the OC UI                                         |
+| `modelCacheTtl` | `number` | `300000` (5 min)                           | `/v1/models` TTL in ms                                     |
+| `baseURL`       | `string` | resolved from `auth.json` after `/connect` | Override OmniRoute base URL                                |
+| `features`      | `object` | see below                                  | Feature toggles (all opt-in/out, defaults preserve v0.1.0) |
 
 ### `features` block
 
 Every field is optional. Defaults mirror v0.1.0 behaviour so existing `opencode.json` files do not need to change.
 
-| Feature               | Type      | Default | What it does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| --------------------- | --------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `combos`              | `boolean` | `true`  | Discover `/api/combos` and surface them as pseudo-models with LCD capabilities. Combos are keyed under the `combo/<slug>` namespace and labelled `Combo: <name>` in the model picker so they're distinguishable from raw provider/model pairs.                                                                                                                                                                                                                                                                                                                       |
-| `enrichment`          | `boolean` | `true`  | Pull display names from `/api/pricing/models` AND per-million-token pricing (`input`, `output`, `cached` → `cacheRead`, `cache_creation` → `cacheWrite`) from `/api/pricing`, then overlay both onto the live catalog (so the UI shows `Claude 4.7 Opus` with `cost.input: 5`, `cost.output: 25` instead of raw IDs and zeroed cost).                                                                                                                                                                                                                                |
-| `compressionMetadata` | `boolean` | `false` | Pull `/api/context/combos` so combo names get tagged with their compression pipeline, e.g. `Combo: claude-primary [rtk🟡 → caveman🟠]`. Intensity tokens render as traffic-light emoji (🟢 lite/minimal · 🟡 standard · 🟠 aggressive/full · 🔴 ultra) so the picker advertises "how compressed" each combo is at a glance.                                                                                                                                                                                                                                          |
-| `providerTag`         | `boolean` | `true`  | Prepend a short upstream-provider label to the enriched display name with `" - "` separator, so `cc/claude-opus-4-7 → Claude - Claude Opus 4.7` differs visibly from `kr/claude-opus-4-7 → Kiro - Claude Opus 4.7` in the OC TUI model picker. Label resolution: use `/api/pricing/models[<alias>].name` verbatim when ≤8 chars (e.g. `Claude`, `Kiro`, `Codex`, `Qwen`), otherwise fall back to `UPPER(alias)` (e.g. `GitHub Models` → `GHM`, `Gemini` → `GEMINI`). Idempotent. Combos intentionally skipped (the `Combo:` prefix already conveys multi-upstream). |
-| `usableOnly`          | `boolean` | `false` | Read `/api/providers` and filter the catalog to providers that have at least one connection with `isActive: true` AND `testStatus: 'active'`. Subtract-filter semantics: providers unknown to BOTH the pricing-models catalog AND the connection table pass through (so synthetic prefixes like `agentrouter/*` survive). On fetch failure the filter is disabled for the refresh — never hides the whole catalog.                                                                                                                                                   |
-| `diskCache`           | `boolean` | `true`  | Persist the last successful `/v1/models` + `/api/combos` + enrichment + connections + compression snapshot to `${OPENCODE_DATA_DIR ?? ~/.local/share/opencode}/plugins/omniroute-<providerId>.json`. On a subsequent cold start where `/v1/models` throws (network down / IP whitelist drop / 5xx) the static block hydrates from the snapshot so OC's model picker survives offline. Soft-fail on read/write — never blocks publishing.                                                                                                                             |
-| `geminiSanitization`  | `boolean` | `true`  | Strip `$schema`/`$ref`/`additionalProperties` from tool params when the model id matches `gemini`                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| `mcpAutoEmit`         | `boolean` | `false` | Auto-write an `mcp.<providerId>` remote entry into the OC config pointing at `<baseURL>/api/mcp/stream` with the resolved Bearer token                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| `mcpToken`            | `string`  | _unset_ | Optional separate Bearer for the auto-emitted MCP entry. Falls back to the provider's `apiKey` (from `auth.json`) when unset                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `fetchInterceptor`    | `boolean` | `true`  | Inject `Authorization: Bearer` + default `Content-Type` on every outbound request targeting `baseURL` (suffix-spoof guarded)                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| Feature               | Type      | Default | What it does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| --------------------- | --------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `combos`              | `boolean` | `true`  | Discover `/api/combos` and surface them as pseudo-models with LCD capabilities. Combos are keyed under the `combo/<slug>` namespace and labelled `Combo: <name>` in the model picker so they're distinguishable from raw provider/model pairs.                                                                                                                                                                                                                                                                                                                               |
+| `enrichment`          | `boolean` | `true`  | Pull display names from `/api/pricing/models` AND per-million-token pricing (`input`, `output`, `cached` → `cacheRead`, `cache_creation` → `cacheWrite`) from `/api/pricing`, then overlay both onto the live catalog (so the UI shows `Claude 4.7 Opus` with `cost.input: 5`, `cost.output: 25` instead of raw IDs and zeroed cost).                                                                                                                                                                                                                                        |
+| `compressionMetadata` | `boolean` | `false` | Pull `/api/context/combos` so combo names get tagged with their compression pipeline, e.g. `Combo: claude-primary [rtk🟡 → caveman🟠]`. Intensity tokens render as traffic-light emoji (🟢 lite/minimal · 🟡 standard · 🟠 aggressive/full · 🔴 ultra) so the picker advertises "how compressed" each combo is at a glance.                                                                                                                                                                                                                                                  |
+| `providerTag`         | `boolean` | `true`  | Prepend a short upstream-provider label to the enriched display name with `" - "` separator, so `cc/claude-opus-4-7 → Claude - Claude Opus 4.7` differs visibly from `kr/claude-opus-4-7 → Kiro - Claude Opus 4.7` in the OC TUI model picker. Label resolution: use `/api/pricing/models[<alias>].name` verbatim when ≤8 chars (e.g. `Claude`, `Kiro`, `Codex`, `Qwen`), otherwise fall back to `UPPER(alias)` (e.g. `GitHub Models` → `GHM`, `Gemini` → `GEMINI`). Idempotent. Combos intentionally skipped (the `Combo: ` prefix already conveys multi-upstream). |
+| `usableOnly`          | `boolean` | `false` | Read `/api/providers` and filter the catalog to providers that have at least one connection with `isActive: true` AND `testStatus: 'active'`. Subtract-filter semantics: providers unknown to BOTH the pricing-models catalog AND the connection table pass through (so synthetic prefixes like `agentrouter/*` survive). On fetch failure the filter is disabled for the refresh — never hides the whole catalog.                                                                                                                                                           |
+| `diskCache`           | `boolean` | `true`  | Persist the last successful `/v1/models` + `/api/combos` + enrichment + connections + compression snapshot to `${OPENCODE_DATA_DIR ?? ~/.local/share/opencode}/plugins/omniroute-<providerId>.json`. On a subsequent cold start where `/v1/models` throws (network down / IP whitelist drop / 5xx) the static block hydrates from the snapshot so OC's model picker survives offline. Soft-fail on read/write — never blocks publishing.                                                                                                                                     |
+| `geminiSanitization`  | `boolean` | `true`  | Strip `$schema`/`$ref`/`additionalProperties` from tool params when the model id matches `gemini`                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `mcpAutoEmit`         | `boolean` | `false` | Auto-write an `mcp.<providerId>` remote entry into the OC config pointing at `<baseURL>/api/mcp/stream` with the resolved Bearer token                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `mcpToken`            | `string`  | _unset_ | Optional separate Bearer for the auto-emitted MCP entry. Falls back to the provider's `apiKey` (from `auth.json`) when unset                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| `fetchInterceptor`    | `boolean` | `true`  | Inject `Authorization: Bearer` + default `Content-Type` on every outbound request targeting `baseURL` (suffix-spoof guarded)                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 
 #### Example — enrichment + compression tags + MCP auto-emit
 
@@ -217,7 +214,6 @@ Every field is optional. Defaults mirror v0.1.0 behaviour so existing `opencode.
       {
         "providerId": "omniroute",
         "baseURL": "https://or.example.com",
-        "managementReadToken": "<read-only-management-token>",
         "features": {
           "combos": true,
           "enrichment": true,

@omniroute/opencode-plugin/package.json

@@ -23,7 +23,7 @@
   "scripts": {
     "build": "tsup",
     "clean": "rm -rf dist",
-    "test": "node --import tsx/esm --test tests/scaffold.test.ts tests/auth.test.ts tests/options-schema.test.ts tests/multi-instance.test.ts tests/fetch-interceptor.test.ts tests/provider.test.ts tests/gemini-sanitize.test.ts tests/combos.test.ts tests/config-shim.test.ts tests/features.test.ts tests/usable-combo.test.ts tests/disk-snapshot-perms.test.ts tests/fork-features.test.ts tests/auto-combo-context.test.ts tests/provider-id-routing.test.ts tests/management-read-token.test.ts",
+    "test": "node --import tsx/esm --test tests/scaffold.test.ts tests/auth.test.ts tests/options-schema.test.ts tests/multi-instance.test.ts tests/fetch-interceptor.test.ts tests/provider.test.ts tests/gemini-sanitize.test.ts tests/combos.test.ts tests/config-shim.test.ts tests/features.test.ts tests/usable-combo.test.ts tests/disk-snapshot-perms.test.ts tests/fork-features.test.ts tests/auto-combo-context.test.ts tests/provider-id-routing.test.ts",
     "prepublishOnly": "npm run clean && npm run build && npm test"
   },
   "keywords": [

@omniroute/opencode-plugin/src/index.ts

@@ -91,10 +91,6 @@ import {
  *  - `baseURL`        Override base URL for this OmniRoute instance. When
  *                     absent, the loader falls back to a credential-attached
  *                     baseURL set by `/connect`.
- *  - `managementReadToken` Optional read-only management-plane bearer token.
- *                     Used only for catalog GETs under `/api/*`; `/v1/*`
- *                     inference continues to use the connected `apiKey`.
- *                     Falls back to `apiKey` when unset.
  */
 /**
  * Optional feature toggles. Every field is opt-in/out per call; defaults
@@ -126,9 +122,8 @@ import {
  *                           provider's API key (from auth.json) when unset.
  *                           Useful when a narrower-scoped MCP-only key is
  *                           preferred over the chat/inference key.
- *  - `fetchInterceptor`     Inject Authorization: Bearer + Content-Type only
- *                           on same-origin `/v1/chat/completions` and
- *                           `/v1/models` requests. Default true.
+ *  - `fetchInterceptor`     Inject Authorization: Bearer + Content-Type on
+ *                           every outbound request to baseURL. Default true.
  *  - `debugLog`             Capture every outbound request + response to a
  *                           JSONL file at
  *                           `~/.local/share/opencode/plugins/omniroute-debug-{providerId}.jsonl`.
@@ -191,7 +186,6 @@ const optionsSchema = z
     displayName: z.string().min(1).optional(),
     modelCacheTtl: z.number().positive().optional(),
     baseURL: z.string().url().optional(),
-    managementReadToken: z.string().min(1).optional(),
     features: featuresSchema.optional(),
   })
   .strict();
@@ -242,7 +236,9 @@ function trimLeadingDashes(value: string): string {
  * applying defaults. Centralises the providerId fallback so every hook
  * sees a consistent identifier.
  */
-export function resolveOmniRoutePluginOptions(opts?: OmniRoutePluginOptions): Required<
+export function resolveOmniRoutePluginOptions(
+  opts?: OmniRoutePluginOptions
+): Required<
   Pick<OmniRoutePluginOptions, "providerId" | "displayName" | "modelCacheTtl">
 > & {
   /**
@@ -259,7 +255,7 @@ export function resolveOmniRoutePluginOptions(opts?: OmniRoutePluginOptions): Re
    * lookup fails with "No credentials for opencode-<x>".
    */
   omnirouteProviderId: string;
-} & Pick<OmniRoutePluginOptions, "baseURL" | "managementReadToken" | "features"> {
+} & Pick<OmniRoutePluginOptions, "baseURL" | "features"> {
   const rawProviderId = opts?.providerId ?? OMNIROUTE_PROVIDER_KEY;
   const omnirouteProviderId = trimLeadingOpencodePrefix(rawProviderId);
   // OC 1.17.8+ native-adapter gate rejects providerID not in
@@ -283,7 +279,6 @@ export function resolveOmniRoutePluginOptions(opts?: OmniRoutePluginOptions): Re
     displayName,
     modelCacheTtl,
     baseURL: opts?.baseURL,
-    managementReadToken: opts?.managementReadToken,
     features: opts?.features,
   };
 }
@@ -297,9 +292,7 @@ export function resolveOmniRoutePluginOptions(opts?: OmniRoutePluginOptions): Re
  * idempotent-prefix handling above.
  */
 function trimLeadingOpencodePrefix(rawProviderId: string): string {
-  return rawProviderId.startsWith("opencode-")
-    ? rawProviderId.slice("opencode-".length)
-    : rawProviderId;
+  return rawProviderId.startsWith("opencode-") ? rawProviderId.slice("opencode-".length) : rawProviderId;
 }
 
 /**
@@ -862,14 +855,6 @@ export interface OmniRouteRawCombo {
   isHidden?: boolean;
   /** When OmniRoute attaches a lifecycle hint we forward it; today it doesn't. */
   release_date?: string;
-  /**
-   * Server-computed context window for this combo (aggregated from member
-   * models using the same logic as /v1/models). When present, the client
-   * uses this value directly instead of re-aggregating from member models.
-   *
-   * Added in 3.9.x — old servers do not send it.
-   */
-  computed_context_length?: number;
 }
 
 /**
@@ -1074,12 +1059,7 @@ export function mapComboToModelV2(
       cache: { read: 0, write: 0 },
     },
     limit: {
-      context:
-        typeof combo.computed_context_length === "number" && combo.computed_context_length > 0
-          ? combo.computed_context_length
-          : contextValues.length > 0
-            ? Math.min(...contextValues)
-            : 0,
+      context: contextValues.length > 0 ? Math.min(...contextValues) : 0,
       ...(everyDeclaresInput ? { input: Math.min(...inputValues) } : {}),
       output: outputValues.length > 0 ? Math.min(...outputValues) : 0,
     },
@@ -2355,14 +2335,12 @@ export function buildComboKey(
 }
 
 /**
- * Internal cache key: `${baseURL}::sha256(credentialId)`. The credential id
- * combines the inference key and effective management-read token so catalog
- * results fetched under different permissions never share an entry. We hash
- * it so the cache key is safe to inspect without leaking either secret.
- * Different credential tuples MUST keep independent cache entries: a single
- * OC user may register prod + preprod OmniRoute side-by-side with distinct
- * keys, and serving one's catalog from the other's cache would be a
- * correctness bug, not just a privacy one.
+ * Internal cache key: `${baseURL}::sha256(apiKey)`. We hash the apiKey so
+ * the key is safe to log / inspect via debugger without leaking the secret.
+ * Different (baseURL, apiKey) tuples MUST keep independent cache entries:
+ * a single OC user may register prod + preprod OmniRoute side-by-side with
+ * distinct keys, and serving one's catalog from the other's cache would be
+ * a correctness bug, not just a privacy one.
  */
 // codeql[js/insufficient-password-hash]: the input here is an API-key
 // identifier we use solely to derive an in-memory cache lookup key — it is
@@ -2513,9 +2491,6 @@ export function createOmniRouteProviderHook(
         return {};
       }
       const apiKey = (auth as { key: string }).key;
-      // Management-plane catalog reads may use a narrower read-only token.
-      // Backward compatibility: when unset, retain the historical apiKey use.
-      const managementReadToken = resolved.managementReadToken ?? apiKey;
 
       // baseURL resolution: plugin opts first, then credential-attached
       // baseURL (auth backends sometimes stash it next to the key), then the
@@ -2545,7 +2520,7 @@ export function createOmniRouteProviderHook(
         return {};
       }
 
-      const cacheKey = modelsCacheKey(baseURL, `${apiKey}\0${managementReadToken}`);
+      const cacheKey = modelsCacheKey(baseURL, apiKey);
       const t = now();
       const cached = cache.get(cacheKey);
 
@@ -2577,7 +2552,7 @@ export function createOmniRouteProviderHook(
         rawCombos = [];
         if (wantCombos) {
           try {
-            rawCombos = await combosFetcher(baseURL, managementReadToken, 10_000);
+            rawCombos = await combosFetcher(baseURL, apiKey, 10_000);
           } catch (err) {
             console.warn(
               "[omniroute-plugin] combos fetch failed, falling back to models-only catalog",
@@ -2592,7 +2567,7 @@ export function createOmniRouteProviderHook(
         rawAutoCombos = [];
         if (wantAutoCombos) {
           try {
-            rawAutoCombos = await autoCombosFetcher(baseURL, managementReadToken, 5_000);
+            rawAutoCombos = await autoCombosFetcher(baseURL, apiKey, 5_000);
           } catch {
             // Already handled inside the default fetcher — this catch
             // is belt-and-suspenders for injected stubs.
@@ -2604,7 +2579,7 @@ export function createOmniRouteProviderHook(
         rawEnrichment = new Map();
         if (wantEnrichment) {
           try {
-            rawEnrichment = await enrichmentFetcher(baseURL, managementReadToken, 10_000);
+            rawEnrichment = await enrichmentFetcher(baseURL, apiKey, 10_000);
           } catch (err) {
             console.warn(
               "[omniroute-plugin] enrichment fetch failed, falling back to raw ids",
@@ -2618,11 +2593,7 @@ export function createOmniRouteProviderHook(
         rawCompressionCombos = [];
         if (wantCompressionMeta) {
           try {
-            rawCompressionCombos = await compressionMetaFetcher(
-              baseURL,
-              managementReadToken,
-              10_000
-            );
+            rawCompressionCombos = await compressionMetaFetcher(baseURL, apiKey, 10_000);
           } catch (err) {
             console.warn("[omniroute-plugin] compression-metadata fetch failed", err);
           }
@@ -2636,7 +2607,7 @@ export function createOmniRouteProviderHook(
         rawConnections = [];
         if (wantUsableOnly) {
           try {
-            rawConnections = await providersFetcher(baseURL, managementReadToken, 10_000);
+            rawConnections = await providersFetcher(baseURL, apiKey, 10_000);
           } catch (err) {
             console.warn(
               "[omniroute-plugin] /api/providers fetch failed; usableOnly filter disabled for this refresh",
@@ -3024,18 +2995,17 @@ export function createOmniRouteProviderHook(
 }
 
 // ────────────────────────────────────────────────────────────────────────────
-// Fetch interceptor (T-04) — Bearer + Content-Type injection on intended
-// same-origin OmniRoute inference requests only
+// Fetch interceptor (T-04) — Bearer + Content-Type injection on outbound
+// provider requests targeting the configured OmniRoute baseURL
 // ────────────────────────────────────────────────────────────────────────────
 
 /**
  * Build a `fetch`-compatible interceptor that injects `Authorization: Bearer`
- * (and a default `Content-Type`) only onto same-origin requests targeting
- * `<base>/chat/completions` or `<base>/models`, where `<base>` is the
- * configured baseURL path normalized to end in `/v1`. Management, MCP, and
- * unrelated inference paths pass through untouched. The apiKey is treated as
- * a secret bound to both the configured OmniRoute origin and these intended
- * inference endpoints, and MUST NOT leak elsewhere.
+ * (and a default `Content-Type`) onto outbound requests targeting the given
+ * `baseURL`. Requests to any other host pass through untouched — the apiKey
+ * is treated as a secret bound to the configured OmniRoute instance and
+ * MUST NOT leak to third-party endpoints (a vector AI-SDKs occasionally
+ * exercise when a tool call rewrites the URL mid-flight).
  *
  * Ported from Alph4d0g's `opencode-omniroute-auth@1.2.1` `createFetchInterceptor`
  * (their `dist/src/plugin.js:477-516`) with these intentional deviations:
@@ -3062,35 +3032,17 @@ export function createOmniRouteFetchInterceptor(config: {
   apiKey: string;
   baseURL: string;
 }): typeof fetch {
-  let baseOrigin: string | undefined;
-  const inferencePaths = new Set<string>();
-  try {
-    const baseUrl = new URL(config.baseURL);
-    baseOrigin = baseUrl.origin;
-    const basePath = ensureV1Suffix(baseUrl.pathname);
-    inferencePaths.add(`${basePath}/chat/completions`);
-    inferencePaths.add(`${basePath}/models`);
-  } catch {
-    // Credential-attached base URLs are not schema-validated. A malformed
-    // value must disable injection rather than broaden the credential scope.
-  }
+  const trimmed = trimTrailingSlashes(config.baseURL);
+  // Use `<base>/` for prefix matching to prevent suffix-spoof attacks
+  // (e.g. baseURL `https://or.example.com/v1` should NOT match
+  // `https://or.example.com/v1-attacker.evil/...`).
+  const prefix = `${trimmed}/`;
   return async (input, init = {}) => {
     const url =
       typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
 
-    let requestUrl: URL | undefined;
-    try {
-      requestUrl = new URL(url);
-    } catch {
-      // Native fetch will report malformed/relative URLs as usual. We only
-      // decline to attach credentials before forwarding the original input.
-    }
-    const normalizedPath = requestUrl ? trimTrailingSlashes(requestUrl.pathname) || "/" : undefined;
-    const targetsInference =
-      requestUrl?.origin === baseOrigin &&
-      normalizedPath !== undefined &&
-      inferencePaths.has(normalizedPath);
-    if (!targetsInference) {
+    const targetsOmniRoute = url === trimmed || url.startsWith(prefix);
+    if (!targetsOmniRoute) {
       return fetch(input, init);
     }
 
@@ -3939,16 +3891,7 @@ export function buildStaticProviderEntry(
       // `combo/MASTER` as provider=`combo`. Slug collisions across
       // combos are disambiguated with a short UUID-prefix suffix; see
       // `buildComboKey` for the policy.
-      // #6859: server-facing key — NOT the OC-gate-prefixed `opts.providerId`.
-      // OC dispatches the static-catalog `models` map key VERBATIM as the
-      // `model` field of the outbound `@ai-sdk/openai-compatible` request
-      // (only the top-level `provider["<id>"]` segment is stripped for
-      // routing) — so a bare-slug combo key prefixed with the OC-gated
-      // `opts.providerId` reaches OmniRoute's server doubled
-      // (`opencode-omniroute/opencode-omniroute/<slug>`), and `parseModel()`
-      // resolves credentials for the nonexistent provider `opencode-omniroute`
-      // instead of `omniroute`. See #7976.
-      models[buildComboKey(combo, usedComboKeys, opts.omnirouteProviderId)] = entry;
+      models[buildComboKey(combo, usedComboKeys, opts.providerId)] = entry;
 
       // Make this combo's resolved entry available to parent combos
       // that reference it via combo-ref. Use the friendly name since
@@ -4041,9 +3984,7 @@ type AuthJsonShape = Record<string, AuthJsonApiEntry | { type?: string; [k: stri
 
 /** Disk snapshot envelope. Versioned for forward-compat. */
 interface OmniRouteDiskSnapshot {
-  v: 2;
-  /** Opaque identity for normalized baseURL + both effective credentials. */
-  identityFingerprint: string;
+  v: 1;
   rawModels: OmniRouteRawModelEntry[];
   rawCombos: OmniRouteRawCombo[];
   rawAutoCombos?: OmniRouteRawAutoCombo[];
@@ -4063,53 +4004,22 @@ export function diskSnapshotPath(providerId: string): string {
 
 export type OmniRouteDiskSnapshotWriter = (
   providerId: string,
-  entry: Omit<OmniRouteFetchCacheEntry, "expiresAt">,
-  identityFingerprint: string
+  entry: Omit<OmniRouteFetchCacheEntry, "expiresAt">
 ) => Promise<void>;
 
 export type OmniRouteDiskSnapshotReader = (
-  providerId: string,
-  identityFingerprint: string
+  providerId: string
 ) => Promise<Omit<OmniRouteFetchCacheEntry, "expiresAt"> | undefined>;
 
-/**
- * Bind a snapshot to the endpoint and effective credential tuple without
- * persisting any raw token. This opaque value is only stored and compared;
- * it is never logged or included in generated provider configuration.
- */
-function diskSnapshotIdentityFingerprint(
-  baseURL: string,
-  apiKey: string,
-  managementReadToken: string
-): string {
-  let normalizedBaseURL: string;
-  try {
-    const parsed = new URL(baseURL);
-    parsed.hash = "";
-    parsed.pathname = trimTrailingSlashes(parsed.pathname) || "/";
-    normalizedBaseURL = parsed.toString();
-  } catch {
-    normalizedBaseURL = trimTrailingSlashes(baseURL);
-  }
-  return createHash("sha256")
-    .update(JSON.stringify([normalizedBaseURL, apiKey, managementReadToken]))
-    .digest("hex");
-}
-
 /** Best-effort disk write. Soft-fails on any I/O error (no exception thrown). */
-export const defaultDiskSnapshotWriter: OmniRouteDiskSnapshotWriter = async (
-  providerId,
-  entry,
-  identityFingerprint
-) => {
+export const defaultDiskSnapshotWriter: OmniRouteDiskSnapshotWriter = async (providerId, entry) => {
   try {
     const file = diskSnapshotPath(providerId);
     // Restrict perms to the owner: the snapshot lives alongside auth.json
     // (0o600) and embeds provider topology + masked connection records.
     await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
     const snapshot: OmniRouteDiskSnapshot = {
-      v: 2,
-      identityFingerprint,
+      v: 1,
       rawModels: entry.rawModels,
       rawCombos: entry.rawCombos,
       rawAutoCombos: entry.rawAutoCombos,
@@ -4128,22 +4038,12 @@ export const defaultDiskSnapshotWriter: OmniRouteDiskSnapshotWriter = async (
 };
 
 /** Best-effort disk read. Returns `undefined` when missing/corrupt/unreadable. */
-export const defaultDiskSnapshotReader: OmniRouteDiskSnapshotReader = async (
-  providerId,
-  identityFingerprint
-) => {
+export const defaultDiskSnapshotReader: OmniRouteDiskSnapshotReader = async (providerId) => {
   try {
     const file = diskSnapshotPath(providerId);
     const body = await readFile(file, "utf8");
     const parsed = JSON.parse(body) as Partial<OmniRouteDiskSnapshot>;
-    if (
-      !parsed ||
-      parsed.v !== 2 ||
-      typeof parsed.identityFingerprint !== "string" ||
-      parsed.identityFingerprint !== identityFingerprint
-    ) {
-      return undefined;
-    }
+    if (!parsed || parsed.v !== 1) return undefined;
     return {
       rawModels: Array.isArray(parsed.rawModels) ? parsed.rawModels : [],
       rawCombos: Array.isArray(parsed.rawCombos) ? parsed.rawCombos : [],
@@ -4567,9 +4467,6 @@ export function createOmniRouteConfigHook(
       );
       return;
     }
-    // Management-plane catalog reads may use a narrower read-only token.
-    // Backward compatibility: when unset, retain the historical apiKey use.
-    const managementReadToken = resolved.managementReadToken ?? apiKey;
 
     // baseURL resolution: opts.baseURL wins, then auth.json's stored baseURL.
     // No silent localhost default — a misconfigured plugin should surface a
@@ -4586,12 +4483,7 @@ export function createOmniRouteConfigHook(
     // Try the shared cache first. On OC ≥1.14.49 the provider hook may have
     // populated it moments earlier; on OC ≤1.14.48 only this hook runs but
     // the cache still works (single producer + consumer through one Map).
-    const cacheKey = modelsCacheKey(baseURL, `${apiKey}\0${managementReadToken}`);
-    const snapshotFingerprint = diskSnapshotIdentityFingerprint(
-      baseURL,
-      apiKey,
-      managementReadToken
-    );
+    const cacheKey = modelsCacheKey(baseURL, apiKey);
     const t = now();
     const cached = cache.get(cacheKey);
 
@@ -4632,7 +4524,7 @@ export function createOmniRouteConfigHook(
 
       rawCombos = [];
       try {
-        rawCombos = await combosFetcher(baseURL, managementReadToken, 10_000);
+        rawCombos = await combosFetcher(baseURL, apiKey, 10_000);
       } catch (err) {
         logger.warn(
           "[omniroute-plugin] config shim: /api/combos fetch failed; publishing models-only static catalog",
@@ -4643,7 +4535,7 @@ export function createOmniRouteConfigHook(
       rawAutoCombos = [];
       if (wantAutoCombos) {
         try {
-          rawAutoCombos = await autoCombosFetcher(baseURL, managementReadToken, 5_000);
+          rawAutoCombos = await autoCombosFetcher(baseURL, apiKey, 5_000);
         } catch {
           // Already handled inside the default fetcher
         }
@@ -4659,7 +4551,7 @@ export function createOmniRouteConfigHook(
       rawEnrichment = new Map();
       if (wantEnrichment) {
         try {
-          rawEnrichment = await enrichmentFetcher(baseURL, managementReadToken, 10_000);
+          rawEnrichment = await enrichmentFetcher(baseURL, apiKey, 10_000);
         } catch (err) {
           logger.warn(
             "[omniroute-plugin] config shim: /api/pricing/models fetch failed; publishing raw-id static catalog",
@@ -4674,7 +4566,7 @@ export function createOmniRouteConfigHook(
       rawCompressionCombos = [];
       if (wantCompressionMeta) {
         try {
-          rawCompressionCombos = await compressionMetaFetcher(baseURL, managementReadToken, 10_000);
+          rawCompressionCombos = await compressionMetaFetcher(baseURL, apiKey, 10_000);
         } catch (err) {
           logger.warn(
             "[omniroute-plugin] config shim: /api/context/combos fetch failed; publishing combos without compression suffix",
@@ -4690,7 +4582,7 @@ export function createOmniRouteConfigHook(
       rawConnections = [];
       if (wantUsableOnly) {
         try {
-          rawConnections = await providersFetcher(baseURL, managementReadToken, 10_000);
+          rawConnections = await providersFetcher(baseURL, apiKey, 10_000);
         } catch (err) {
           logger.warn(
             "[omniroute-plugin] config shim: /api/providers fetch failed; usableOnly filter disabled for this refresh",
@@ -4706,7 +4598,7 @@ export function createOmniRouteConfigHook(
       // a healthy refresh; staleness is bounded only by how recently the
       // user was online.
       if (modelsFetchThrew && wantDiskCache) {
-        const snapshot = await diskSnapshotReader(resolved.providerId, snapshotFingerprint);
+        const snapshot = await diskSnapshotReader(resolved.providerId);
         if (snapshot && snapshot.rawModels.length > 0) {
           logger.warn(
             `[omniroute-plugin] config shim: /v1/models unreachable; using stale disk cache (${snapshot.rawModels.length} models)`
@@ -4751,18 +4643,14 @@ export function createOmniRouteConfigHook(
       // Best-effort; soft-fail keeps us moving when the data dir isn't
       // writable (e.g. read-only container).
       if (modelsFetchOk && wantDiskCache) {
-        await diskSnapshotWriter(
-          resolved.providerId,
-          {
-            rawModels,
-            rawCombos,
-            rawAutoCombos,
-            rawEnrichment,
-            rawCompressionCombos,
-            rawConnections,
-          },
-          snapshotFingerprint
-        );
+        await diskSnapshotWriter(resolved.providerId, {
+          rawModels,
+          rawCombos,
+          rawAutoCombos,
+          rawEnrichment,
+          rawCompressionCombos,
+          rawConnections,
+        });
       }
     }
 

@omniroute/opencode-plugin/tests/config-shim.test.ts

@@ -248,7 +248,7 @@ test("config: with valid auth.json + apiKey + baseURL → mutates input.provider
 
   // Combo surfaces under bare key + LCD'd
   // (gemini's reasoning=false → combo reasoning=false).
-  const combo = entry.models["omniroute/claude-tier"];
+  const combo = entry.models["opencode-omniroute/claude-tier"];
   assert.ok(combo, "combo surfaced under bare key");
   assert.equal(combo.name, "Claude Tier");
   assert.equal(combo.reasoning, false, "LCD: any member reasoning=false → combo reasoning=false");
@@ -474,7 +474,7 @@ test("config: combos fetcher throws → emit models-only catalog (no combos in m
     "opencode-omniroute/claude-sonnet-4-6",
     "opencode-omniroute/gemini-3-flash",
   ]);
-  assert.equal(entry.models["omniroute/claude-tier"], undefined, "no combo entry");
+  assert.equal(entry.models["opencode-omniroute/claude-tier"], undefined, "no combo entry");
   assert.ok(
     logger.entries.some((e) => String(e[0]).includes("/api/combos fetch failed")),
     "combos-fetch breadcrumb emitted"
@@ -748,7 +748,7 @@ test("buildStaticProviderEntry: hidden combos are excluded", () => {
     "https://or.example/v1",
     "sk-test"
   );
-  assert.equal(block.models["omniroute/claude-tier"], undefined);
+  assert.equal(block.models["opencode-omniroute/claude-tier"], undefined);
   assert.ok(block.models["opencode-omniroute/claude-sonnet-4-6"]);
 });
 
@@ -858,7 +858,7 @@ test("buildStaticProviderEntry: combo modalities = intersection of members (LCD)
     "https://or.example/v1",
     "sk-test"
   );
-  const combo = block.models["omniroute/mixed-tier"];
+  const combo = block.models["opencode-omniroute/mixed-tier"];
   assert.ok(combo, "combo emitted under slug key");
   // claude has text+image, text-only has text → intersection drops image.
   assert.deepEqual(combo.modalities?.input, ["text"]);
@@ -970,7 +970,7 @@ test("config: enrichment fetched + name overlaid on raw-model entries", async ()
   assert.equal(entry.models["opencode-omniroute/claude-sonnet-4-6"].name, "Claude Sonnet 4.6");
   assert.equal(entry.models["opencode-omniroute/gemini-3-flash"].name, "Gemini 3 Flash");
   // Combo names still come from /api/combos — enrichment overlay does NOT touch combos.
-  assert.equal(entry.models["omniroute/claude-tier"].name, "Claude Tier");
+  assert.equal(entry.models["opencode-omniroute/claude-tier"].name, "Claude Tier");
   assert.equal(enrichmentFetcher.callCount(), 1);
 });
 
@@ -1337,7 +1337,7 @@ test("config: providerTag (default-on) prepends '<provider> - ' to enriched raw-
   );
   assert.equal(entry.models["opencode-omniroute/gemini-3-flash"].name, "Gemini - Gemini 3 Flash");
   // Combos stay untouched — `Combo: ` prefix already conveys multi-upstream.
-  assert.equal(entry.models["omniroute/claude-tier"].name, "Claude Tier");
+  assert.equal(entry.models["opencode-omniroute/claude-tier"].name, "Claude Tier");
 });
 
 test("config: providerTag=false suppresses the suffix", async () => {
@@ -1516,7 +1516,7 @@ test("buildStaticProviderEntry: nested combo-ref context is the bottleneck acros
   );
   // Pre-fix: Parent would advertise 200_000 (only raw-big counted).
   // Post-fix: Parent should advertise 8_000 (TinyCombo bottleneck).
-  const parent = block.models["omniroute/parent"];
+  const parent = block.models["opencode-omniroute/parent"];
   assert.ok(parent, "Parent combo must be in the static catalog");
   assert.equal(parent.limit?.context, 8_000);
 });

@omniroute/opencode-plugin/tests/disk-snapshot-perms.test.ts

@@ -40,7 +40,7 @@ test("defaultDiskSnapshotWriter writes an owner-only (no group/other) snapshot",
   process.env.OPENCODE_DATA_DIR = tmp;
 
   try {
-    await defaultDiskSnapshotWriter("perm-test", makeEntry(), "test-snapshot-identity");
+    await defaultDiskSnapshotWriter("perm-test", makeEntry());
 
     const file = diskSnapshotPath("perm-test");
     assert.ok(fs.existsSync(file), "snapshot file should be written");

@omniroute/opencode-plugin/tests/fetch-interceptor.test.ts

@@ -50,52 +50,6 @@ test("createOmniRouteFetchInterceptor: targets baseURL → Authorization header
   }
 });
 
-test("createOmniRouteFetchInterceptor: path-prefixed baseURL scopes auth to its normalized inference paths", async () => {
-  const { calls, restore } = installFetchRecorder();
-  try {
-    const prefixedBase = "https://or.example.com/tenant-a/v1";
-    const f = createOmniRouteFetchInterceptor({
-      apiKey: KEY,
-      baseURL: `${prefixedBase}///`,
-    });
-    const streamingBody = '{"stream":true}';
-
-    await f(`${prefixedBase}/chat/completions?trace=1`, {
-      method: "POST",
-      body: streamingBody,
-      headers: { Accept: "text/event-stream" },
-    });
-    await f(`${prefixedBase}/models/?refresh=1`);
-    await f("https://or.example.com/v1/chat/completions", { method: "POST", body: "{}" });
-    await f("https://or.example.com/v1/models");
-    await f("https://or.example.com/tenant-b/v1/chat/completions", {
-      method: "POST",
-      body: "{}",
-    });
-    await f(`${prefixedBase}/chat/completions/batch`, { method: "POST", body: "{}" });
-
-    const headers = calls.map(({ init }) => new Headers(init?.headers));
-    assert.equal(headers[0]?.get("Authorization"), `Bearer ${KEY}`);
-    assert.equal(headers[1]?.get("Authorization"), `Bearer ${KEY}`);
-    for (const index of [2, 3, 4, 5]) {
-      assert.equal(headers[index]?.get("Authorization"), null);
-    }
-    assert.equal(calls[0]?.input, `${prefixedBase}/chat/completions?trace=1`);
-    assert.equal(calls[0]?.init?.body, streamingBody);
-    assert.equal(headers[0]?.get("Accept"), "text/event-stream");
-
-    const suffixingInterceptor = createOmniRouteFetchInterceptor({
-      apiKey: KEY,
-      baseURL: "https://or.example.com/tenant-a/",
-    });
-    await suffixingInterceptor(`${prefixedBase}/models`);
-    const suffixedHeaders = new Headers(calls[6]?.init?.headers);
-    assert.equal(suffixedHeaders.get("Authorization"), `Bearer ${KEY}`);
-  } finally {
-    restore();
-  }
-});
-
 test("createOmniRouteFetchInterceptor: targets baseURL → Authorization OVERRIDES caller-supplied Bearer", async () => {
   const { calls, restore } = installFetchRecorder();
   try {
@@ -305,7 +259,7 @@ test("loader integration: wired interceptor actually injects Bearer when invoked
       {} as never
     );
     const wiredFetch = (result as { fetch: typeof fetch }).fetch;
-    await wiredFetch(`${BASE}/models`, {});
+    await wiredFetch(`${BASE}/v1/models`, {});
     assert.equal(calls.length, 1);
     const sentHeaders = new Headers((calls[0]!.init as RequestInit).headers);
     assert.equal(sentHeaders.get("Authorization"), `Bearer ${KEY}`);

@omniroute/opencode-plugin/tests/management-read-token.test.ts

@@ -1,271 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-
-import {
-  createOmniRouteAuthHook,
-  createOmniRouteConfigHook,
-  createOmniRouteProviderHook,
-  parseOmniRoutePluginOptions,
-  type OmniRouteCompressionMetaFetcher,
-  type OmniRouteEnrichmentFetcher,
-  type OmniRouteProvidersFetcher,
-  type OmniRouteRawModelEntry,
-} from "../src/index.js";
-
-const BASE_URL = "https://or.example.com/v1";
-const API_KEY = "sk-inference-only";
-const MANAGEMENT_READ_TOKEN = "sk-management-read-only";
-
-const RAW_MODELS: OmniRouteRawModelEntry[] = [
-  {
-    id: "openai/gpt-test",
-    context_length: 16_000,
-    max_output_tokens: 4_000,
-    capabilities: {
-      tool_calling: true,
-      reasoning: false,
-      vision: false,
-      thinking: false,
-      temperature: true,
-    },
-    input_modalities: ["text"],
-    output_modalities: ["text"],
-  },
-];
-
-function apiAuth(key: string) {
-  return { type: "api" as const, key };
-}
-
-test("options: managementReadToken is accepted and preserved", () => {
-  const parsed = parseOmniRoutePluginOptions({ managementReadToken: MANAGEMENT_READ_TOKEN });
-  assert.equal(parsed.managementReadToken, MANAGEMENT_READ_TOKEN);
-});
-
-test("provider hook: management GET fetchers use managementReadToken while /v1 uses apiKey", async () => {
-  const calls: Array<[string, string]> = [];
-  const enrichmentFetcher: OmniRouteEnrichmentFetcher = async (_baseURL, token) => {
-    calls.push(["pricing", token]);
-    return new Map();
-  };
-  const compressionMetaFetcher: OmniRouteCompressionMetaFetcher = async (_baseURL, token) => {
-    calls.push(["context", token]);
-    return [];
-  };
-  const providersFetcher: OmniRouteProvidersFetcher = async (_baseURL, token) => {
-    calls.push(["providers", token]);
-    return [];
-  };
-
-  const hook = createOmniRouteProviderHook(
-    {
-      baseURL: BASE_URL,
-      managementReadToken: MANAGEMENT_READ_TOKEN,
-      features: { compressionMetadata: true, usableOnly: true },
-    },
-    {
-      fetcher: async (_baseURL, token) => {
-        calls.push(["models", token]);
-        return RAW_MODELS;
-      },
-      combosFetcher: async (_baseURL, token) => {
-        calls.push(["combos", token]);
-        return [];
-      },
-      autoCombosFetcher: async (_baseURL, token) => {
-        calls.push(["auto-combos", token]);
-        return [];
-      },
-      enrichmentFetcher,
-      compressionMetaFetcher,
-      providersFetcher,
-    }
-  );
-
-  await hook.models!({} as never, { auth: apiAuth(API_KEY) as never });
-
-  assert.deepEqual(calls, [
-    ["models", API_KEY],
-    ["combos", MANAGEMENT_READ_TOKEN],
-    ["auto-combos", MANAGEMENT_READ_TOKEN],
-    ["pricing", MANAGEMENT_READ_TOKEN],
-    ["context", MANAGEMENT_READ_TOKEN],
-    ["providers", MANAGEMENT_READ_TOKEN],
-  ]);
-});
-
-test("provider hook: absent managementReadToken preserves apiKey fallback", async () => {
-  const calls: Array<[string, string]> = [];
-  const hook = createOmniRouteProviderHook(
-    { baseURL: BASE_URL, features: { enrichment: false, autoCombos: false } },
-    {
-      fetcher: async (_baseURL, token) => {
-        calls.push(["models", token]);
-        return RAW_MODELS;
-      },
-      combosFetcher: async (_baseURL, token) => {
-        calls.push(["combos", token]);
-        return [];
-      },
-    }
-  );
-
-  await hook.models!({} as never, { auth: apiAuth(API_KEY) as never });
-
-  assert.deepEqual(calls, [
-    ["models", API_KEY],
-    ["combos", API_KEY],
-  ]);
-});
-
-test("config hook: managementReadToken stays out of provider inference and MCP config", async () => {
-  const calls: Array<[string, string]> = [];
-  const hook = createOmniRouteConfigHook(
-    {
-      baseURL: BASE_URL,
-      managementReadToken: MANAGEMENT_READ_TOKEN,
-      features: { enrichment: false, autoCombos: false, diskCache: false, mcpAutoEmit: true },
-    },
-    {
-      readAuthJson: async () => ({
-        "opencode-omniroute": { type: "api" as const, key: API_KEY },
-      }),
-      fetcher: async (_baseURL, token) => {
-        calls.push(["models", token]);
-        return RAW_MODELS;
-      },
-      combosFetcher: async (_baseURL, token) => {
-        calls.push(["combos", token]);
-        return [];
-      },
-      logger: { warn: () => {} },
-    }
-  );
-  const input: { provider?: Record<string, any>; mcp?: Record<string, any> } = {};
-
-  await hook(input as never);
-
-  assert.deepEqual(calls, [
-    ["models", API_KEY],
-    ["combos", MANAGEMENT_READ_TOKEN],
-  ]);
-  assert.equal(input.provider?.["opencode-omniroute"]?.options?.apiKey, API_KEY);
-  assert.equal(
-    input.mcp?.["opencode-omniroute"]?.headers?.Authorization,
-    `Bearer ${API_KEY}`,
-    "mcpAutoEmit remains independent of managementReadToken"
-  );
-});
-
-test("auth fetch: only intended same-origin inference paths receive apiKey", async () => {
-  const calls: Array<{ input: RequestInfo | URL; init?: RequestInit }> = [];
-  const originalFetch = globalThis.fetch;
-  globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
-    calls.push({ input, init });
-    return new Response("ok");
-  }) as typeof fetch;
-
-  try {
-    const hook = createOmniRouteAuthHook({
-      baseURL: `${BASE_URL}/`,
-      managementReadToken: MANAGEMENT_READ_TOKEN,
-    });
-    const loaded = await hook.loader!(async () => apiAuth(API_KEY) as never, {} as never);
-    const interceptedFetch = (loaded as { fetch: typeof fetch }).fetch;
-
-    const streamingBody = '{"stream":true}';
-    await interceptedFetch(`${BASE_URL}/chat/completions?trace=1`, {
-      method: "POST",
-      body: streamingBody,
-      headers: { Accept: "text/event-stream" },
-    });
-    await interceptedFetch(`${BASE_URL}/models/?refresh=1`);
-    await interceptedFetch("https://or.example.com/api/combos");
-    await interceptedFetch("https://or.example.com/api/mcp/stream");
-    await interceptedFetch("https://or.example.com/v1/embeddings");
-    await interceptedFetch("https://third-party.example/v1/chat/completions", {
-      method: "POST",
-      body: "{}",
-    });
-
-    const headers = calls.map(({ init }) => new Headers(init?.headers));
-    assert.equal(headers[0]?.get("Authorization"), `Bearer ${API_KEY}`);
-    assert.equal(headers[1]?.get("Authorization"), `Bearer ${API_KEY}`);
-    for (const index of [2, 3, 4, 5]) {
-      assert.equal(headers[index]?.get("Authorization"), null);
-    }
-    assert.equal(calls[0]?.input, `${BASE_URL}/chat/completions?trace=1`);
-    assert.equal(calls[0]?.init?.body, streamingBody);
-    assert.equal(headers[0]?.get("Accept"), "text/event-stream");
-    assert.equal(
-      calls.some(({ init }) =>
-        [...new Headers(init?.headers).values()].some((value) =>
-          value.includes(MANAGEMENT_READ_TOKEN)
-        )
-      ),
-      false,
-      "managementReadToken must never enter inference fetch headers"
-    );
-  } finally {
-    globalThis.fetch = originalFetch;
-  }
-});
-
-test("disk cache: snapshot written under management token A is rejected under token B", async () => {
-  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-token-snapshot-"));
-  const previousDataDir = process.env.OPENCODE_DATA_DIR;
-  process.env.OPENCODE_DATA_DIR = tmp;
-
-  try {
-    const commonDeps = {
-      readAuthJson: async () => ({
-        "opencode-omniroute": {
-          type: "api" as const,
-          key: API_KEY,
-          baseURL: BASE_URL,
-        },
-      }),
-      combosFetcher: async () => [],
-      logger: { warn: () => {} },
-    };
-    const features = {
-      enrichment: false,
-      autoCombos: false,
-      diskCache: true,
-    } as const;
-
-    const tokenAHook = createOmniRouteConfigHook(
-      { managementReadToken: "token-A", features },
-      {
-        ...commonDeps,
-        fetcher: async () => RAW_MODELS,
-      }
-    );
-    await tokenAHook({} as never);
-
-    const tokenBHook = createOmniRouteConfigHook(
-      { managementReadToken: "token-B", features },
-      {
-        ...commonDeps,
-        fetcher: async () => {
-          throw new Error("offline");
-        },
-      }
-    );
-    const input: { provider?: Record<string, { models: Record<string, unknown> }> } = {};
-    await tokenBHook(input as never);
-
-    assert.deepEqual(
-      input.provider?.["opencode-omniroute"]?.models,
-      {},
-      "catalog from token A must not hydrate after switching to token B"
-    );
-  } finally {
-    if (previousDataDir === undefined) delete process.env.OPENCODE_DATA_DIR;
-    else process.env.OPENCODE_DATA_DIR = previousDataDir;
-    fs.rmSync(tmp, { recursive: true, force: true });
-  }
-});

@omniroute/opencode-plugin/tests/provider-id-routing.test.ts

@@ -22,11 +22,9 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 import {
-  buildStaticProviderEntry,
   createOmniRouteProviderHook,
   mapRawModelToModelV2,
   resolveOmniRoutePluginOptions,
-  type OmniRouteRawCombo,
 } from "../src/index.js";
 
 /**
@@ -99,43 +97,3 @@ test("#6859: createOmniRouteProviderHook end-to-end — catalog keys/providerID
     "the OC-gate prefix must never leak into ModelV2.providerID"
   );
 });
-
-// #7976: buildStaticProviderEntry (the STATIC provider() config-hook path,
-// exercised when the plugin writes `opencode.json` up front rather than
-// registering the dynamic `provider.models()` hook) never received the
-// #6859 fix. OC dispatches a static-catalog `models` map key verbatim as
-// the `model` field of the outbound request — only the top-level
-// `provider["<id>"]` segment is stripped for routing — so a bare-slug combo
-// key built with the OC-gated `providerId` reaches OmniRoute's server
-// doubled and fails credential lookup for the nonexistent provider
-// `opencode-omniroute`. Confirmed against the issue's own curl repro
-// (`model: "opencode-omniroute/hermes-smart-stack"` → "No active
-// credentials for provider: opencode-omniroute").
-test("#7976: buildStaticProviderEntry keys bare-slug combo ids with the unprefixed omnirouteProviderId (no double OC-gate prefix)", () => {
-  const resolved = resolveOmniRoutePluginOptions({ providerId: "omniroute" });
-  assert.equal(resolved.providerId, "opencode-omniroute");
-  assert.equal(resolved.omnirouteProviderId, "omniroute");
-
-  const combo = {
-    id: "combo-abc123",
-    name: "Hermes Smart Stack",
-    isHidden: false,
-    models: [],
-  } as unknown as OmniRouteRawCombo;
-
-  const block = buildStaticProviderEntry(
-    [],
-    [combo],
-    resolved,
-    "https://or.example/v1",
-    "sk-test"
-  );
-
-  assert.deepEqual(Object.keys(block.models), ["omniroute/hermes-smart-stack"]);
-  assert.equal(
-    block.models["opencode-omniroute/hermes-smart-stack"],
-    undefined,
-    "combo key must not carry the OC-gate-prefixed providerId — it doubles up once " +
-      "OC dispatches it verbatim as the `model` field"
-  );
-});

AGENTS.md

@@ -3,12 +3,12 @@
 ## Project
 
 Unified AI proxy/router — route any LLM through one endpoint. Multi-provider support
-with **290 provider entries** (OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Fireworks,
+with **250 provider entries** (OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Fireworks,
 Cohere, NVIDIA, Cerebras, Pollinations, Puter, Cloudflare AI, HuggingFace, DeepInfra,
 SambaNova, Meta Llama API, Moonshot AI, AI21 Labs, Databricks, Snowflake, and many more)
-with **MCP Server** (104 tools), **A2A v0.3 Protocol**, and **Electron desktop app**.
+with **MCP Server** (94 tools), **A2A v0.3 Protocol**, and **Electron desktop app**.
 
-> **Live counts (v3.8.49)**: providers 290 · MCP tools 104 · MCP scopes 30 · A2A skills 6 ·
+> **Live counts (v3.8.47)**: providers 250 · MCP tools 94 · MCP scopes 30 · A2A skills 6 ·
 > open-sse services 134 · routing strategies 17 · auto-combo scoring factors 12 ·
 > DB modules 95 · DB migrations 110 · base tables 17 · search providers 11 ·
 > i18n locales 42. **Refresh with `npm run check:docs-all`.**
@@ -267,8 +267,8 @@ Zod schemas, and unit tests aligned when editing.
 
 ### Provider Categories
 
-- **Free** (2): Qoder AI, Kiro AI
-- **OAuth** (13): Claude Code, Antigravity, Codex, GitHub Copilot, Cursor, Kimi Coding, Kilo Code, Cline, Kiro, Qoder, Gemini, Windsurf (v3.8), GitLab Duo (v3.8)
+- **Free** (3): Qoder AI, Qwen Code, Kiro AI
+- **OAuth** (14): Claude Code, Antigravity, Codex, GitHub Copilot, Cursor, Kimi Coding, Kilo Code, Cline, Qwen (⚠️ free tier discontinued 2026-04-15), Kiro, Qoder, Gemini, Windsurf (v3.8), GitLab Duo (v3.8)
 - **API Key** (120+): OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Perplexity,
   Together, Fireworks, Cerebras, Cohere, NVIDIA, Nebius, SiliconFlow, Hyperbolic,
   HuggingFace, OpenRouter, Vertex AI, Cloudflare AI, Scaleway, AI/ML API, Pollinations,
@@ -391,7 +391,7 @@ Policy engine modules: `policyEngine.ts`, `comboResolver.ts`, `costRules.ts`,
 
 ### MCP Server (`open-sse/mcp-server/`)
 
-**104 tools** total (`TOTAL_MCP_TOOL_COUNT`, `open-sse/mcp-server/server.ts`): a 42-entry base registry (`MCP_TOOLS` in `schemas/tools.ts`, bundling the core / cache / compression / 1proxy / advanced tools) **plus** standalone module sets — memory (3), skill (4), agentSkill (3), pool (6), gamification (8), plugin (8), notion (6), obsidian (22). 3 transports (stdio / SSE / Streamable HTTP). Scoped auth (31 scopes — see `OMNIROUTE_MCP_SCOPES`), Zod schemas. See [`docs/frameworks/MCP-SERVER.md`](docs/frameworks/MCP-SERVER.md).
+**94 tools** total (`TOTAL_MCP_TOOL_COUNT`, `open-sse/mcp-server/server.ts`): a 34-entry base registry (`MCP_TOOLS` in `schemas/tools.ts`, bundling the core / cache / compression / 1proxy / advanced tools) **plus** standalone module sets — memory (3), skill (4), agentSkill (3), pool (6), gamification (8), plugin (8), notion (6), obsidian (22). 3 transports (stdio / SSE / Streamable HTTP). Scoped auth (30 scopes — see `OMNIROUTE_MCP_SCOPES`), Zod schemas. See [`docs/frameworks/MCP-SERVER.md`](docs/frameworks/MCP-SERVER.md).
 
 **Core tools** (20): get_health, list_combos, get_combo_metrics, switch_combo, check_quota,
 route_request, cost_report, list_models_catalog, web_search, simulate_route, set_budget_guard,

CHANGELOG.md

@@ -6,706 +6,6 @@
 
 ## [3.8.49] — TBD
 
-_Living section — regenerated 2026-07-19 from all 306 cycle commits (bump 2c62333b0 → tip). Bullets carry the merged PR and its author; direct pushes listed separately. Finalized at the v3.8.49 release._
-
-### ✨ New Features
-
-- **feat:** generalize ensureThinkingBudget to all providers + preserve server-side tool invocations on antigravity ([#6979](https://github.com/diegosouzapw/OmniRoute/pull/6979)) — thanks @rafaumeu
-- **feat(6922):** effort-tier aliases for glm-5.2 & mimo-v2.5 on opencode-go ([#6987](https://github.com/diegosouzapw/OmniRoute/pull/6987)) — thanks @rafaumeu
-- **feat(providers):** curated OpenRouter embeddings catalog + specialty merge in live discovery (#6976) ([#6994](https://github.com/diegosouzapw/OmniRoute/pull/6994))
-- **feat(quota):** opt-in auto-ping to keep Codex quota windows warm (#6977) ([#6995](https://github.com/diegosouzapw/OmniRoute/pull/6995))
-- **feat(providers):** add Agnes AI native provider support ([#7035](https://github.com/diegosouzapw/OmniRoute/pull/7035)) — thanks @HouMinXi
-- **feat(sse):** allow disabling `:` comment heartbeats via OMNIROUTE_SSE_COMMENTS=off ([#7036](https://github.com/diegosouzapw/OmniRoute/pull/7036)) — thanks @xier2012
-- **feat(perf):** add performance.mark/measure to SSE pipeline + request-size metric ([#7045](https://github.com/diegosouzapw/OmniRoute/pull/7045)) — thanks @oyi77
-- **feat(providers):** add Dahl free inference provider ([#7062](https://github.com/diegosouzapw/OmniRoute/pull/7062)) — thanks @growab
-- **feat(ci):** boot-smoke the packed npm tarball (check:pack-boot, #7065 class killer) ([#7086](https://github.com/diegosouzapw/OmniRoute/pull/7086))
-- **feat(ci):** hotfix fast-lane + tests-only E2E skip (WS3.1) ([#7088](https://github.com/diegosouzapw/OmniRoute/pull/7088))
-- **feat(ci):** continuous release-green — on-push quick gate + 3x/day full sweep (WS5.1) ([#7089](https://github.com/diegosouzapw/OmniRoute/pull/7089))
-- **feat(ci):** duration-balanced E2E shards via LPT bin-packing (WS4.1) ([#7090](https://github.com/diegosouzapw/OmniRoute/pull/7090))
-- **feat(ci):** TypeScript 7 native shadow for typecheck:core (WS4.2, advisory) ([#7091](https://github.com/diegosouzapw/OmniRoute/pull/7091))
-- **feat(release):** npm staged publishing + pre-publish boot-smoke (WS1.3) ([#7092](https://github.com/diegosouzapw/OmniRoute/pull/7092))
-- **feat(release):** post-publish verifier — clean-container install + boot (WS1.4) ([#7109](https://github.com/diegosouzapw/OmniRoute/pull/7109))
-- **feat(ci):** Mergify merge queue + manual-train fallback runbook (WS3.4/WS3.2) ([#7112](https://github.com/diegosouzapw/OmniRoute/pull/7112))
-- **feat(ci):** Windows leg for Electron prepare smoke (WS1.5) ([#7113](https://github.com/diegosouzapw/OmniRoute/pull/7113))
-- **feat(ci):** Codecov patch coverage (informational) + fix missing lcov reporter (WS5.6) ([#7114](https://github.com/diegosouzapw/OmniRoute/pull/7114))
-- **feat(sidecar):** support conditional provider manifest refresh ([#7130](https://github.com/diegosouzapw/OmniRoute/pull/7130)) — thanks @KooshaPari
-- **feat(homolog):** real-environment E2E homologation suite (npm run homolog) ([#7133](https://github.com/diegosouzapw/OmniRoute/pull/7133))
-- **feat(usage):** add Codex reset credit picker ([#7154](https://github.com/diegosouzapw/OmniRoute/pull/7154)) — thanks @JxnLexn
-- **feat(ci):** Trunk Flaky Tests uploads for vitest + Playwright E2E (WS5.2/5.3) ([#7175](https://github.com/diegosouzapw/OmniRoute/pull/7175))
-- **feat(ci):** Trunk Flaky Tests upload on the fast-path vitest job (per-PR volume) ([#7205](https://github.com/diegosouzapw/OmniRoute/pull/7205))
-- **feat(kiro):** register GPT-5.6 Sol/Terra/Luna model family ([#7209](https://github.com/diegosouzapw/OmniRoute/pull/7209))
-- **feat(dashboard):** show Codex plan label in provider and quota views ([#7210](https://github.com/diegosouzapw/OmniRoute/pull/7210))
-- **feat(dashboard):** add reorder connections by availability button ([#7211](https://github.com/diegosouzapw/OmniRoute/pull/7211))
-- **feat(dashboard):** add 180D and 365D usage/cost analytics periods (#7213) ([#7213](https://github.com/diegosouzapw/OmniRoute/pull/7213))
-- **feat(api):** add Vary: Accept-Encoding to token-authenticated /v1* responses (#6737) ([#7217](https://github.com/diegosouzapw/OmniRoute/pull/7217))
-- **feat(api):** expose GET /api/usage/model-latency-stats (#6873) ([#7218](https://github.com/diegosouzapw/OmniRoute/pull/7218))
-- **feat(dashboard):** add compression-mode selector to Context & Cache combos page (#6760) ([#7219](https://github.com/diegosouzapw/OmniRoute/pull/7219))
-- **feat(sse):** route GitHub Copilot Claude models through native /v1/messages ([#7223](https://github.com/diegosouzapw/OmniRoute/pull/7223))
-- **feat(mitm):** add Antigravity reasoning-effort overrides ([#7228](https://github.com/diegosouzapw/OmniRoute/pull/7228))
-- **feat:** replace free-text model inputs with hidePaid-aware Selects (#6540) ([#7229](https://github.com/diegosouzapw/OmniRoute/pull/7229))
-- **feat:** editable ComfyUI base-URL field + per-connection override for image/video/music generation (#6928) ([#7232](https://github.com/diegosouzapw/OmniRoute/pull/7232))
-- **feat(sse):** add optional-enum null-omission idiom for codex strict-mode tools (#7023) ([#7233](https://github.com/diegosouzapw/OmniRoute/pull/7233))
-- **feat(sse):** preserve tools/tool_choice for tool-bearing requests through fusion combos (#6771) ([#7235](https://github.com/diegosouzapw/OmniRoute/pull/7235))
-- **feat(api):** accept x-goog-api-key header for client-facing auth (#7034) ([#7236](https://github.com/diegosouzapw/OmniRoute/pull/7236))
-- **feat(sse):** add native xAI Grok Imagine video generation provider ([#7238](https://github.com/diegosouzapw/OmniRoute/pull/7238))
-- **feat:** add Type filter and easiest-first sort to Free Provider Rankings (#6915) ([#7240](https://github.com/diegosouzapw/OmniRoute/pull/7240))
-- **feat(cli):** add Grok Build CLI tool setup (~/.grok/config.toml) ([#7241](https://github.com/diegosouzapw/OmniRoute/pull/7241))
-- **feat(provider):** add Chenzk API OpenAI-compatible gateway ([#7246](https://github.com/diegosouzapw/OmniRoute/pull/7246))
-- **feat(providers):** let custom connections opt into prompt-cache capability (#6880) ([#7257](https://github.com/diegosouzapw/OmniRoute/pull/7257))
-- **feat(db):** include xp_audit_log in automatic retention/prune (#6801) ([#7260](https://github.com/diegosouzapw/OmniRoute/pull/7260))
-- **feat(api):** structured X-Routing-Fallback-Reason header for relay routing (#6872) ([#7262](https://github.com/diegosouzapw/OmniRoute/pull/7262))
-- **feat(compression):** support RTK TOML schema v1 filters ([#7281](https://github.com/diegosouzapw/OmniRoute/pull/7281)) — thanks @JxnLexn
-- **feat:** add principal-scoped CCR MCP lifecycle ([#7282](https://github.com/diegosouzapw/OmniRoute/pull/7282)) — thanks @JxnLexn
-- **feat(morph):** refresh curated models ([#7314](https://github.com/diegosouzapw/OmniRoute/pull/7314)) — thanks @backryun
-- **feat(issue-agent):** surface RecordedTriageTimeoutError as 504 ([#7315](https://github.com/diegosouzapw/OmniRoute/pull/7315)) — thanks @KooshaPari
-- **feat(incident-response):** structured incident response templates ([#7334](https://github.com/diegosouzapw/OmniRoute/pull/7334)) — thanks @KooshaPari
-- **feat(providers):** add xAI OAuth PKCE provider ([#7399](https://github.com/diegosouzapw/OmniRoute/pull/7399)) — thanks @fenix007
-- **feat(models):** advertise Claude reasoning-effort variants in /v1/models ([#7497](https://github.com/diegosouzapw/OmniRoute/pull/7497)) — thanks @thepigdestroyer
-- **feat(kimi):** sync Code, Web, and Moonshot providers ([#7531](https://github.com/diegosouzapw/OmniRoute/pull/7531)) — thanks @backryun
-- **feat(resilience):** guard OmniRoute peer routing loops ([#7555](https://github.com/diegosouzapw/OmniRoute/pull/7555)) — thanks @isiahw1
-- **feat:** add Mixedbread AI as embeddings provider (#6660) ([#7595](https://github.com/diegosouzapw/OmniRoute/pull/7595))
-- **feat(providers):** add Rev AI speech-to-text provider (#6655) ([#7596](https://github.com/diegosouzapw/OmniRoute/pull/7596))
-- **feat:** add Freepik (Magnific Mystic) image generation provider (#6654) ([#7597](https://github.com/diegosouzapw/OmniRoute/pull/7597))
-- **feat(sse):** add DeepInfra as a video-generation provider (#6653) ([#7598](https://github.com/diegosouzapw/OmniRoute/pull/7598))
-- **feat(providers):** add Felo chat-aggregator provider (#6666) ([#7599](https://github.com/diegosouzapw/OmniRoute/pull/7599))
-- **feat(sse):** add Notion AI Web (Unofficial/Experimental) provider (#6758) ([#7600](https://github.com/diegosouzapw/OmniRoute/pull/7600))
-- **feat:** add FreeTheAi as OpenAI-compatible gateway provider (#6670) ([#7602](https://github.com/diegosouzapw/OmniRoute/pull/7602))
-- **feat:** add Gladia as an async speech-to-text provider (#6657) ([#7603](https://github.com/diegosouzapw/OmniRoute/pull/7603))
-- **feat:** add EdgeTTS audio-tts provider (#6668) ([#7605](https://github.com/diegosouzapw/OmniRoute/pull/7605))
-- **feat(video):** add Novita AI as video-generation provider (#6658) ([#7606](https://github.com/diegosouzapw/OmniRoute/pull/7606))
-- **feat:** add Segmind image+video provider (#6656) ([#7608](https://github.com/diegosouzapw/OmniRoute/pull/7608))
-- **feat:** add Microsoft Designer as image provider (#6672) ([#7609](https://github.com/diegosouzapw/OmniRoute/pull/7609))
-- **feat:** per-model default reasoning_effort + no-think none on OpenAI path (#6879) ([#7631](https://github.com/diegosouzapw/OmniRoute/pull/7631))
-- **feat(sse):** per-model upstream header-response timeout override (#6354) ([#7632](https://github.com/diegosouzapw/OmniRoute/pull/7632))
-- **feat(dashboard):** in-product guidance for prompt compression engines (#7530) ([#7634](https://github.com/diegosouzapw/OmniRoute/pull/7634))
-- **feat(usage):** add TTFT/E2E-latency/tokens-per-second to model latency stats (#6875) ([#7635](https://github.com/diegosouzapw/OmniRoute/pull/7635))
-- **feat:** import providers from CSV/JSON file (#6836) ([#7636](https://github.com/diegosouzapw/OmniRoute/pull/7636))
-- **feat:** confirm before removing a single connection (#7361) ([#7640](https://github.com/diegosouzapw/OmniRoute/pull/7640))
-- **feat(sse):** honor excluded models in no-auth auto-combo candidate pool (#7622) ([#7646](https://github.com/diegosouzapw/OmniRoute/pull/7646))
-- **feat(providers):** add g4f.space no-key gateway (groq/gemini/pollinations/ollama/nvidia) (#6650) ([#7647](https://github.com/diegosouzapw/OmniRoute/pull/7647))
-- **feat:** rate-limit queue admission control (maxQueueDepth + 15s default) (#6593) ([#7649](https://github.com/diegosouzapw/OmniRoute/pull/7649))
-- **feat(sse):** generalize session affinity TTL to all providers (#7274) ([#7650](https://github.com/diegosouzapw/OmniRoute/pull/7650))
-- **feat:** OpenRouter quota tracking (key/credits + free-window counter) (#6842) ([#7651](https://github.com/diegosouzapw/OmniRoute/pull/7651))
-- **feat(sse):** quota tracking for AgentRouter, v0 (Vercel), FreeModel (#6850, #6845, #7075) ([#7653](https://github.com/diegosouzapw/OmniRoute/pull/7653))
-- **feat(providers):** Speechmatics STT, gTTS, VibeProxy preset (#6659, #6667, #6874) ([#7655](https://github.com/diegosouzapw/OmniRoute/pull/7655))
-- **feat(api):** route Google AI Studio Imagen through /v1/images/generations ([#7656](https://github.com/diegosouzapw/OmniRoute/pull/7656)) — thanks @danscMax
-
-- **feat(auth):** OIDC as optional dashboard admin login gate (password fallback preserved) ([#6973](https://github.com/diegosouzapw/OmniRoute/pull/6973)) — thanks @mikolaj92
-- **feat(api):** add pagination params to 8 DB modules + recharts code-split ([#7046](https://github.com/diegosouzapw/OmniRoute/pull/7046)) — thanks @oyi77
-- **feat(proxy):** operator-level proxy subscriptions (Karing-style) — hardened, ready for review ([#7299](https://github.com/diegosouzapw/OmniRoute/pull/7299)) — thanks @xier2012
-- **feat(grok-cli):** align with official Grok Build client ([#7358](https://github.com/diegosouzapw/OmniRoute/pull/7358)) — thanks @backryun
-- **feat(providers):** Complete GHE Copilot OAuth provider implementation ([#7546](https://github.com/diegosouzapw/OmniRoute/pull/7546)) — thanks @hppsc1215
-- **feat(guardrails):** add CredentialMaskerGuardrail for API key/secret redaction ([#7683](https://github.com/diegosouzapw/OmniRoute/pull/7683)) — thanks @Securiteru
-- **feat(perplexity):** refresh provider integrations ([#7687](https://github.com/diegosouzapw/OmniRoute/pull/7687)) — thanks @backryun
-- **feat(providers):** notion-web live model discovery via getAvailableModels ([#7696](https://github.com/diegosouzapw/OmniRoute/pull/7696)) — thanks @artickc
-- **feat(providers):** add proactive cf_clearance/User-Agent hint to grok-web connection dialog (#7567) ([#7713](https://github.com/diegosouzapw/OmniRoute/pull/7713))
-- **feat:** add live gRPC-web quota fetcher for grok-cli (#6844) ([#7714](https://github.com/diegosouzapw/OmniRoute/pull/7714))
-- **feat(api):** add opt-in auto-sync scheduler for free-proxy sources (#7079) ([#7716](https://github.com/diegosouzapw/OmniRoute/pull/7716))
-- **feat(dashboard):** show proxy name in badge, sort saved-proxy picker, default to Saved tab (#7643) ([#7720](https://github.com/diegosouzapw/OmniRoute/pull/7720))
-- **feat(cli):** add auth export command for decrypted provider credentials (#6683) ([#7724](https://github.com/diegosouzapw/OmniRoute/pull/7724))
-- **feat(oauth):** accept full ChatGPT session JSON for Codex manual import (#6636) ([#7725](https://github.com/diegosouzapw/OmniRoute/pull/7725))
-- **feat(sse):** add nvidia NIM local RPM budget + concurrency cap (#6846) ([#7726](https://github.com/diegosouzapw/OmniRoute/pull/7726))
-- **feat(gemini-web):** emulate OpenAI tool calling via the webTools prompt shim (#7286) ([#7727](https://github.com/diegosouzapw/OmniRoute/pull/7727))
-- **feat(services):** introduce pluggable service-provider contract, migrate 9router (#7333) ([#7730](https://github.com/diegosouzapw/OmniRoute/pull/7730))
-- **feat(mitm):** root-CA + per-host leaf certs for AgentBridge static server (#6684) ([#7731](https://github.com/diegosouzapw/OmniRoute/pull/7731))
-- **feat(providers):** add hailuo-web (MiniMax web) chat provider (#6673) ([#7734](https://github.com/diegosouzapw/OmniRoute/pull/7734))
-- **feat:** browser login for Grok Build provider (#7013) ([#7735](https://github.com/diegosouzapw/OmniRoute/pull/7735))
-- **feat(routing):** wire interceptFetch tool interception into the chat pipeline (#7339) ([#7736](https://github.com/diegosouzapw/OmniRoute/pull/7736))
-- **feat(sse):** add X-OmniRoute-Decision routing trace header (#6022) ([#7765](https://github.com/diegosouzapw/OmniRoute/pull/7765))
-- **feat(providers):** zai-web live model discovery with local-catalog fallback (#7678) ([#7766](https://github.com/diegosouzapw/OmniRoute/pull/7766))
-- **feat(api):** sync upstream reasoning.supported_efforts into synced-model catalog (#7694) ([#7767](https://github.com/diegosouzapw/OmniRoute/pull/7767))
-- **feat(dashboard):** pin Kimi providers first in category + official supporter card accent ([#7775](https://github.com/diegosouzapw/OmniRoute/pull/7775))
-- **feat(chaos+ponytail):** parallel chaos-mode dispatch + ponytail output … ([#7781](https://github.com/diegosouzapw/OmniRoute/pull/7781)) — thanks @Moseyuh333
-- **feat(perf):** IC2 — cache provider connections by ID + lazy-decrypt credentials ([#7787](https://github.com/diegosouzapw/OmniRoute/pull/7787)) — thanks @oyi77
-- **feat(quality):** gate the free-tier headline so it can never silently drift again ([#7798](https://github.com/diegosouzapw/OmniRoute/pull/7798))
-- **feat(providers):** expose an explicit tier override for any provider connection (#7818) ([#7838](https://github.com/diegosouzapw/OmniRoute/pull/7838))
-- **feat(routing):** read-only auto/* candidate transparency + per-API-key exclusions (#7819) ([#7839](https://github.com/diegosouzapw/OmniRoute/pull/7839))
-- **feat(catalog):** map unmapped free tiers, add navy + aihorde, surface keyless providers ([#7840](https://github.com/diegosouzapw/OmniRoute/pull/7840))
-- **feat(providers):** add OpenRouter speech-to-text (audio transcription) provider ([#7861](https://github.com/diegosouzapw/OmniRoute/pull/7861)) — thanks @Tasogarre
-- **feat(qwen):** add Qwen3.8 Max Preview catalogs [Part 2/3] ([#7874](https://github.com/diegosouzapw/OmniRoute/pull/7874)) — thanks @backryun
-- **feat:** support Bun bundled SQLite runtime ([#7878](https://github.com/diegosouzapw/OmniRoute/pull/7878)) — thanks @Arul-
-- **feat(providers):** add 5 free-tier providers (ainative, aion, sealion, routeway, nara) ([#7887](https://github.com/diegosouzapw/OmniRoute/pull/7887))
-- **feat(vnc-session):** persistent noVNC browser login for web-cookie providers ([#7892](https://github.com/diegosouzapw/OmniRoute/pull/7892)) — thanks @Capslockb
-- **feat(sse):** add PromptQL playground provider (unofficial) ([#7911](https://github.com/diegosouzapw/OmniRoute/pull/7911)) — thanks @artickc
-- **feat(cline):** align ClinePass catalog and request protocol ([#7914](https://github.com/diegosouzapw/OmniRoute/pull/7914)) — thanks @backryun
-- **feat:** narrow mcp:connect scope + per-key HTTP tool-scope binding (#7895) ([#7967](https://github.com/diegosouzapw/OmniRoute/pull/7967))
-- **feat:** provider tab account search + mirrored top pagination (#7937) ([#7968](https://github.com/diegosouzapw/OmniRoute/pull/7968))
-- **feat:** canonical numeric helpers + tier-1 (analytics) migration (#7879) ([#7969](https://github.com/diegosouzapw/OmniRoute/pull/7969))
-- **feat(sse):** add HyperAgent (hyperagent.com) unofficial web provider ([#7994](https://github.com/diegosouzapw/OmniRoute/pull/7994)) — thanks @artickc
-- **feat:** copilot-m365-web tone-selected model variants (#7872) ([#7997](https://github.com/diegosouzapw/OmniRoute/pull/7997))
-- **feat(media):** Adobe Firefly image + video generation provider ([#8006](https://github.com/diegosouzapw/OmniRoute/pull/8006)) — thanks @artickc
-- **feat(routing):** add prompt-cache affinity ([#8008](https://github.com/diegosouzapw/OmniRoute/pull/8008)) — thanks @JxnLexn
-- **feat(compression):** select model-aware tokenizers ([#8009](https://github.com/diegosouzapw/OmniRoute/pull/8009)) — thanks @JxnLexn
-- **feat(compression):** add Responses tool-output engine ([#8010](https://github.com/diegosouzapw/OmniRoute/pull/8010)) — thanks @JxnLexn
-- **feat(dashboard):** Kimi sponsor banner, Kimi Coding preset, official logomarks and partner links ([#8039](https://github.com/diegosouzapw/OmniRoute/pull/8039))
-- **feat(dashboard):** make Codex quota card windows reflect reality ([#8054](https://github.com/diegosouzapw/OmniRoute/pull/8054)) — thanks @insoln
-- **feat(compression):** teach the model the CCR retrieve protocol on first marker (#8033) ([#8063](https://github.com/diegosouzapw/OmniRoute/pull/8063))
-- **feat(compression):** per-model/endpoint compression exclusion filter (#8034) ([#8064](https://github.com/diegosouzapw/OmniRoute/pull/8064))
-- **feat(providers):** add CLOVA Studio, InternLM and Ant Ling API-key providers ([#8077](https://github.com/diegosouzapw/OmniRoute/pull/8077)) — thanks @alvaretto
-- **feat(codex):** support reference image edits ([#8122](https://github.com/diegosouzapw/OmniRoute/pull/8122)) — thanks @xiaoyaner0201
-- **feat(providers):** add weekly quota tracking for grok-web ([#8127](https://github.com/diegosouzapw/OmniRoute/pull/8127)) — thanks @apoapostolov
-- **feat(providers):** add Sarvam AI, Writer Palmyra and PLaMo API-key providers ([#8161](https://github.com/diegosouzapw/OmniRoute/pull/8161)) — thanks @alvaretto
-- **feat:** native Fish Audio TTS provider on /v1/audio/speech (#8099) ([#8164](https://github.com/diegosouzapw/OmniRoute/pull/8164))
-- **feat:** zh-CN terminology glossary + consistency gate + normalization pass (#8038) ([#8166](https://github.com/diegosouzapw/OmniRoute/pull/8166))
-- **feat(providers):** add Typhoon (Thailand) and Inception Mercury diffusion LLM ([#8170](https://github.com/diegosouzapw/OmniRoute/pull/8170)) — thanks @alvaretto
-- **feat(sse):** restrict auto-combo no-auth pool to allowlist (opencode, felo) + docs ([#8183](https://github.com/diegosouzapw/OmniRoute/pull/8183))
-- **feat(sre):** add tcp-close-analyzer.py for debugging client-vs-server TCP close order ([#8208](https://github.com/diegosouzapw/OmniRoute/pull/8208)) — thanks @hartmark
-- **feat(settings):** configurable model catalog cache TTL ([#8219](https://github.com/diegosouzapw/OmniRoute/pull/8219)) — thanks @oyi77
-- **feat(github-models):** refresh catalog and compatibility ([#8225](https://github.com/diegosouzapw/OmniRoute/pull/8225)) — thanks @backryun
-- **feat(github):** refresh Copilot model catalog ([#8226](https://github.com/diegosouzapw/OmniRoute/pull/8226)) — thanks @backryun
-- **feat:** classify grok-web Cloudflare anti-bot blocks + gated browser-backed cf_clearance path (#8019) ([#8241](https://github.com/diegosouzapw/OmniRoute/pull/8241))
-### ⚡ Performance
-
-- **perf(db):** project columns + composite index in getProviderConnections ([#6918](https://github.com/diegosouzapw/OmniRoute/pull/6918)) — thanks @oyi77
-- **perf(db):** add jitter to stagger due-on-restart connections ([#6919](https://github.com/diegosouzapw/OmniRoute/pull/6919)) — thanks @oyi77
-- **perf(startup):** warm model catalog cache at module init ([#6920](https://github.com/diegosouzapw/OmniRoute/pull/6920)) — thanks @oyi77
-- **perf(db):** add temp_store=MEMORY pragma to SQLite init ([#6921](https://github.com/diegosouzapw/OmniRoute/pull/6921)) — thanks @oyi77
-- **perf(db):** cap modelLockouts eviction at 1000 entries ([#6923](https://github.com/diegosouzapw/OmniRoute/pull/6923)) — thanks @oyi77
-- **perf:** wrap ComboCard, HeroSection in React.memo ([#7070](https://github.com/diegosouzapw/OmniRoute/pull/7070)) — thanks @oyi77
-
-- **perf:** Date.now hoist, hasActiveDeltaValue hoist, buffer.split guard in SSE stream ([#7066](https://github.com/diegosouzapw/OmniRoute/pull/7066)) — thanks @oyi77
-- **perf(memory):** mitigate event-loop starvation under 3000+ provider connections ([#7719](https://github.com/diegosouzapw/OmniRoute/pull/7719)) — thanks @oyi77
-- **perf:** reduce long-context request copies ([#7862](https://github.com/diegosouzapw/OmniRoute/pull/7862)) — thanks @RaviTharuma
-- **perf:** lazy provider init, P2C quota cache, structuredClone elimination, getSettings→getCachedSettings (batch 2) ([#7893](https://github.com/diegosouzapw/OmniRoute/pull/7893)) — thanks @oyi77
-### 🐛 Bug Fixes
-
-- **fix:** add re-entrancy guard to token health check sweep ([#6917](https://github.com/diegosouzapw/OmniRoute/pull/6917)) — thanks @oyi77
-- **fix(grok):** strip reasoningEffort for grok cli models ([#6938](https://github.com/diegosouzapw/OmniRoute/pull/6938)) — thanks @CitrusIce
-- **fix(6954,6953):** preserve system role + strip empty-signature thinking blocks ([#6982](https://github.com/diegosouzapw/OmniRoute/pull/6982)) — thanks @rafaumeu
-- **fix(6980):** classify Cloudflare AI neuron exhaustion as quota_exhausted ([#6983](https://github.com/diegosouzapw/OmniRoute/pull/6983)) — thanks @rafaumeu
-- **fix(dashboard):** hide disabled provider connections from combo builder ([#6984](https://github.com/diegosouzapw/OmniRoute/pull/6984))
-- **fix(providers):** cap grok-cli tools at 200 for cli-chat-proxy ([#6986](https://github.com/diegosouzapw/OmniRoute/pull/6986))
-- **fix(6848):** auto-cleanup for telemetry tables causing OOM ([#6988](https://github.com/diegosouzapw/OmniRoute/pull/6988)) — thanks @rafaumeu
-- **fix(models):** preserve direct-model combo metadata ([#6993](https://github.com/diegosouzapw/OmniRoute/pull/6993)) — thanks @JxnLexn
-- **fix:** DDG circuit breaker (#6999) + null content validation (#7000) ([#7001](https://github.com/diegosouzapw/OmniRoute/pull/7001)) — thanks @rafaumeu
-- **fix(models):** preserve chat-capable image model rows ([#7004](https://github.com/diegosouzapw/OmniRoute/pull/7004)) — thanks @xz-dev
-- **fix(codex):** preserve GPT-5.6 reasoning contract ([#7012](https://github.com/diegosouzapw/OmniRoute/pull/7012)) — thanks @xz-dev
-- **fix(base-red):** align least-used combo tests with executionKey usage keying ([#7015](https://github.com/diegosouzapw/OmniRoute/pull/7015))
-- **fix:** infer bare models from active synced catalogs ([#7028](https://github.com/diegosouzapw/OmniRoute/pull/7028)) — thanks @guanbear
-- **fix(auggie):** update model registry to match v0.32.0 CLI model IDs ([#7032](https://github.com/diegosouzapw/OmniRoute/pull/7032)) — thanks @oyi77
-- **fix(sse):** register ollama-cloud in USAGE_FETCHER_PROVIDERS (#7026) ([#7041](https://github.com/diegosouzapw/OmniRoute/pull/7041)) — thanks @alltomatos
-- **fix(quality):** read cognitiveComplexity= machine line in validate-release-green (#7009) ([#7042](https://github.com/diegosouzapw/OmniRoute/pull/7042)) — thanks @alltomatos
-- **fix(providers):** sanitize Claude native output_config.effort (#7044) ([#7050](https://github.com/diegosouzapw/OmniRoute/pull/7050)) — thanks @xier2012
-- **fix(combo):** treat maxInputTokens as an input-only cap in the context filter (#7039) ([#7052](https://github.com/diegosouzapw/OmniRoute/pull/7052)) — thanks @xier2012
-- **fix(antigravity):** collect native part.functionCall into tool calls (#7037) ([#7053](https://github.com/diegosouzapw/OmniRoute/pull/7053)) — thanks @xier2012
-- **fix(responses):** map mid-conversation system turns to developer role (#6954) ([#7056](https://github.com/diegosouzapw/OmniRoute/pull/7056)) — thanks @xier2012
-- **fix(combo):** least-used sorts by per-account executionKey (#7015) ([#7059](https://github.com/diegosouzapw/OmniRoute/pull/7059)) — thanks @xier2012
-- **fix(providers):** AgentRouter model import applies Claude Code wire image to /v1/models (#7016) ([#7060](https://github.com/diegosouzapw/OmniRoute/pull/7060)) — thanks @xier2012
-- **fix(translator):** preserve thinking.budget_tokens: 0 in Claude->Gemini (#6813) ([#7061](https://github.com/diegosouzapw/OmniRoute/pull/7061)) — thanks @xier2012
-- **fix(cloudflare-relay):** avoid invalid regex syntax in generated worker ([#7063](https://github.com/diegosouzapw/OmniRoute/pull/7063)) — thanks @SeaXen
-- **fix(dashboard):** strip browser-extension attrs before hydration ([#7073](https://github.com/diegosouzapw/OmniRoute/pull/7073)) — thanks @MrFadiAi
-- **fix(relay):** bound Bifrost stream lifetime ([#7093](https://github.com/diegosouzapw/OmniRoute/pull/7093)) — thanks @KooshaPari
-- **fix(sse):** recognize xiaomi-tokenplan mimo as a thinking-mode model ([#7098](https://github.com/diegosouzapw/OmniRoute/pull/7098))
-- **fix(codex):** strip regex lookaround from tool schema patterns ([#7100](https://github.com/diegosouzapw/OmniRoute/pull/7100))
-- **fix(openai):** strip reasoning_effort when GPT-5.x models carry function tools ([#7101](https://github.com/diegosouzapw/OmniRoute/pull/7101))
-- **fix(compression):** Headroom SmartCrusher skips developer-role messages (port from 9router#2132) ([#7102](https://github.com/diegosouzapw/OmniRoute/pull/7102))
-- **fix(providers):** surface a warning on 404 model_not_found in OpenAI-compatible Check (port from 9router#2032) ([#7103](https://github.com/diegosouzapw/OmniRoute/pull/7103))
-- **fix(executors):** forward X-Session-ID/X-Title agent metadata headers ([#7104](https://github.com/diegosouzapw/OmniRoute/pull/7104))
-- **fix(cli):** verify better-sqlite3 native binary is actually loadable ([#7105](https://github.com/diegosouzapw/OmniRoute/pull/7105))
-- **fix(sse):** sanitize non-ok Antigravity streaming error body (port from 9router#2461) ([#7106](https://github.com/diegosouzapw/OmniRoute/pull/7106))
-- **fix(providers):** add MiniMax image-generation provider ([#7108](https://github.com/diegosouzapw/OmniRoute/pull/7108))
-- **fix(sse):** handle space-separated arg name/value in Composer tool calls (port from 9router#1811) ([#7116](https://github.com/diegosouzapw/OmniRoute/pull/7116))
-- **fix(cli):** remove MITM DNS spoof entries before killing server process ([#7117](https://github.com/diegosouzapw/OmniRoute/pull/7117))
-- **fix(dashboard):** include never-tested connections in combo builder active-provider list (port from 9router#2057) ([#7118](https://github.com/diegosouzapw/OmniRoute/pull/7118))
-- **fix(api):** check Vercel SSO-protection PATCH response on relay deploy ([#7119](https://github.com/diegosouzapw/OmniRoute/pull/7119))
-- **fix(combos):** reject oversized fusion panels before fan-out (port from 9router#1905) ([#7120](https://github.com/diegosouzapw/OmniRoute/pull/7120))
-- **fix(combo):** detect empty content_block in streaming SSE peek ([#7121](https://github.com/diegosouzapw/OmniRoute/pull/7121))
-- **fix(oauth):** resolve Kiro AWS SSO cache client credentials by clientId match (port from 9router#1253) ([#7122](https://github.com/diegosouzapw/OmniRoute/pull/7122))
-- **fix(tests):** vitest UI suite back to green (69 fails triaged — WS6.1) ([#7127](https://github.com/diegosouzapw/OmniRoute/pull/7127))
-- **fix(auto):** use p95 fallback in speed factors ([#7128](https://github.com/diegosouzapw/OmniRoute/pull/7128)) — thanks @KooshaPari
-- **fix(models):** update Anthropic model contextLength to 1M ([#7129](https://github.com/diegosouzapw/OmniRoute/pull/7129)) — thanks @HouMinXi
-- **fix(ci):** raise dast-smoke timeout 12->25min (build alone eats up to 11min) ([#7139](https://github.com/diegosouzapw/OmniRoute/pull/7139))
-- **fix(compression):** lazy-load typescript in RTK codeStripper so prod-lean deploys don't break (#7096) ([#7164](https://github.com/diegosouzapw/OmniRoute/pull/7164)) — thanks @alltomatos
-- **fix(providers):** accept m365.cloud.microsoft for copilot-m365-web token (#7078) ([#7166](https://github.com/diegosouzapw/OmniRoute/pull/7166)) — thanks @xier2012
-- **fix(executors):** disable parallel tools for Codex Responses Lite ([#7171](https://github.com/diegosouzapw/OmniRoute/pull/7171)) — thanks @fenix007
-- **fix(tests+providers):** env-dependent tests exposed by GH-hosted runners (#6634 selfref shallow checkout + yuanbao live-network 401) ([#7174](https://github.com/diegosouzapw/OmniRoute/pull/7174))
-- **fix(combo):** reject known context overflow without exhausting providers ([#7177](https://github.com/diegosouzapw/OmniRoute/pull/7177)) — thanks @JxnLexn
-- **fix:** add static.cloudflareinsights.com to CSP script-src ([#7178](https://github.com/diegosouzapw/OmniRoute/pull/7178)) — thanks @oyi77
-- **fix:** extend turbopack ignoreIssue suppression to compression module (#7051) ([#7180](https://github.com/diegosouzapw/OmniRoute/pull/7180))
-- **fix:** recognize Ollama Cloud session usage-limit 429 as quota-exhausted (#7071) ([#7181](https://github.com/diegosouzapw/OmniRoute/pull/7181))
-- **fix:** preserve relayAuth for pool-referenced relay proxies (#5716) ([#7182](https://github.com/diegosouzapw/OmniRoute/pull/7182))
-- **fix:** wire adaptive context-budget dial into settings schema and DB (#7005) ([#7183](https://github.com/diegosouzapw/OmniRoute/pull/7183))
-- **fix(providers):** DuckDuckGo VQD 429 misclassified as 503 (#6996) ([#7185](https://github.com/diegosouzapw/OmniRoute/pull/7185))
-- **fix(db):** cap OOM probe-failure cycle in getDbInstance() (#6835) ([#7186](https://github.com/diegosouzapw/OmniRoute/pull/7186))
-- **fix:** stop opencode-go quota lookup defaulting to Z.AI endpoint (#7022) ([#7187](https://github.com/diegosouzapw/OmniRoute/pull/7187))
-- **fix(providers):** refresh OpenCode (oc) free-tier model catalog (#6998) ([#7188](https://github.com/diegosouzapw/OmniRoute/pull/7188))
-- **fix:** include proxyId when testing a saved registry proxy (#7080) ([#7189](https://github.com/diegosouzapw/OmniRoute/pull/7189))
-- **fix:** sanitize non-Latin1 chars in combo diagnostic headers (#6612) ([#7190](https://github.com/diegosouzapw/OmniRoute/pull/7190))
-- **fix:** raise main server keepAliveTimeout/headersTimeout above Node's 5s default (#7003) ([#7191](https://github.com/diegosouzapw/OmniRoute/pull/7191))
-- **fix:** route zai-web (and other registry-entry web-cookie providers) connection-test cookie probe through the configured proxy (#7058) ([#7192](https://github.com/diegosouzapw/OmniRoute/pull/7192))
-- **fix(providers):** reject chat requests for cloud-agent-only jules provider (#6699) ([#7193](https://github.com/diegosouzapw/OmniRoute/pull/7193))
-- **fix:** restore mobile grid-cols-1 fallback on quota page card grid (#7072) ([#7194](https://github.com/diegosouzapw/OmniRoute/pull/7194))
-- **fix:** wire modelAliases fetch into HermesAgentToolCard (#7151) ([#7195](https://github.com/diegosouzapw/OmniRoute/pull/7195))
-- **fix:** surface real claude-web error body for non-SSE 400s (#7134) ([#7196](https://github.com/diegosouzapw/OmniRoute/pull/7196))
-- **fix(dashboard):** agent bridge dns toggle uses POST, not PUT (#7157) ([#7197](https://github.com/diegosouzapw/OmniRoute/pull/7197))
-- **fix:** stop duplicating text in Gemini Web streamed responses (#7163) ([#7198](https://github.com/diegosouzapw/OmniRoute/pull/7198))
-- **fix:** filter hidden custom models out of legacy combo model picker (#7156) ([#7199](https://github.com/diegosouzapw/OmniRoute/pull/7199))
-- **fix(dashboard):** implement missing handleToggleSource on Free Pool tab (#7161) ([#7200](https://github.com/diegosouzapw/OmniRoute/pull/7200))
-- **fix:** honor combo-level proxy assignments from the registry (#7149) ([#7201](https://github.com/diegosouzapw/OmniRoute/pull/7201))
-- **fix(ci):** run quality gates on Mergify merge-queue draft PRs (anchor check never ran, queue always dequeued) ([#7202](https://github.com/diegosouzapw/OmniRoute/pull/7202))
-- **fix:** add dashboard-scoped typecheck gate covering src/app/(dashboard) TSX (#7033) ([#7203](https://github.com/diegosouzapw/OmniRoute/pull/7203))
-- **fix(guardrails/chat):** stop Vision Bridge hijacking credentialed models to opencode-zen ([#7204](https://github.com/diegosouzapw/OmniRoute/pull/7204)) — thanks @artickc
-- **fix(translator):** preserve Gemini thought parts as reasoning_content on the OpenAI bridge ([#7206](https://github.com/diegosouzapw/OmniRoute/pull/7206))
-- **fix(translator):** register openai response projection for gemini clients ([#7207](https://github.com/diegosouzapw/OmniRoute/pull/7207))
-- **fix(cli):** fast-path --version to skip full CLI bootstrap ([#7208](https://github.com/diegosouzapw/OmniRoute/pull/7208))
-- **fix:** honor PROVIDER_LIMITS_SYNC_SPACING_MS for local/API-key connections (#6916) ([#7214](https://github.com/diegosouzapw/OmniRoute/pull/7214))
-- **fix(api):** bulk-add API keys no longer overwrite existing connections ([#7234](https://github.com/diegosouzapw/OmniRoute/pull/7234))
-- **fix(sse):** route the public OpenAI GPT-5.6 family through the Responses API ([#7242](https://github.com/diegosouzapw/OmniRoute/pull/7242))
-- **fix(providers):** honor configured proxy on Grok Build egress ([#7244](https://github.com/diegosouzapw/OmniRoute/pull/7244))
-- **fix(nvidia):** expand NIM chat model catalog ([#7247](https://github.com/diegosouzapw/OmniRoute/pull/7247))
-- **fix(sse):** reconstruct Claude-format content in synthetic bypass responses ([#7248](https://github.com/diegosouzapw/OmniRoute/pull/7248))
-- **fix(build):** isolate Windows HOME/AppData during next build ([#7249](https://github.com/diegosouzapw/OmniRoute/pull/7249))
-- **fix(cli):** omniroute dashboard respects PORT env when --port is omitted (#7049) ([#7252](https://github.com/diegosouzapw/OmniRoute/pull/7252))
-- **fix(sse):** project non-streaming JSON back to the Gemini/Antigravity envelope ([#7255](https://github.com/diegosouzapw/OmniRoute/pull/7255))
-- **fix(combo):** fall back on Responses SSE failures ([#7256](https://github.com/diegosouzapw/OmniRoute/pull/7256)) — thanks @rushsinging
-- **fix(routing):** resolve nested combo-ref panel members in fusion strategy (#6764) ([#7259](https://github.com/diegosouzapw/OmniRoute/pull/7259))
-- **fix(usage):** reset logs and show provider names in analytics ([#7264](https://github.com/diegosouzapw/OmniRoute/pull/7264)) — thanks @SeaXen
-- **fix(sse):** silence noisy proxy-failure log on caller-initiated abort ([#7266](https://github.com/diegosouzapw/OmniRoute/pull/7266))
-- **fix(codex):** normalize nested Responses output content ([#7269](https://github.com/diegosouzapw/OmniRoute/pull/7269)) — thanks @JxnLexn
-- **fix(combo):** derive session stickiness key from Responses API .input, not just .messages (#7270) ([#7277](https://github.com/diegosouzapw/OmniRoute/pull/7277)) — thanks @alltomatos
-- **fix(antigravity):** wrap Pro fallback chain in try/catch for timeout resilience ([#7290](https://github.com/diegosouzapw/OmniRoute/pull/7290)) — thanks @HouMinXi
-- **fix(logs):** show saved provider names in request/provider log views ([#7294](https://github.com/diegosouzapw/OmniRoute/pull/7294)) — thanks @SeaXen
-- **fix(stream):** reconcile encrypted Codex reasoning visibility without mutating upstream item ([#7304](https://github.com/diegosouzapw/OmniRoute/pull/7304))
-- **fix(build):** packed tarball boot crash — server-ws timeout import escaped the package (#7065 class) ([#7308](https://github.com/diegosouzapw/OmniRoute/pull/7308))
-- **fix(skills):** register cli-skill-collector in the agent-skills catalog (Integration 2/2 base-red) ([#7310](https://github.com/diegosouzapw/OmniRoute/pull/7310))
-- **fix(db):** tolerate unavailable virtual table modules in stats ([#7313](https://github.com/diegosouzapw/OmniRoute/pull/7313)) — thanks @megamen32
-- **fix(router-eval):** retained-optimization gate cleanup ([#7318](https://github.com/diegosouzapw/OmniRoute/pull/7318)) — thanks @KooshaPari
-- **fix(ci):** Coverage job timeout 10->20min (lcov reporter pushed it past the old cap) ([#7342](https://github.com/diegosouzapw/OmniRoute/pull/7342))
-- **fix(electron):** normalize hashed standalone externals ([#7353](https://github.com/diegosouzapw/OmniRoute/pull/7353)) — thanks @tianrking
-- **fix(db):** stop a 'latest' path segment from disabling backups and migrations ([#7359](https://github.com/diegosouzapw/OmniRoute/pull/7359)) — thanks @danscMax
-- **fix(branding):** regenerate raster favicons — white mark was shipped without its gradient tile ([#7390](https://github.com/diegosouzapw/OmniRoute/pull/7390)) — thanks @vzts
-- **fix(test):** skip real DNS writes in MITM dynamic-import test ([#7398](https://github.com/diegosouzapw/OmniRoute/pull/7398)) — thanks @HouMinXi
-- **fix(antigravity):** streaming passthrough for non-streaming clients ([#7408](https://github.com/diegosouzapw/OmniRoute/pull/7408)) — thanks @HouMinXi
-- **fix(build):** align engines.node with SUPPORTED_NODE_RANGE (#7446) ([#7490](https://github.com/diegosouzapw/OmniRoute/pull/7490)) — thanks @alltomatos
-- **fix(api):** await params in Agent Bridge DNS route (Next.js 16) (#7271) ([#7492](https://github.com/diegosouzapw/OmniRoute/pull/7492)) — thanks @alltomatos
-- **fix(dashboard):** show Obsidian context source card ([#7500](https://github.com/diegosouzapw/OmniRoute/pull/7500)) — thanks @DKotsyuba
-- **fix(ci):** fetch full base history in pr-test-policy (shallow graft broke merge-base) ([#7501](https://github.com/diegosouzapw/OmniRoute/pull/7501))
-- **fix(sse):** preserve chat quota across mixed windows ([#7504](https://github.com/diegosouzapw/OmniRoute/pull/7504)) — thanks @webmasterarbez
-- **fix(oauth):** surface sanitized device-code error instead of a generic 500 ([#7511](https://github.com/diegosouzapw/OmniRoute/pull/7511)) — thanks @danscMax
-- **fix(oauth):** repair qwen + codebuddy-cn device-code endpoints ([#7517](https://github.com/diegosouzapw/OmniRoute/pull/7517)) — thanks @danscMax
-- **fix(mitm):** strip trailing assistant prefill to prevent upstream Anthropic 400 errors ([#7520](https://github.com/diegosouzapw/OmniRoute/pull/7520)) — thanks @chirag127
-- **fix(codex):** Test probe uses a ChatGPT-account-supported model (#7521) ([#7524](https://github.com/diegosouzapw/OmniRoute/pull/7524))
-- **fix(codex):** validate refresh_token on import before persisting (#7522) ([#7525](https://github.com/diegosouzapw/OmniRoute/pull/7525))
-- **fix(codex):** non-stream chat 502 'Response body is already used' (single-reader peek) ([#7526](https://github.com/diegosouzapw/OmniRoute/pull/7526))
-- **fix(oauth):** surface tunnel hint when Codex OAuth runs on a remote host (#7523) ([#7527](https://github.com/diegosouzapw/OmniRoute/pull/7527))
-- **fix(sse):** preserve custom tool output images ([#7540](https://github.com/diegosouzapw/OmniRoute/pull/7540)) — thanks @loulanyue
-- **fix(combo):** failover when upstream SSE is truncated mid-lifecycle ([#7545](https://github.com/diegosouzapw/OmniRoute/pull/7545)) — thanks @Chewji9875
-- **fix(dashboard):** prefer public endpoint URLs ([#7547](https://github.com/diegosouzapw/OmniRoute/pull/7547)) — thanks @nguyenha935
-- **fix(cli):** refresh runtime detection accurately ([#7552](https://github.com/diegosouzapw/OmniRoute/pull/7552)) — thanks @nguyenha935
-- **fix(ui):** improve React Flow dark theme ([#7553](https://github.com/diegosouzapw/OmniRoute/pull/7553)) — thanks @nguyenha935
-- **fix(i18n):** treat **MISSING** sync placeholders as absent in EN fallback (#7258) ([#7556](https://github.com/diegosouzapw/OmniRoute/pull/7556))
-- **fix(cli):** Windows cert check/uninstall key off the real CA identity, not a hardcoded legacy host (#7275) ([#7557](https://github.com/diegosouzapw/OmniRoute/pull/7557))
-- **fix(sse):** feed compression pipeline the authoritative vision capability (#7237) ([#7560](https://github.com/diegosouzapw/OmniRoute/pull/7560))
-- **fix(dashboard):** providers model-name filter matches live/synced catalog (#7250) ([#7561](https://github.com/diegosouzapw/OmniRoute/pull/7561))
-- **fix(db):** pre-init sql.js WASM ahead of any getDbInstance() consumer (#7288) ([#7562](https://github.com/diegosouzapw/OmniRoute/pull/7562))
-- **fix(dashboard):** resolve costs page 500 from out-of-scope t() in TopListCard (#7272) ([#7564](https://github.com/diegosouzapw/OmniRoute/pull/7564))
-- **fix(dashboard):** surface rate-limit warning on 429 chat-probe (#7284) ([#7565](https://github.com/diegosouzapw/OmniRoute/pull/7565))
-- **fix(sse):** lazy-load playwright in claudeTurnstileSolver (#7265) ([#7566](https://github.com/diegosouzapw/OmniRoute/pull/7566))
-- **fix(sse):** combo failover for OpenAI streams truncated without finish_reason (#7285) ([#7568](https://github.com/diegosouzapw/OmniRoute/pull/7568))
-- **fix(cli):** reuse win32-aware locateCommand in tool-detector (#7279) ([#7569](https://github.com/diegosouzapw/OmniRoute/pull/7569))
-- **fix(codex):** #7536 check content-type before touching response.body in peek ([#7570](https://github.com/diegosouzapw/OmniRoute/pull/7570))
-- **fix(sse):** stop dropping tool_search and leaking OpenAI-only params in Responses->Chat translation ([#7571](https://github.com/diegosouzapw/OmniRoute/pull/7571))
-- **fix(api):** resolve provider display name and dedup byModel on normalized key (#7534, #7535) ([#7573](https://github.com/diegosouzapw/OmniRoute/pull/7573))
-- **fix(mitm):** route Claude Code standalone MITM traffic ([#7574](https://github.com/diegosouzapw/OmniRoute/pull/7574)) — thanks @dongwook-chan
-- **fix(sse):** stop per-byte enumeration of binary image bytes in log redaction (#7297) ([#7576](https://github.com/diegosouzapw/OmniRoute/pull/7576))
-- **fix(sse):** split effort/reasoning suffix off pinned cursor model ids (#7289) ([#7577](https://github.com/diegosouzapw/OmniRoute/pull/7577))
-- **fix(chatgpt-web):** recognize update_content.messages[] celsius WS frames (#7357) ([#7578](https://github.com/diegosouzapw/OmniRoute/pull/7578))
-- **fix(sse):** 401 model-not-supported lockout + sticky quota-exhausted release (#7268, #7387) ([#7580](https://github.com/diegosouzapw/OmniRoute/pull/7580))
-- **fix(antigravity):** allow cloudcode envelope through messages guard ([#7582](https://github.com/diegosouzapw/OmniRoute/pull/7582)) — thanks @dongwook-chan
-- **fix(sse):** sanitize empty-signature thinking blocks + hoist strict-provider system messages ([#7583](https://github.com/diegosouzapw/OmniRoute/pull/7583))
-- **fix(sse):** honor per-model targetFormat override for zai/glm-coding-apikey (#7364) ([#7584](https://github.com/diegosouzapw/OmniRoute/pull/7584))
-- **fix(sse):** clamp glm-4.6v max_tokens to the 32768 ceiling (#7364) ([#7585](https://github.com/diegosouzapw/OmniRoute/pull/7585))
-- **fix(cli):** log Codex Responses WebSocket history/usage per logical turn, not per connection ([#7588](https://github.com/diegosouzapw/OmniRoute/pull/7588))
-- **fix(providers):** derive static model catalogs for search providers from searchTypes ([#7589](https://github.com/diegosouzapw/OmniRoute/pull/7589))
-- **fix(stream-readiness):** bump timeout for heavy Claude-format reasoning replicas ([#7612](https://github.com/diegosouzapw/OmniRoute/pull/7612)) — thanks @herjarsa
-- **fix(translator):** synthesize tool call chunks from response.completed batched output ([#7613](https://github.com/diegosouzapw/OmniRoute/pull/7613)) — thanks @ekinnee
-- **fix(embeddings):** add lmstudio to embedding provider registry ([#7614](https://github.com/diegosouzapw/OmniRoute/pull/7614)) — thanks @ekinnee
-- **fix(combo):** auto-clear stale session pins and emit recovery hints on combo exhaustion ([#7625](https://github.com/diegosouzapw/OmniRoute/pull/7625)) — thanks @herjarsa
-- **fix(providers):** unify connection and routing flows ([#7629](https://github.com/diegosouzapw/OmniRoute/pull/7629)) — thanks @nguyenha935
-- **fix(db):** dedupe bulk-imported proxies by full credential tuple (#7594) ([#7644](https://github.com/diegosouzapw/OmniRoute/pull/7644)) — thanks @alltomatos
-- **fix(api):** allow text-to-image on dual-modality models + revive HuggingFace image host ([#7648](https://github.com/diegosouzapw/OmniRoute/pull/7648)) — thanks @danscMax
-- **fix(stryker):** add Microsoft Designer test to tap.testFiles ([#7659](https://github.com/diegosouzapw/OmniRoute/pull/7659))
-- **fix(dashboard):** cut UI import chain from connection persist module (CI shard base-red) ([#7677](https://github.com/diegosouzapw/OmniRoute/pull/7677))
-
-- **fix(perplexity-web):** stop empty-content responses from live schematized SSE ([#6955](https://github.com/diegosouzapw/OmniRoute/pull/6955)) — thanks @artickc
-- **fix(dashboard):** make quota cards container responsive ([#7027](https://github.com/diegosouzapw/OmniRoute/pull/7027)) — thanks @xz-dev
-- **fix(nvidia):** restore GLM-5.2 reasoning on NIM (#7215) ([#7296](https://github.com/diegosouzapw/OmniRoute/pull/7296)) — thanks @backryun
-- **fix(i18n):** complete Vietnamese dashboard localization and runtime fixes ([#7493](https://github.com/diegosouzapw/OmniRoute/pull/7493)) — thanks @nguyenha935
-- **fix(providers):** migrate muse-spark-web from GraphQL to WebSocket protocol ([#7528](https://github.com/diegosouzapw/OmniRoute/pull/7528)) — thanks @Ajeesh25353646
-- **fix(combo):** expose computed context_length via /api/combos for accurate OC plugin display ([#7633](https://github.com/diegosouzapw/OmniRoute/pull/7633)) — thanks @herjarsa
-- **fix(api):** enumerate tiered auto combo endpoints in /api/combos/auto ([#7662](https://github.com/diegosouzapw/OmniRoute/pull/7662)) — thanks @ekinnee
-- **fix(dashboard):** topology reflects connection health + clears finished requests ([#7672](https://github.com/diegosouzapw/OmniRoute/pull/7672)) — thanks @danscMax
-- **fix(kimi-coding):** capture and replay reasoning for thinking-mode turns ([#7673](https://github.com/diegosouzapw/OmniRoute/pull/7673)) — thanks @xz-dev
-- **fix(ci):** merge-train --fast mirrors test:unit subdir allowlist ([#7688](https://github.com/diegosouzapw/OmniRoute/pull/7688))
-- **fix(sse):** start credential-health sweep at boot so stale web sessions recover ([#7689](https://github.com/diegosouzapw/OmniRoute/pull/7689)) — thanks @danscMax
-- **fix(cursor):** discover models via official CLI command ([#7692](https://github.com/diegosouzapw/OmniRoute/pull/7692)) — thanks @makcimbx
-- **fix(quota):** fix antigravity/agy multi-model quota skipping in combos ([#7695](https://github.com/diegosouzapw/OmniRoute/pull/7695)) — thanks @irvandikky
-- **fix(usage):** preserve account identity history ([#7700](https://github.com/diegosouzapw/OmniRoute/pull/7700)) — thanks @xz-dev
-- **fix(db):** update proxies on password rotation ([#7707](https://github.com/diegosouzapw/OmniRoute/pull/7707)) — thanks @floze-the-genius
-- **fix(providers):** correct Chutes registry baseUrl (#7621) ([#7708](https://github.com/diegosouzapw/OmniRoute/pull/7708))
-- **fix(routing):** strip prompt_cache_key for NVIDIA NIM (#7617) ([#7709](https://github.com/diegosouzapw/OmniRoute/pull/7709))
-- **fix(providers):** degrade Arena (lmarena) cookie validation redirect to unsupported (#7542) ([#7710](https://github.com/diegosouzapw/OmniRoute/pull/7710))
-- **fix(claude-web):** unify Turnstile/executor/fast-path User-Agents behind one fingerprint (#7548) ([#7711](https://github.com/diegosouzapw/OmniRoute/pull/7711))
-- **fix(sse):** authenticate CLIProxyAPI fallback/passthrough legs with a dedicated credential (#7645) ([#7712](https://github.com/diegosouzapw/OmniRoute/pull/7712))
-- **fix(sse):** proactively refresh Grok Build OAuth token before dispatch (#7610) ([#7715](https://github.com/diegosouzapw/OmniRoute/pull/7715))
-- **fix(providers):** classify ambiguous Mistral 401 instead of hard auth error (#7638) ([#7718](https://github.com/diegosouzapw/OmniRoute/pull/7718))
-- **fix(security):** bump adm-zip >=0.6.0 + exact host matching in mitm DNS test ([#7732](https://github.com/diegosouzapw/OmniRoute/pull/7732))
-- **fix(icons):** fall back to Stepfun Mono when Color component is absent … ([#7743](https://github.com/diegosouzapw/OmniRoute/pull/7743)) — thanks @Dan-ex-hub
-- **fix(stream):** suppress `</think>` close marker for Responses API clients ([#7747](https://github.com/diegosouzapw/OmniRoute/pull/7747)) — thanks @xz-dev
-- **fix(sse):** wire settings.wildcardAliases into model resolution (#7693) ([#7748](https://github.com/diegosouzapw/OmniRoute/pull/7748))
-- **fix(authz):** classify forge/jcode CLI settings routes as LOCAL_ONLY (#7263) ([#7749](https://github.com/diegosouzapw/OmniRoute/pull/7749))
-- **fix(routing):** honor eye-icon hidden models for no-auth providers in auto-combo (#7620) ([#7750](https://github.com/diegosouzapw/OmniRoute/pull/7750))
-- **fix(sse):** persist rotated Gemini web-session cookies via onCredentialsRefreshed (#7676) ([#7751](https://github.com/diegosouzapw/OmniRoute/pull/7751))
-- **fix(docs):** heal release-green docs drift + eslint any-suppression drift (#7253) ([#7755](https://github.com/diegosouzapw/OmniRoute/pull/7755))
-- **fix(mcp):** copy undici into dist/node_modules to prevent hollow-package shadowing crash (#7701) ([#7756](https://github.com/diegosouzapw/OmniRoute/pull/7756))
-- **fix(packaging):** move fumadocs-mdx to devDependencies (#7661) ([#7757](https://github.com/diegosouzapw/OmniRoute/pull/7757))
-- **fix(ci):** build API-only smoke workflows backend-only to fix dast-smoke timeouts (#7226) ([#7758](https://github.com/diegosouzapw/OmniRoute/pull/7758))
-- **fix(cli):** load DATA_DIR/server.env as fallback for .env on Electron migration (#7302) ([#7759](https://github.com/diegosouzapw/OmniRoute/pull/7759))
-- **fix(cli):** split outboundUrlGuard's DB helpers so setup-opencode packages cleanly (#7682) ([#7760](https://github.com/diegosouzapw/OmniRoute/pull/7760))
-- **fix(notion-web):** production-ready labels, multi-workspace, inference, usage (FINAL) ([#7768](https://github.com/diegosouzapw/OmniRoute/pull/7768)) — thanks @artickc
-- **fix(kimi):** expose K3 reasoning effort levels ([#7776](https://github.com/diegosouzapw/OmniRoute/pull/7776)) — thanks @xz-dev
-- **fix(compression):** apply compression combo assignments to routing combos ([#7779](https://github.com/diegosouzapw/OmniRoute/pull/7779)) — thanks @ekinnee
-- **fix(i18n):** regenerate Polish UI locale from English ([#7782](https://github.com/diegosouzapw/OmniRoute/pull/7782)) — thanks @leszek3737
-- **fix(combo):** retry transient errors in pipeline strategy ([#7794](https://github.com/diegosouzapw/OmniRoute/pull/7794)) — thanks @AndrianBalanescu
-- **fix(quality):** register nvidia-quota-phase1 and service-provider-plugin-registry in stryker tap.testFiles ([#7796](https://github.com/diegosouzapw/OmniRoute/pull/7796))
-- **fix(stream):** synthesize terminal finish_reason chunk when upstream omits it (#7800) ([#7804](https://github.com/diegosouzapw/OmniRoute/pull/7804)) — thanks @AndrianBalanescu
-- **fix(plugins):** 5 bugs on the plugin path (3 Windows-only, 2 all-platform) ([#7806](https://github.com/diegosouzapw/OmniRoute/pull/7806)) — thanks @tmone
-- **fix(cli):** register ESM alias resolver for @/ paths under global install ([#7808](https://github.com/diegosouzapw/OmniRoute/pull/7808)) — thanks @rafaumeu
-- **fix(auth):** gate invalid-key check on isRequireApiKeyEnabled for embeddings and web-fetch (#7785) ([#7810](https://github.com/diegosouzapw/OmniRoute/pull/7810)) — thanks @AndrianBalanescu
-- **fix(ci):** repair release regressions exposed by clean runs ([#7812](https://github.com/diegosouzapw/OmniRoute/pull/7812)) — thanks @backryun
-- **fix(rerank):** add voyage format adapter for request/response translation (#7809) ([#7813](https://github.com/diegosouzapw/OmniRoute/pull/7813)) — thanks @AndrianBalanescu
-- **fix(antigravity):** attempt onboarding when projectId is empty (#5193 regression of #2541) ([#7815](https://github.com/diegosouzapw/OmniRoute/pull/7815)) — thanks @rafaumeu
-- **fix(stream):** emit terminal SSE frames on mid-stream upstream failure (#7699) ([#7816](https://github.com/diegosouzapw/OmniRoute/pull/7816)) — thanks @AndrianBalanescu
-- **fix(sse):** strip orphaned tool_use before antigravity/Vertex Claude dispatch (#7752) ([#7822](https://github.com/diegosouzapw/OmniRoute/pull/7822))
-- **fix(translator):** sanitize tool_result.tool_use_id symmetrically with tool_use.id (#7705) ([#7823](https://github.com/diegosouzapw/OmniRoute/pull/7823))
-- **fix(oauth):** require chatgptUserId agreement for Codex account dedup (#7737) ([#7825](https://github.com/diegosouzapw/OmniRoute/pull/7825))
-- **fix(db):** purge in-memory key-health state when a provider connection is deleted (#7740) ([#7826](https://github.com/diegosouzapw/OmniRoute/pull/7826))
-- **fix(compression):** keep a retrievable preamble instead of a bare CCR marker (#7746) ([#7827](https://github.com/diegosouzapw/OmniRoute/pull/7827))
-- **fix(db):** log fatal boot-time SQLite driver-cascade failure before propagating (#7773) ([#7828](https://github.com/diegosouzapw/OmniRoute/pull/7828))
-- **fix(docker):** repair tls-client-node native binary after --ignore-scripts (#7802) ([#7829](https://github.com/diegosouzapw/OmniRoute/pull/7829))
-- **fix(auth):** restore TICK_MS in tokenHealthCheck (ReferenceError on startup) ([#7830](https://github.com/diegosouzapw/OmniRoute/pull/7830))
-- **fix(cli):** fix Windows CLI detection false negatives (#7753, #7774) ([#7831](https://github.com/diegosouzapw/OmniRoute/pull/7831))
-- **fix(docs):** document CREDENTIAL_REDACTION_ENABLED and GHE_COPILOT_OAUTH_CLIENT_ID (#7793) ([#7833](https://github.com/diegosouzapw/OmniRoute/pull/7833))
-- **fix(dashboard):** fix collapsed quota card session/weekly order (#7764) ([#7834](https://github.com/diegosouzapw/OmniRoute/pull/7834))
-- **fix(dashboard):** mirror connection-row action-icon spacing under RTL (#7680) ([#7835](https://github.com/diegosouzapw/OmniRoute/pull/7835))
-- **fix:** avoid cmd.exe spawn on Windows by using os.hostname() before execSync fallback ([#7841](https://github.com/diegosouzapw/OmniRoute/pull/7841)) — thanks @tientien17
-- **fix(usage):** harden account identity reconciliation ([#7843](https://github.com/diegosouzapw/OmniRoute/pull/7843)) — thanks @xz-dev
-- **fix(cli):** use rundll32 instead of cmd.exe for Windows browser fallback in dashboard command ([#7844](https://github.com/diegosouzapw/OmniRoute/pull/7844)) — thanks @tientien17
-- **fix:** add native lifecycle-aware health endpoint ([#7852](https://github.com/diegosouzapw/OmniRoute/pull/7852)) — thanks @RaviTharuma
-- **fix:** reserve chat admission before body parsing ([#7853](https://github.com/diegosouzapw/OmniRoute/pull/7853)) — thanks @RaviTharuma
-- **fix:** bound quadratic session-dedup memory growth ([#7855](https://github.com/diegosouzapw/OmniRoute/pull/7855)) — thanks @RaviTharuma
-- **fix(compression):** enable OmniGlyph for Claude Fable 5 ([#7863](https://github.com/diegosouzapw/OmniRoute/pull/7863)) — thanks @enjoyer-hub
-- **fix(notion-web):** add browser fingerprint headers to reduce Cloudflare challenges ([#7864](https://github.com/diegosouzapw/OmniRoute/pull/7864)) — thanks @HassiyYT
-- **fix(mitm):** gate Agent Bridge Repair on sudo password (#7836) ([#7865](https://github.com/diegosouzapw/OmniRoute/pull/7865)) — thanks @skutanjir
-- **fix(rerank):** honor the connection's pinned proxy on rerank calls (#7350) ([#7867](https://github.com/diegosouzapw/OmniRoute/pull/7867))
-- **fix(compression):** skip CCR on tool outputs to preserve agent loop ([#7869](https://github.com/diegosouzapw/OmniRoute/pull/7869)) — thanks @herjarsa
-- **fix(vision-bridge):** reroute auto/ prefix to vision model when images present ([#7871](https://github.com/diegosouzapw/OmniRoute/pull/7871)) — thanks @herjarsa
-- **fix(opencode-plugin):** support separate management read token ([#7885](https://github.com/diegosouzapw/OmniRoute/pull/7885)) — thanks @RaviTharuma
-- **fix(sse):** CC bridge loses OpenAI-format image input (OpenCode/Kilo/Cline → AgentRouter) ([#7888](https://github.com/diegosouzapw/OmniRoute/pull/7888))
-- **fix(combo):** strip boolean reasoning field for opencode-go providers ([#7891](https://github.com/diegosouzapw/OmniRoute/pull/7891)) — thanks @AndrianBalanescu
-- **fix(notion-web):** accept OpenAI content-parts arrays in transcript ([#7896](https://github.com/diegosouzapw/OmniRoute/pull/7896)) — thanks @artickc
-- **fix(notion-web):** reuse threadId across OpenAI multi-turn (no new chat each request) ([#7900](https://github.com/diegosouzapw/OmniRoute/pull/7900)) — thanks @artickc
-- **fix(gemini):** strip OpenAI "strict" tool-schema keyword for Antigravity ([#7901](https://github.com/diegosouzapw/OmniRoute/pull/7901)) — thanks @Witroch4
-- **fix(antigravity):** collect native functionCall parts in SSE collector ([#7902](https://github.com/diegosouzapw/OmniRoute/pull/7902)) — thanks @Witroch4
-- **fix(sse):** recover invalid Anthropic thinking signatures once ([#7906](https://github.com/diegosouzapw/OmniRoute/pull/7906)) — thanks @insoln
-- **fix(resilience):** don't cool down accounts or trip the breaker on client aborts ([#7908](https://github.com/diegosouzapw/OmniRoute/pull/7908)) — thanks @insoln
-- **fix(dashboard):** preserve quota cutoff drafts ([#7909](https://github.com/diegosouzapw/OmniRoute/pull/7909)) — thanks @hydraxman
-- **fix(providers):** treat public-host 302 as valid in Gemini Web connection test (#7859) ([#7917](https://github.com/diegosouzapw/OmniRoute/pull/7917))
-- **fix(providers):** read reasoning_text in Claude-format response translator (#7856) ([#7919](https://github.com/diegosouzapw/OmniRoute/pull/7919))
-- **fix(dashboard):** safely render structured error objects in Request Logs detail (#7845) ([#7920](https://github.com/diegosouzapw/OmniRoute/pull/7920))
-- **fix(dashboard):** repair monaco deep import broken by 0.56 exports map (#7897) ([#7922](https://github.com/diegosouzapw/OmniRoute/pull/7922))
-- **fix(autostart):** adopt 9Router VBS startup to suppress console flash on Windows ([#7925](https://github.com/diegosouzapw/OmniRoute/pull/7925)) — thanks @tientien17
-- **fix(translators):** normalize TitleCase tool names for non-Anthropic models ([#7926](https://github.com/diegosouzapw/OmniRoute/pull/7926)) — thanks @nramabad
-- **fix(api):** resolve local provider models via dashboard catalog fallback ([#7927](https://github.com/diegosouzapw/OmniRoute/pull/7927)) — thanks @ekinnee
-- **fix(auto):** pool accounts by provider model ([#7928](https://github.com/diegosouzapw/OmniRoute/pull/7928)) — thanks @adrianaryaputra
-- **fix(perplexity-web):** multi-step empty content + advanced-quota cooldown ([#7930](https://github.com/diegosouzapw/OmniRoute/pull/7930)) — thanks @artickc
-- **fix(ccr):** resolve principal via OMNIROUTE_API_KEY env var on stdio MCP transport ([#7932](https://github.com/diegosouzapw/OmniRoute/pull/7932)) — thanks @ekinnee
-- **fix(combo):** context-aware fallback ignores model_context_override ([#7933](https://github.com/diegosouzapw/OmniRoute/pull/7933)) — thanks @tmone
-- **fix(i18n):** preserve remaining Vietnamese localization ([#7935](https://github.com/diegosouzapw/OmniRoute/pull/7935)) — thanks @nguyenha935
-- **fix(mitm):** gate Agent Bridge DNS and Trust Cert on sudo password (#7938) ([#7939](https://github.com/diegosouzapw/OmniRoute/pull/7939)) — thanks @skutanjir
-- **fix(providers):** route iflytek/sparkdesk to Spark's OpenAI-compatible host ([#7942](https://github.com/diegosouzapw/OmniRoute/pull/7942)) — thanks @FenjuFu
-- **fix(sse):** preserve parallel_tool_calls for GPT-5.6 delegation under Codex Responses Lite (#7821) ([#7957](https://github.com/diegosouzapw/OmniRoute/pull/7957))
-- **fix(providers):** copilot-m365-web fails loudly on empty turns + tier-aware enterprise invocation (#7858, #7870) ([#7958](https://github.com/diegosouzapw/OmniRoute/pull/7958))
-- **fix(providers):** treat unreliable web-cookie /models probe status as unsupported, not valid (#7857) ([#7959](https://github.com/diegosouzapw/OmniRoute/pull/7959))
-- **fix(api):** add amazon-q to the static model catalog (#7820) ([#7960](https://github.com/diegosouzapw/OmniRoute/pull/7960))
-- **fix:** parse Gemini 429 RetryInfo.retryDelay for model lockout (#7940) ([#7961](https://github.com/diegosouzapw/OmniRoute/pull/7961))
-- **fix(quality):** tolerate ESLint's trailing unpruned-suppressions text in validate-release-green (#7837) ([#7962](https://github.com/diegosouzapw/OmniRoute/pull/7962))
-- **fix(cli):** translate missing sqlite bindings error into actionable guidance (#7868) ([#7963](https://github.com/diegosouzapw/OmniRoute/pull/7963))
-- **fix(cli):** spawn opencode.cmd shim with shell:true on win32 (#7913) ([#7964](https://github.com/diegosouzapw/OmniRoute/pull/7964))
-- **fix(dashboard):** correct block-extra-Claude-usage toggle copy to match quarantine behavior (#7918) ([#7965](https://github.com/diegosouzapw/OmniRoute/pull/7965))
-- **fix(api):** classify /api/acp/agents as loopback-only (#7948) ([#7966](https://github.com/diegosouzapw/OmniRoute/pull/7966))
-- **fix(auth):** restore configurable HEALTHCHECK_BATCH_SIZE dropped by #7719 (#7875) ([#7970](https://github.com/diegosouzapw/OmniRoute/pull/7970))
-- **fix(test):** widen ratelimit-admission pollUntil deadline to 10s (#7842) ([#7971](https://github.com/diegosouzapw/OmniRoute/pull/7971))
-- **fix(pricing):** clarify disabled automatic sync status ([#7972](https://github.com/diegosouzapw/OmniRoute/pull/7972)) — thanks @RaviTharuma
-- **fix(combo):** exempt content_filter from empty-content detection ([#7973](https://github.com/diegosouzapw/OmniRoute/pull/7973)) — thanks @HouMinXi
-- **fix(embeddings):** support secure multimodal inputs ([#7978](https://github.com/diegosouzapw/OmniRoute/pull/7978)) — thanks @RaviTharuma
-- **fix(resilience):** cap exactCooldownMs against maxCooldownMs (#7940) ([#7980](https://github.com/diegosouzapw/OmniRoute/pull/7980)) — thanks @ekinnee
-- **fix(electron):** derive macOS Helper name from execPath to remove 2nd Dock icon (#7941) ([#8002](https://github.com/diegosouzapw/OmniRoute/pull/8002))
-- **fix(chatcore):** report string-reason client aborts as 499, not 502 (#7907) ([#8011](https://github.com/diegosouzapw/OmniRoute/pull/8011)) — thanks @Long-Feeds
-- **fix(models):** drop generic catalog siblings of specialty surfaces (#8015) ([#8021](https://github.com/diegosouzapw/OmniRoute/pull/8021)) — thanks @RaviTharuma
-- **fix(models):** stop inventing chat capabilities for specialty surfaces (#8016) ([#8022](https://github.com/diegosouzapw/OmniRoute/pull/8022)) — thanks @RaviTharuma
-- **fix(capabilities):** resolve models.dev specialty rows across provider keys (#8017) ([#8023](https://github.com/diegosouzapw/OmniRoute/pull/8023)) — thanks @RaviTharuma
-- **fix(models):** attach models.dev pricing to GET /v1/models entries (#8018) ([#8025](https://github.com/diegosouzapw/OmniRoute/pull/8025)) — thanks @RaviTharuma
-- **fix(grok-cli):** require full auth.json on OAuth paste import (#7610) ([#8027](https://github.com/diegosouzapw/OmniRoute/pull/8027)) — thanks @RaviTharuma
-- **fix(grok-cli):** sanitize function_call_output before Grok Build dispatch (#7611) ([#8030](https://github.com/diegosouzapw/OmniRoute/pull/8030)) — thanks @RaviTharuma
-- **fix(sse):** bound forwarded response headers ([#8041](https://github.com/diegosouzapw/OmniRoute/pull/8041)) — thanks @insoln
-- **fix(sse):** replace spoofable .includes() PromptQL issuer check with hostname comparison (#8029) ([#8042](https://github.com/diegosouzapw/OmniRoute/pull/8042))
-- **fix(sse):** bound Codex SSE peek read with per-read timeout (#8020) ([#8043](https://github.com/diegosouzapw/OmniRoute/pull/8043))
-- **fix(cli):** stop double-prefixing combo model ids in opencode plugin static catalog (#7976) ([#8047](https://github.com/diegosouzapw/OmniRoute/pull/8047))
-- **fix(antigravity):** scope 404 model-not-found lockout to exact model + bare-model autopick ([#8050](https://github.com/diegosouzapw/OmniRoute/pull/8050)) — thanks @AndrianBalanescu
-- **fix:** repair pre-existing red gates on the release/v3.8.49 tip ([#8055](https://github.com/diegosouzapw/OmniRoute/pull/8055))
-- **fix(oauth):** honor connectionId on token refresh so email-less providers don't duplicate ([#8062](https://github.com/diegosouzapw/OmniRoute/pull/8062)) — thanks @insoln
-- **fix:** classify Google quota exhaustion responses ([#8071](https://github.com/diegosouzapw/OmniRoute/pull/8071)) — thanks @rafaumeu
-- **fix(providers):** refresh duckduckgo-web catalog to current Duck.ai wire ids (#8000) ([#8079](https://github.com/diegosouzapw/OmniRoute/pull/8079))
-- **fix(security):** decouple request PII redaction from injection mode ([#8102](https://github.com/diegosouzapw/OmniRoute/pull/8102)) — thanks @RaviTharuma
-- **fix(providers):** discover live AGY models ([#8123](https://github.com/diegosouzapw/OmniRoute/pull/8123)) — thanks @adevwithpurpose
-- **fix(guardrails):** align INPUT_SANITIZER request masking gate (#8093) ([#8124](https://github.com/diegosouzapw/OmniRoute/pull/8124)) — thanks @RaviTharuma
-- **fix(providers):** refresh Baidu ERNIE and Qianfan website URLs (#6271) ([#8128](https://github.com/diegosouzapw/OmniRoute/pull/8128)) — thanks @TrackCrewGalore
-- **fix(stream):** add logging to empty catch blocks in stream error handling ([#8143](https://github.com/diegosouzapw/OmniRoute/pull/8143)) — thanks @chirag127
-- **fix(sse):** stop Codex/Responses sanitizer turning system image_url into output_text (#8089) ([#8147](https://github.com/diegosouzapw/OmniRoute/pull/8147))
-- **fix(db):** register SIGHUP handler and stop force-killing server on win32 stop paths (#8045) ([#8148](https://github.com/diegosouzapw/OmniRoute/pull/8148))
-- **fix(providers):** add missing poe registry baseUrl entry (#8082) ([#8149](https://github.com/diegosouzapw/OmniRoute/pull/8149))
-- **fix(routing):** anchor quota cache on globalThis for cross-chunk consistency (#8065) ([#8150](https://github.com/diegosouzapw/OmniRoute/pull/8150))
-- **fix(responses):** close namespace round-trip for Responses-Chat translation (#7936) ([#8151](https://github.com/diegosouzapw/OmniRoute/pull/8151)) — thanks @RCrushMe
-- **fix(oauth):** warn instead of silently opening unreachable localhost redirect for LAN-IP Codex/xAI/Grok OAuth (#8046) ([#8152](https://github.com/diegosouzapw/OmniRoute/pull/8152))
-- **fix(db):** stop closing the sql.js singleton in getDbInstance() probe/reopen (#7494) ([#8153](https://github.com/diegosouzapw/OmniRoute/pull/8153))
-- **fix(sse):** run compression pipeline per turn in Codex Responses WS bridge (#8052) ([#8154](https://github.com/diegosouzapw/OmniRoute/pull/8154))
-- **fix(cli):** merge node bin dir into CLI healthcheck PATH for codex detection (#8036) ([#8156](https://github.com/diegosouzapw/OmniRoute/pull/8156))
-- **fix(sse):** anonymous fingerprint fallback for keyless Pollinations image gen (#8085) ([#8157](https://github.com/diegosouzapw/OmniRoute/pull/8157))
-- **fix(cli):** surface the real spawn error in process supervisor (#8091) ([#8158](https://github.com/diegosouzapw/OmniRoute/pull/8158))
-- **fix:** strip internal reasoning placeholder from user-visible content (#8081) ([#8162](https://github.com/diegosouzapw/OmniRoute/pull/8162)) — thanks @Dingding-leo
-- **fix(combos):** expose synced reasoning-effort variants in Combo Builder model picker (#8072) ([#8165](https://github.com/diegosouzapw/OmniRoute/pull/8165)) — thanks @Dingding-leo
-- **fix(windows):** add windowsHide to all child process spawns (#8131) ([#8167](https://github.com/diegosouzapw/OmniRoute/pull/8167)) — thanks @Dingding-leo
-- **fix(cursor):** bridge native tools to client calls ([#8171](https://github.com/diegosouzapw/OmniRoute/pull/8171)) — thanks @makcimbx
-- **fix(security):** bound JWT-extraction regexes to prevent polynomial ReDoS (CodeQL #754/#755/#756) ([#8173](https://github.com/diegosouzapw/OmniRoute/pull/8173))
-- **fix(#8141):** log pending request counter decrement failures ([#8179](https://github.com/diegosouzapw/OmniRoute/pull/8179)) — thanks @rafaumeu
-- **fix(#8135):** suppress sql.js build warning via non-analyzable dynamic import ([#8184](https://github.com/diegosouzapw/OmniRoute/pull/8184)) — thanks @rafaumeu
-- **fix(#8093):** align INPUT_SANITIZER_ENABLED default to true across all docs ([#8185](https://github.com/diegosouzapw/OmniRoute/pull/8185)) — thanks @rafaumeu
-- **fix(combo):** skip remaining same-provider targets on 401/403 auth failure ([#8195](https://github.com/diegosouzapw/OmniRoute/pull/8195)) — thanks @rafaumeu
-- **fix(compression):** make memo key model-independent for non-vision engines ([#8196](https://github.com/diegosouzapw/OmniRoute/pull/8196)) — thanks @rafaumeu
-- **fix(resilience):** add max/step to NumberField for provider cooldown inputs (#8107) ([#8203](https://github.com/diegosouzapw/OmniRoute/pull/8203)) — thanks @rafaumeu
-- **fix(providers):** fix Azure AI Foundry multi-model discovery and per-deployment connection testing (#8174) ([#8206](https://github.com/diegosouzapw/OmniRoute/pull/8206)) — thanks @not-knope
-- **fix(logs):** stop the async-EPIPE log-flood loop at its ignition point ([#8207](https://github.com/diegosouzapw/OmniRoute/pull/8207)) — thanks @Tasogarre
-- **fix(sse):** surface OpenRouter mid-stream error chunks instead of a false empty success ([#8210](https://github.com/diegosouzapw/OmniRoute/pull/8210)) — thanks @hartmark
-- **fix(sse):** Gemini malformed function-call handling + tool_choice translation ([#8211](https://github.com/diegosouzapw/OmniRoute/pull/8211)) — thanks @hartmark
-- **fix(sse):** tool-incapable provider handling (AI Horde + Responses content-collapse scoping) ([#8212](https://github.com/diegosouzapw/OmniRoute/pull/8212)) — thanks @hartmark
-- **fix(sse):** Gemini TPM/RPD quota classification + combo cooldown-wait resilience ([#8213](https://github.com/diegosouzapw/OmniRoute/pull/8213)) — thanks @hartmark
-- **fix(services):** resolve and record a real pid when adopting a service ([#8218](https://github.com/diegosouzapw/OmniRoute/pull/8218)) — thanks @seanford
-- **fix(memory):** resolve remote embedding dimensions for reindex (#8074) ([#8220](https://github.com/diegosouzapw/OmniRoute/pull/8220)) — thanks @Prudhvivuda
-- **fix(dashboard):** correct machine-translated Korean UI strings in ko.json ([#8224](https://github.com/diegosouzapw/OmniRoute/pull/8224)) — thanks @MichaelYcJo
-- **fix(devin-cli):** refresh shared model catalog ([#8227](https://github.com/diegosouzapw/OmniRoute/pull/8227)) — thanks @backryun
-- **fix(claude-web):** align session transport and fallback ([#8230](https://github.com/diegosouzapw/OmniRoute/pull/8230)) — thanks @backryun
-- **fix:** restore OAuth auto-refresh for gemini-cli connections ([#8232](https://github.com/diegosouzapw/OmniRoute/pull/8232)) — thanks @seanford
-- **fix:** normalize Codex URLs and dashboard regressions ([#8233](https://github.com/diegosouzapw/OmniRoute/pull/8233)) — thanks @nguyenha935
-- **fix(api):** narrow claudeClassifierCompat auto trigger so stop_sequences alone no longer short-circuits (#8189) ([#8236](https://github.com/diegosouzapw/OmniRoute/pull/8236))
-- **fix(gemini):** drop HARM_CATEGORY_CIVIC_INTEGRITY from the default Gemini safety settings (#8231) ([#8238](https://github.com/diegosouzapw/OmniRoute/pull/8238))
-- **fix(backend):** word-boundary-safe tool-result truncation in lite compression mode (#8169) ([#8239](https://github.com/diegosouzapw/OmniRoute/pull/8239))
-- **fix(providers):** filter unsupported family-fallback candidates against the provider catalog (#8134) ([#8240](https://github.com/diegosouzapw/OmniRoute/pull/8240))
-### 📚 Docs
-
-- **docs(quality):** codify retry policy per runner + release-level drift rule (WS5.4/WS5.5) ([#7107](https://github.com/diegosouzapw/OmniRoute/pull/7107))
-- **docs(troubleshooting):** document Avast/AVG README.md false positive (#5946) ([#7295](https://github.com/diegosouzapw/OmniRoute/pull/7295))
-- **docs(perf):** add per-endpoint p50/p95/p99 latency + cost budget reference ([#7336](https://github.com/diegosouzapw/OmniRoute/pull/7336)) — thanks @KooshaPari
-- **docs:** refresh revoked Discord invite + WhatsApp Brasil link ([#7604](https://github.com/diegosouzapw/OmniRoute/pull/7604))
-- **docs(readme):** animated SVG for the 4-tier auto-fallback cascade ([#7615](https://github.com/diegosouzapw/OmniRoute/pull/7615))
-- **docs:** sync provider count to 259 (unblocks docs-counts strict gate) ([#7616](https://github.com/diegosouzapw/OmniRoute/pull/7616))
-- **docs(readme):** animate pool + combo ASCII blocks as SMIL SVG diagrams ([#7626](https://github.com/diegosouzapw/OmniRoute/pull/7626))
-- **docs(readme):** animate CLI command list + compression flow as SMIL SVGs ([#7637](https://github.com/diegosouzapw/OmniRoute/pull/7637))
-- **docs(readme):** replace free-tier budget mockup with animated SMIL card ([#7665](https://github.com/diegosouzapw/OmniRoute/pull/7665))
-- **docs(readme):** standardize all README tables to full content width ([#7666](https://github.com/diegosouzapw/OmniRoute/pull/7666))
-
-- **docs:** fix three stale references failing the fabricated-docs gate ([#7728](https://github.com/diegosouzapw/OmniRoute/pull/7728))
-- **docs(readme):** unified animated card system — audited v3.8.49 numbers, style contract across all cards, 5 new cards + rebuilt terminal ([#7769](https://github.com/diegosouzapw/OmniRoute/pull/7769))
-- **docs(readme):** add Kimi (Moonshot AI) official supporter section ([#7770](https://github.com/diegosouzapw/OmniRoute/pull/7770))
-- **docs(getting-started):** reorder Verify It Works before IDE/CLI setup + add examples ([#7790](https://github.com/diegosouzapw/OmniRoute/pull/7790)) — thanks @swingtempo
-- **docs(readme):** audit every number against the live code + refresh contributors and acknowledgments ([#7795](https://github.com/diegosouzapw/OmniRoute/pull/7795))
-- **docs(readme):** evolve supporter section into sub2api-style Sponsors section ([#7799](https://github.com/diegosouzapw/OmniRoute/pull/7799))
-- **docs(readme):** contributors 360+ -> 350+ (audited) ([#7803](https://github.com/diegosouzapw/OmniRoute/pull/7803))
-- **docs(i18n):** refresh Polish README and fix relative links ([#7807](https://github.com/diegosouzapw/OmniRoute/pull/7807)) — thanks @leszek3737
-- **docs:** add general Web Cookie provider setup guide ([#7881](https://github.com/diegosouzapw/OmniRoute/pull/7881)) — thanks @arpit-jaiswal-dev
-- **docs(guides):** document Kaspersky PDM behavioral false positive on the Desktop installer (#7903) ([#7923](https://github.com/diegosouzapw/OmniRoute/pull/7923))
-- **docs:** document npm install ERESOLVE/peer/deprecated warnings as harmless (fixes #7951) ([#7988](https://github.com/diegosouzapw/OmniRoute/pull/7988)) — thanks @Dingding-leo
-- **docs:** fix Docker IPv6 connection reset with -p 127.0.0.1 bind (fixes #7722) ([#7989](https://github.com/diegosouzapw/OmniRoute/pull/7989)) — thanks @Dingding-leo
-- **docs(readme):** Kimi partner tracking links (aff=omniroute) + first-Brazilian-project line + disclosure ([#8028](https://github.com/diegosouzapw/OmniRoute/pull/8028))
-- **docs:** add AgentRouter multi-provider routing troubleshooting ([#8049](https://github.com/diegosouzapw/OmniRoute/pull/8049)) — thanks @leninejunior
-- **docs(security):** correct prompt-injection severity table + heuristic-limitations disclaimer (#8097) ([#8113](https://github.com/diegosouzapw/OmniRoute/pull/8113)) — thanks @rafaumeu
-- **docs(ops):** publish public branching and release model (#7627) ([#8129](https://github.com/diegosouzapw/OmniRoute/pull/8129)) — thanks @c4usal
-- **docs(i18n):** full Russian README rewrite ([#8217](https://github.com/diegosouzapw/OmniRoute/pull/8217)) — thanks @MonteNegroX
-- **docs(readme):** re-audit numbers, fix table scroll, refresh contributors ([#8243](https://github.com/diegosouzapw/OmniRoute/pull/8243))
-### 🧪 Tests & Quality
-
-- **test(build):** derive pack-artifact closures for all npm-shipped entrypoints (#7065 class) ([#7081](https://github.com/diegosouzapw/OmniRoute/pull/7081))
-- **test(dashboard):** dedicated regression guard for #6815 density guarantee ([#7291](https://github.com/diegosouzapw/OmniRoute/pull/7291))
-- **test(ci):** make #6634 selfref guard hermetic — read file from disk, no git ref ([#7327](https://github.com/diegosouzapw/OmniRoute/pull/7327))
-- **test(ci):** mock route bridge surfaces error message, not raw stack ([#7354](https://github.com/diegosouzapw/OmniRoute/pull/7354))
-- **test(ci):** static body in codex e2e mock route bridge (CodeQL #737) ([#7558](https://github.com/diegosouzapw/OmniRoute/pull/7558))
-- **test(ci):** exact-line assert in grok-build config test (CodeQL #740/#741) ([#7628](https://github.com/diegosouzapw/OmniRoute/pull/7628))
-
-- **test(codex):** cover image tool output replay (#7698) ([#7704](https://github.com/diegosouzapw/OmniRoute/pull/7704)) — thanks @dongwook-chan
-- **test(security):** exact SAN-entry match in mitm leaf-cert test (CodeQL #746) ([#7824](https://github.com/diegosouzapw/OmniRoute/pull/7824))
-- **test(#8140):** verify keepalive interval cleanup on disconnect, resolve, and reject ([#8190](https://github.com/diegosouzapw/OmniRoute/pull/8190)) — thanks @rafaumeu
-### 🔧 Chores / CI
-
-- **chore(release):** gate the sync-back push on release-green --quick (WS0.3) ([#7083](https://github.com/diegosouzapw/OmniRoute/pull/7083))
-- **chore(ci):** gate hygiene — secrets baseline 0, semgrep drop, hadolint (WS6/D3 + WS1.7) ([#7099](https://github.com/diegosouzapw/OmniRoute/pull/7099))
-- **chore(ops):** runner-box janitor + operations runbook (WS3.3) ([#7115](https://github.com/diegosouzapw/OmniRoute/pull/7115))
-- **chore(ci):** promote test:vitest:ui to blocking (suite green after #7127) ([#7147](https://github.com/diegosouzapw/OmniRoute/pull/7147))
-- **chore(ci):** stop dependabot proposing typescript majors — peer-blocked by typescript-eslint ([#7306](https://github.com/diegosouzapw/OmniRoute/pull/7306))
-- **chore(release):** script the 0a.0b PR re-home with a verified read-back ([#7312](https://github.com/diegosouzapw/OmniRoute/pull/7312))
-- **chore(quality):** tighten the coverage ratchet to the CI's real numbers ([#7326](https://github.com/diegosouzapw/OmniRoute/pull/7326))
-- **chore(ci):** make the Electron Windows leg advisory with bash stderr capture (first-run failure diagnosis) ([#7340](https://github.com/diegosouzapw/OmniRoute/pull/7340))
-- **chore(deps):** bump actions/setup-node from 6 to 7 ([#7348](https://github.com/diegosouzapw/OmniRoute/pull/7348))
-- **chore(deps):** bump codecov/codecov-action ([#7350](https://github.com/diegosouzapw/OmniRoute/pull/7350))
-- **ci(release-green):** add a main-green arm to detect when main goes red ([#7355](https://github.com/diegosouzapw/OmniRoute/pull/7355))
-- **chore(deps):** bump github/codeql-action/analyze from 4.37.0 to 4.37.1 ([#7641](https://github.com/diegosouzapw/OmniRoute/pull/7641))
-- **chore(deps):** bump github/codeql-action/init from 4.37.0 to 4.37.1 ([#7642](https://github.com/diegosouzapw/OmniRoute/pull/7642))
-- **chore(quality):** register #6672 test in stryker tap.testFiles (base-red unblock) ([#7652](https://github.com/diegosouzapw/OmniRoute/pull/7652))
-- **chore(release):** merge-train box-speed suite + --fast mode ([#7670](https://github.com/diegosouzapw/OmniRoute/pull/7670))
-
-- **chore:** [defer] fix embedded CLIProxyAPI config handling ([#6877](https://github.com/diegosouzapw/OmniRoute/pull/6877)) — thanks @professional-ALFIE
-- **chore:** [defer] fix(grok): align responses tool-call shape for grok models ([#6937](https://github.com/diegosouzapw/OmniRoute/pull/6937)) — thanks @CitrusIce
-- **chore:** [needs-vps] feat(dashboard): add per-operator quota row visibility on usage tab ([#7251](https://github.com/diegosouzapw/OmniRoute/pull/7251))
-- **chore:** [defer] feat(combo): universal cooldown-aware retry & auto-strategy combo-ref guard ([#7301](https://github.com/diegosouzapw/OmniRoute/pull/7301)) — thanks @ViFigueiredo
-- **chore:** Completing Arabic language ([#7686](https://github.com/diegosouzapw/OmniRoute/pull/7686)) — thanks @mustafa-phd
-- **chore:** IC2: Cache provider connections by ID + provider nodes ([#7744](https://github.com/diegosouzapw/OmniRoute/pull/7744)) — thanks @oyi77
-- **chore:** [Emergency Fix] fix(build): repair release build blockers ([#7772](https://github.com/diegosouzapw/OmniRoute/pull/7772)) — thanks @backryun
-- **chore:** [Part 1/3]refactor(qwen): replace legacy Qwen Code and remove OAuth provider ([#7866](https://github.com/diegosouzapw/OmniRoute/pull/7866)) — thanks @backryun
-- **chore:** [Part 3/3] feat(qwen): add regional Alibaba and Qwen Cloud providers ([#7882](https://github.com/diegosouzapw/OmniRoute/pull/7882)) — thanks @backryun
-- **chore:** Preserve supported Responses behavior in Chat translation ([#7894](https://github.com/diegosouzapw/OmniRoute/pull/7894)) — thanks @JxnLexn
-- **chore:** Restore Responses API custom tool calls ([#7905](https://github.com/diegosouzapw/OmniRoute/pull/7905)) — thanks @JxnLexn
-- **chore:** Hide internal reasoning replay placeholders ([#7912](https://github.com/diegosouzapw/OmniRoute/pull/7912)) — thanks @JxnLexn
-- **chore(deps):** bump js-yaml, brace-expansion, shell-quote, tar (security) ([#7915](https://github.com/diegosouzapw/OmniRoute/pull/7915))
-- **chore:** i18n(zh-TW): complete Traditional Chinese (Taiwan) translation overhaul ([#8024](https://github.com/diegosouzapw/OmniRoute/pull/8024)) — thanks @lunkerchen
-- **chore:** i18n: bring 40 locales to full parity with en.json ([#8031](https://github.com/diegosouzapw/OmniRoute/pull/8031)) — thanks @nguyenha935
-- **chore(deps):** resolve 7 open Dependabot alerts via npm overrides ([#8066](https://github.com/diegosouzapw/OmniRoute/pull/8066))
-- **chore(deps):** resolve 3 more Dependabot alerts (dompurify, fast-xml-parser, sharp) ([#8069](https://github.com/diegosouzapw/OmniRoute/pull/8069))
-- **chore(dashboard):** reframe Kimi partnership as "Open Source Friends" ([#8117](https://github.com/diegosouzapw/OmniRoute/pull/8117))
-- **chore(quality):** fix 2 pre-existing lint/suppression drift issues ([#8209](https://github.com/diegosouzapw/OmniRoute/pull/8209)) — thanks @hartmark
-- **chore:** add K3banner-1.png banner asset ([#8242](https://github.com/diegosouzapw/OmniRoute/pull/8242))
-### 🔀 Other
-
-- [needs-vps] fix(electron): materialize Turbopack hashed-module symlinks during packaging (#6724, #6594) ([#6794](https://github.com/diegosouzapw/OmniRoute/pull/6794)) — thanks @huohua-dev
-- [codex] Keep mode-pack weights consistent in auto fallback ranking ([#7008](https://github.com/diegosouzapw/OmniRoute/pull/7008)) — thanks @KooshaPari
-- Explain effective auto-combo scoring weights ([#7087](https://github.com/diegosouzapw/OmniRoute/pull/7087)) — thanks @KooshaPari
-- [needs-vps] fix(dashboard): add vision-capability toggle for custom OpenAI-compatible models ([#7124](https://github.com/diegosouzapw/OmniRoute/pull/7124))
-- [needs-vps] fix(dashboard): align onboarding tier content ([#7125](https://github.com/diegosouzapw/OmniRoute/pull/7125)) — thanks @Wibias
-- Use OpenAI chunks for early chat keepalives ([#7136](https://github.com/diegosouzapw/OmniRoute/pull/7136)) — thanks @KooshaPari
-- Fix Codex Responses compression analytics ([#7273](https://github.com/diegosouzapw/OmniRoute/pull/7273)) — thanks @JxnLexn
-- Add cache-aligned Live Zone compression ([#7280](https://github.com/diegosouzapw/OmniRoute/pull/7280)) — thanks @JxnLexn
-- Fix routed target request parameters ([#7323](https://github.com/diegosouzapw/OmniRoute/pull/7323)) — thanks @JxnLexn
-- deps: bump electron from 43.1.0 to 43.1.1 in /electron ([#7349](https://github.com/diegosouzapw/OmniRoute/pull/7349))
-- deps: bump the development group with 8 updates ([#7351](https://github.com/diegosouzapw/OmniRoute/pull/7351))
-- deps: bump the production group across 1 directory with 12 updates ([#7352](https://github.com/diegosouzapw/OmniRoute/pull/7352))
-- Add per-connection Provider Quota visibility ([#7360](https://github.com/diegosouzapw/OmniRoute/pull/7360)) — thanks @JxnLexn
-- Stream model health probes for slow providers ([#7377](https://github.com/diegosouzapw/OmniRoute/pull/7377)) — thanks @JxnLexn
-- Refresh NVIDIA free metadata and detect catalog drift ([#7378](https://github.com/diegosouzapw/OmniRoute/pull/7378)) — thanks @JxnLexn
-- Reject invalid output token budgets ([#7379](https://github.com/diegosouzapw/OmniRoute/pull/7379)) — thanks @JxnLexn
-- Honor provider proxies for The Old LLM Vercel blocks ([#7380](https://github.com/diegosouzapw/OmniRoute/pull/7380)) — thanks @JxnLexn
-- Restore proxy navigation and sidebar accordion state ([#7381](https://github.com/diegosouzapw/OmniRoute/pull/7381)) — thanks @JxnLexn
-- Expose proxy controls for no-auth providers ([#7419](https://github.com/diegosouzapw/OmniRoute/pull/7419)) — thanks @JxnLexn
-- Add reasoning-based model and effort routing ([#7607](https://github.com/diegosouzapw/OmniRoute/pull/7607)) — thanks @JxnLexn
-
-- **refactor(sse):** extract per-provider token-refresh functions from tokenRefresh.ts ([#7817](https://github.com/diegosouzapw/OmniRoute/pull/7817))
-- **deps:** bump the production group with 8 updates ([#7897](https://github.com/diegosouzapw/OmniRoute/pull/7897)) — thanks @dependabot[bot]
-- **deps:** bump the development group with 5 updates ([#7898](https://github.com/diegosouzapw/OmniRoute/pull/7898)) — thanks @dependabot[bot]
-- **refactor(antigravity):** align official clients and callable catalog ([#8013](https://github.com/diegosouzapw/OmniRoute/pull/8013)) — thanks @backryun
-- **refactor(compression):** extract resolveHeadroomDetail to keep dispatchCompression under the complexity gate ([#8058](https://github.com/diegosouzapw/OmniRoute/pull/8058))
-- **deps:** bump next from 16.2.10 to 16.2.11 ([#8235](https://github.com/diegosouzapw/OmniRoute/pull/8235)) — thanks @dependabot[bot]
-### 🩹 Direct release-branch fixes (no PR — authorized base-red sweep, 2026-07-18)
-
-- **fix(base-red):** full-suite realignment after the 102-PR merge campaign: two real production fixes (legacy `refresh_token` column healed before its index is created; `shouldSkipCloudSyncInitialization` no longer swaps its `(env, argv)` arguments) plus 13 test files, goldens, provider counts, and env docs realigned to the live-validated behavior of the merged PRs.
-
-### 🙌 Contributors
-
-Thanks to everyone whose work landed in v3.8.49:
-
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@adevwithpurpose](https://github.com/adevwithpurpose) | #8123 |
-| [@adrianaryaputra](https://github.com/adrianaryaputra) | #7928 |
-| [@Ajeesh25353646](https://github.com/Ajeesh25353646) | #7528 |
-| [@alltomatos](https://github.com/alltomatos) | #7041, #7042, #7164, #7277, #7490, #7492, #7644 |
-| [@alvaretto](https://github.com/alvaretto) | #8077, #8161, #8170 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #7794, #7804, #7810, #7813, #7816, #7891, #8050 |
-| [@apoapostolov](https://github.com/apoapostolov) | #8127 |
-| [@arpit-jaiswal-dev](https://github.com/arpit-jaiswal-dev) | #7881 |
-| [@artickc](https://github.com/artickc) | #6955, #7204, #7696, #7768, #7896, #7900, #7911, #7930, #7994, #8006 |
-| [@Arul-](https://github.com/Arul-) | #7878 |
-| [@backryun](https://github.com/backryun) | #7296, #7314, #7358, #7531, #7687, #7772, #7812, #7866, #7874, #7882, #7914, #8013, #8225, #8226, #8227, #8230 |
-| [@c4usal](https://github.com/c4usal) | #8129 |
-| [@Capslockb](https://github.com/Capslockb) | #7892 |
-| [@Chewji9875](https://github.com/Chewji9875) | #7545 |
-| [@chirag127](https://github.com/chirag127) | #7520, #8143 |
-| [@CitrusIce](https://github.com/CitrusIce) | #6937, #6938 |
-| [@Dan-ex-hub](https://github.com/Dan-ex-hub) | #7743 |
-| [@danscMax](https://github.com/danscMax) | #7359, #7511, #7517, #7648, #7656, #7672, #7689 |
-| [@dependabot](https://github.com/dependabot) | #7897, #7898, #8235 |
-| [@Dingding-leo](https://github.com/Dingding-leo) | #7988, #7989, #8162, #8165, #8167 |
-| [@DKotsyuba](https://github.com/DKotsyuba) | #7500 |
-| [@dongwook-chan](https://github.com/dongwook-chan) | #7574, #7582, #7704 |
-| [@ekinnee](https://github.com/ekinnee) | #7613, #7614, #7662, #7779, #7927, #7932, #7980 |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #7863 |
-| [@fenix007](https://github.com/fenix007) | #7171, #7399 |
-| [@FenjuFu](https://github.com/FenjuFu) | #7942 |
-| [@floze-the-genius](https://github.com/floze-the-genius) | #7707 |
-| [@growab](https://github.com/growab) | #7062 |
-| [@guanbear](https://github.com/guanbear) | #7028 |
-| [@hartmark](https://github.com/hartmark) | #8208, #8209, #8210, #8211, #8212, #8213 |
-| [@HassiyYT](https://github.com/HassiyYT) | #7864 |
-| [@herjarsa](https://github.com/herjarsa) | #7612, #7625, #7633, #7869, #7871 |
-| [@HouMinXi](https://github.com/HouMinXi) | #7035, #7129, #7290, #7398, #7408, #7973 |
-| [@hppsc1215](https://github.com/hppsc1215) | #7546 |
-| [@huohua-dev](https://github.com/huohua-dev) | #6794 |
-| [@hydraxman](https://github.com/hydraxman) | #7909 |
-| [@insoln](https://github.com/insoln) | #7906, #7908, #8041, #8054, #8062 |
-| [@irvandikky](https://github.com/irvandikky) | #7695 |
-| [@isiahw1](https://github.com/isiahw1) | #7555 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6993, #7154, #7177, #7269, #7273, #7280, #7281, #7282, #7323, #7360, #7377, #7378, #7379, #7380, #7381, #7419, #7607, #7894, #7905, #7912, #8008, #8009, #8010 |
-| [@KooshaPari](https://github.com/KooshaPari) | #7008, #7087, #7093, #7128, #7130, #7136, #7315, #7318, #7334, #7336 |
-| [@leninejunior](https://github.com/leninejunior) | #8049 |
-| [@leszek3737](https://github.com/leszek3737) | #7782, #7807 |
-| [@Long-Feeds](https://github.com/Long-Feeds) | #8011 |
-| [@loulanyue](https://github.com/loulanyue) | #7540 |
-| [@lunkerchen](https://github.com/lunkerchen) | #8024 |
-| [@makcimbx](https://github.com/makcimbx) | #7692, #8171 |
-| [@megamen32](https://github.com/megamen32) | #7313 |
-| [@MichaelYcJo](https://github.com/MichaelYcJo) | #8224 |
-| [@mikolaj92](https://github.com/mikolaj92) | #6973 |
-| [@MonteNegroX](https://github.com/MonteNegroX) | #8217 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #7781 |
-| [@MrFadiAi](https://github.com/MrFadiAi) | #7073 |
-| [@mustafa-phd](https://github.com/mustafa-phd) | #7686 |
-| [@nguyenha935](https://github.com/nguyenha935) | #7493, #7547, #7552, #7553, #7629, #7935, #8031, #8233 |
-| [@not-knope](https://github.com/not-knope) | #8206 |
-| [@nramabad](https://github.com/nramabad) | #7926 |
-| [@oyi77](https://github.com/oyi77) | #6917, #6918, #6919, #6920, #6921, #6923, #7032, #7045, #7046, #7066, #7070, #7178, #7719, #7744, #7787, #7893, #8219 |
-| [@professional-ALFIE](https://github.com/professional-ALFIE) | #6877 |
-| [@Prudhvivuda](https://github.com/Prudhvivuda) | #8220 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6979, #6982, #6983, #6987, #6988, #7001, #7808, #7815, #8071, #8113, #8179, #8184, #8185, #8190, #8195, #8196, #8203 |
-| [@RaviTharuma](https://github.com/RaviTharuma) | #7852, #7853, #7855, #7862, #7885, #7972, #7978, #8021, #8022, #8023, #8025, #8027, #8030, #8102, #8124 |
-| [@RCrushMe](https://github.com/RCrushMe) | #8151 |
-| [@rushsinging](https://github.com/rushsinging) | #7256 |
-| [@seanford](https://github.com/seanford) | #8218, #8232 |
-| [@SeaXen](https://github.com/SeaXen) | #7063, #7264, #7294 |
-| [@Securiteru](https://github.com/Securiteru) | #7683 |
-| [@skutanjir](https://github.com/skutanjir) | #7865, #7939 |
-| [@swingtempo](https://github.com/swingtempo) | #7790 |
-| [@Tasogarre](https://github.com/Tasogarre) | #7861, #8207 |
-| [@thepigdestroyer](https://github.com/thepigdestroyer) | #7497 |
-| [@tianrking](https://github.com/tianrking) | #7353 |
-| [@tientien17](https://github.com/tientien17) | #7841, #7844, #7925 |
-| [@tmone](https://github.com/tmone) | #7806, #7933 |
-| [@TrackCrewGalore](https://github.com/TrackCrewGalore) | #8128 |
-| [@ViFigueiredo](https://github.com/ViFigueiredo) | #7301 |
-| [@vzts](https://github.com/vzts) | #7390 |
-| [@webmasterarbez](https://github.com/webmasterarbez) | #7504 |
-| [@Wibias](https://github.com/Wibias) | #7125 |
-| [@Witroch4](https://github.com/Witroch4) | #7901, #7902 |
-| [@xiaoyaner0201](https://github.com/xiaoyaner0201) | #8122 |
-| [@xier2012](https://github.com/xier2012) | #7036, #7050, #7052, #7053, #7056, #7059, #7060, #7061, #7166, #7299 |
-| [@xz-dev](https://github.com/xz-dev) | #7004, #7012, #7027, #7673, #7700, #7747, #7776, #7843 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
-
 ---
 
 ## [3.8.48] — 2026-07-13

CLAUDE.md

@@ -35,22 +35,22 @@ For full test matrix, see `CONTRIBUTING.md` → "Running Tests". For deep archit
 
 ## Project at a Glance
 
-**OmniRoute** — unified AI proxy/router. One endpoint, 290 LLM providers, auto-fallback.
+**OmniRoute** — unified AI proxy/router. One endpoint, 250 LLM providers, auto-fallback.
 
-| Layer         | Location                | Purpose                                                                                                                                                 |
-| ------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| API Routes    | `src/app/api/v1/`       | Next.js App Router — entry points                                                                                                                       |
-| Handlers      | `open-sse/handlers/`    | Request processing (chat, embeddings, etc)                                                                                                              |
-| Executors     | `open-sse/executors/`   | Provider-specific HTTP dispatch                                                                                                                         |
-| Translators   | `open-sse/translator/`  | Format conversion (OpenAI↔Claude↔Gemini)                                                                                                                |
-| Transformer   | `open-sse/transformer/` | Responses API ↔ Chat Completions                                                                                                                        |
-| Services      | `open-sse/services/`    | Combo routing, rate limits, caching, etc                                                                                                                |
-| Database      | `src/lib/db/`           | SQLite domain modules (95 files, 110 migrations)                                                                                                        |
-| Domain/Policy | `src/domain/`           | Policy engine, cost rules, fallback logic                                                                                                               |
-| MCP Server    | `open-sse/mcp-server/`  | 104 tools (42 base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules), 3 transports (stdio / SSE / Streamable HTTP), 31 scopes |
-| A2A Server    | `src/lib/a2a/`          | JSON-RPC 2.0 agent protocol                                                                                                                             |
-| Skills        | `src/lib/skills/`       | Extensible skill framework                                                                                                                              |
-| Memory        | `src/lib/memory/`       | Persistent conversational memory                                                                                                                        |
+| Layer         | Location                | Purpose                                                                                                                                                |
+| ------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| API Routes    | `src/app/api/v1/`       | Next.js App Router — entry points                                                                                                                      |
+| Handlers      | `open-sse/handlers/`    | Request processing (chat, embeddings, etc)                                                                                                             |
+| Executors     | `open-sse/executors/`   | Provider-specific HTTP dispatch                                                                                                                        |
+| Translators   | `open-sse/translator/`  | Format conversion (OpenAI↔Claude↔Gemini)                                                                                                               |
+| Transformer   | `open-sse/transformer/` | Responses API ↔ Chat Completions                                                                                                                       |
+| Services      | `open-sse/services/`    | Combo routing, rate limits, caching, etc                                                                                                               |
+| Database      | `src/lib/db/`           | SQLite domain modules (95 files, 110 migrations)                                                                                                       |
+| Domain/Policy | `src/domain/`           | Policy engine, cost rules, fallback logic                                                                                                              |
+| MCP Server    | `open-sse/mcp-server/`  | 94 tools (34 base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules), 3 transports (stdio / SSE / Streamable HTTP), 30 scopes |
+| A2A Server    | `src/lib/a2a/`          | JSON-RPC 2.0 agent protocol                                                                                                                            |
+| Skills        | `src/lib/skills/`       | Extensible skill framework                                                                                                                             |
+| Memory        | `src/lib/memory/`       | Persistent conversational memory                                                                                                                       |
 
 Monorepo: `src/` (Next.js 16 app), `open-sse/` (streaming engine workspace), `electron/` (desktop app), `tests/`, `bin/` (CLI entry point).
 
@@ -482,8 +482,8 @@ list` shows worktrees you didn't create, leave them alone. End every session wit
 
 ## Environment
 
-- **Runtime**: Node.js ≥22.0.0 <23 || ≥24.0.0 <27, ES Modules. This is the **only supported** runtime for the published `omniroute` CLI, the server, and the test suites (`node:test` + vitest) — `engines.node` is authoritative and end users never need Bun. A **best-effort `bun:sqlite` compatibility path** exists so a global Bun install (`bun install -g omniroute`) can start without `better-sqlite3` (driver adapter + Bun-aware process spawning); it is **not** a supported runtime — no support guarantees — and every Bun-specific runtime change MUST preserve the Node driver/fallback chain and ship a Bun test (`test:bun:db`) or an explicit reason why the path is Node-only.
-- **Bun (build/dev script runner + compatibility smoke only)**: Bun `1.3.14` is pinned as an **exact devDependency** (provisioned through the existing `npm ci` via the lockfile's `@oven/bun-*` platform binaries — no `setup-bun`/ad-hoc install). It is used **only** to execute a small, allow-listed set of TypeScript **gate/generator scripts** (replacing `node --import tsx` for startup speed): the CI checks `check:provider-consistency`, `check:compression-budget`, `check:known-symbols`, and the non-CI `gen:provider-reference`, `bench:compression` — plus the focused `test:bun:db` compatibility smoke suite for the best-effort `bun:sqlite` path. **Do NOT** widen Bun to `npm install`, the build (`build:cli*`), `check:pack-artifact`, the supported published runtime, or the main test runners — those stay on Node. Any new Bun-invoking gate/generator script must be validated byte-identical against its `node --import tsx` output first. After pulling the lockfile change, run `npm install` so `bun` resolves locally (a stale `node_modules` will fail those scripts with `bun: not found`).
+- **Runtime**: Node.js ≥22.0.0 <23 || ≥24.0.0 <27, ES Modules. This is the **only** runtime for the published `omniroute` CLI, the server, and the test suites (`node:test` + vitest) — `engines.node` is authoritative and end users never need Bun.
+- **Bun (build/dev script runner only)**: Bun `1.3.10` is pinned as an **exact devDependency** (provisioned through the existing `npm ci` via the lockfile's `@oven/bun-*` platform binaries — no `setup-bun`/ad-hoc install). It is used **only** to execute a small, allow-listed set of TypeScript **gate/generator scripts** (replacing `node --import tsx` for startup speed): the CI checks `check:provider-consistency`, `check:compression-budget`, `check:known-symbols`, and the non-CI `gen:provider-reference`, `bench:compression`. **Do NOT** widen Bun to `npm install`, the build (`build:cli*`), `check:pack-artifact`, the published runtime, or the test runners — those stay on Node. Any new Bun-invoking script must be validated byte-identical against its `node --import tsx` output first. After pulling the lockfile change, run `npm install` so `bun` resolves locally (a stale `node_modules` will fail those 5 scripts with `bun: not found`).
 - **TypeScript**: 6.0+, target ES2022, module esnext, resolution bundler
 - **Path aliases**: `@/*` → `src/`, `@omniroute/open-sse` → `open-sse/`, `@omniroute/open-sse/*` → `open-sse/*`
 - **Default port**: 20128 (API + dashboard on same port)

CONTRIBUTING.md

@@ -103,19 +103,13 @@ Default URLs:
 ## Git Workflow
 
 > ⚠️ **NEVER commit directly to `main`.** Always use feature branches.
->
-> **PR base:** target the active `release/vX.Y.Z` branch (not `main`). See
-> [`docs/ops/BRANCHING_MODEL.md`](docs/ops/BRANCHING_MODEL.md) for the
-> release-per-branch + tag-at-ship model.
 
 ```bash
-# Branch from the active release tip (example: release/v3.8.49)
-git fetch origin
-git checkout -b feat/your-feature-name origin/release/v3.8.49
+git checkout -b feat/your-feature-name
 # ... make changes ...
 git commit -m "feat: describe your change"
 git push -u origin feat/your-feature-name
-# Open a Pull Request with base = release/v3.8.49
+# Open a Pull Request on GitHub
 ```
 
 ### Branch Naming

Dockerfile

@@ -65,25 +65,11 @@ RUN test -f package-lock.json \
 # node-gyp comes from npm's own bundled copy (deterministic, already in the image)
 # instead of `npx --yes`, which would install an arbitrary registry version
 # on-demand and run its lifecycle scripts (Sonar docker:S6505).
-#
-# tls-client-node (chatgpt-web/claude-web/grok-web/lmarena/perplexity-web TLS
-# impersonation) hits the same --ignore-scripts wall: its own postinstall.js
-# fetches a platform .so/.dylib/.dll from the bogdanfinn/tls-client GitHub
-# Releases API and is never invoked when npm ci skips lifecycle scripts. Unlike
-# better-sqlite3 above, that script never throws on failure — it only
-# `console.warn`s and exits 0 — so a rate-limited or offline build would
-# otherwise succeed silently with an empty bin/ and only fail at first request
-# in production (TlsClientUnavailableError, #7802). Run it explicitly here so
-# a broken/rate-limited fetch fails the BUILD loudly instead of shipping a
-# broken image.
 RUN --mount=type=cache,id=npm-cache,target=/root/.npm \
   npm ci --no-audit --no-fund --legacy-peer-deps --ignore-scripts \
   && (cd node_modules/better-sqlite3 \
       && node /usr/local/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js rebuild) \
-  && node -e "require('better-sqlite3')(':memory:').close()" \
-  && node node_modules/tls-client-node/scripts/postinstall.js \
-  && (test -n "$(find node_modules/tls-client-node/bin -mindepth 1 -print -quit 2>/dev/null)" \
-      || (echo "tls-client-node native binary missing after postinstall — GitHub API fetch likely rate-limited or failed (#7802)" >&2 && exit 1))
+  && node -e "require('better-sqlite3')(':memory:').close()"
 
 # Build with Turbopack (stable in Next 16, the repo default). The v3.8.27-era
 # TurbopackInternalError panic ("entered unreachable code: there must be a path to a

SECURITY.md

@@ -42,7 +42,7 @@ Request → CORS → Authz pipeline (classify → policies → enforce)
 | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
 | **Dashboard Login**   | Password-based auth with JWT tokens (HttpOnly cookies)                                                                                    |
 | **API Key Auth**      | HMAC-signed keys with CRC validation                                                                                                      |
-| **OAuth 2.0 + PKCE**  | 13 providers (Claude, Codex, GitHub, Cursor, Antigravity, Gemini, Kimi Coding, Kilo Code, Cline, Kiro, Qoder, Windsurf, GitLab Duo)       |
+| **OAuth 2.0 + PKCE**  | 14 providers (Claude, Codex, GitHub, Cursor, Antigravity, Gemini, Kimi Coding, Kilo Code, Cline, Qwen, Kiro, Qoder, Windsurf, GitLab Duo) |
 | **Token Refresh**     | Automatic OAuth token refresh before expiry                                                                                               |
 | **Secure Cookies**    | `AUTH_COOKIE_SECURE=true` for HTTPS environments                                                                                          |
 | **Authz Pipeline**    | Route classification (PUBLIC / CLIENT_API / MANAGEMENT) — see `docs/architecture/AUTHZ_GUIDE.md`                                          |
@@ -77,28 +77,21 @@ Custom guardrails register via `registerGuardrail(new MyGuardrail())`. The model
 
 ### 🧠 Prompt Injection Guard
 
-Best-effort heuristic middleware that detects prompt injection patterns in LLM requests.
-**Not a complete prompt-injection firewall** — can produce false positives (benign
-persona/RPG prompts) and false negatives (leetspeak, spacing, non-English patterns).
+Middleware that detects and blocks prompt injection attacks in LLM requests:
 
 | Pattern Type        | Severity | Example                                        |
 | ------------------- | -------- | ---------------------------------------------- |
 | System Override     | High     | "ignore all previous instructions"             |
-| Role Hijack         | Medium   | "you are now DAN, you can do anything"         |
-| Delimiter Injection | High     | Encoded separators to break context boundaries |
-| DAN/Jailbreak       | Medium   | Known jailbreak prompt patterns                |
-| Instruction Leak    | High     | "show me your system prompt"                   |
-| Encoding Evasion    | Medium   | base64/rot13/hex decode + instruction keywords |
-
-Only **High** severity detections are blocked in `block` mode. Medium-severity
-families are logged but never blocked by `sanitizeRequest`.
+| Role Hijack         | High     | "you are now DAN, you can do anything"         |
+| Delimiter Injection | Medium   | Encoded separators to break context boundaries |
+| DAN/Jailbreak       | High     | Known jailbreak prompt patterns                |
+| Instruction Leak    | Medium   | "show me your system prompt"                   |
 
 Configure via dashboard (Settings → Security) or `.env`:
 
 ```env
 INPUT_SANITIZER_ENABLED=true
-INPUT_SANITIZER_MODE=block    # warn | block (injection policy; legacy "redact" does not strip injection text)
-INPUT_SANITIZER_BLOCK_THRESHOLD=high  # high (default) | medium | low — severities at/above this are blocked in block mode
+INPUT_SANITIZER_MODE=block    # warn | block | redact
 ```
 
 ### 🔒 PII Redaction
@@ -115,8 +108,7 @@ Automatic detection and optional redaction of personally identifiable informatio
 | SSN (US)      | `123-45-6789`         | `[SSN_REDACTED]`   |
 
 ```env
-PII_REDACTION_ENABLED=true   # request PII rewrite; independent of INPUT_SANITIZER_MODE
-PII_RESPONSE_SANITIZATION=true  # optional: redact PII in provider responses returned to clients
+PII_REDACTION_ENABLED=true
 ```
 
 ### 🌐 Network Security

bin/aliasResolver.mjs

@@ -1,230 +0,0 @@
-/**
- * ESM path-alias resolver for global installs.
- *
- * Problem (#7791): when OmniRoute is installed via `npm i -g omniroute`, the
- * package files live under `node_modules/omniroute/`. tsx's tsconfig-path
- * resolution does not apply there, so specifiers like `@/shared/utils/featureFlags`
- * (declared in tsconfig.json `paths` as `@/* → ./src/*`) or
- * `@omniroute/open-sse/services/usage` fail with `ERR_MODULE_NOT_FOUND`.
- * The CLI crashes before any command can run.
- *
- * Fix: register a Node ESM `resolve` hook that rewrites alias specifiers to
- * absolute file URLs. Covers all tsconfig.json `paths` entries:
- *   - `@/*`             → `./src/*`
- *   - `@omniroute/open-sse`    → `./open-sse/index.ts`
- *   - `@omniroute/open-sse/*`  → `./open-sse/*`
- * The hook runs after tsx so `.ts` extensions are already handled, and only
- * intercepts matched prefixes — everything else falls through to Node's
- * default resolver.
- *
- * Exposed as pure functions so the mapping logic is unit-testable without a
- * running module loader.
- */
-
-import { existsSync, statSync } from "node:fs";
-import { dirname, join, relative, isAbsolute } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-
-/**
- * Alias mapping table — mirrors tsconfig.json `paths`.
- * Processed top-to-bottom; first matching prefix wins.
- *
- * Each entry:
- *   prefix  — specifier prefix to match (e.g. `"@/"`, `"@omniroute/open-sse/"`)
- *   target  — directory name under the package root (e.g. `"src"`, `"open-sse"`)
- *   exact   — if true, the prefix also matches when the specifier equals the
- *             prefix *without* a trailing slash (e.g. `@omniroute/open-sse` →
- *             `<root>/open-sse/index.ts`).
- *
- * Exported for tests/consumers.
- */
-export const ALIAS_MAP = [
-  { prefix: "@/", target: "src", exact: false },
-  { prefix: "@omniroute/open-sse/", target: "open-sse", exact: false },
-  { prefix: "@omniroute/open-sse", target: "open-sse", exact: true },
-];
-
-/** @deprecated Use ALIAS_MAP instead. Kept for backward compat. */
-export const ALIAS_PREFIX = "@/";
-
-// This file is ESM (no CJS __dirname global) — derive it from import.meta.url
-// so the pathToFileURL(join(__dirname, ...)) call below resolves correctly
-// regardless of the caller's cwd.
-const __dirname = dirname(fileURLToPath(import.meta.url));
-
-/**
- * Resolve an alias specifier to an absolute file URL.
- *
- * Rules mirror tsconfig.json `paths` via `ALIAS_MAP`:
- *   "@/..."                     → <root>/src/...
- *   "@omniroute/open-sse/..."   → <root>/open-sse/...
- *   "@omniroute/open-sse"       → <root>/open-sse/index.*
- *
- * - Strips the matched alias prefix and joins the remainder against the
- *   corresponding target directory.
- * - Probes the underlying filesystem for the actual source file: the specifier
- *   itself, then with common source extensions (`.ts`, `.tsx`, `.js`, `.mjs`,
- *   `.cjs`, `.json`), then `<dir>/index.*`. Returns the first existing match
- *   as a `file://` URL.
- * - Returns `null` for specifiers that do not match any alias, for malformed
- *   escapes, for path-traversal attempts, or when no corresponding source
- *   file exists on disk. The caller treats `null` as "defer to the default
- *   resolver".
- *
- * @param {string} specifier  Module specifier from an `import` statement.
- * @param {string} root       Absolute path to the package root.
- * @returns {string|null}     Absolute `file://` URL, or `null` when unresolved.
- */
-const SOURCE_EXTENSIONS = [".ts", ".tsx", ".js", ".mjs", ".cjs", ".json"];
-
-export function resolveAlias(specifier, root) {
-  if (typeof specifier !== "string" || !root || typeof root !== "string") {
-    return null;
-  }
-
-  // Find the first matching alias entry (top-to-bottom order).
-  let matchedEntry = null;
-  let rest = null;
-  for (const entry of ALIAS_MAP) {
-    if (specifier.startsWith(entry.prefix)) {
-      // For non-exact entries, require at least one char after the prefix
-      // to avoid matching bare "@/" as "nothing".
-      const after = specifier.slice(entry.prefix.length);
-      if (after.length === 0 && !entry.exact) continue;
-      matchedEntry = entry;
-      rest = after;
-      break;
-    }
-  }
-  if (!matchedEntry) return null;
-
-  const targetDir = join(root, matchedEntry.target);
-
-  // Exact match (e.g. `@omniroute/open-sse` with no trailing path) →
-  // resolve to `<target>/index.*`.
-  if (rest === "" || rest === undefined) {
-    return probeIndex(targetDir);
-  }
-
-  // Guard against absolute-ish escapes (`@//etc/passwd`, `@/\x00`).
-  if (rest.startsWith("/") || rest.startsWith("\\")) {
-    return null;
-  }
-  // Guard against path-traversal escapes (`@/../../../etc/hostname`).
-  const segments = rest.split(/[\\\/]+/);
-  if (segments.includes("..")) {
-    return null;
-  }
-  const base = join(targetDir, rest);
-  if (!isWithinRoot(targetDir, base)) {
-    return null;
-  }
-  return probeFile(base) ?? probeIndex(base) ?? null;
-}
-
-/**
- * Probe a bare path and its extension variants. Returns the first existing
- * match as a `file://` URL, or `null`.
- */
-function probeFile(base) {
-  // Try extension variants first — a bare `base` that happens to be a directory
-  // would match existsSync() but should NOT be returned as a file URL (the
-  // caller expects a file, not a directory). Extension-probing avoids this
-  // false positive (e.g. `usage` vs `usage.ts` vs `usage/`).
-  for (const ext of SOURCE_EXTENSIONS) {
-    const candidate = base + ext;
-    if (existsSync(candidate)) return pathToFileURL(candidate).href;
-  }
-  // Only accept the bare path if it is NOT a directory.
-  if (existsSync(base)) {
-    try {
-      const st = statSync(base);
-      if (!st.isDirectory()) return pathToFileURL(base).href;
-    } catch {}
-  }
-  return null;
-}
-
-/**
- * Probe a directory for an `index.*` entry. Returns the first existing
- * match as a `file://` URL, or `null`.
- */
-function probeIndex(dir) {
-  const indexBase = join(dir, "index");
-  for (const ext of SOURCE_EXTENSIONS) {
-    const candidate = indexBase + ext;
-    if (existsSync(candidate)) return pathToFileURL(candidate).href;
-  }
-  return null;
-}
-
-/**
- * True when `candidate` resolves to a location inside `ancestor` (or is
- * `ancestor` itself). Used as a second, path-normalization-aware layer of
- * defense against traversal beyond the literal `..` segment check above.
- *
- * @param {string} ancestor
- * @param {string} candidate
- * @returns {boolean}
- */
-function isWithinRoot(ancestor, candidate) {
-  const rel = relative(ancestor, candidate);
-  return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
-}
-
-/**
- * Register the ESM resolve hook for the current process. Safe to call multiple
- * times — subsequent calls are no-ops once the hook is installed.
- *
- * Uses Node's stable `module.register()` API (available since Node 20.6,
- * required Node 22+ here). The hook runs in a worker thread but only reads the
- * captured `root`, so no shared-state hazards.
- *
- * @param {string} root  Absolute path to the package root.
- * @returns {Promise<boolean>}  Resolves `true` once registered (or if already
- *   registered), `false` on environments where `module.register` is unavailable.
- */
-let _registered = false;
-export async function registerAliasResolver(root) {
-  // Validate input FIRST, before the _registered short-circuit. Otherwise the
-  // second call in the same process (e.g. a test suite that already registered
-  // once) would silently return `true` for invalid input instead of rejecting,
-  // masking programmer errors. Input validation must be unconditional.
-  if (!root || typeof root !== "string") {
-    throw new TypeError("registerAliasResolver: root must be a non-empty string");
-  }
-  if (_registered) return true;
-  // if the directory does not exist we would only mask a real misconfiguration
-  // by installing a hook that rewrites to nowhere.
-  if (!existsSync(join(root, "src"))) {
-    return false;
-  }
-
-  try {
-    const { register } = await import("node:module");
-    // #7808: load the hook from a real file on disk via pathToFileURL() instead
-    // of building a `data:text/javascript,...` URL dynamically. CodeQL's
-    // `js/incomplete-url-substring-sanitization` flagged the interpolated
-    // `new URL(...)` call; a file URL produced by pathToFileURL() is a trusted,
-    // fully-parsed URL — no sanitization ambiguity. The hook source lives in
-    // `bin/aliasResolverHook.mjs` (sibling of this file), shipped via
-    // package.json "files": ["bin/"].
-    const hookPath = join(__dirname, "aliasResolverHook.mjs");
-    const hookUrl = pathToFileURL(hookPath);
-    register(hookUrl, { data: { root } });
-    _registered = true;
-    return true;
-  } catch {
-    // Older Node or sandboxed env without module.register — fall back to the
-    // default resolver. The bug will resurface only in the exact global-install
-    // scenario, which is what we explicitly patched; other entry points still
-    // work because they import via relative paths.
-    return false;
-  }
-}
-
-// #7808: the ESM loader hook source now lives in `bin/aliasResolverHook.mjs`,
-// loaded via `pathToFileURL()` above. The previous inline `HOOK_SOURCE` template
-// literal was removed because its `new URL(\`data:text/javascript,...\`)` wrapper
-// triggered CodeQL `js/incomplete-url-substring-sanitization`. The hook logic
-// itself is unchanged — see aliasResolverHook.mjs for the resolver behaviour.

bin/aliasResolverHook.mjs

@@ -1,126 +0,0 @@
-/**
- * ESM loader hook for path-alias resolution (#7791 + #7808).
- *
- * This file runs in Node's loader worker thread after being registered via
- * `module.register(url, data)` from `bin/aliasResolver.mjs`. It MUST NOT import
- * anything from the parent module — all inputs arrive through `initialize(data)`.
- *
- * Behaviour:
- * - Rewrites alias specifiers to absolute filesystem paths, mirroring
- *   tsconfig.json `paths`:
- *     - `@/*`                    → <root>/src/*
- *     - `@omniroute/open-sse`     → <root>/open-sse/index.*
- *     - `@omniroute/open-sse/*`   → <root>/open-sse/*
- * - Probes the usual source extensions (`.ts`, `.tsx`, `.js`, `.mjs`, `.cjs`,
- *   `.json`) plus `index.*` for directory imports.
- * - Returns `shortCircuit: true` only when a candidate file exists on disk;
- *   otherwise delegates to the next resolver (tsx/Node) so unrelated imports
- *   and legitimate "module not found" errors pass through unchanged.
- *
- * Why a separate file instead of an inline `data:` URL?
- * CodeQL's `js/incomplete-url-substring-sanitization` flags dynamic `new URL(...)`
- * construction with interpolated strings. A real file URL produced by
- * `pathToFileURL()` is a trusted, fully-parsed URL — no sanitization ambiguity.
- */
-import { pathToFileURL } from "node:url";
-import { join, relative, isAbsolute } from "node:path";
-import { existsSync, statSync } from "node:fs";
-
-let ROOT = "";
-
-export function initialize(data) {
-  ROOT = (data && data.root) || "";
-}
-
-const EXTENSIONS = [".ts", ".tsx", ".js", ".mjs", ".cjs", ".json"];
-
-/**
- * Alias prefix table — mirrors ALIAS_MAP in aliasResolver.mjs and
- * tsconfig.json `paths`. Processed top-to-bottom; first match wins.
- *
- * @type {Array<{prefix: string, target: string, exact: boolean}>}
- */
-const ALIAS_TABLE = [
-  { prefix: "@/", target: "src", exact: false },
-  { prefix: "@omniroute/open-sse/", target: "open-sse", exact: false },
-  { prefix: "@omniroute/open-sse", target: "open-sse", exact: true },
-];
-
-function tryResolveAliasFsPath(specifier) {
-  if (!ROOT || typeof specifier !== "string") return null;
-
-  // Find the first matching alias entry.
-  let matchedEntry = null;
-  let rest = null;
-  for (const entry of ALIAS_TABLE) {
-    if (specifier.startsWith(entry.prefix)) {
-      const after = specifier.slice(entry.prefix.length);
-      if (after.length === 0 && !entry.exact) continue;
-      matchedEntry = entry;
-      rest = after;
-      break;
-    }
-  }
-  if (!matchedEntry) return null;
-
-  const targetDir = join(ROOT, matchedEntry.target);
-
-  // Exact match (e.g. `@omniroute/open-sse`) → resolve to `<target>/index.*`.
-  if (rest === "" || rest === undefined) {
-    return probeIndex(targetDir);
-  }
-
-  // Guard against absolute-ish escapes.
-  if (rest.startsWith("/") || rest.startsWith("\\")) return null;
-  // Guard against path-traversal escapes.
-  const segments = rest.split(/[\\\/]+/);
-  if (segments.includes("..")) return null;
-
-  const base = join(targetDir, rest);
-  if (!isWithinRoot(targetDir, base)) return null;
-  return probeFile(base) ?? probeIndex(base) ?? null;
-}
-
-function probeFile(base) {
-  // Extension variants first — avoids matching a bare directory name.
-  for (const ext of EXTENSIONS) {
-    const candidate = base + ext;
-    if (existsSync(candidate)) return candidate;
-  }
-  if (existsSync(base)) {
-    try {
-      const st = statSync(base);
-      if (!st.isDirectory()) return base;
-    } catch {}
-  }
-  return null;
-}
-
-function probeIndex(dir) {
-  const indexBase = join(dir, "index");
-  for (const ext of EXTENSIONS) {
-    const candidate = indexBase + ext;
-    if (existsSync(candidate)) return candidate;
-  }
-  return null;
-}
-
-/**
- * True when `candidate` resolves to a location inside `ancestor` (or is
- * `ancestor` itself). Path-normalization-aware defense against traversal.
- */
-function isWithinRoot(ancestor, candidate) {
-  const rel = relative(ancestor, candidate);
-  return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
-}
-
-export function resolve(specifier, context, nextResolve) {
-  const fsPath = tryResolveAliasFsPath(specifier);
-  if (fsPath) {
-    return {
-      url: pathToFileURL(fsPath).href,
-      shortCircuit: true,
-    };
-  }
-  return nextResolve(specifier, context);
-}

bin/cli/commands/auth-export.mjs

@@ -1,163 +0,0 @@
-import { chmodSync, existsSync, writeFileSync } from "node:fs";
-import { decryptCredential } from "../encryption.mjs";
-import { findProviderConnection, listProviderConnections } from "../provider-store.mjs";
-import { openOmniRouteDb } from "../sqlite.mjs";
-import { t } from "../i18n.mjs";
-
-/**
- * Local-only, operator-invoked command that dumps DECRYPTED provider credentials
- * (apiKey/accessToken/refreshToken/idToken). This never runs inside the HTTP server
- * process and must never be reachable over the network — no src/app/api/ route wraps
- * this. See docs/security/ for the threat-model writeup referenced in issue #6683.
- */
-
-const CREDENTIAL_FIELDS = [
-  { key: "apiKey", envSuffix: "API_KEY" },
-  { key: "accessToken", envSuffix: "ACCESS_TOKEN" },
-  { key: "refreshToken", envSuffix: "REFRESH_TOKEN" },
-  { key: "idToken", envSuffix: "ID_TOKEN" },
-];
-
-const VALID_FORMATS = new Set(["json", "env"]);
-const SECURE_FILE_MODE = 0o600;
-
-export function registerAuthExport(program) {
-  program
-    .command("auth export")
-    .description(t("authExport.description"))
-    .option("--id <id>", t("authExport.idOpt"))
-    .option("--format <format>", t("authExport.formatOpt"), "json")
-    .option("--out <file>", t("authExport.outOpt"))
-    .option("--force", t("authExport.forceOpt"))
-    .action(async (opts, cmd) => {
-      const globalOpts = cmd.optsWithGlobals();
-      const exitCode = await runAuthExportCommand({ ...opts, ...globalOpts });
-      if (exitCode !== 0) process.exit(exitCode);
-    });
-}
-
-export async function runAuthExportCommand(opts = {}) {
-  // Security control (a): confirmation gate BEFORE any DB access — a dry invocation
-  // never opens the database and never decrypts anything.
-  if (!opts.force) {
-    printConfirmationGate();
-    return 0;
-  }
-
-  const format = opts.format || "json";
-  if (!VALID_FORMATS.has(format)) {
-    console.error(t("authExport.invalidFormat", { format }));
-    return 1;
-  }
-
-  if (!process.env.STORAGE_ENCRYPTION_KEY) {
-    console.error(t("authExport.missingKey"));
-    return 1;
-  }
-
-  // Security control (b): stderr warning banner BEFORE any plaintext is emitted.
-  process.stderr.write(t("authExport.warning") + "\n");
-
-  const rows = await loadTargetConnections(opts.id);
-  if (rows === null) {
-    console.error(t("authExport.notFound", { id: opts.id }));
-    return 1;
-  }
-
-  const exported = rows.map(exportConnection);
-  const content = format === "env" ? formatAsEnv(exported) : formatAsJson(exported);
-
-  if (opts.out) {
-    writeSecureFile(opts.out, content);
-  } else {
-    console.log(content);
-  }
-
-  return 0;
-}
-
-function printConfirmationGate() {
-  console.log(
-    `\n${t("authExport.confirmHeading")}\n\n${t("authExport.confirmBody")}\n\n${t("authExport.confirmFooter")}\n`
-  );
-}
-
-async function loadTargetConnections(id) {
-  const { db } = await openOmniRouteDb();
-  try {
-    if (!id) return listProviderConnections(db);
-    const connection = findProviderConnection(db, id);
-    return connection ? [connection] : null;
-  } finally {
-    db.close();
-  }
-}
-
-function decryptField(rawValue) {
-  // Security control (d): a per-field decrypt failure surfaces as a boolean flag,
-  // never the caught error text. Security control (e): the caught error is never
-  // interpolated into any message.
-  try {
-    return { value: decryptCredential(rawValue), failed: false };
-  } catch {
-    return { value: null, failed: true };
-  }
-}
-
-function exportConnection(connection) {
-  const result = {
-    id: connection.id,
-    provider: connection.provider,
-    name: connection.name,
-    authType: connection.authType,
-  };
-
-  for (const { key } of CREDENTIAL_FIELDS) {
-    const rawValue = connection[key];
-    if (!rawValue) {
-      result[key] = null;
-      result[`${key}DecryptFailed`] = false;
-      continue;
-    }
-    const { value, failed } = decryptField(rawValue);
-    result[key] = value;
-    result[`${key}DecryptFailed`] = failed;
-  }
-
-  return result;
-}
-
-function formatAsJson(rows) {
-  return JSON.stringify(rows, null, 2);
-}
-
-function envSafeSegment(value) {
-  return String(value || "")
-    .toUpperCase()
-    .replace(/[^A-Z0-9]+/g, "_")
-    .replace(/^_+|_+$/g, "");
-}
-
-function formatAsEnv(rows) {
-  const lines = [];
-  for (const row of rows) {
-    lines.push(`# ${row.provider} (${row.id})`);
-    const providerSegment = envSafeSegment(row.provider);
-    for (const { key, envSuffix } of CREDENTIAL_FIELDS) {
-      const value = row[key];
-      if (!value) continue;
-      lines.push(`OMNIROUTE_${providerSegment}_${envSuffix}=${value}`);
-    }
-  }
-  return lines.join("\n");
-}
-
-function writeSecureFile(filePath, content) {
-  // Security control (c): file output written with mode 0o600 (plus chmodSync if the
-  // file pre-existed, belt-and-suspenders against an already world-readable file).
-  const preExisted = existsSync(filePath);
-  writeFileSync(filePath, content, { mode: SECURE_FILE_MODE });
-  if (preExisted) {
-    chmodSync(filePath, SECURE_FILE_MODE);
-  }
-}

bin/cli/commands/dashboard.mjs

@@ -1,22 +1,17 @@
 import { execFile } from "node:child_process";
 import { t } from "../i18n.mjs";
 
-function parsePort(value, fallback) {
-  const parsed = parseInt(String(value), 10);
-  return Number.isFinite(parsed) && parsed > 0 && parsed <= 65535 ? parsed : fallback;
-}
-
 export function registerDashboard(program) {
   program
     .command("dashboard")
     .description(t("dashboard.description"))
     .option("--url", t("dashboard.urlOnly"))
-    .option("--port <port>", "Port the server is running on")
+    .option("--port <port>", "Port the server is running on", "20128")
     .option("--tui", t("dashboard.tui") || "Open interactive TUI dashboard (terminal UI)")
     .action(async (opts, cmd) => {
       if (opts.tui) {
         const globalOpts = cmd.optsWithGlobals();
-        const port = parsePort(opts.port ?? process.env.PORT ?? "20128", 20128);
+        const port = opts.port ? parseInt(String(opts.port), 10) : 20128;
         const baseUrl = globalOpts.baseUrl ?? `http://localhost:${port}`;
         const apiKey = globalOpts.apiKey ?? null;
         const { startInteractiveTui } = await import("../tui/Dashboard.jsx");
@@ -29,7 +24,7 @@ export function registerDashboard(program) {
 }
 
 export async function runDashboardCommand(opts = {}) {
-  const port = parsePort(opts.port ?? process.env.PORT ?? "20128", 20128);
+  const port = opts.port ? parseInt(String(opts.port), 10) : 20128;
   const dashboardUrl = `http://localhost:${port}`;
 
   if (opts.url) {
@@ -49,22 +44,22 @@ export async function runDashboardCommand(opts = {}) {
   return 0;
 }
 
-/**
- * Resolve the command and args to open a URL in the default browser
- * for a given platform. Exported for testing — callers should use openFallback().
- * @param {"darwin"|"win32"|string} platform
- * @param {string} url
- * @returns {{ cmd: string, args: string[] }}
- */
-export function resolveOpenCommand(platform, url) {
-  if (platform === "darwin") return { cmd: "open", args: [url] };
-  if (platform === "win32") return { cmd: "rundll32", args: ["url.dll,FileProtocolHandler", url] };
-  return { cmd: "xdg-open", args: [url] };
-}
-
 function openFallback(url) {
   return new Promise((resolve) => {
-    const { cmd, args } = resolveOpenCommand(process.platform, url);
+    const { platform } = process;
+    let cmd, args;
+
+    if (platform === "darwin") {
+      cmd = "open";
+      args = [url];
+    } else if (platform === "win32") {
+      cmd = "cmd";
+      args = ["/c", "start", "", url];
+    } else {
+      cmd = "xdg-open";
+      args = [url];
+    }
+
     execFile(cmd, args, { stdio: "ignore" }, () => resolve());
   });
 }

bin/cli/commands/launch.mjs

@@ -106,10 +106,10 @@ export async function runLaunchCommand(opts = {}, claudeArgs = []) {
     if (!res.ok) throw new Error(`status ${res.status}`);
   } catch {
     console.error(
-      (
-        t("launch.notRunning") ||
-        "OmniRoute is not reachable at {port}. Start it with 'omniroute serve'."
-      ).replace("{port}", baseUrl)
+      (t("launch.notRunning") || "OmniRoute is not reachable at {port}. Start it with 'omniroute serve'.").replace(
+        "{port}",
+        baseUrl
+      )
     );
     return 1;
   }
@@ -120,14 +120,7 @@ export async function runLaunchCommand(opts = {}, claudeArgs = []) {
   const env = buildClaudeEnv(process.env, baseUrl, authToken, { configDir });
 
   return await new Promise((resolve) => {
-    // #8246: on Windows, npm installs claude as a .cmd shim — spawn() without
-    // shell:true cannot resolve PATHEXT shims and fails with ENOENT.
-    const claudeCommand = process.platform === "win32" ? "claude.cmd" : "claude";
-    const child = spawn(claudeCommand, claudeArgs, {
-      env,
-      stdio: "inherit",
-      ...(process.platform === "win32" ? { shell: true, windowsHide: true } : {}),
-    });
+    const child = spawn("claude", claudeArgs, { env, stdio: "inherit" });
     child.on("error", (err) => {
       if (err && err.code === "ENOENT") {
         console.error(t("launch.notFound") || "The 'claude' CLI was not found in PATH.");
@@ -149,10 +142,7 @@ export function registerLaunch(program) {
     )
     .option("--port <port>", t("serve.port") || "Proxy port", "20128")
     .option("--remote <url>", "Remote OmniRoute base URL (overrides --port and the active context)")
-    .option(
-      "--profile <name>",
-      "Claude Code profile to use (CLAUDE_CONFIG_DIR ~/.claude/profiles/<name>)"
-    )
+    .option("--profile <name>", "Claude Code profile to use (CLAUDE_CONFIG_DIR ~/.claude/profiles/<name>)")
     .option("--token <token>", t("launch.token") || "Token Claude sends (ANTHROPIC_AUTH_TOKEN)")
     .option("--api-key <key>", "Alias for --token (OmniRoute access token / API key)")
     .allowUnknownOption(true)

bin/cli/commands/oauth.mjs

@@ -7,6 +7,7 @@ const PROVIDERS_WITH_OAUTH = [
   { id: "gemini", name: "Google Gemini", flow: "browser" },
   { id: "antigravity", name: "Antigravity", flow: "browser" },
   { id: "windsurf", name: "Windsurf", flow: "browser" },
+  { id: "qwen", name: "Qwen Code", flow: "browser" },
   { id: "cursor", name: "Cursor", flow: "import" },
   { id: "zed", name: "Zed", flow: "import" },
   { id: "kiro", name: "Amazon Kiro", flow: "social" },

bin/cli/commands/registry.mjs

@@ -37,7 +37,6 @@ import { registerProviders } from "./providers.mjs";
 import { registerProvider } from "./provider-cmd.mjs";
 import { registerConfig } from "./config.mjs";
 import { registerKeys } from "./keys.mjs";
-import { registerAuthExport } from "./auth-export.mjs";
 import { registerModels } from "./models.mjs";
 import { registerCombo } from "./combo.mjs";
 import { registerStatus } from "./status.mjs";
@@ -70,8 +69,8 @@ import { registerSetupCursor } from "./setup-cursor.mjs";
 import { registerSetupRoo } from "./setup-roo.mjs";
 import { registerSetupCrush } from "./setup-crush.mjs";
 import { registerSetupGoose } from "./setup-goose.mjs";
-import { registerSetupAider } from "./setup-aider.mjs";
 import { registerSetupQwen } from "./setup-qwen.mjs";
+import { registerSetupAider } from "./setup-aider.mjs";
 import { registerConnect } from "./connect.mjs";
 import { registerContexts } from "./contexts.mjs";
 import { registerTokens } from "./tokens.mjs";
@@ -119,7 +118,6 @@ export function registerCommands(program) {
   registerProvider(program);
   registerConfig(program);
   registerKeys(program);
-  registerAuthExport(program);
   registerModels(program);
   registerCombo(program);
   registerStatus(program);
@@ -153,8 +151,8 @@ export function registerCommands(program) {
   registerSetupRoo(program);
   registerSetupCrush(program);
   registerSetupGoose(program);
-  registerSetupAider(program);
   registerSetupQwen(program);
+  registerSetupAider(program);
   registerConnect(program);
   registerContexts(program);
   registerTokens(program);

bin/cli/commands/serve.mjs

@@ -134,7 +134,7 @@ export async function runServe(opts = {}) {
     "Release",
     "better_sqlite3.node"
   );
-  if (!process.versions.bun && existsSync(sqliteBinary) && !isNativeBinaryCompatible(sqliteBinary)) {
+  if (existsSync(sqliteBinary) && !isNativeBinaryCompatible(sqliteBinary)) {
     console.error(
       "\x1b[31m✖ better-sqlite3 native module is incompatible with this platform.\x1b[0m"
     );
@@ -230,10 +230,7 @@ export async function runServe(opts = {}) {
 function runDaemon(serverJs, env, memoryLimit, dashboardPort, apiPort) {
   // #5238: skip the explicit CLI --max-old-space-size when the user pinned the
   // heap via NODE_OPTIONS (a CLI arg would shadow/override their value).
-  const server = spawn(process.versions.bun ? process.execPath : "node", [
-    ...(process.versions.bun ? [] : buildNodeHeapArgs(process.env, memoryLimit)),
-    serverJs,
-  ], {
+  const server = spawn("node", [...buildNodeHeapArgs(process.env, memoryLimit), serverJs], {
     cwd: APP_DIR,
     env,
     stdio: "ignore",
@@ -249,10 +246,7 @@ function runDaemon(serverJs, env, memoryLimit, dashboardPort, apiPort) {
 function runWithoutRecovery(serverJs, env, memoryLimit, dashboardPort, apiPort, noOpen, startedAt) {
   // #5238: skip the explicit CLI --max-old-space-size when the user pinned the
   // heap via NODE_OPTIONS (a CLI arg would shadow/override their value).
-  const server = spawn(process.versions.bun ? process.execPath : "node", [
-    ...(process.versions.bun ? [] : buildNodeHeapArgs(process.env, memoryLimit)),
-    serverJs,
-  ], {
+  const server = spawn("node", [...buildNodeHeapArgs(process.env, memoryLimit), serverJs], {
     cwd: APP_DIR,
     env,
     stdio: "pipe",

bin/cli/commands/setup-open-code.mjs

@@ -218,29 +218,13 @@ function registerPluginInOpenCodeConfig({
  * a clear "could not run opencode" message instead of a hard import
  * failure.
  */
-/**
- * Pure resolver for the `opencode auth login` spawn descriptor. Extracted so the
- * platform-branching logic is unit-testable without mocking child_process or
- * mutating process.platform.
- *
- * On Windows the `opencode` binary is an npm `.cmd` shim that Node's hardened
- * spawnSync (post CVE-2024-27980) refuses to run without a shell — spawning it
- * with shell:false throws EINVAL (#7913). Mirror the same fix already applied to
- * codex (resolveCodexSpawn in launch-codex.mjs, crediting #6263) and
- * qodercli/Auggie (#6263/#6304): shell:true on win32, shell:false everywhere else.
- */
-export function resolveOpenCodeAuthSpawn(providerId, platform = process.platform) {
-  const isWin = platform === "win32";
-  return {
-    command: isWin ? "opencode.cmd" : "opencode",
-    args: ["auth", "login", "--provider", providerId],
-    options: { stdio: "inherit", shell: isWin },
-  };
-}
-
-export function runOpenCodeAuth(providerId) {
-  const { command, args, options } = resolveOpenCodeAuthSpawn(providerId);
-  const res = spawnSync(command, args, options);
+function runOpenCodeAuth(providerId) {
+  const isWin = process.platform === "win32";
+  const opencodeBin = isWin ? "opencode.cmd" : "opencode";
+  const res = spawnSync(opencodeBin, ["auth", "login", "--provider", providerId], {
+    stdio: "inherit",
+    shell: false,
+  });
   if (res.error) {
     // ENOENT = opencode is not on PATH
     if (res.error.code === "ENOENT") {

bin/cli/commands/setup-qwen.mjs

@@ -1,166 +1,156 @@
-/** Configure Qwen Code's OpenAI-compatible provider for OmniRoute. */
+/**
+ * omniroute setup-qwen — configure Qwen Code (QwenLM/qwen-code) for OmniRoute.
+ *
+ * Qwen Code is a terminal AI agent with a file-based config at
+ * ~/.qwen/settings.json. For a custom OpenAI-compatible endpoint it uses a
+ * `modelProviders` entry with authType "openai", baseUrl WITH /v1, and an
+ * `envKey` naming the env var holding the key (secret stays in the env, never the
+ * file). Remote-aware; headless test via `qwen -p "..."`.
+ */
 
-import {
-  chmodSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  renameSync,
-  unlinkSync,
-  writeFileSync,
-} from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 import os from "node:os";
-import path from "node:path";
-
-import {
-  mergeQwenCodeEnv,
-  mergeQwenCodeSettings,
-  normalizeQwenCodeBaseUrl,
-} from "../../../src/shared/services/qwenCodeConfig.ts";
+import { printHeading, printInfo, printSuccess, printError, createPrompt } from "../io.mjs";
 import { resolveActiveContext } from "../contexts.mjs";
-import { createPrompt, printError, printHeading, printInfo, printSuccess } from "../io.mjs";
 
-/** Resolve base URL and key from flags, active context, then local defaults. */
-export function resolveQwenTarget(opts = {}) {
-  let root = opts.remote ? String(opts.remote) : "";
-  let context;
-
-  if (!root || !(opts.apiKey ?? opts["api-key"])) {
-    try {
-      context = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT);
-    } catch {
-      // An active context is optional for local setup.
-    }
-  }
-
-  if (!root) root = context?.baseUrl || "";
-  if (!root) {
-    const port = Number(opts.port ?? process.env.PORT ?? 20128) || 20128;
-    root = `http://localhost:${port}`;
-  }
-
-  const apiKey =
-    opts.apiKey ??
-    opts["api-key"] ??
-    context?.accessToken ??
-    context?.apiKey ??
-    process.env.OMNIROUTE_API_KEY ??
-    "sk_omniroute";
-
-  return { baseUrl: normalizeQwenCodeBaseUrl(root), apiKey };
+function ensureV1(url) {
+  const s = String(url || "").replace(/\/+$/, "");
+  return s.endsWith("/v1") ? s : `${s}/v1`;
 }
 
-const readSettings = (filePath) => {
-  if (!existsSync(filePath)) return {};
-  const parsed = JSON.parse(readFileSync(filePath, "utf8"));
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("Qwen Code settings.json must contain a JSON object");
-  }
-  return parsed;
-};
-
-const readText = (filePath) => (existsSync(filePath) ? readFileSync(filePath, "utf8") : "");
-
-const writeAtomic = (filePath, content, mode) => {
-  const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
-  try {
-    writeFileSync(tempPath, content, { encoding: "utf8", mode });
-    if (mode !== undefined) chmodSync(tempPath, mode);
-    renameSync(tempPath, filePath);
-  } catch (error) {
+/** Resolve baseUrl (WITH /v1) + apiKey from flags → active context → localhost. */
+export function resolveQwenTarget(opts = {}) {
+  let root;
+  if (opts.remote) root = String(opts.remote).replace(/\/+$/, "");
+  else {
     try {
-      unlinkSync(tempPath);
+      root = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT)?.baseUrl;
     } catch {
-      // The temporary file may not have been created.
+      /* none */
     }
-    throw error;
+    if (!root) root = `http://localhost:${Number(opts.port ?? process.env.PORT ?? 20128) || 20128}`;
   }
-};
+  let apiKey = opts.apiKey ?? opts["api-key"];
+  if (!apiKey) {
+    try {
+      const c = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT);
+      apiKey = c?.accessToken || c?.apiKey;
+    } catch {
+      /* none */
+    }
+  }
+  if (!apiKey) apiKey = process.env.OMNIROUTE_API_KEY || "";
+  return { baseUrl: ensureV1(root), apiKey };
+}
 
-const fetchModelIds = async (baseUrl, apiKey) => {
+/** Merge the OmniRoute modelProvider into Qwen's settings.json (preserve rest). */
+export function buildQwenSettings(existing, { baseUrl, model }) {
+  const s = existing && typeof existing === "object" ? { ...existing } : {};
+  const providers = Array.isArray(s.modelProviders)
+    ? s.modelProviders.filter((p) => p?.id !== "omniroute")
+    : [];
+  providers.push({
+    id: "omniroute",
+    name: "OmniRoute",
+    authType: "openai",
+    baseUrl,
+    envKey: "OMNIROUTE_API_KEY",
+  });
+  s.modelProviders = providers;
+  if (model) {
+    s.selectedProvider = "omniroute";
+    s.model = model;
+  }
+  return s;
+}
+
+function readJson(path) {
   try {
-    const response = await fetch(`${baseUrl}/models`, {
-      headers: { Authorization: `Bearer ${apiKey}` },
+    if (existsSync(path)) return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    /* corrupt/missing */
+  }
+  return {};
+}
+
+async function fetchModelIds(baseUrl, apiKey) {
+  try {
+    const headers = { "Content-Type": "application/json" };
+    if (apiKey) headers["Authorization"] = `Bearer ${apiKey}`;
+    const res = await fetch(`${baseUrl.replace(/\/v1$/, "")}/v1/models`, {
+      headers,
       signal: AbortSignal.timeout(8000),
     });
-    if (!response.ok) return [];
-    const body = await response.json();
-    const models = Array.isArray(body) ? body : (body.data ?? body.models ?? []);
-    return models.map((entry) => (typeof entry === "string" ? entry : entry?.id)).filter(Boolean);
+    if (!res.ok) return [];
+    const body = await res.json();
+    const list = Array.isArray(body) ? body : (body.data ?? body.models ?? []);
+    return list.map((m) => (typeof m === "string" ? m : m?.id)).filter(Boolean);
   } catch {
     return [];
   }
-};
+}
 
 export async function runSetupQwenCommand(opts = {}) {
   const { baseUrl, apiKey } = resolveQwenTarget(opts);
   const dryRun = Boolean(opts.dryRun ?? opts["dry-run"]);
-  const settingsPath =
-    opts.configPath ?? opts["config-path"] ?? path.join(os.homedir(), ".qwen", "settings.json");
-  const envPath = opts.envPath ?? opts["env-path"] ?? path.join(path.dirname(settingsPath), ".env");
+  const configPath =
+    opts.configPath ?? opts["config-path"] ?? join(os.homedir(), ".qwen", "settings.json");
 
-  printHeading("OmniRoute → Qwen Code (OpenAI-compatible)");
+  printHeading("OmniRoute → Qwen Code (openai-compatible)");
   printInfo(`baseUrl: ${baseUrl}`);
 
-  let model = String(opts.model || "").trim();
-  if (!model && !opts.yes) {
-    const modelIds = await fetchModelIds(baseUrl, apiKey);
-    if (modelIds.length > 0) {
-      printInfo(`Examples: ${modelIds.slice(0, 20).join(", ")}${modelIds.length > 20 ? " …" : ""}`);
-    }
-    const prompt = createPrompt();
-    try {
-      model = String(await prompt.ask("Model id for Qwen Code")).trim();
-    } finally {
-      prompt.close();
+  let model = opts.model;
+  if (!model) {
+    const ids = await fetchModelIds(baseUrl, apiKey);
+    if (ids.length && !opts.yes) {
+      printInfo(`Examples: ${ids.slice(0, 20).join(", ")}${ids.length > 20 ? " …" : ""}`);
+      const prompt = createPrompt();
+      try {
+        model = await prompt.ask("Model id for Qwen");
+      } finally {
+        prompt.close();
+      }
     }
   }
-
   if (!model) {
     printError("A model is required. Pass --model <id>.");
     return 2;
   }
 
-  try {
-    const settings = mergeQwenCodeSettings(readSettings(settingsPath), { baseUrl, model });
-    const envText = mergeQwenCodeEnv(readText(envPath), apiKey);
-    const settingsText = `${JSON.stringify(settings, null, 2)}\n`;
+  const merged = buildQwenSettings(readJson(configPath), { baseUrl, model });
+  const out = JSON.stringify(merged, null, 2) + "\n";
 
-    if (dryRun) {
-      console.log(`\n${settingsText}`);
-      printInfo(`[dry-run] settings → ${settingsPath}`);
-      printInfo(`[dry-run] credential → ${envPath} (OMNIROUTE_API_KEY)`);
-      return 0;
-    }
-
-    mkdirSync(path.dirname(settingsPath), { recursive: true, mode: 0o700 });
-    mkdirSync(path.dirname(envPath), { recursive: true, mode: 0o700 });
-    writeAtomic(settingsPath, settingsText);
-    writeAtomic(envPath, envText, 0o600);
-    printSuccess(`Wrote ${settingsPath}`);
-    printSuccess(`Updated ${envPath} (OMNIROUTE_API_KEY only)`);
-    printInfo('Run: qwen   (or headless: qwen -p "reply OK")');
-    return 0;
-  } catch (error) {
-    printError(`Failed to configure Qwen Code: ${error?.message || error}`);
-    return 1;
+  if (dryRun) {
+    console.log("\n" + out);
+    printInfo(`[dry-run] → ${configPath}`);
+  } else {
+    mkdirSync(join(configPath, ".."), { recursive: true });
+    writeFileSync(configPath, out, "utf8");
+    printSuccess(`Wrote ${configPath}`);
   }
+  printInfo(
+    "\nProvide the key (settings reference OMNIROUTE_API_KEY):  export OMNIROUTE_API_KEY=..."
+  );
+  printInfo('Then run:  qwen        (or headless: qwen -p "reply OK")');
+  return 0;
 }
 
 export function registerSetupQwen(program) {
   program
     .command("setup-qwen")
-    .description("Configure Qwen Code's upstream V4 modelProviders format for OmniRoute")
+    .description(
+      "Configure Qwen Code for OmniRoute: write ~/.qwen/settings.json (openai modelProvider)"
+    )
     .option("--port <port>", "Local OmniRoute port (ignored when --remote is set)", "20128")
-    .option("--remote <url>", "Remote OmniRoute URL")
-    .option("--api-key <key>", "OmniRoute API key")
-    .option("--model <id>", "Model id for Qwen Code")
-    .option("--config-path <path>", "Qwen Code settings.json path")
-    .option("--env-path <path>", "Qwen Code .env path")
-    .option("--yes", "Non-interactive; requires --model")
-    .option("--dry-run", "Print settings without writing files or secrets")
+    .option("--remote <url>", "Remote OmniRoute URL, e.g. http://192.168.0.15:20128")
+    .option("--api-key <key>", "OmniRoute API key (defaults to OMNIROUTE_API_KEY env var)")
+    .option("--model <id>", "Model id for Qwen (required unless picked interactively)")
+    .option("--config-path <path>", "settings.json path (default: ~/.qwen/settings.json)")
+    .option("--yes", "Non-interactive: do not prompt (requires --model)")
+    .option("--dry-run", "Print what would be written without touching the filesystem")
     .action(async (opts) => {
       const code = await runSetupQwenCommand(opts);
-      if (code !== 0) process.exitCode = code;
+      if (code !== 0) process.exit(code);
     });
 }

bin/cli/commands/stop.mjs

@@ -8,7 +8,6 @@ import {
   sleep,
 } from "../utils/pid.mjs";
 import { t } from "../i18n.mjs";
-import { stopProcessGracefully } from "../../../src/shared/platform/windowsProcess.ts";
 
 const execFileAsync = promisify(execFile);
 
@@ -28,11 +27,18 @@ export async function runStopCommand(opts = {}) {
   if (pid && isPidRunning(pid)) {
     console.log(t("stop.stopping", { pid }));
     try {
-      // #8045: on win32, process.kill(pid, "SIGTERM") unconditionally force-terminates
-      // the target instead of delivering an interceptable signal, racing (and beating)
-      // the server's own async graceful shutdown / WAL checkpoint. stopProcessGracefully
-      // skips the immediate SIGTERM on win32 and just polls before escalating to SIGKILL.
-      await stopProcessGracefully({ pid, timeoutMs: 5000, isPidRunning, sleep });
+      process.kill(pid, "SIGTERM");
+
+      let waited = 0;
+      while (waited < 5000 && isPidRunning(pid)) {
+        await sleep(100);
+        waited += 100;
+      }
+
+      if (isPidRunning(pid)) {
+        process.kill(pid, "SIGKILL");
+        await sleep(500);
+      }
 
       killAllSubprocesses();
       cleanupPidFile("server");

bin/cli/locales/en.json

@@ -133,20 +133,6 @@
       "listTitle": "Keys expiring within {days} days:"
     }
   },
-  "authExport": {
-    "description": "Export DECRYPTED provider credentials (local-only, plaintext output)",
-    "idOpt": "Export only the connection matching this id/name/provider",
-    "formatOpt": "Output format: json or env",
-    "outOpt": "Write output to a file instead of stdout (written with 0600 permissions)",
-    "forceOpt": "Confirm you understand this prints/writes plaintext secrets",
-    "warning": "⚠ This prints/writes DECRYPTED plaintext API keys and OAuth tokens. Make sure your screen, shell history, and any output file stay private.",
-    "confirmHeading": "⚠ WARNING: this exports DECRYPTED provider credentials in plaintext",
-    "confirmBody": "This command decrypts and prints/writes apiKey, accessToken, refreshToken, and\nidToken for the selected connection(s). Treat the output as a secret.",
-    "confirmFooter": "To confirm, run:\n  omniroute auth export --force",
-    "missingKey": "STORAGE_ENCRYPTION_KEY is required to export credentials.",
-    "notFound": "Connection not found: {id}",
-    "invalidFormat": "Invalid format: {format}. Use json or env."
-  },
   "stream": {
     "description": "Stream a chat response with SSE inspection modes",
     "file": "Read prompt from file",

bin/cli/locales/pt-BR.json

@@ -132,20 +132,6 @@
       "listTitle": "Chaves que expiram nos próximos {days} dias:"
     }
   },
-  "authExport": {
-    "description": "Exportar credenciais DESCRIPTOGRAFADAS de provedores (somente local, saída em texto puro)",
-    "idOpt": "Exportar apenas a conexão correspondente a este id/nome/provedor",
-    "formatOpt": "Formato de saída: json ou env",
-    "outOpt": "Gravar a saída em um arquivo em vez do stdout (gravado com permissão 0600)",
-    "forceOpt": "Confirma que você entende que isso imprime/grava segredos em texto puro",
-    "warning": "⚠ Isso imprime/grava chaves de API e tokens OAuth DESCRIPTOGRAFADOS em texto puro. Garanta que sua tela, o histórico do shell e qualquer arquivo de saída permaneçam privados.",
-    "confirmHeading": "⚠ AVISO: isso exporta credenciais de provedores DESCRIPTOGRAFADAS em texto puro",
-    "confirmBody": "Este comando descriptografa e imprime/grava apiKey, accessToken, refreshToken e\nidToken da(s) conexão(ões) selecionada(s). Trate a saída como um segredo.",
-    "confirmFooter": "Para confirmar, execute:\n  omniroute auth export --force",
-    "missingKey": "STORAGE_ENCRYPTION_KEY é obrigatório para exportar credenciais.",
-    "notFound": "Conexão não encontrada: {id}",
-    "invalidFormat": "Formato inválido: {format}. Use json ou env."
-  },
   "stream": {
     "description": "Transmitir resposta de chat com modos de inspeção SSE",
     "file": "Ler prompt de arquivo",

bin/cli/locales/zh-CN.json

@@ -29,16 +29,16 @@
   "setup": {
     "title": "OmniRoute 设置",
     "passwordPrompt": "管理员密码",
-    "providerPrompt": "默认提供者（留空跳过）",
+    "providerPrompt": "默认提供商（留空跳过）",
     "done": "设置完成",
     "passwordSet": "管理员密码已配置",
-    "providerSet": "提供者已配置：{name}",
-    "testingProvider": "正在测试提供者连接：{name}",
-    "testPassed": "提供者测试通过",
-    "testFailed": "提供者测试失败：{error}",
+    "providerSet": "提供商已配置：{name}",
+    "testingProvider": "正在测试提供商连接：{name}",
+    "testPassed": "提供商测试通过",
+    "testFailed": "提供商测试失败：{error}",
     "loginEnabled": "登录：已启用（密码已更新）",
     "loginDisabled": "登录：已禁用",
-    "providerInfo": "提供者：{info}"
+    "providerInfo": "提供商：{info}"
   },
   "doctor": {
     "title": "OmniRoute 诊断",
@@ -52,29 +52,29 @@
     "warnings": "{count} 个警告 — 见上文。"
   },
   "providers": {
-    "title": "提供者",
-    "noProviders": "未配置提供者。运行：omniroute setup",
+    "title": "提供商",
+    "noProviders": "未配置提供商。运行：omniroute setup",
     "testing": "正在测试 {name}...",
-    "available": "{count} 个提供者可用",
+    "available": "{count} 个提供商可用",
     "connected": "已连接",
     "disconnected": "未连接",
     "validationFailed": "验证失败：{error}",
     "metrics": {
-      "description": "显示提供者性能指标（延迟、成功率、成本）",
-      "provider": "按提供者 ID 筛选",
+      "description": "显示提供商性能指标（延迟、成功率、成本）",
+      "provider": "按提供商 ID 筛选",
       "connection_id": "按连接 ID 筛选",
       "period": "时间范围：1h|6h|24h|7d|30d（默认：24h）",
       "metric": "关注特定指标字段",
       "sort": "按字段排序（降序）",
       "limit": "最大行数（默认：50）",
       "watch": "每 5 秒刷新（实时模式）",
-      "compare": "逗号分隔的提供者 ID，并排比较"
+      "compare": "逗号分隔的提供商 ID，并排比较"
     },
     "metric_single": {
       "description": "获取特定连接的单个指标值"
     },
     "rotate": {
-      "description": "轮换提供者连接的上游 API 密钥",
+      "description": "轮换提供商连接的上游 API 密钥",
       "newKeyOpt": "新 API 密钥值（避免使用：优先使用 --from-env）",
       "fromEnvOpt": "从环境变量 VAR 读取新密钥",
       "oauthOpt": "改为触发 OAuth 重新认证流程",
@@ -89,18 +89,18 @@
       "testFailed": "轮换后测试失败：{error}"
     },
     "status": {
-      "description": "显示所有提供者连接的密钥健康状态（期限、过期、冷却）",
-      "providerOpt": "按提供者名称筛选",
-      "header": "ID         提供者       名称                     过期状态  测试状态  冷却至",
-      "noData": "没有可用的提供者连接数据。",
+      "description": "显示所有提供商连接的密钥健康状态（期限、过期、冷却）",
+      "providerOpt": "按提供商名称筛选",
+      "header": "ID         提供商       名称                     过期状态  测试状态  冷却至",
+      "noData": "没有可用的提供商连接数据。",
       "requiresServer": "providers status 需要 OmniRoute 服务器正在运行。"
     }
   },
   "keys": {
     "title": "API 密钥",
-    "addDescription": "为提供者添加或更新 API 密钥",
+    "addDescription": "为提供商添加或更新 API 密钥",
     "listDescription": "列出所有已配置的 API 密钥",
-    "removeDescription": "移除提供者的 API 密钥",
+    "removeDescription": "移除提供商的 API 密钥",
     "regenerateDescription": "重新生成 OmniRoute API 密钥",
     "revokeDescription": "撤销 OmniRoute API 密钥",
     "revealDescription": "显示未掩码的 API 密钥值",
@@ -122,10 +122,10 @@
     "revoked": "密钥 {id} 已撤销。",
     "rotated": "密钥 {id} 已轮换。新密钥 ID：{newId}",
     "revealWarning": "⚠ 这将显示完整的未掩码密钥。请确保您的屏幕不被人看到。",
-    "providerRequired": "需要提供者。",
+    "providerRequired": "需要提供商。",
     "keyRequired": "需要 API 密钥。",
     "stdinEmpty": "未通过标准输入提供 API 密钥。",
-    "unknownProvider": "未知提供者：{provider}",
+    "unknownProvider": "未知提供商：{provider}",
     "policy": {
       "title": "密钥策略",
       "showDescription": "显示密钥的速率/成本策略",
@@ -165,7 +165,7 @@
     "analytics": {
       "description": "显示汇总使用分析",
       "period": "时间范围：1d|7d|30d|90d|ytd|all（默认：30d）",
-      "provider": "按提供者 ID 筛选"
+      "provider": "按提供商 ID 筛选"
     },
     "budget": {
       "description": "管理成本预算",
@@ -175,8 +175,8 @@
       }
     },
     "quota": {
-      "description": "显示提供者配额使用情况",
-      "provider": "按提供者 ID 筛选",
+      "description": "显示提供商配额使用情况",
+      "provider": "按提供商 ID 筛选",
       "check": "显示新请求是否有可用配额"
     },
     "logs": {
@@ -201,7 +201,7 @@
     }
   },
   "cost": {
-    "description": "按提供者、模型、组合或 API 密钥显示成本报告",
+    "description": "按提供商、模型、组合或 API 密钥显示成本报告",
     "period": "时间范围：1d|7d|30d|90d|ytd|all（默认：30d）",
     "since": "开始日期（ISO 格式，例如 2026-01-01）— 覆盖 --period",
     "until": "结束日期（ISO 格式）",
@@ -210,7 +210,7 @@
     "limit": "显示的最大行数（默认：100）"
   },
   "simulate": {
-    "description": "模拟路由（空运行）— 显示将选择哪些提供者而不调用上游",
+    "description": "模拟路由（空运行）— 显示将选择哪些提供商而不调用上游",
     "file": "从 JSON 文件加载完整请求体",
     "model": "模型 ID（默认：auto）",
     "combo": "强制指定组合名称",
@@ -301,7 +301,7 @@
     "cost": "成本（24h）："
   },
   "quota": {
-    "description": "显示提供者配额使用情况",
+    "description": "显示提供商配额使用情况",
     "noServer": "服务器未运行。启动：omniroute serve",
     "noData": "没有可用的配额信息。"
   },
@@ -315,12 +315,12 @@
     "description": "一键启动本地 Redis 容器（Podman 或 Docker），用于 OmniRoute 缓存和配额跟踪"
   },
   "test": {
-    "description": "测试提供者连接",
+    "description": "测试提供商连接",
     "noServer": "服务器未运行。启动：omniroute serve",
     "testing": "正在测试 {provider} / {model}...",
     "passed": "连接成功！",
     "failed": "连接失败：{error}",
-    "allProvidersOpt": "测试所有已配置的提供者",
+    "allProvidersOpt": "测试所有已配置的提供商",
     "latencyOpt": "显示延迟测量值（平均/最小/最大 毫秒）",
     "repeatOpt": "重复测试 N 次并汇总结果",
     "compareOpt": "逗号分隔的要比较的模型（例如 gpt-4o,claude-3-5-sonnet）",
@@ -328,7 +328,7 @@
     "saved": "结果已保存至 {path}",
     "compareTitle": "模型比较",
     "compareMinTwo": "--compare 需要至少两个模型（逗号分隔）",
-    "noProviders": "未配置提供者。添加：omniroute keys add"
+    "noProviders": "未配置提供商。添加：omniroute keys add"
   },
   "update": {
     "checking": "正在检查更新...",
@@ -509,7 +509,7 @@
   },
   "models": {
     "description": "列出可用模型（需要服务器）",
-    "search": "按 ID、名称、提供者或描述筛选模型",
+    "search": "按 ID、名称、提供商或描述筛选模型",
     "noServer": "服务器未运行。启动：omniroute serve",
     "noModels": "未找到模型。"
   },
@@ -656,25 +656,25 @@
     }
   },
   "oauth": {
-    "description": "管理 OAuth 提供者连接",
+    "description": "管理 OAuth 提供商连接",
     "providers": {
-      "description": "列出支持 OAuth 的提供者及其流程类型"
+      "description": "列出支持 OAuth 的提供商及其流程类型"
     },
     "start": {
-      "description": "为提供者启动 OAuth 授权流程",
-      "provider": "提供者 ID（gemini, copilot, cursor, ...）",
+      "description": "为提供商启动 OAuth 授权流程",
+      "provider": "提供商 ID（gemini, copilot, cursor, ...）",
       "no_browser": "仅打印 URL — 不打开浏览器",
       "import_system": "从本地系统配置自动导入凭据",
-      "social": "社交登录提供者（google|github）— kiro 需要",
+      "social": "社交登录提供商（google|github）— kiro 需要",
       "timeout": "等待授权超时时间（毫秒，默认：300000）"
     },
     "status": {
       "description": "列出活动的 OAuth 连接",
-      "provider": "按提供者 ID 筛选"
+      "provider": "按提供商 ID 筛选"
     },
     "revoke": {
       "description": "撤销 OAuth 连接",
-      "provider": "要撤销的提供者 ID",
+      "provider": "要撤销的提供商 ID",
       "connection_id": "按 ID 撤销特定连接",
       "yes": "跳过确认提示"
     }
@@ -884,11 +884,11 @@
     "description": "管理模型定价数据",
     "sync": {
       "description": "从上游同步价格",
-      "provider": "按提供者筛选",
+      "provider": "按提供商筛选",
       "force": "强制重新同步"
     },
     "list": {
-      "provider": "按提供者筛选",
+      "provider": "按提供商筛选",
       "model": "按模型筛选",
       "limit": "最大结果数"
     },
@@ -907,25 +907,25 @@
   "resilience": {
     "description": "检查和管理弹性机制",
     "status": {
-      "provider": "按提供者筛选"
+      "provider": "按提供商筛选"
     },
     "breakers": {
-      "provider": "按提供者筛选"
+      "provider": "按提供商筛选"
     },
     "cooldowns": {
-      "provider": "按提供者筛选",
+      "provider": "按提供商筛选",
       "connectionId": "按连接 ID 筛选"
     },
     "lockouts": {
-      "provider": "按提供者筛选",
+      "provider": "按提供商筛选",
       "model": "按模型筛选"
     },
     "reset": {
       "description": "重置断路器/冷却状态",
-      "provider": "要重置的提供者",
+      "provider": "要重置的提供商",
       "connectionId": "要重置的连接 ID",
       "model": "要重置锁定状态的模型",
-      "allCooldowns": "重置提供者的所有冷却",
+      "allCooldowns": "重置提供商的所有冷却",
       "yes": "跳过确认"
     },
     "profile": {
@@ -940,13 +940,13 @@
     }
   },
   "nodes": {
-    "description": "管理提供者节点（端点）",
+    "description": "管理提供商节点（端点）",
     "list": {
-      "provider": "按提供者筛选",
+      "provider": "按提供商筛选",
       "enabled": "仅显示已启用的节点"
     },
     "add": {
-      "provider": "提供者名称",
+      "provider": "提供商名称",
       "baseUrl": "节点的基础 URL",
       "name": "节点名称",
       "weight": "负载均衡权重",
@@ -965,7 +965,7 @@
     },
     "validate": {
       "baseUrl": "要验证的 URL",
-      "provider": "要验证的提供者"
+      "provider": "要验证的提供商"
     },
     "test": {
       "description": "向节点发送测试请求"
@@ -1091,7 +1091,7 @@
   "oneproxy": {
     "description": "管理 OneProxy 上游代理池",
     "stats": {
-      "provider": "按提供者筛选",
+      "provider": "按提供商筛选",
       "period": "时间范围（默认：24h）"
     },
     "fetch": {
@@ -1101,14 +1101,14 @@
     },
     "rotate": {
       "description": "强制轮换代理",
-      "provider": "要轮换的提供者",
+      "provider": "要轮换的提供商",
       "connectionId": "要轮换的特定连接 ID"
     },
     "config": {
       "description": "显示或更新 OneProxy 配置",
       "enabled": "启用代理池（true|false）",
       "poolSize": "池大小",
-      "providerSource": "代理提供者的 URL",
+      "providerSource": "代理提供商的 URL",
       "rotationPolicy": "轮换策略：sticky|per-request|periodic"
     },
     "pool": {
@@ -1201,7 +1201,7 @@
     "bash": "打印 bash 补全脚本",
     "fish": "打印 fish 补全脚本",
     "install": "为检测到的 Shell 全局安装补全脚本",
-    "refresh": "刷新组合/提供者/模型缓存"
+    "refresh": "刷新组合/提供商/模型缓存"
   },
   "logs": {
     "description": "流式传输或导出请求日志",

bin/cli/locales/zh-TW.json

@@ -29,16 +29,16 @@
   "setup": {
     "title": "OmniRoute 設定",
     "passwordPrompt": "管理員密碼",
-    "providerPrompt": "預設提供者（留空跳過）",
+    "providerPrompt": "預設提供商（留空跳過）",
     "done": "設定完成",
     "passwordSet": "管理員密碼已配置",
-    "providerSet": "提供者已配置：{name}",
-    "testingProvider": "正在測試提供者連線：{name}",
-    "testPassed": "提供者測試通過",
-    "testFailed": "提供者測試失敗：{error}",
+    "providerSet": "提供商已配置：{name}",
+    "testingProvider": "正在測試提供商連線：{name}",
+    "testPassed": "提供商測試通過",
+    "testFailed": "提供商測試失敗：{error}",
     "loginEnabled": "登入：已啟用（密碼已更新）",
     "loginDisabled": "登入：已停用",
-    "providerInfo": "提供者：{info}"
+    "providerInfo": "提供商：{info}"
   },
   "doctor": {
     "title": "OmniRoute 診斷",
@@ -52,29 +52,29 @@
     "warnings": "{count} 個警告 — 見上文。"
   },
   "providers": {
-    "title": "提供者",
-    "noProviders": "未配置提供者。執行：omniroute setup",
+    "title": "提供商",
+    "noProviders": "未配置提供商。執行：omniroute setup",
     "testing": "正在測試 {name}...",
-    "available": "{count} 個提供者可用",
+    "available": "{count} 個提供商可用",
     "connected": "已連線",
     "disconnected": "未連線",
     "validationFailed": "驗證失敗：{error}",
     "metrics": {
-      "description": "顯示提供者效能指標（延遲、成功率、成本）",
-      "provider": "按提供者 ID 篩選",
+      "description": "顯示提供商效能指標（延遲、成功率、成本）",
+      "provider": "按提供商 ID 篩選",
       "connection_id": "按連線 ID 篩選",
       "period": "時間範圍：1h|6h|24h|7d|30d（預設：24h）",
       "metric": "關注特定指標欄位",
       "sort": "按欄位排序（降序）",
       "limit": "最大行數（預設：50）",
       "watch": "每 5 秒重新整理（即時模式）",
-      "compare": "逗號分隔的提供者 ID，並排比較"
+      "compare": "逗號分隔的提供商 ID，並排比較"
     },
     "metric_single": {
       "description": "獲取特定連線的單個指標值"
     },
     "rotate": {
-      "description": "輪換提供者連線的上游 API 金鑰",
+      "description": "輪換提供商連線的上游 API 金鑰",
       "newKeyOpt": "新 API 金鑰值（避免使用：優先使用 --from-env）",
       "fromEnvOpt": "從環境變數 VAR 讀取新金鑰",
       "oauthOpt": "改為觸發 OAuth 重新認證流程",
@@ -89,18 +89,18 @@
       "testFailed": "輪換後測試失敗：{error}"
     },
     "status": {
-      "description": "顯示所有提供者連線的金鑰健康狀態（期限、過期、冷卻）",
-      "providerOpt": "按提供者名稱篩選",
-      "header": "ID         提供者       名稱                     過期狀態  測試狀態  冷卻至",
-      "noData": "沒有可用的提供者連線資料。",
+      "description": "顯示所有提供商連線的金鑰健康狀態（期限、過期、冷卻）",
+      "providerOpt": "按提供商名稱篩選",
+      "header": "ID         提供商       名稱                     過期狀態  測試狀態  冷卻至",
+      "noData": "沒有可用的提供商連線資料。",
       "requiresServer": "providers status 需要 OmniRoute 伺服器正在執行。"
     }
   },
   "keys": {
     "title": "API 金鑰",
-    "addDescription": "為提供者新增或更新 API 金鑰",
+    "addDescription": "為提供商新增或更新 API 金鑰",
     "listDescription": "列出所有已配置的 API 金鑰",
-    "removeDescription": "移除提供者的 API 金鑰",
+    "removeDescription": "移除提供商的 API 金鑰",
     "regenerateDescription": "重新生成 OmniRoute API 金鑰",
     "revokeDescription": "撤銷 OmniRoute API 金鑰",
     "revealDescription": "顯示未掩碼的 API 金鑰值",
@@ -122,10 +122,10 @@
     "revoked": "金鑰 {id} 已撤銷。",
     "rotated": "金鑰 {id} 已輪換。新金鑰 ID：{newId}",
     "revealWarning": "⚠ 這將顯示完整的未掩碼金鑰。請確保您的螢幕不被人看到。",
-    "providerRequired": "需要提供者。",
+    "providerRequired": "需要提供商。",
     "keyRequired": "需要 API 金鑰。",
     "stdinEmpty": "未通過標準輸入提供 API 金鑰。",
-    "unknownProvider": "未知提供者：{provider}",
+    "unknownProvider": "未知提供商：{provider}",
     "policy": {
       "title": "金鑰策略",
       "showDescription": "顯示金鑰的速率/成本策略",
@@ -151,7 +151,7 @@
     "model": "模型 ID（預設：auto）",
     "system": "系統提示",
     "combo": "強制指定組合名稱",
-    "max_tokens": "響應最大權杖數",
+    "max_tokens": "響應最大令牌數",
     "responses_api": "使用 /v1/responses 而不是 /v1/chat/completions",
     "raw": "列印接收到的原始 SSE 行",
     "debug": "在 stderr 中列印每塊的時間資訊",
@@ -165,7 +165,7 @@
     "analytics": {
       "description": "顯示彙總使用分析",
       "period": "時間範圍：1d|7d|30d|90d|ytd|all（預設：30d）",
-      "provider": "按提供者 ID 篩選"
+      "provider": "按提供商 ID 篩選"
     },
     "budget": {
       "description": "管理成本預算",
@@ -175,8 +175,8 @@
       }
     },
     "quota": {
-      "description": "顯示提供者配額使用情況",
-      "provider": "按提供者 ID 篩選",
+      "description": "顯示提供商配額使用情況",
+      "provider": "按提供商 ID 篩選",
       "check": "顯示新請求是否有可用配額"
     },
     "logs": {
@@ -201,7 +201,7 @@
     }
   },
   "cost": {
-    "description": "按提供者、模型、組合或 API 金鑰顯示成本報告",
+    "description": "按提供商、模型、組合或 API 金鑰顯示成本報告",
     "period": "時間範圍：1d|7d|30d|90d|ytd|all（預設：30d）",
     "since": "開始日期（ISO 格式，例如 2026-01-01）— 覆蓋 --period",
     "until": "結束日期（ISO 格式）",
@@ -210,12 +210,12 @@
     "limit": "顯示的最大行數（預設：100）"
   },
   "simulate": {
-    "description": "模擬路由（空執行）— 顯示將選擇哪些提供者而不呼叫上游",
+    "description": "模擬路由（空執行）— 顯示將選擇哪些提供商而不呼叫上游",
     "file": "從 JSON 檔案載入完整請求體",
     "model": "模型 ID（預設：auto）",
     "combo": "強制指定組合名稱",
     "reasoning": "推理努力級別（low|medium|high）",
-    "thinking": "擴充套件思維權杖預算",
+    "thinking": "擴充套件思維令牌預算",
     "explain": "在 stderr 中列印回退樹和成本範圍",
     "noCombo": "未找到匹配的組合。使用以下命令配置：omniroute combo create"
   },
@@ -225,11 +225,11 @@
     "stdin": "從標準輸入讀取提示",
     "system": "系統提示",
     "model": "模型 ID（預設：auto）",
-    "max_tokens": "響應最大權杖數",
+    "max_tokens": "響應最大令牌數",
     "temperature": "取樣溫度（0–2）",
     "top_p": "Top-p 核取樣",
     "reasoning_effort": "推理努力級別（low|medium|high）",
-    "thinking_budget": "擴充套件思維權杖預算",
+    "thinking_budget": "擴充套件思維令牌預算",
     "combo": "強制指定組合名稱",
     "responses_api": "使用 /v1/responses 而不是 /v1/chat/completions",
     "stream": "增量流式傳輸響應",
@@ -301,7 +301,7 @@
     "cost": "成本（24h）："
   },
   "quota": {
-    "description": "顯示提供者配額使用情況",
+    "description": "顯示提供商配額使用情況",
     "noServer": "伺服器未執行。啟動：omniroute serve",
     "noData": "沒有可用的配額資訊。"
   },
@@ -315,12 +315,12 @@
     "description": "一鍵啟動本地 Redis 容器（Podman 或 Docker），用於 OmniRoute 快取和配額跟蹤"
   },
   "test": {
-    "description": "測試提供者連線",
+    "description": "測試提供商連線",
     "noServer": "伺服器未執行。啟動：omniroute serve",
     "testing": "正在測試 {provider} / {model}...",
     "passed": "連線成功！",
     "failed": "連線失敗：{error}",
-    "allProvidersOpt": "測試所有已配置的提供者",
+    "allProvidersOpt": "測試所有已配置的提供商",
     "latencyOpt": "顯示延遲測量值（平均/最小/最大 毫秒）",
     "repeatOpt": "重複測試 N 次並彙總結果",
     "compareOpt": "逗號分隔的要比較的模型（例如 gpt-4o,claude-3-5-sonnet）",
@@ -328,7 +328,7 @@
     "saved": "結果已儲存至 {path}",
     "compareTitle": "模型比較",
     "compareMinTwo": "--compare 需要至少兩個模型（逗號分隔）",
-    "noProviders": "未配置提供者。新增：omniroute keys add"
+    "noProviders": "未配置提供商。新增：omniroute keys add"
   },
   "update": {
     "checking": "正在檢查更新...",
@@ -445,7 +445,7 @@
       "description": "配置壓縮設定",
       "engine": "壓縮引擎（caveman|rtk|hybrid|none）",
       "caveman_agg": "Caveman 激程序度 0.0–1.0",
-      "rtk_budget": "RTK 權杖預算",
+      "rtk_budget": "RTK 令牌預算",
       "language_pack": "要啟用的語言包"
     },
     "engine": {
@@ -509,7 +509,7 @@
   },
   "models": {
     "description": "列出可用模型（需要伺服器）",
-    "search": "按 ID、名稱、提供者或描述篩選模型",
+    "search": "按 ID、名稱、提供商或描述篩選模型",
     "noServer": "伺服器未執行。啟動：omniroute serve",
     "noModels": "未找到模型。"
   },
@@ -621,7 +621,7 @@
       "type": "按記憶型別篩選（user|feedback|project|reference）",
       "limit": "最大結果數（預設：20）",
       "api_key": "按 API 金鑰篩選",
-      "token_budget": "限制結果中的總權杖數"
+      "token_budget": "限制結果中的總令牌數"
     },
     "add": {
       "description": "新增新的記憶條目",
@@ -656,25 +656,25 @@
     }
   },
   "oauth": {
-    "description": "管理 OAuth 提供者連線",
+    "description": "管理 OAuth 提供商連線",
     "providers": {
-      "description": "列出支援 OAuth 的提供者及其流程型別"
+      "description": "列出支援 OAuth 的提供商及其流程型別"
     },
     "start": {
-      "description": "為提供者啟動 OAuth 授權流程",
-      "provider": "提供者 ID（gemini, copilot, cursor, ...）",
+      "description": "為提供商啟動 OAuth 授權流程",
+      "provider": "提供商 ID（gemini, copilot, cursor, ...）",
       "no_browser": "僅列印 URL — 不開啟瀏覽器",
       "import_system": "從本地系統配置自動匯入憑據",
-      "social": "社交登入提供者（google|github）— kiro 需要",
+      "social": "社交登入提供商（google|github）— kiro 需要",
       "timeout": "等待授權超時時間（毫秒，預設：300000）"
     },
     "status": {
       "description": "列出活動的 OAuth 連線",
-      "provider": "按提供者 ID 篩選"
+      "provider": "按提供商 ID 篩選"
     },
     "revoke": {
       "description": "撤銷 OAuth 連線",
-      "provider": "要撤銷的提供者 ID",
+      "provider": "要撤銷的提供商 ID",
       "connection_id": "按 ID 撤銷特定連線",
       "yes": "跳過確認提示"
     }
@@ -884,20 +884,20 @@
     "description": "管理模型定價資料",
     "sync": {
       "description": "從上游同步價格",
-      "provider": "按提供者篩選",
+      "provider": "按提供商篩選",
       "force": "強制重新同步"
     },
     "list": {
-      "provider": "按提供者篩選",
+      "provider": "按提供商篩選",
       "model": "按模型篩選",
       "limit": "最大結果數"
     },
     "defaults": {
       "description": "管理預設定價",
-      "input": "每 1M 權杖的輸入成本（美元）",
-      "output": "每 1M 權杖的輸出成本（美元）",
-      "cacheRead": "每 1M 權杖的快取讀取成本（美元）",
-      "cacheWrite": "每 1M 權杖的快取寫入成本（美元）"
+      "input": "每 1M 令牌的輸入成本（美元）",
+      "output": "每 1M 令牌的輸出成本（美元）",
+      "cacheRead": "每 1M 令牌的快取讀取成本（美元）",
+      "cacheWrite": "每 1M 令牌的快取寫入成本（美元）"
     },
     "diff": {
       "description": "顯示與上游價格的差異",
@@ -907,25 +907,25 @@
   "resilience": {
     "description": "檢查和管理彈性機制",
     "status": {
-      "provider": "按提供者篩選"
+      "provider": "按提供商篩選"
     },
     "breakers": {
-      "provider": "按提供者篩選"
+      "provider": "按提供商篩選"
     },
     "cooldowns": {
-      "provider": "按提供者篩選",
+      "provider": "按提供商篩選",
       "connectionId": "按連線 ID 篩選"
     },
     "lockouts": {
-      "provider": "按提供者篩選",
+      "provider": "按提供商篩選",
       "model": "按模型篩選"
     },
     "reset": {
       "description": "重置斷路器/冷卻狀態",
-      "provider": "要重置的提供者",
+      "provider": "要重置的提供商",
       "connectionId": "要重置的連線 ID",
       "model": "要重置鎖定狀態的模型",
-      "allCooldowns": "重置提供者的所有冷卻",
+      "allCooldowns": "重置提供商的所有冷卻",
       "yes": "跳過確認"
     },
     "profile": {
@@ -940,13 +940,13 @@
     }
   },
   "nodes": {
-    "description": "管理提供者節點（端點）",
+    "description": "管理提供商節點（端點）",
     "list": {
-      "provider": "按提供者篩選",
+      "provider": "按提供商篩選",
       "enabled": "僅顯示已啟用的節點"
     },
     "add": {
-      "provider": "提供者名稱",
+      "provider": "提供商名稱",
       "baseUrl": "節點的基礎 URL",
       "name": "節點名稱",
       "weight": "負載均衡權重",
@@ -965,7 +965,7 @@
     },
     "validate": {
       "baseUrl": "要驗證的 URL",
-      "provider": "要驗證的提供者"
+      "provider": "要驗證的提供商"
     },
     "test": {
       "description": "向節點發送測試請求"
@@ -993,7 +993,7 @@
       "description": "管理 RTK 上下文最佳化器",
       "config": {
         "description": "顯示或更新 RTK 配置",
-        "tokenBudget": "RTK 權杖預算",
+        "tokenBudget": "RTK 令牌預算",
         "reservePct": "保留百分比"
       },
       "filters": {
@@ -1091,7 +1091,7 @@
   "oneproxy": {
     "description": "管理 OneProxy 上游代理池",
     "stats": {
-      "provider": "按提供者篩選",
+      "provider": "按提供商篩選",
       "period": "時間範圍（預設：24h）"
     },
     "fetch": {
@@ -1101,14 +1101,14 @@
     },
     "rotate": {
       "description": "強制輪換代理",
-      "provider": "要輪換的提供者",
+      "provider": "要輪換的提供商",
       "connectionId": "要輪換的特定連線 ID"
     },
     "config": {
       "description": "顯示或更新 OneProxy 配置",
       "enabled": "啟用代理池（true|false）",
       "poolSize": "池大小",
-      "providerSource": "代理提供者的 URL",
+      "providerSource": "代理提供商的 URL",
       "rotationPolicy": "輪換策略：sticky|per-request|periodic"
     },
     "pool": {
@@ -1163,11 +1163,11 @@
       "fromCloud": "從雲備份初始化"
     },
     "tokens": {
-      "description": "管理同步權杖",
+      "description": "管理同步令牌",
       "create": {
-        "name": "權杖名稱",
-        "scope": "權杖作用域",
-        "ttl": "權杖有效期（例如 30d）"
+        "name": "令牌名稱",
+        "scope": "令牌作用域",
+        "ttl": "令牌有效期（例如 30d）"
       },
       "revoke": {
         "yes": "跳過確認"
@@ -1201,7 +1201,7 @@
     "bash": "列印 bash 補全指令碼",
     "fish": "列印 fish 補全指令碼",
     "install": "為檢測到的 Shell 全域性安裝補全指令碼",
-    "refresh": "重新整理組合/提供者/模型快取"
+    "refresh": "重新整理組合/提供商/模型快取"
   },
   "logs": {
     "description": "流式傳輸或匯出請求日誌",

bin/cli/runtime/processSupervisor.mjs

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import { dirname } from "node:path";
-import { writePidFile, cleanupPidFile, killAllSubprocesses, isPidRunning } from "../utils/pid.mjs";
+import { writePidFile, cleanupPidFile, killAllSubprocesses } from "../utils/pid.mjs";
 import {
   RESTART_RESET_MS,
   DEFAULT_MAX_RESTARTS,
@@ -9,7 +9,6 @@ import {
   waitUntilPortFree,
 } from "./supervisorPolicy.mjs";
 import { buildNodeHeapArgs } from "../../../scripts/build/runtime-env.mjs";
-import { stopProcessGracefully } from "../../../src/shared/platform/windowsProcess.ts";
 
 const CRASH_LOG_LINES = 50;
 
@@ -41,10 +40,7 @@ export class ServerSupervisor {
     // silently, so a boot that never becomes ready looked like a dead hang with zero
     // output even at APP_LOG_LEVEL=debug. Pipe stdout too and buffer it alongside
     // stderr so a readiness timeout can surface what the child actually printed.
-    this.child = spawn(process.versions.bun ? process.execPath : "node", [
-      ...(process.versions.bun ? [] : heapArgs),
-      this.serverPath,
-    ], {
+    this.child = spawn("node", [...heapArgs, this.serverPath], {
       cwd: dirname(this.serverPath),
       env: this.env,
       stdio: showLog ? "inherit" : ["ignore", "pipe", "pipe"],
@@ -73,32 +69,12 @@ export class ServerSupervisor {
     return this.child;
   }
 
-  handleExit(code, err) {
+  handleExit(code) {
     // Node.js v24+ requires process.exit() to receive a number. Spawn-error events
     // deliver err.code (a string like 'ENOENT') via the 'error' listener; normalise here.
     const exitCode = typeof code === "number" ? code : null;
     cleanupPidFile("server");
 
-    // #8091: the child's spawn 'error' listener passes `err` through as a second
-    // argument, but it used to be silently dropped — the user only ever saw the
-    // hardcoded "code=-1" with a permanently empty crash log, with no way to
-    // diagnose why the child never started (ENOENT/EACCES/bad path/etc.). Surface
-    // the real reason immediately, both on the console and in the crash-log buffer
-    // so `dumpCrashLog()` shows it too.
-    if (err) {
-      const detail = [
-        err.code && `code=${err.code}`,
-        err.syscall && `syscall=${err.syscall}`,
-        err.path && `path=${err.path}`,
-        err.message,
-      ]
-        .filter(Boolean)
-        .join(" ");
-      const line = `⚠ Spawn error: ${detail || String(err)}`;
-      console.error(line);
-      this.crashLog.push(line);
-    }
-
     // #4425: only exit on an intentional shutdown. A spontaneous code-0 exit (e.g. a
     // systemd MemoryMax cgroup kill, which reports the process exited cleanly) is anomalous
     // and must be restarted, not treated as a graceful stop that leaves the gateway dead.
@@ -156,13 +132,14 @@ export class ServerSupervisor {
   stop() {
     this.isShuttingDown = true;
     if (this.child?.pid) {
-      // #8045: on win32, process.kill(pid, "SIGTERM") unconditionally force-terminates
-      // the target — it is never a real, interceptable signal there. The child already
-      // receives the real CTRL_C_EVENT/CTRL_CLOSE_EVENT independently (it shares the
-      // console) and runs its own async graceful shutdown (WAL checkpoint). Sending
-      // SIGTERM immediately on win32 races and beats that cleanup. Fire-and-forget:
-      // stop() itself stays sync so callers keep their existing control flow.
-      void stopProcessGracefully({ pid: this.child.pid, timeoutMs: 5000, isPidRunning });
+      try {
+        process.kill(this.child.pid, "SIGTERM");
+      } catch {}
+      setTimeout(() => {
+        try {
+          process.kill(this.child.pid, "SIGKILL");
+        } catch {}
+      }, 5000);
     }
     killAllSubprocesses();
   }

bin/cli/sqlite.mjs

@@ -3,10 +3,7 @@ import { resolveDataDir, resolveStoragePath } from "./data-dir.mjs";
 import { ensureProviderSchema } from "./provider-store.mjs";
 import { ensureSettingsSchema, hashManagementPassword, updateSettings } from "./settings-store.mjs";
 
-async function loadSqlite() {
-  if (process.versions.bun) {
-    return (await import("bun:sqlite")).Database;
-  }
+async function loadBetterSqlite() {
   try {
     return (await import("better-sqlite3")).default;
   } catch {
@@ -14,57 +11,6 @@ async function loadSqlite() {
   }
 }
 
-function openBunSqlite(Database, dbPath, options) {
-  const raw = new Database(dbPath, options);
-  const prepare = (sql) => {
-    const statement = raw.query(sql);
-    return {
-      run: (...params) => statement.run(...normalizeBunSqliteParams(params)),
-      get: (...params) => statement.get(...normalizeBunSqliteParams(params)),
-      all: (...params) => statement.all(...normalizeBunSqliteParams(params)),
-    };
-  };
-  return {
-    prepare,
-    query: (sql) => raw.query(sql),
-    exec: (sql) => raw.exec(sql),
-    transaction: (fn) => raw.transaction(fn),
-    close: () => raw.close(),
-    serialize: () => raw.serialize(),
-    pragma: (pragmaStr, pragmaOptions) => {
-      const statement = raw.query(`PRAGMA ${pragmaStr}`);
-      if (pragmaOptions?.simple) {
-        const row = statement.get();
-        return row ? (Object.values(row)[0] ?? null) : null;
-      }
-      return statement.all();
-    },
-  };
-}
-
-export function normalizeBunSqliteParams(params) {
-  if (
-    params.length !== 1 ||
-    params[0] === null ||
-    typeof params[0] !== "object" ||
-    Array.isArray(params[0]) ||
-    params[0] instanceof Uint8Array ||
-    (typeof Buffer !== "undefined" && Buffer.isBuffer(params[0]))
-  ) {
-    return params;
-  }
-  const expanded = {};
-  for (const [key, value] of Object.entries(params[0])) {
-    if (/^[:@$]/.test(key)) expanded[key] = value;
-    else {
-      expanded[`@${key}`] = value;
-      expanded[`:${key}`] = value;
-      expanded[`$${key}`] = value;
-    }
-  }
-  return [expanded];
-}
-
 export function createSqliteNativeError(error) {
   const message = error instanceof Error ? error.message : String(error);
   if (message.includes("NODE_MODULE_VERSION") || message.includes("ERR_DLOPEN_FAILED")) {
@@ -75,35 +21,13 @@ export function createSqliteNativeError(error) {
         "(rebuilds into a user-writable runtime; works without a C++ toolchain)."
     );
   }
-  if (
-    message.includes("Could not locate the bindings file") ||
-    message.includes("MODULE_NOT_FOUND") ||
-    message.includes("Cannot find module 'better-sqlite3'")
-  ) {
-    return new Error(
-      "better-sqlite3 native binding could not be found (no prebuilt addon for this platform). " +
-        "This is common under `npx`, which runs a fresh, ephemeral install that never built the addon. " +
-        "Run: omniroute runtime repair  " +
-        "(rebuilds into a user-writable runtime; works without a C++ toolchain)."
-    );
-  }
   return error;
 }
 
 async function openSqliteDatabase(dbPath, options = {}) {
-  const Database = await loadSqlite();
-  if (process.versions.bun) {
-    if (options.fileMustExist && !fs.existsSync(dbPath)) {
-      throw new Error(`SQLite file does not exist: ${dbPath}`);
-    }
-    options = options.readonly
-      ? { readonly: true }
-      : { readwrite: true, create: options.fileMustExist !== true };
-  }
+  const Database = await loadBetterSqlite();
   try {
-    return process.versions.bun
-      ? openBunSqlite(Database, dbPath, options)
-      : new Database(dbPath, options);
+    return new Database(dbPath, options);
   } catch (error) {
     throw createSqliteNativeError(error);
   }
@@ -135,16 +59,7 @@ export async function withReadonlySqlite(dbPath, callback) {
 export async function backupSqliteFile(sourcePath, destPath) {
   const db = await openSqliteDatabase(sourcePath, { readonly: true });
   try {
-    if (typeof db.backup === "function") {
-      await db.backup(destPath);
-    } else if (sourcePath === ":memory:" && typeof db.serialize === "function") {
-      fs.writeFileSync(destPath, Buffer.from(db.serialize()));
-    } else {
-      try {
-        db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
-      } catch {}
-      fs.copyFileSync(sourcePath, destPath);
-    }
+    await db.backup(destPath);
   } finally {
     db.close();
   }

bin/cli/tray/autostart.mjs

@@ -6,7 +6,6 @@ import { fileURLToPath } from "node:url";
 
 const APP_LABEL = "com.omniroute.autostart";
 const WIN_REG_VALUE = "OmniRoute";
-const WIN_STARTUP_FILE = "OmniRoute.vbs";
 const LINUX_SERVICE_NAME = "omniroute.service";
 const LINUX_DESKTOP_NAME = "omniroute.desktop";
 
@@ -324,101 +323,38 @@ function isEnabledMac() {
   );
 }
 
-/**
- * Returns the absolute path to the Windows Startup folder
- * (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\),
- * or null when APPDATA is not set.
- */
-function winStartupDir() {
-  if (!process.env.APPDATA) return null;
-  return join(process.env.APPDATA, "Microsoft", "Windows", "Start Menu", "Programs", "Startup");
-}
-
-/**
- * Returns the full path to the VBS autostart script in the Startup folder,
- * or null when the Startup folder cannot be resolved.
- */
-function winStartupPath() {
-  const dir = winStartupDir();
-  return dir ? join(dir, WIN_STARTUP_FILE) : null;
-}
-
-/**
- * Builds the VBScript source that launches OmniRoute with WSH's Run method
- * using SW_HIDE (0) so no console window appears.
- *
- * 9Router uses the same pattern: a .vbs file in the Startup folder that calls
- * WScript.Shell.Run with window style 0 (hidden). This avoids the console
- * window flash that HKCU\Run causes for console-mode node.exe.
- */
-function buildWinVbsContent(cliPath) {
-  const execLine = buildServeExecLine(cliPath, { tray: true });
-  // VBScript doubles `"` inside a string to escape them. The execLine already
-  // contains quoted paths; escape each `"` to `""` so the VBS parser reads
-  // them as literal quote characters in the command string passed to Run().
-  const vbsSafe = execLine.replace(/"/g, '""');
-  return [
-    'Set WshShell = CreateObject("WScript.Shell")',
-    `WshShell.Run "${vbsSafe}", 0, False`,
-    "",
-  ].join("\n");
-}
-
-/**
- * Removes the legacy HKCU\Run registry value if present. Callers use this
- * during migration so stale Run entries don't linger after switching to the
- * VBS-based autostart.
- */
-function cleanLegacyWinReg() {
-  try {
-    execSync(
-      `reg delete HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v ${WIN_REG_VALUE} /f 2>nul`,
-      { stdio: "ignore", windowsHide: true }
-    );
-  } catch {
-    // entry did not exist or already removed — noop
-  }
-}
-
 function enableWin() {
   const cliPath = resolveCliPath();
   if (!cliPath) return false;
-  const vbsPath = winStartupPath();
-  if (!vbsPath) return false;
-  const dir = dirname(vbsPath);
-  mkdirSync(dir, { recursive: true });
-  writeFileSync(vbsPath, buildWinVbsContent(cliPath), { mode: 0o644 });
-  // Migrate away from the legacy HKCU\Run entry — it launches node.exe with
-  // a visible console window. The VBS approach is the replacement.
-  cleanLegacyWinReg();
-  return existsSync(vbsPath);
+  const value = `"${process.execPath}" "${cliPath}" serve --tray --no-open`;
+  try {
+    execSync(
+      `reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v ${WIN_REG_VALUE} /t REG_SZ /d "${value}" /f`,
+      { stdio: "ignore", windowsHide: true }
+    );
+    return true;
+  } catch {
+    return false;
+  }
 }
 
 function disableWin() {
-  const vbsPath = winStartupPath();
-  if (!vbsPath) return false;
   try {
-    unlinkSync(vbsPath);
+    execSync(
+      `reg delete HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v ${WIN_REG_VALUE} /f`,
+      { stdio: "ignore", windowsHide: true }
+    );
+    return true;
   } catch {
-    // already removed
+    return false;
   }
-  // Also clean up any lingering legacy registry entry as a safety net.
-  cleanLegacyWinReg();
-  return !existsSync(vbsPath);
 }
 
 function isEnabledWin() {
-  const vbsPath = winStartupPath();
-  if (!vbsPath) return false;
-  // Primary check: VBS file exists in the Startup folder.
-  if (existsSync(vbsPath)) return true;
-  // Fallback check: legacy HKCU\Run entry (for users who enabled autostart
-  // before the VBS migration). Treat it as enabled so the tray menu shows
-  // the correct toggle state, and calling disable() will clean it up.
   try {
     const out = execSync(
       `reg query HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v ${WIN_REG_VALUE}`,
-      { stdio: "pipe", windowsHide: true, encoding: "utf8", timeout: 3000 }
+      { stdio: "pipe", windowsHide: true, encoding: "utf8" }
     );
     return out.includes(WIN_REG_VALUE);
   } catch {

bin/cli/utils/versionFastPath.mjs

@@ -1,25 +0,0 @@
-/**
- * Decide whether a CLI invocation is a bare `--version`/`-V` query that should
- * short-circuit BEFORE the runtime polyfill import, env-file loading, and
- * Commander's command registration (~70 command modules) are loaded.
- *
- * Scope is intentionally narrow — only a single, unambiguous `--version`/`-V`
- * argument fast-paths. Anything else (extra args, a subcommand, `--help`,
- * global options like `--lang`/`--output` alongside it) falls through to the
- * normal Commander flow. Unlike `--version`, OmniRoute's `--help` output is
- * generated dynamically from every registered subcommand, so skipping
- * registration would change (truncate) the help text — that flag is
- * deliberately NOT fast-pathed here.
- *
- * Mirrors the intent of upstream 9router PR #2414 (fast-path help/version
- * before expensive self-heal hooks), adapted to OmniRoute's Commander-based
- * CLI where the equivalent expensive work is eager command registration
- * rather than npm-install-based runtime self-healing.
- *
- * @param {string[]} argv - process.argv (node + script + args).
- * @returns {boolean}
- */
-export function isVersionFastPath(argv) {
-  const args = Array.isArray(argv) ? argv.slice(2) : [];
-  return args.length === 1 && (args[0] === "--version" || args[0] === "-V");
-}

bin/omniroute.mjs

@@ -4,9 +4,6 @@
  * OmniRoute CLI entry point.
  *
  * Special bypasses (handled before Commander):
- *   --version / -V (alone)    Fast-path: print the version and exit, skipping the
- *                             tsx/esm + polyfill imports, env-file loading, and
- *                             Commander's ~70-command registration entirely.
  *   --mcp                     Start MCP server over stdio
  *   reset-encrypted-columns   Recovery tool for broken encrypted credentials
  *   reset-password            Reset the admin/management password
@@ -14,7 +11,7 @@
  * All other commands are routed through Commander (bin/cli/program.mjs).
  */
 
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import updateNotifier from "update-notifier";
@@ -22,26 +19,6 @@ import { isNativeBinaryCompatible } from "../scripts/build/native-binary-compat.
 import { getNodeRuntimeSupport, getNodeRuntimeWarning } from "./nodeRuntimeSupport.mjs";
 import { getDefaultDataDir } from "./cli/data-dir.mjs";
 import { shouldProvisionStorageKey } from "./cli/utils/storageKeyProvision.mjs";
-import { isVersionFastPath } from "./cli/utils/versionFastPath.mjs";
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-const ROOT = join(__dirname, "..");
-
-// Fast-path a bare `--version`/`-V` query BEFORE the tsx/esm registration, the
-// polyfill import, env-file loading, or Commander's command registration (~70
-// modules — DB, providers, OAuth, etc.) run. None of that work is needed to answer
-// "what version is this" — mirrors upstream 9router PR #2414 (fast-path help/version
-// ahead of expensive self-heal hooks), adapted to OmniRoute's Commander CLI where the
-// equivalent expensive work is eager command registration rather than npm-install-based
-// runtime self-healing. `--help` is intentionally NOT fast-pathed here: its output is
-// generated dynamically from every registered subcommand, so skipping registration
-// would truncate the help text instead of just speeding it up.
-if (isVersionFastPath(process.argv)) {
-  const pkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8"));
-  console.log(pkg.version);
-  process.exit(0);
-}
 
 // Register tsx so dynamic imports of .ts source files (referenced as .js per
 // TypeScript conventions) resolve correctly. The build never emits .js for
@@ -49,14 +26,9 @@ if (isVersionFastPath(process.argv)) {
 await import("tsx/esm");
 await import("../open-sse/utils/setupPolyfill.ts");
 
-// #7791: tsx's tsconfig-path resolution does not apply when OmniRoute is
-// installed globally (files live under node_modules/omniroute/), so bare
-// `@/...` specifiers (declared in tsconfig.json paths as `@/* → ./src/*`)
-// fail with ERR_MODULE_NOT_FOUND. Register an ESM resolve hook that maps
-// `@/...` to absolute file URLs under <ROOT>/src/. Safe no-op in dev checkout
-// (paths already resolve via tsconfig) and when ROOT has no `src/` dir.
-const { registerAliasResolver } = await import("./aliasResolver.mjs");
-await registerAliasResolver(ROOT);
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const ROOT = join(__dirname, "..");
 
 // MCP stdio transport uses stdout exclusively for JSON-RPC messages.
 // Redirect console.log/warn to stderr early (before loadEnvFile and DB init)
@@ -68,28 +40,6 @@ if (process.argv.includes("--mcp")) {
   console.warn = stderrConsole.warn.bind(stderrConsole);
 }
 
-// Electron persists secrets (JWT_SECRET, API_KEY_SECRET, STORAGE_ENCRYPTION_KEY) to
-// `<DATA_DIR>/server.env` (electron/main.js), never `.env`. Migrating an existing
-// install (storage.sqlite + server.env) to the CLI left those secrets undiscoverable —
-// the CLI only ever looked for `.env`, so the STORAGE_ENCRYPTION_KEY needed to decrypt
-// the migrated database was silently dropped (#7302). One-time, one-directory migration:
-// if `<dataDir>/.env` is absent but `<dataDir>/server.env` is present, copy it to `.env`
-// so it flows through the normal env-loading path below. Never overwrites an existing
-// `.env` — an explicit `.env` always wins over a legacy `server.env`.
-function migrateElectronServerEnv(dataDir) {
-  try {
-    const envPath = join(dataDir, ".env");
-    const serverEnvPath = join(dataDir, "server.env");
-    if (existsSync(envPath) || !existsSync(serverEnvPath)) return;
-    writeFileSync(envPath, readFileSync(serverEnvPath, "utf-8"), "utf-8");
-    console.log(
-      `  \x1b[2m♻ Migrated Electron secrets from ${serverEnvPath} to ${envPath}\x1b[0m`
-    );
-  } catch {
-    // Ignore errors migrating server.env — fall back to normal env loading below.
-  }
-}
-
 function loadEnvFile() {
   const envPaths = [];
   const loadedEnvPaths = [];
@@ -100,8 +50,6 @@ function loadEnvFile() {
     envPaths.push(envPath);
   };
 
-  migrateElectronServerEnv(process.env.DATA_DIR || getDefaultDataDir());
-
   if (process.env.DATA_DIR) {
     addEnvPath(join(process.env.DATA_DIR, ".env"));
   }

changelog.d/features/6022-decision-trace-header.md

@@ -1 +0,0 @@
-- **feat(sse):** every completion response now carries an `X-OmniRoute-Decision: strategy=<name>; provider=<alias>; latency_ms=<n>` header exposing the routing decision — `<name>` is the combo strategy (`priority`, `weighted`, `fusion`, etc.) or `single` for a non-combo request — for client-side debugging/analytics without server log access (#6022 — thanks @chirag127).

changelog.d/features/6354-per-model-timeout.md

@@ -1 +0,0 @@
-- feat(sse): configurable per-model upstream header-response timeout override, precedence model > provider > global; applied to codex reasoning-heavy tiers (gpt-5.5-high/xhigh, gpt-5.6-\*-high/xhigh) (#6354)

changelog.d/features/6540-hidepaid-ui-selects.md

@@ -1 +0,0 @@
-- **feat(dashboard):** Replace free-text model inputs in the Routing (web search route), Combo Defaults (handoff model), and Background Degradation tabs with a `hidePaidModels`-aware `ModelSelectField`, add a fail-open "paid-only pattern" warning to the per-model routing rule pattern field, and reject paid-only model targets at save time on `PATCH /api/settings`, `PATCH /api/settings/combo-defaults`, and `PUT /api/settings/background-degradation` when `hidePaidModels` is on ([#6540](https://github.com/diegosouzapw/OmniRoute/issues/6540))

changelog.d/features/6593-ratelimit-admission-control.md

@@ -1 +0,0 @@
-- **feat(sse):** rate-limit request queue admission control — `resilienceSettings.requestQueue.maxQueueDepth` (default `0` = disabled, opt-in 0–100000) fast-rejects a request with a typed `RATE_LIMIT_QUEUE_FULL` error once the local per-provider+connection queue already holds `maxQueueDepth` requests, instead of growing the queue unboundedly; the factory default for `requestQueue.maxWaitMs` (how long a request may wait before being dropped) also fell from 120s to 15s so a saturated queue fails fast (#6593 — thanks @chirag127).

changelog.d/features/6636-codex-session-import.md

@@ -1 +0,0 @@
-- feat(oauth): accept the full ChatGPT session JSON (not just a bare access token) when pasting Codex credentials manually or via `POST /api/oauth/codex/import-token` (#6636)

changelog.d/features/6650-g4f-space-gateway.md

@@ -1 +0,0 @@
-- feat(sse): add 5 no-key g4f.space gateway providers — `g4f-groq`, `g4f-gemini`, `g4f-pollinations`, `g4f-ollama`, `g4f-nvidia` — a free, no-signup reverse proxy (gpt4free project) fronting Groq, Gemini, Pollinations, Ollama, and NVIDIA NIM, rate-limited to 5 req/min per IP (#6650 — thanks @chirag127).

changelog.d/features/6653-deepinfra-video-provider.md

@@ -1 +0,0 @@
-- feat(sse): add DeepInfra as a video-generation provider via its native synchronous inference endpoint (#6653)

changelog.d/features/6654-freepik-pikaso-image-provider.md

@@ -1 +0,0 @@
-- feat(providers): add Freepik (Magnific Mystic) API-key image generation provider — async submit/poll flow with realism/fluid/zen/flexible/super_real/editorial_portraits models (#6654)

changelog.d/features/6655-revai-stt-provider.md

@@ -1 +0,0 @@
-- feat(providers): add Rev AI speech-to-text provider with async job upload/poll/transcript flow (#6655)

changelog.d/features/6656-segmind-image-video-provider.md

@@ -1 +0,0 @@
-- **feat(providers):** add **Segmind** as an image + video generation provider — `x-api-key` auth against `POST https://api.segmind.com/v1/{model}`, with a curated starter model list (Flux, Stable Diffusion XL/3.5, Kandinsky for image; Wan, Hunyuan, LTX, Kling for video) (#6656).

changelog.d/features/6657-gladia-stt-provider.md

@@ -1 +0,0 @@
-- feat(providers): add Gladia as an async speech-to-text provider (#6657)

changelog.d/features/6658-novita-video-gen-provider.md

@@ -1 +0,0 @@
-- feat(video): add Novita AI as a video-generation provider (Wan/Kling async submit-poll) (#6658)

changelog.d/features/6659-speechmatics-stt-provider.md

@@ -1 +0,0 @@
-- **feat(providers):** add Speechmatics as an STT provider — async batch transcription (Enhanced operating point), 8 hours/month free tier, no credit card required. Streaming (real-time) mode is out of scope for v1. (#6659)

changelog.d/features/6660-mixedbread-embeddings-provider.md

@@ -1 +0,0 @@
-- feat(providers): add Mixedbread AI as an embeddings provider (`mxbai-embed-large-v1`, `mxbai-embed-2d-large-v1`, free tier) (#6660)

changelog.d/features/6666-felo-chat-aggregator-provider.md

@@ -1 +0,0 @@
-- **feat(providers):** add Felo (felo.ai) as a free, no-signup, no-API-key chat/search-agent aggregator provider (`felo-web`) — joins the existing `-web` family (DuckDuckGo AI Chat, Blackbox, etc). Five models (`felo-chat`, `felo-search`, `felo-scholar`, `felo-social`, `felo-document`) map to Felo's search categories; the executor opens a search thread then translates Felo's bespoke SSE stream into OpenAI-compatible chunks (#6666).

changelog.d/features/6667-gtts-audio-tts-provider.md

@@ -1 +0,0 @@
-- **feat(providers):** add gTTS (Google Translate TTS) as a free, no-signup audio-speech provider — routes through Google's current `batchexecute` RPC endpoint (the previously proposed `translate_tts` endpoint is deprecated), splitting input at the 100-char-per-request limit. (#6667)

changelog.d/features/6668-edgetts-audio-tts-provider.md

@@ -1 +0,0 @@
-- **feat(sse):** add EdgeTTS (Microsoft Edge "Read Aloud") as a free, no-API-key `audio-tts` provider — the first WebSocket-transport speech provider, with per-client-IP rate limiting. (#6668)

changelog.d/features/6670-freetheai-gateway-provider.md

@@ -1 +0,0 @@
-- feat(providers): add FreeTheAi as an OpenAI-compatible gateway provider with a free Discord-signup tier (#6670)

changelog.d/features/6672-microsoftdesigner-image-provider.md

@@ -1 +0,0 @@
-- feat(sse): add Microsoft Designer as an unofficial web-session image provider, reverse-engineered submit-then-poll DallE.ashx flow (#6672)

changelog.d/features/6673-hailuoai-web-provider.md

@@ -1 +0,0 @@
-- **feat(providers):** add Hailuo Web (`hailuo-web`) — a free, `_token`-based web-cookie chat provider for the MiniMax consumer chat product at hailuo.ai, ported from the g4f reference implementation (MD5-chain request signing, custom `event:`/`data:` SSE parsing). Distinct from the existing paid API-key `minimax`/`minimax-cn` providers. (#6673)

changelog.d/features/6683-cli-auth-export.md

@@ -1 +0,0 @@
-- **feat(cli):** new `omniroute auth export` command dumps DECRYPTED provider credentials (`apiKey`/`accessToken`/`refreshToken`/`idToken`) for one connection (`--id <id>`) or all connections, as `json` or `env` (`--format`), local-only and gated behind `--force` — no DB access happens without it, a stderr warning banner prints before any plaintext, `--out <file>` writes with `0600` permissions, and per-field decrypt failures surface as a `<field>DecryptFailed` boolean instead of aborting the export or leaking the caught error text (#6683)

changelog.d/features/6684-mitm-root-ca.md

@@ -1 +0,0 @@
-- **feat(mitm):** the AgentBridge static MITM server (`server.cjs`) can now issue a per-host TLS leaf from a persisted local root CA (`src/mitm/cert/rootCa.ts`, reusing the CA/leaf crypto already proven for TPROXY in `tproxy/dynamicCert.ts`) instead of a single static self-signed leaf scoped only to the 4 antigravity hosts — a fresh install covers the full `MITM_TOOL_HOSTS` set automatically; an install that already trusted the old leaf keeps using it until the operator opts in via `MITM_ROOT_CA_ENABLED=true` (`src/mitm/cert/migration.ts`), so no existing install is silently upgraded to the more powerful any-host-signing CA trust model (#6684).

changelog.d/features/6737-vary-accept-encoding.md

@@ -1 +0,0 @@
-- **feat(api):** add `Vary: Accept-Encoding` to token-authenticated `/v1*`/`/v1beta*` responses so downstream caches distinguish compressed vs uncompressed variants (RFC 9110 §12.5.5). (thanks @chirag127)

changelog.d/features/6758-notion-web-provider.md

@@ -1 +0,0 @@
-- feat(sse): add Notion AI Web (Unofficial/Experimental) cookie-session provider (#6758)

changelog.d/features/6760-compression-mode-selector-context-cache.md

@@ -1 +0,0 @@
-- **feat(dashboard):** add per-routing-combo compression-mode override to the Compression Combos page under Context & Cache, alongside the existing combo-card quick override. (#6760)

changelog.d/features/6771-fusion-preserve-tools-bypass.md

@@ -1 +0,0 @@
-- **feat(sse):** preserve `tools`/`tool_choice` for tool-bearing requests through fusion combos — bypass panel synthesis and route straight to the judge with tools intact (#6771 — thanks @chirag127).

changelog.d/features/6801-xp-audit-log-retention.md

@@ -1 +0,0 @@
-- feat(db): include `xp_audit_log` in the automatic retention/prune cycle, with a configurable `retention.xpAuditLog` setting (#6801)

changelog.d/features/6836-import-providers-from-file.md

@@ -1 +0,0 @@
-- feat(dashboard): import multiple, possibly different providers from a CSV/JSON file — per-row validation, a checklist to pick which parsed rows to import, and a new `POST /api/providers/import` route with partial-failure results (#6836)

changelog.d/features/6842-openrouter-quota-tracking.md

@@ -1 +0,0 @@
-- **feat(sse):** OpenRouter quota tracking — a dedicated fetcher polls `/api/v1/key` + `/api/v1/credits` (per-key credit cap/remaining/reset, daily/weekly/monthly USD spend, BYOK usage) with a 45s cache and graceful degradation, a local per-account counter tracks the `:free`-model 50-or-1000-per-day + 20 RPM windows (corrected from `X-RateLimit-*` headers and `Retry-After` on 429), and OpenRouter `402` responses now lock the connection with a real cooldown instead of triggering an immediate reselection of the same credit-exhausted key (#6842).

changelog.d/features/6844-grok-cli-quota.md

@@ -1 +0,0 @@
-- **feat(sse):** live gRPC-web quota fetcher for Grok Build (`grok-cli`) — polls xAI's shared weekly credit pool (`grok.com/grok_api_v2.GrokBuildBilling/GetGrokCreditsConfig`) with the connection's existing bearer token, hand-decoding the framed/raw protobuf response (proto3 omission = 0% used, malformed/expired-token fails open) instead of relying solely on the static 864 req/day estimate, which now serves as an explicit fallback when the live fetch is unavailable (#6844).

changelog.d/features/6845-v0-vercel-quota-tracking.md

@@ -1 +0,0 @@
-- feat(sse): add dual-window quota tracking for the `v0-vercel` provider — polls the credits (`/v1/user/billing`) and daily Platform-API operation (`/v1/rate-limits`) endpoints with the existing routing API key, defensively degrading to an `unknown` billing type rather than misparsing a future v0 billing-model migration, feeding preflight + the dashboard's Provider Quota card (#6845).

changelog.d/features/6846-nvidia-nim-quota.md

@@ -1 +0,0 @@
-- feat(sse): add a static local RPM budget (default 40/min, operator-overridable), per-model 429 scoping (already covered by #6773's `passthroughModels`), and a per-connection concurrency cap (default 6, operator-overridable) for the `nvidia` (NVIDIA NIM) provider, which sends no rate-limit headers and has no usage API — Phase 1 of client-side quota tracking; adaptive AIMD learning and the dashboard quota card are deferred follow-ups (#6846).

changelog.d/features/6850-agentrouter-quota-tracking.md

@@ -1 +0,0 @@
-- feat(sse): add quota tracking for the `agentrouter` provider — polls the New-API `/api/user/self` balance endpoint with a separate System Access Token + `New-Api-User` id (configured via `providerSpecificData.consoleApiKey` / `newApiUserId`), converting raw quota units into a dollar balance and feeding preflight + the dashboard's Provider Quota card (#6850).

changelog.d/features/6872-relay-routing-fallback-reason-header.md

@@ -1 +0,0 @@
-- feat(api): add a structured `X-Routing-Fallback-Reason` header to relay routing responses, exposing a stable machine-readable reason code alongside the legacy `X-Routing-Fallback` detail string (#6872)

changelog.d/features/6873-model-latency-stats-api.md

@@ -1 +0,0 @@
-- **feat(api):** new **GET /api/usage/model-latency-stats** management endpoint exposes the existing rolling per-provider/model latency aggregate (avg/p50/p95/p99, success rate) already used internally by auto-combo routing — supports `windowHours`/`minSamples`/`maxRows`/`provider`/`model` filters (#6873).

changelog.d/features/6874-vibeproxy-openai-provider-node-preset.md

@@ -1 +0,0 @@
-- **feat(providers):** add a `vibeproxy-openai` provider-node preset to `POST /api/provider-nodes` — defaults name/prefix/apiType for VibeProxy's local OpenAI-compatible gateway and normalizes the caller-supplied base URL to its `/v1` root; `baseUrl` remains mandatory. (#6874, idea from #6137 by @KooshaPari)

changelog.d/features/6875-latency-stats-ttft.md

@@ -1 +0,0 @@
-- feat(usage): add avgTtftMs/avgE2ELatencyMs/avgTokensPerSecond to `getModelLatencyStats()` and feed them into auto-combo's speed-ranking factor (#6875)

changelog.d/features/6879-default-reasoning-effort.md

@@ -1 +0,0 @@
-- feat(sse): per-model default `reasoning_effort` (`ModelSpec.defaultReasoningEffort`, injected only when the request carries no reasoning field) and make `no-think/` express `reasoning_effort:"none"` instead of deleting the field on the OpenAI path, so thinks-by-default models actually stop thinking (#6879)

changelog.d/features/6880-connection-cache-override.md

@@ -1 +0,0 @@
-- **feat(providers):** let a custom/openai-compatible connection opt into prompt-cache behavior via a per-connection `cache` capability override, unblocking `prompt_cache_key` injection, the compression cache-aware guard, and `cache_control` passthrough for `openai-compatible-chat-<uuid>`-style connections. (thanks @andrea-kingautomation)

changelog.d/features/6915-free-rankings-auth-type-filter.md

@@ -1 +0,0 @@
-- **feat(dashboard):** add a Type filter (No Signup / OAuth Login / API Key) and an "Easiest first" sort toggle to Free Provider Rankings, so zero-setup NOAUTH providers can be surfaced without eyeballing the Type column. (#6915)

changelog.d/features/6928-comfyui-base-url-field.md

@@ -1 +0,0 @@
-- **feat(providers):** expose an editable base-URL field on the ComfyUI connection so Docker-network setups (e.g. `http://comfyui:8188`) work for image, video, and music generation ([#6928](https://github.com/diegosouzapw/OmniRoute/issues/6928))

changelog.d/features/6976-openrouter-embeddings.md

@@ -1 +0,0 @@
-- **feat(providers):** refresh the curated OpenRouter embeddings catalog (`open-sse/config/embeddingRegistry.ts`) with the current lineup — `openai/text-embedding-3-small`/`-large`, `qwen/qwen3-embedding-8b`/`-4b`, `baai/bge-m3`, `mistralai/mistral-embed-2312`, `google/gemini-embedding-001` — and fold curated embedding/rerank entries into OpenRouter's live model-discovery response (`src/app/api/providers/[id]/models/route.ts`), additively and deduped by id, so they no longer only appear on the no-config `local_catalog` fallback. OpenRouter serves embeddings via a dedicated `/api/v1/embeddings` endpoint (omitted from `/v1/models`), so the live-discovery success path previously returned chat models only ([#6976](https://github.com/diegosouzapw/OmniRoute/issues/6976)). Regression guard: `tests/unit/openrouter-embeddings-catalog-6976.test.ts`.

changelog.d/features/6977-quota-auto-ping.md

@@ -1 +0,0 @@
-- **feat(quota):** Add opt-in auto-ping to keep Codex quota windows warm — per-connection toggle in Settings → AI that sends a tiny request right after a Codex session window resets, so it isn't cold on the next real request ([#6977](https://github.com/diegosouzapw/OmniRoute/issues/6977))

changelog.d/features/7013-grok-build-browser-login.md

@@ -1 +0,0 @@
-- **feat(oauth):** Add a one-click browser (PKCE) login for Grok Build (`grok-cli`) ALONGSIDE the existing device-code flow — reusing the same `auth.x.ai` authorize/token endpoints and public client id as the sibling `xai-oauth` provider on its own loopback port — while keeping the pre-existing device-code method and the paste-token/`auth.json` import flow both available; the connect modal lets the user pick "Device Code", "Browser Login", or "JWT Token" ([#7013](https://github.com/diegosouzapw/OmniRoute/issues/7013))

changelog.d/features/7023-optional-enum-null-sentinel.md

@@ -1 +0,0 @@
-- **feat(sse):** Add optional-enum `null`-omission idiom for Responses-API (codex) strict-mode tool schemas, closing the #6951 follow-up ([#7023](https://github.com/diegosouzapw/OmniRoute/issues/7023))

changelog.d/features/7034-x-goog-api-key-client-auth.md

@@ -1 +0,0 @@
-- **feat(auth):** accept the `x-goog-api-key` header for client-facing auth so `gemini-cli` and other `@google/genai`-based clients can use OmniRoute as a native `/v1beta` gateway (#7034 — thanks @QRcode1337).