fix(auto): enforce quota cutoff before scoring (#4483)

Thanks @megamen32! Rebased onto release/v3.8.32. On review (owner decision) the auto-routing quota cutoff was made OPT-IN behind QuotaPreflightSettings.enabled (default OFF, so current behavior is unchanged) and the ...eligibleTargets last-resort fallback was restored so a quota-blocked target survives as final fallback rather than vanishing. The 429-when-all-blocked guard stays for the enabled path. typecheck clean, 13/13 tests.

.dockerignore

@@ -77,8 +77,6 @@ bun.lock
 # Agent config
 .agents
 .gemini
-.claude
-.source
 
 # Misc
 llm.txt
@@ -125,4 +123,3 @@ app.__qa_backup/
 .worktrees
 .next-playwright/
 cloud/
-electron/dist-electron

.editorconfig

@@ -1,12 +0,0 @@
-root = true
-
-[*]
-indent_style = space
-indent_size = 2
-end_of_line = lf
-charset = utf-8
-trim_trailing_whitespace = true
-insert_final_newline = true
-
-[*.sh]
-indent_size = 4

.env.homolog.example

@@ -1,9 +0,0 @@
-# Homologação E2E real — copie para .env.homolog (NUNCA commitar o real)
-HOMOLOG_BASE_URL=http://192.168.0.15:20128
-# Senha de management do dashboard da VPS (a mesma do /login)
-HOMOLOG_ADMIN_PASSWORD=
-# Deixe vazio: a suíte cria uma API key efêmera via admin e revoga no fim.
-# Só preencha para depurar uma camada isolada com uma key fixa.
-HOMOLOG_API_KEY=
-# Tier crítico (chat real, max_tokens=5). Demais providers: só validação de catálogo.
-HOMOLOG_CRITICAL_PROVIDERS=openai,anthropic,gemini,codex,grok,glm,deepseek,openrouter

.github/dependabot.yml

@@ -24,15 +24,6 @@ updates:
         update-types: ["version-update:semver-major"]
       - dependency-name: "eslint-config-next"
         update-types: ["version-update:semver-major"]
-      # typescript majors are peer-blocked by typescript-eslint, which pins a hard
-      # upper bound (8.64.0 → peerDependencies.typescript ">=4.8.4 <6.1.0"). A TS 7
-      # bump therefore violates the peer and takes down the whole toolchain at once —
-      # #7068 grouped it with 6 harmless bumps and turned Build + Lint + Quality Ratchet
-      # + Unit (6/8, 8/8) + Integration (1/2, 2/2) + dast-smoke red in one shot, blocking
-      # the innocuous updates riding along with it. Un-ignore once typescript-eslint
-      # widens the peer, and migrate TS majors intentionally (own PR, own CI run).
-      - dependency-name: "typescript"
-        update-types: ["version-update:semver-major"]
       # jscpd v5 is a Rust rewrite (native binary, no Node.js programmatic API).
       # scripts/check/check-duplication.mjs is deliberately pinned to jscpd@4 (it
       # parses jscpd-report.json against a frozen baseline). A v5 major would break

.github/workflows/codeql.yml

@@ -22,10 +22,10 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+      - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           languages: javascript-typescript
           queries: security-extended
-      - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+      - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           category: "/language:javascript-typescript"

.github/workflows/dast-smoke.yml

@@ -10,10 +10,7 @@ jobs:
     # ADVISORY while this new gate matures (repo convention: advisory -> blocking).
     # Flip to blocking (remove continue-on-error) once it's proven stable across a few PRs.
     continue-on-error: true
-    # Build CLI bundle alone varies 6-11min on GitHub-hosted runners (3 consecutive
-    # timeouts observed on 2026-07-14 with the old 12min cap killing schemathesis
-    # mid-run) — 25min leaves real headroom for the actual DAST steps.
-    timeout-minutes: 25
+    timeout-minutes: 12
     env:
       JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
       API_KEY_SECRET: ci-api-key-secret-with-sufficient-length-aaaa
@@ -21,14 +18,12 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "24"
           cache: npm
       - run: npm ci
       - name: Build CLI bundle
-        env:
-          OMNIROUTE_BUILD_BACKEND_ONLY: "1"
         run: npm run build:cli
       - name: Start OmniRoute
         env:
@@ -47,7 +42,7 @@ jobs:
       - run: pip install schemathesis
       - name: Schemathesis smoke (high-risk endpoints, blocking)
         run: |
-          schemathesis run docs/openapi.yaml --url http://localhost:20128 \
+          schemathesis run docs/reference/openapi.yaml --url http://localhost:20128 \
             --include-path-regex '^/v1/(chat/completions|models)$|^/api/(auth|keys)' \
             --max-examples 8 --workers 4 --checks all --max-response-time 30 \
             --request-timeout 20 --suppress-health-check all --no-color

.github/workflows/docker-publish.yml

@@ -98,13 +98,11 @@ jobs:
             PROMOTE="${PROMOTE_INPUT:-false}"
           else
             git fetch --tags --quiet || true
-            # Decide via the extracted helper, which folds VERSION into the
-            # candidate set so the result is independent of git-tag sync timing
-            # on `release` events (#5301). Without that, the freshly-created tag
-            # is often not yet visible here and :latest stays a release behind.
-            PROMOTE=$(git tag -l 'v[0-9]*' | bash scripts/ci/should-promote-latest.sh "$VERSION")
-            if [ "$PROMOTE" != "true" ]; then
-              echo "Version $VERSION is not the highest stable semver. Not promoting :latest."
+            HIGHEST=$(git tag -l 'v[0-9]*' | sed 's/^v//' | grep -vE -- '-(rc|alpha|beta|pre|next)' | sort -V | tail -1 || echo "")
+            if [ -n "$HIGHEST" ] && [ "$VERSION" = "$HIGHEST" ]; then
+              PROMOTE="true"
+            else
+              echo "Version $VERSION is not the highest semver tag (highest=${HIGHEST:-<none>}). Not promoting :latest."
             fi
           fi
           echo "promote_latest=$PROMOTE" >> "$GITHUB_OUTPUT"
@@ -346,15 +344,6 @@ jobs:
 
       # Visibility scan: reports HIGH + CRITICAL into the SARIF (Security tab) but
       # never blocks (exit-code 0). The blocking gate below narrows to CRITICAL.
-      #
-      # ignore-unfixed mirrors the blocking gate: the Security tab must surface only
-      # ACTIONABLE vulnerabilities — ones with a published fix we can pull by rebuilding
-      # on a patched base or bumping the dep. Without it the advisory upload floods the
-      # tab with unfixable base-image OS CVEs (Debian trixie packages with no upstream
-      # patch yet, overwhelmingly local-only and not reachable from the proxy request
-      # surface), which is noise an operator cannot act on. trivyignores points at the
-      # repo-root .trivyignore so accepted-risk fixable CVEs have one auditable home.
-      # See docs/security/SUPPLY_CHAIN.md.
       - name: Trivy image scan (SARIF, advisory)
         if: needs.prepare.outputs.version != 'main'
         continue-on-error: true
@@ -364,8 +353,6 @@ jobs:
           format: sarif
           output: trivy-results.sarif
           severity: HIGH,CRITICAL
-          ignore-unfixed: true
-          trivyignores: .trivyignore
           exit-code: "0"
 
       # BLOCKING gate (v3.8.27 cycle-end): fail the release on a CRITICAL CVE in the

.github/workflows/electron-release.yml

@@ -88,13 +88,13 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v6
         with:
           node-version: 24
           cache: npm
 
       - name: Cache node_modules
-        uses: actions/cache@v6.1.0
+        uses: actions/cache@v5.0.5
         with:
           path: node_modules
           key: ${{ runner.os }}-node-${{ hashFiles('package-lock.json') }}
@@ -201,12 +201,6 @@ jobs:
               [ -f "$file" ] && cp "$file" "../../release-assets/OmniRoute.exe" && break
             done
           fi
-          # electron-updater manifests (latest.yml / latest-mac.yml / latest-linux.yml)
-          # must be published alongside the installers, or autoUpdater fails with
-          # "Cannot find latest.yml in the latest release artifacts" (#6766).
-          for file in latest*.yml; do
-            [ -f "$file" ] && cp "$file" ../../release-assets/
-          done
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v7
@@ -269,7 +263,6 @@ jobs:
             release-assets/*.AppImage
             release-assets/*.deb
             release-assets/*.blockmap
-            release-assets/*.yml
             release-assets/*.source.tar.gz
             release-assets/*.source.zip
         env:

.github/workflows/mutation-redundancy.yml

@@ -44,7 +44,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm

.github/workflows/nightly-compat.yml

@@ -1,126 +0,0 @@
-name: Nightly Node Compat
-
-# Plano mestre testes+CI (Eixo D2, aprovado 2026-07-04): as matrizes de compatibilidade
-# Node 24/26 custavam ~28% de CADA run do CI pesado (2 execuções completas da suíte por
-# sync da release-PR) para pegar uma classe de quebra que raramente nasce num PR típico.
-# Elas rodam aqui 1×/dia contra o tip da release ativa (mesmo alvo do nightly-release-green)
-# e continuam obrigatórias no gate de release via workflow_dispatch do ci.yml se preciso.
-# fail-fast desligado: numa quebra queremos saber TODAS as versões afetadas de uma vez.
-
-on:
-  schedule:
-    - cron: "47 6 * * *" # 06:47 UTC diário — slot distinto dos demais nightlies
-  workflow_dispatch:
-    inputs:
-      branch:
-        description: "Branch to validate (default: highest release/vX.Y.Z)"
-        required: false
-        type: string
-
-permissions:
-  contents: read
-  issues: write
-
-concurrency:
-  group: nightly-compat
-  cancel-in-progress: true
-
-jobs:
-  resolve-branch:
-    name: Resolve active release branch
-    runs-on: ubuntu-latest
-    outputs:
-      target: ${{ steps.branch.outputs.target }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - name: Resolve active release branch
-        id: branch
-        env:
-          INPUT_BRANCH: ${{ github.event.inputs.branch }}
-        run: |
-          set -euo pipefail
-          if [ -n "${INPUT_BRANCH:-}" ]; then
-            TARGET="$INPUT_BRANCH"
-          else
-            TARGET=$(git for-each-ref --format='%(refname:short)' 'refs/remotes/origin/release/v*' \
-              | sed 's#origin/##' \
-              | sort -t/ -k2 -V \
-              | tail -1)
-          fi
-          case "$TARGET" in
-            release/v[0-9]*.[0-9]*.[0-9]*) ;;
-            *) echo "Refusing non-canonical branch name: $TARGET"; exit 1 ;;
-          esac
-          echo "target=$TARGET" >> "$GITHUB_OUTPUT"
-
-  compat-build-26:
-    name: Node 26 Compatibility Build
-    runs-on: ubuntu-latest
-    timeout-minutes: 25
-    needs: resolve-branch
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ needs.resolve-branch.outputs.target }}
-          persist-credentials: false
-      - uses: actions/setup-node@v7
-        with:
-          node-version: "26"
-          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
-      - run: npm run build
-
-  compat-tests:
-    name: Node ${{ matrix.node }} Compat Tests (${{ matrix.shard }}/4)
-    runs-on: ubuntu-latest
-    timeout-minutes: 25
-    needs: resolve-branch
-    strategy:
-      fail-fast: false
-      matrix:
-        node: [24, 26]
-        shard: [1, 2, 3, 4]
-    env:
-      JWT_SECRET: ci-nightly-secret-with-sufficient-length-for-validation
-      API_KEY_SECRET: ci-nightly-api-key-secret-long
-      DISABLE_SQLITE_AUTO_BACKUP: "true"
-      TEST_SHARD: ${{ matrix.shard }}/4
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ needs.resolve-branch.outputs.target }}
-          persist-credentials: false
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ matrix.node }}
-          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
-      - run: npm run check:node-runtime
-      - run: npm run test:unit:ci:shard
-
-  report:
-    name: Open / update tracking issue on failure
-    runs-on: ubuntu-latest
-    if: ${{ !cancelled() && (needs.compat-tests.result == 'failure' || needs.compat-build-26.result == 'failure') }}
-    needs: [resolve-branch, compat-build-26, compat-tests]
-    permissions:
-      issues: write
-    steps:
-      - name: Open or update issue
-        env:
-          GH_TOKEN: ${{ github.token }}
-          TARGET: ${{ needs.resolve-branch.outputs.target }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: |
-          set -euo pipefail
-          TITLE="🌙 nightly-compat: Node 24/26 failures on $TARGET"
-          EXISTING=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open --search "$TITLE in:title" --json number --jq '.[0].number')
-          BODY="Nightly Node-compat run failed on \`$TARGET\`: $RUN_URL — triage which Node version/shard broke (fail-fast off, all versions reported)."
-          if [ -n "$EXISTING" ]; then
-            gh issue comment "$EXISTING" --repo "$GITHUB_REPOSITORY" --body "$BODY"
-          else
-            gh issue create --repo "$GITHUB_REPOSITORY" --title "$TITLE" --body "$BODY"
-          fi

.github/workflows/nightly-llm-security.yml

@@ -15,13 +15,11 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with: { node-version: "24", cache: npm }
       - run: npm ci
       - name: Build CLI bundle
-        env:
-          JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
-          OMNIROUTE_BUILD_BACKEND_ONLY: "1"
+        env: { JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation }
         run: npm run build:cli
       - name: Start OmniRoute (block mode)
         env:
@@ -67,16 +65,14 @@ jobs:
         with:
           persist-credentials: false
         if: steps.gate.outputs.run == 'true'
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         if: steps.gate.outputs.run == 'true'
         with: { node-version: "24", cache: npm }
       - run: npm ci
         if: steps.gate.outputs.run == 'true'
       - name: Build CLI bundle
         if: steps.gate.outputs.run == 'true'
-        env:
-          JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
-          OMNIROUTE_BUILD_BACKEND_ONLY: "1"
+        env: { JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation }
         run: npm run build:cli
       - name: Start OmniRoute
         if: steps.gate.outputs.run == 'true'

.github/workflows/nightly-mutation.yml

@@ -107,13 +107,13 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm
       - run: npm ci
       - name: Restore Stryker incremental cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: reports/mutation/stryker-incremental.json
           key: stryker-incremental-${{ matrix.batch.name }}-${{ github.run_id }}
@@ -151,7 +151,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
       - name: Download all mutation reports

.github/workflows/nightly-property.yml

@@ -13,7 +13,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm

.github/workflows/nightly-release-green.yml

@@ -1,303 +0,0 @@
-name: Release-Green (continuous)
-
-# Solution D — continuous, NON-BLOCKING drift signal for the active release branch.
-#
-# WHY: the full gate (ci.yml) only runs on the release PR (PR → main), so reds
-# accrue silently on release/** and explode — in layers — at release time. This
-# workflow reproduces the release-equivalent validation on the release branch and,
-# when there are HARD failures, opens/updates a single tracking issue.
-#
-# WS5.1 (v3.8.49 quality plan) — two modes:
-#   push to release/v* (code paths) → --quick (fast HARD gates, ~5-8min). Catches the
-#     captain's direct pushes (sync-back — the one ungated write path) AND the merged
-#     COMBINATION right after every PR merge, attributing the offending push range in
-#     the issue. Base-red MTTD drops from ≤24h to ≤~15min after the offending push.
-#   schedule (3×/day) → full --with-build --full-ci (the deep sweep incl. build+suites).
-#
-# It is NOT a required status check and never touches a contributor PR — it only
-# reports. Ratchet drift (eslint warnings / cognitive-complexity / file-size) is
-# expected mid-cycle and is reported but never raises the alarm on its own; only
-# real defects (typecheck / lint errors / unit / vitest / db-rules / public-creds /
-# package-artifact) flip the issue open.
-
-on:
-  push:
-    branches: ["release/v*", "main"]
-    paths:
-      - "src/**"
-      - "open-sse/**"
-      - "bin/**"
-      - "electron/**"
-      - "scripts/**"
-      - "tests/**"
-      - "config/**"
-      - "package.json"
-      - "package-lock.json"
-      - "tsconfig*.json"
-  schedule:
-    - cron: "23 5 * * *" # full sweep — off-peak, distinct from other nightlies
-    - cron: "23 12 * * *" # full sweep — midday (WS5.1: 3×/day instead of 1×)
-    - cron: "23 18 * * *" # full sweep — evening
-  workflow_dispatch:
-    inputs:
-      branch:
-        description: "Release branch to validate (default: highest release/vX.Y.Z)"
-        required: false
-        type: string
-
-permissions:
-  contents: read
-  issues: write
-
-concurrency:
-  # push storms during merge campaigns collapse to the newest commit per branch;
-  # scheduled full sweeps keep their own single lane.
-  group: release-green-${{ github.event_name }}-${{ github.ref }}
-  cancel-in-progress: true
-
-env:
-  OMNIROUTE_SKIP_SYSTEM_TRUST: "1"
-
-jobs:
-  release-green:
-    name: Validate active release branch
-    # On a push, only run for release/* pushes — a push to main is handled by the
-    # main-green job below. Schedule/dispatch always run (they validate the highest release).
-    if: ${{ github.event_name != 'push' || startsWith(github.ref_name, 'release/') }}
-    # Dynamic runner: with USE_VPS_RUNNER=true (release window / on-demand pre-flight)
-    # this runs on the dedicated VPS runner — clean env (no operator OMNIROUTE_API_KEY,
-    # no local noauth CLIs => zero machine-specific false positives) and no contention.
-    # Nightly cron normally finds the var false (VM off) and falls back to hosted.
-    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && fromJSON('["self-hosted","omni-release"]')) || 'ubuntu-latest' }}
-    env:
-      JWT_SECRET: ci-nightly-secret-with-sufficient-length-for-validation
-      API_KEY_SECRET: ci-nightly-api-key-secret-long
-      DISABLE_SQLITE_AUTO_BACKUP: "true"
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Resolve active release branch
-        id: branch
-        env:
-          INPUT_BRANCH: ${{ github.event.inputs.branch }}
-          EVENT_NAME: ${{ github.event_name }}
-          PUSHED_REF: ${{ github.ref_name }}
-        run: |
-          set -euo pipefail
-          if [ -n "${INPUT_BRANCH:-}" ]; then
-            TARGET="$INPUT_BRANCH"
-          elif [ "$EVENT_NAME" = "push" ]; then
-            # validate exactly what was pushed, not the highest branch
-            TARGET="$PUSHED_REF"
-          else
-            # highest release/vX.Y.Z by semver among remote branches
-            TARGET=$(git for-each-ref --format='%(refname:short)' 'refs/remotes/origin/release/v*' \
-              | sed 's#origin/##' \
-              | sort -t/ -k2 -V \
-              | tail -1)
-          fi
-          if [ -z "$TARGET" ]; then echo "No release/v* branch found"; exit 1; fi
-          # Strict format guard — reject anything that isn't release/vX.Y.Z (blocks
-          # ref/command injection via the workflow_dispatch input).
-          if ! printf '%s' "$TARGET" | grep -qE '^release/v[0-9]+\.[0-9]+\.[0-9]+$'; then
-            echo "Refusing non-canonical branch name: $TARGET"; exit 1
-          fi
-          echo "target=$TARGET" >> "$GITHUB_OUTPUT"
-          echo "Active release branch: $TARGET"
-
-      - name: Checkout the release branch
-        env:
-          TARGET: ${{ steps.branch.outputs.target }}
-        run: |
-          set -euo pipefail
-          git checkout "$TARGET"
-          git log -1 --oneline
-
-      - uses: actions/setup-node@v7
-        with:
-          node-version: "24"
-          cache: npm
-
-      - uses: ./.github/actions/npm-ci-retry
-
-      - name: Release-green validation (full)
-        id: validate
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-        run: |
-          set +e
-          # --hermetic: scrub live-test trigger vars (self-hosted runner may carry
-          # operator env; hosted ignores the unknown flag before #6300 lands).
-          # push → --quick: fast HARD gates only (~5-8min), per-merge signal.
-          # schedule/dispatch → --with-build --full-ci: ALSO run every static gate from
-          # ci.yml's gate jobs (lint, quality-gate, quality-extended, docs-sync-strict,
-          # pr-test-policy) + build + full suites. PRs into release/** only get the
-          # fast-gates, so these accrue silently and explode in layers on the release PR
-          # (v3.8.46: 11 static base-reds leaked).
-          if [ "$EVENT_NAME" = "push" ]; then
-            MODE="--quick"
-          else
-            MODE="--with-build --full-ci"
-          fi
-          echo "[release-green] mode: $MODE (event: $EVENT_NAME)"
-          # shellcheck disable=SC2086 — MODE is an intentional flag list
-          node scripts/quality/validate-release-green.mjs --json --hermetic $MODE \
-            1> release-green.json 2> release-green.log
-          echo "exit=$?" >> "$GITHUB_OUTPUT"
-          echo "------- report -------"
-          cat release-green.log
-
-      - name: Open / update tracking issue on HARD failure
-        if: steps.validate.outputs.exit != '0'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          TARGET: ${{ steps.branch.outputs.target }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          EVENT_NAME: ${{ github.event_name }}
-          BEFORE_SHA: ${{ github.event.before }}
-          AFTER_SHA: ${{ github.event.after }}
-        run: |
-          set -euo pipefail
-          TITLE="🔴 Release branch not green: ${TARGET}"
-          {
-            echo "The **release-green** validation found HARD failures on \`${TARGET}\`."
-            echo "These are real defects that would block the release PR — fix them in the"
-            echo "originating PR branch (via co-authorship), not by demanding it from contributors."
-            echo ""
-            echo "**Run:** ${RUN_URL} (mode: ${EVENT_NAME})"
-            # WS5.1 attribution: on push events the offending change IS this push's range
-            # (one merge per push in the normal queue), so name it — no bisect needed.
-            if [ "$EVENT_NAME" = "push" ] && [ -n "${BEFORE_SHA:-}" ] && \
-               git cat-file -e "$BEFORE_SHA" 2>/dev/null; then
-              echo ""
-              echo "**Offending push range** (\`${BEFORE_SHA:0:9}..${AFTER_SHA:0:9}\`):"
-              echo '```'
-              git log --no-decorate --oneline "${BEFORE_SHA}..${AFTER_SHA}" | head -20
-              echo '```'
-            fi
-            echo ""
-            echo '```'
-            sed -n '/──────── verdict ────────/,$p' release-green.log || tail -40 release-green.log
-            echo '```'
-            echo ""
-            echo "_Ratchet drift (eslint warnings / cognitive-complexity / file-size) listed above is expected mid-cycle and is rebaselined at release — it is NOT a contributor concern and did not, on its own, open this issue._"
-          } > issue-body.md
-
-          EXISTING=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open \
-            --search "in:title $TITLE" --json number --jq '.[0].number' 2>/dev/null || echo "")
-          if [ -n "$EXISTING" ]; then
-            gh issue comment "$EXISTING" --repo "$GITHUB_REPOSITORY" --body-file issue-body.md
-            echo "Updated existing issue #$EXISTING"
-          else
-            gh issue create --repo "$GITHUB_REPOSITORY" --title "$TITLE" --body-file issue-body.md
-          fi
-
-      - name: Upload report artifact
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: release-green-report
-          path: |
-            release-green.json
-            release-green.log
-          if-no-files-found: ignore
-
-  # Companion arm for `main`. Under the parallel-cycle model, main only receives merged
-  # work at the release squash — so a gate/infra fix that lands only on release leaves
-  # main red the whole cycle, and repo-wide gates (CodeQL alert count, ratchet baselines)
-  # turn EVERY PR into main red on a check unrelated to its diff. This detects that and
-  # opens a "🔴 main not green" tracking issue. The PREVENTION is the companion-PR reflex
-  # (Hard Rule #21 area / _shared/merge-gates.md §8); this is the automated backstop.
-  main-green:
-    name: Validate main branch
-    # On a push, only run for a push to main — a push to release/* is handled by
-    # release-green above. Schedule/dispatch always run (they also sweep main).
-    if: ${{ github.event_name != 'push' || github.ref_name == 'main' }}
-    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && fromJSON('["self-hosted","omni-release"]')) || 'ubuntu-latest' }}
-    env:
-      JWT_SECRET: ci-nightly-secret-with-sufficient-length-for-validation
-      API_KEY_SECRET: ci-nightly-api-key-secret-long
-      DISABLE_SQLITE_AUTO_BACKUP: "true"
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: main # literal — no injection surface; scheduled runs default to the repo default branch (a release/v*), so pin main explicitly
-          fetch-depth: 0
-          persist-credentials: false
-
-      - uses: actions/setup-node@v7
-        with:
-          node-version: "24"
-          cache: npm
-
-      - uses: ./.github/actions/npm-ci-retry
-
-      - name: Main-green validation
-        id: validate
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-        run: |
-          set +e
-          # push (a merge into main) → --quick fast HARD gates; schedule/dispatch → full sweep.
-          if [ "$EVENT_NAME" = "push" ]; then
-            MODE="--quick"
-          else
-            MODE="--with-build --full-ci"
-          fi
-          echo "[main-green] mode: $MODE (event: $EVENT_NAME)"
-          # shellcheck disable=SC2086 — MODE is an intentional flag list
-          node scripts/quality/validate-release-green.mjs --json --hermetic $MODE \
-            1> main-green.json 2> main-green.log
-          echo "exit=$?" >> "$GITHUB_OUTPUT"
-          echo "------- report -------"
-          cat main-green.log
-
-      - name: Open / update tracking issue on HARD failure
-        if: steps.validate.outputs.exit != '0'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          EVENT_NAME: ${{ github.event_name }}
-        run: |
-          set -euo pipefail
-          TITLE="🔴 main branch not green"
-          {
-            echo "The **main-green** validation found HARD failures on \`main\`."
-            echo ""
-            echo "Because \`main\` only receives merged work at the release squash, a gate/infra"
-            echo "fix that landed only on the release branch leaves \`main\` broken for the whole"
-            echo "cycle — and repo-wide gates (CodeQL alert count, ratchet baselines) then turn"
-            echo "**every open PR into main** red on a check unrelated to its diff. The fix is a"
-            echo "companion PR \`--base main\` carrying the release-side fix (see"
-            echo "\`_shared/merge-gates.md\` §8), NOT chasing each contributor PR."
-            echo ""
-            echo "**Run:** ${RUN_URL} (mode: ${EVENT_NAME})"
-            echo ""
-            echo '```'
-            sed -n '/──────── verdict ────────/,$p' main-green.log || tail -40 main-green.log
-            echo '```'
-            echo ""
-            echo "_Ratchet drift (eslint warnings / cognitive-complexity / file-size) is expected mid-cycle and did NOT, on its own, open this issue._"
-          } > issue-body.md
-
-          EXISTING=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open \
-            --search "in:title $TITLE" --json number --jq '.[0].number' 2>/dev/null || echo "")
-          if [ -n "$EXISTING" ]; then
-            gh issue comment "$EXISTING" --repo "$GITHUB_REPOSITORY" --body-file issue-body.md
-            echo "Updated existing issue #$EXISTING"
-          else
-            gh issue create --repo "$GITHUB_REPOSITORY" --title "$TITLE" --body-file issue-body.md
-          fi
-
-      - name: Upload report artifact
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: main-green-report
-          path: |
-            main-green.json
-            main-green.log
-          if-no-files-found: ignore

.github/workflows/nightly-resilience.yml

@@ -15,7 +15,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm
@@ -29,7 +29,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm
@@ -43,7 +43,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm
@@ -51,7 +51,6 @@ jobs:
       - name: Build CLI bundle
         env:
           JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
-          OMNIROUTE_BUILD_BACKEND_ONLY: "1"
         run: npm run build:cli
       - name: Start OmniRoute (background)
         env:
@@ -95,13 +94,13 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           cache: npm
       - run: npm ci
       - name: Cache Playwright browsers
-        uses: actions/cache@v6.1.0
+        uses: actions/cache@v5.0.5
         with:
           path: ~/.cache/ms-playwright
           key: playwright-chromium-${{ runner.os }}-${{ hashFiles('package-lock.json') }}

.github/workflows/nightly-schemathesis.yml

@@ -16,13 +16,11 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with: { node-version: "24", cache: npm }
       - run: npm ci
       - name: Build CLI bundle
-        env:
-          JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
-          OMNIROUTE_BUILD_BACKEND_ONLY: "1"
+        env: { JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation }
         run: npm run build:cli
       - name: Start OmniRoute (background)
         env:
@@ -47,7 +45,7 @@ jobs:
         # PROVE the contract is fuzzable and surface regressions, not to gate the build.
         continue-on-error: true
         run: |
-          schemathesis run docs/openapi.yaml \
+          schemathesis run docs/reference/openapi.yaml \
             --url http://localhost:20128 \
             --max-examples 20 \
             --workers 4 \

.github/workflows/npm-publish.yml

@@ -22,14 +22,6 @@ on:
           - latest
           - next
           - historic
-      publish_mode:
-        description: "staged = npm stage publish (owner approves with 2FA after the staged boot-verify); direct = legacy immediate publish (emergency fallback only)"
-        required: false
-        default: "staged"
-        type: choice
-        options:
-          - staged
-          - direct
   workflow_call:
     inputs:
       version:
@@ -71,7 +63,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ env.NPM_PUBLISH_NODE_VERSION }}
           registry-url: https://registry.npmjs.org
@@ -174,34 +166,8 @@ jobs:
           TAG: ${{ github.ref_name }}
         run: gh release upload "$TAG" sbom-npm.cdx.json --clobber
 
-      # WS1.2/WS1.3 (#7065 class): the artifact that is about to be published must
-      # BOOT. build:cli already assembled dist/ above; this packs+installs+boots the
-      # real tarball and fails the publish before anything reaches the registry.
-      - name: Boot-smoke the tarball before ANY publish
+      - name: Publish to npm
         if: steps.resolve.outputs.skip != 'true'
-        run: npm run check:pack-boot
-
-      # WS1.3 (D2, v3.8.49 plan): STAGED publishing by default — `npm stage publish`
-      # parks the exact bytes on the registry WITHOUT making them installable; the
-      # owner then verifies and approves with 2FA (`npm stage approve`), moving the
-      # human gate to AFTER the proof instead of before it. Requires npm >= 11.15
-      # (staged publishing GA 2026-05-22). publish_mode=direct is the emergency
-      # fallback (legacy immediate publish) via workflow_dispatch.
-      - name: Ensure npm supports staged publishing
-        if: steps.resolve.outputs.skip != 'true' && (github.event_name != 'workflow_dispatch' || inputs.publish_mode != 'direct')
-        run: |
-          set -euo pipefail
-          CUR=$(npm --version)
-          if ! node -e "const [a,b]='$(npm --version)'.split('.').map(Number); process.exit(a>11||(a===11&&b>=15)?0:1)"; then
-            # Pinned exact version (supply-chain: never float @latest in the publish
-            # job); bump deliberately when a newer npm is required.
-            echo "npm $CUR < 11.15 — installing pinned npm 11.15.0 for staged publishing"
-            npm install -g --ignore-scripts npm@11.15.0
-          fi
-          npm --version
-
-      - name: Publish to npm (staged — owner approves with 2FA)
-        if: steps.resolve.outputs.skip != 'true' && (github.event_name != 'workflow_dispatch' || inputs.publish_mode != 'direct')
         env:
           VERSION: ${{ steps.resolve.outputs.version }}
           TAG: ${{ steps.resolve.outputs.tag }}
@@ -209,32 +175,10 @@ jobs:
         run: |
           set -euo pipefail
           # Always pass --tag explicitly. Defense in depth: even if VERSION is
-          # accidentally an older release, the historic tag will NOT claim `@latest`.
-          npm stage publish --provenance --access public --tag "$TAG"
-          {
-            echo "## 📦 omniroute@$VERSION STAGED (not yet installable)"
-            echo ""
-            echo "The exact bytes are parked on the registry. To release them:"
-            echo '```'
-            echo "npm stage list omniroute            # find the stage id"
-            echo "npm stage approve <id>              # owner 2FA — THE publish"
-            echo '```'
-            echo "To verify the staged bytes first: npm stage download <id> → run"
-            echo "scripts/check/check-pack-boot.mjs against them (see RELEASE_CHECKLIST)."
-            echo "To discard: npm stage reject <id>."
-          } >> "$GITHUB_STEP_SUMMARY"
-          echo "✅ Staged omniroute@$VERSION (dist-tag=$TAG) — awaiting owner 'npm stage approve'"
-
-      - name: Publish to npm (DIRECT — emergency fallback)
-        if: steps.resolve.outputs.skip != 'true' && github.event_name == 'workflow_dispatch' && inputs.publish_mode == 'direct'
-        env:
-          VERSION: ${{ steps.resolve.outputs.version }}
-          TAG: ${{ steps.resolve.outputs.tag }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: |
-          set -euo pipefail
+          # accidentally an older release, `npm publish --tag historic` will
+          # NOT promote it to `@latest`.
           npm publish --provenance --access public --tag "$TAG"
-          echo "✅ Published omniroute@$VERSION (dist-tag=$TAG) [DIRECT mode]"
+          echo "✅ Published omniroute@$VERSION (dist-tag=$TAG)"
 
       - name: Publish to GitHub Packages
         if: steps.resolve.outputs.skip != 'true'
@@ -261,56 +205,13 @@ jobs:
         uses: actions/checkout@v7
         with:
           persist-credentials: false
-          fetch-depth: 0
-          # Full history needed for auto-bump: git diff against previous release tag
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ env.NPM_PUBLISH_NODE_VERSION }}
           registry-url: https://registry.npmjs.org
 
-      - name: Auto-bump plugin version if plugin changed since last release
-        id: bump
-        working-directory: "@omniroute/opencode-plugin"
-        env:
-          CURRENT_TAG: ${{ github.ref_name }}
-        run: |
-          set -euo pipefail
-
-          PKG_VERSION=$(node -p "require('./package.json').version")
-          PKG_NAME=$(node -p "require('./package.json').name")
-
-          # 1) Skip if current version is not yet published (no bump needed)
-          PUBLISHED="$(npm view "${PKG_NAME}@${PKG_VERSION}" version 2>/dev/null || true)"
-          if [ "$PUBLISHED" != "$PKG_VERSION" ]; then
-            echo "✅ ${PKG_NAME}@${PKG_VERSION} is new — no bump needed."
-            echo "bumped=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          # 2) Find the previous release tag (exclude the current one)
-          PREV_TAG=$(git tag -l 'v*' --sort=-version:refname \
-            | grep -v "^${CURRENT_TAG}$" | head -1 || echo "")
-          if [ -z "$PREV_TAG" ]; then
-            echo "No previous tag to compare — skipping bump."
-            echo "bumped=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          # 3) Check if plugin dir actually changed since that tag
-          if git diff --quiet "$PREV_TAG" -- "@omniroute/opencode-plugin/"; then
-            echo "⏭️ No plugin changes since $PREV_TAG — nothing to publish."
-            echo "bumped=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          # 4) Auto-bump patch version
-          npm version patch --no-git-tag-version --allow-same-version
-          NEW_VERSION=$(node -p "require('./package.json').version")
-          echo "bumped=true" >> "$GITHUB_OUTPUT"
-          echo "📦 Auto-bumped ${PKG_NAME} from ${PKG_VERSION} to ${NEW_VERSION}"
-
       - name: Install plugin dependencies
         working-directory: "@omniroute/opencode-plugin"
         run: npm install --no-audit --no-fund

.github/workflows/opencode-plugin-ci.yml

@@ -35,7 +35,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
           cache: npm
@@ -52,7 +52,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "22"
           cache: npm

.github/workflows/opencode-provider-ci.yml

@@ -35,7 +35,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
           cache: npm
@@ -51,7 +51,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "20"
           cache: npm

.github/workflows/quality.yml

@@ -14,80 +14,12 @@ permissions:
   contents: read
 
 env:
-  # CI must never mutate the runner's OS trust store (2026-07-05: a cert-flow
-  # test installed a fake PEM on a persistent self-hosted runner and broke all
-  # system TLS). Belt-and-suspenders with tests/_setup/isolateDataDir.ts.
-  OMNIROUTE_SKIP_SYSTEM_TRUST: "1"
   CI_NODE_VERSION: "24"
 
 jobs:
-  # Same classifier as ci.yml (scripts/quality/classify-pr-changes.mjs) so PR→release
-  # path filters share existence reasons: code / docs / i18n / workflow.
-  changes:
-    name: Change Classification
-    runs-on: ubuntu-latest
-    outputs:
-      code: ${{ steps.classify.outputs.code }}
-      docs: ${{ steps.classify.outputs.docs }}
-      i18n: ${{ steps.classify.outputs.i18n }}
-      workflow: ${{ steps.classify.outputs.workflow }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-          fetch-depth: 0
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.CI_NODE_VERSION }}
-      - id: classify
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          if [ "$EVENT_NAME" != "pull_request" ]; then
-            {
-              echo "code=true"
-              echo "docs=true"
-              echo "i18n=true"
-              echo "workflow=true"
-            } >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          git diff --name-only "$BASE_SHA" "$HEAD_SHA" > changed-files.txt
-          node scripts/quality/classify-pr-changes.mjs changed-files.txt >> "$GITHUB_OUTPUT"
-
-  # Docs/OpenAPI contract gates only — existence reason is doc accuracy + route refs.
-  # Split out of fast-gates so pure-docs PRs skip typecheck/unit while still validating docs.
-  docs-gates:
-    name: Docs Gates (fast-path)
-    needs: changes
-    if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && (needs.changes.outputs.docs == 'true' || needs.changes.outputs.code == 'true')) }}
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.CI_NODE_VERSION }}
-          cache: npm
-      - run: npm ci
-      # One walk of src/app/api for openapi-routes + docs-symbols (both still fail independently).
-      - run: npm run check:api-docs-refs
-      - name: Docs accuracy (fabricated-docs + i18n mirrors, strict)
-        run: npm run check:docs-all
-
   fast-gates:
     name: Fast Quality Gates
-    needs: changes
-    # Code surface only — pure docs/i18n PRs skip this bag (docs-gates covers docs).
-    if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true') }}
-    # Dynamic runner (same rule as ci.yml): use the self-hosted VPS pool only when the
-    # release captain has USE_VPS_RUNNER=true AND this is not a fork PR (own-origin
-    # branches only — a fork PR must never execute on the LAN runner). Var unset/false
-    # or a fork PR falls back to ubuntu-latest, so this is inert until the flag flips.
-    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     # tsx gates (known-symbols, route-guard-membership) import modules that open
     # SQLite on load; provide DB env so a fresh CI DB initializes cleanly.
     env:
@@ -99,23 +31,15 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
       - run: npm ci
-      - name: Restore ESLint file cache
-        uses: actions/cache@v6
-        with:
-          path: |
-            .eslintcache
-            .eslintcache-complexity
-          key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'eslint.complexity-ratchets.config.mjs', 'config/quality/eslint-suppressions.json', 'package-lock.json') }}
-          restore-keys: |
-            eslint-${{ runner.os }}-
       - run: npm run check:provider-consistency
       - run: npm run check:fetch-targets
-      # docs-all / openapi-routes / docs-symbols live in docs-gates (path-filtered).
+      - run: npm run check:openapi-routes
+      - run: npm run check:docs-symbols
       - run: npm run check:deps
       - run: npm run check:file-size
       - run: npm run check:error-helper
@@ -125,52 +49,21 @@ jobs:
       - run: npm run check:known-symbols
       - run: npm run check:route-guard-membership
       - run: npm run check:test-discovery
-      - run: npm run check:test-runner-api
-      # Guards tap.testFiles drift: a covering unit test absent from stryker.conf.json
-      # tap.testFiles makes its module's mutants survive on a cold nightly-mutation run,
-      # false-failing the blocking mutationScore ratchet. See check-mutation-test-coverage.mjs.
-      - run: npm run check:mutation-test-coverage
       - run: npm run check:any-budget:t11
-      # Build-scope guard: fails if worktrees/cruft leak into the tsconfig include
-      # scope (would OOM `next build`). Instant. See incident 2026-06-25 / #5031.
-      - run: npm run check:build-scope
-      # Pack-policy (unexpected-files allowlist) WITHOUT a build — catches a stray file
-      # leaking into the npm tarball (v3.8.36: 6 ops bin/*.sh) per-PR instead of only on
-      # the release PR's heavy Package Artifact job.
-      - run: npm run check:pack-policy
-      # Complexity + cognitive-complexity: ONE ESLint walk (both baselines still
-      # enforced separately by ruleId). Avoids two cold tree walks on fast-path.
-      - run: npm run check:complexity-ratchets
       - name: Typecheck (core)
         run: npm run typecheck:core
-      # #7033: dashboard-scoped typecheck gate — src/app/(dashboard) TSX is not
-      # covered by typecheck:core's curated allowlist. See check-dashboard-typecheck.mjs.
-      - name: Typecheck (dashboard)
-        run: npm run check:dashboard-typecheck
-      # WS4.2 (v3.8.49 plan): TypeScript 7 native-compiler SHADOW — advisory only.
-      # TS7 went GA 2026-07-08 with 8-12x type-check speedups; its Compiler API only
-      # arrives in 7.1, so typescript-eslint / type-coverage / Stryker stay on 6.x
-      # (the hybrid is the officially documented pattern). Isolated npx on purpose:
-      # installing an alias package could collide node_modules/.bin/tsc with 6.x.
-      # Promote to the blocking gate after ~1 week of parity with the step above.
-      - name: Typecheck (core) — TS7 native shadow (advisory)
-        continue-on-error: true
-        run: |
-          RC=0
-          START=$(date +%s)
-          npx -y -p typescript@7 tsc --pretty false -p tsconfig.typecheck-core.json || RC=$?
-          echo "[ts7-shadow] exit=$RC elapsed=$(( $(date +%s) - START ))s — the 6.x step above stays authoritative"
-          exit $RC
       # TIA: build the impact map at runtime (gitignored, ~21MB) and run only the
-      # unit tests impacted by this PR's changed files. On hub/unmapped changes the
-      # selector returns __RUN_ALL__ — full-suite authority is the parallel
-      # `fast-unit` 4-shard job (test:unit:ci:shard; was 2-shard, #6781), NOT an
-      # unsharded re-run here. Stacking unsharded test:unit:ci on top of fast-unit
-      # doubled wall time (~16 min extra on ubuntu-latest) without extra coverage.
+      # unit tests impacted by this PR's changed files. Fail-safe runs the FULL
+      # unit suite on hub/unmapped changes — TIA accelerates, never replaces, the net.
       #
-      # BLOCKING for the *impacted subset* (flipped 2026-06-17). Fail-safe full
-      # coverage remains required via `Unit Tests fast-path` (fast-unit).
-      - name: Impacted unit tests (TIA subset; blocking)
+      # BLOCKING (flipped 2026-06-17). The pre-existing release unit test-debt that kept
+      # this advisory was cleared: #4030 (16 Zod/registry reds, lossless restore) and
+      # #4063 (the last red — the LiveWS boot test — root-caused as a real event-loop
+      # stall in the WS sidecar, fixed + relocated to the integration suite). A full
+      # ci.yml run on release/v3.8.28 then showed all 8 unit shards green, so PR->release
+      # now blocks on unit-test regressions in the impacted set (typecheck:core already
+      # blocked above). Fail-safe still runs the FULL unit suite on hub/unmapped changes.
+      - name: Impacted unit tests (TIA, fail-safe full; blocking)
         env:
           GITHUB_BASE_REF: ${{ github.base_ref }}
         run: |
@@ -184,171 +77,8 @@ jobs:
           # which must not happen on a blocking gate. DATA_DIR isolation keeps the parallel
           # run race-free regardless of concurrency.
           if echo "$SEL" | grep -q "__RUN_ALL__"; then
-            echo "Fail-safe: __RUN_ALL__ — deferring FULL unit suite to fast-unit (4-shard)."
-            echo "Not re-running unsharded test:unit:ci here (duplicate of fast-unit coverage)."
-            exit 0
+            echo "Fail-safe: running FULL unit suite (CI concurrency)"; npm run test:unit:ci; exit $?
           fi
           echo "Running impacted tests:"; echo "$SEL"
           mapfile -t FILES <<< "$SEL"
-          # Loader parity with test:unit:ci:shard (#6787): tests/unit/dashboard/** runs
-          # under `--import tsx` (CJS transform — required for ESM-only deep imports like
-          # @lobehub/icons/es/* reached via lobeProviderIcons.ts); everything else under
-          # `--import tsx/esm`. A single tsx/esm invocation false-reds every dashboard
-          # module-shape test the impact map selects ("Unexpected token 'export'").
-          DASH=(); REST=()
-          for f in "${FILES[@]}"; do
-            case "$f" in
-              tests/unit/dashboard/*) DASH+=("$f") ;;
-              *) REST+=("$f") ;;
-            esac
-          done
-          RC=0
-          if [ ${#REST[@]} -gt 0 ]; then
-            node --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 "${REST[@]}" || RC=$?
-          fi
-          if [ ${#DASH[@]} -gt 0 ]; then
-            node --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 "${DASH[@]}" || RC=$?
-          fi
-          exit $RC
-
-  fast-vitest:
-    name: Vitest (fast-path)
-    needs: changes
-    if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true') }}
-    # Dynamic runner — see fast-gates (own-origin + flag; fork/unset → ubuntu-latest).
-    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
-    env:
-      JWT_SECRET: ci-lint-secret-with-sufficient-length-for-validation
-      API_KEY_SECRET: ci-lint-api-key-secret-long
-      DISABLE_SQLITE_AUTO_BACKUP: "true"
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.CI_NODE_VERSION }}
-          cache: npm
-      - run: npm ci
-      # WS5.2/5.3: JUnit feeds Trunk Flaky Tests — the fast-path runs on EVERY PR,
-      # which is where flaky-detection volume actually comes from (ci.yml's heavy
-      # jobs only run on the release PR). Advisory upload, own-origin only.
-      - run: npm run test:vitest -- --reporter=default --reporter=junit --outputFile.junit=trunk-junit/vitest-fastpath.xml
-      - name: Upload test results to Trunk (advisory)
-        if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
-        continue-on-error: true
-        uses: trunk-io/analytics-uploader@385f1ccdf345b4532dc4b6c665dd432b702b8e28 # v2.1.2
-        with:
-          junit-paths: trunk-junit/**/*.xml
-          org-slug: omniroute
-          token: ${{ secrets.TRUNK_TOKEN }}
-
-  fast-unit:
-    name: Unit Tests fast-path (${{ matrix.shard }}/4)
-    needs: changes
-    if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true') }}
-    # Dynamic runner — see fast-gates (own-origin + flag; fork/unset → ubuntu-latest).
-    # This is the heaviest fast-path job; 4-way sharding (was 2, #6781) halves the
-    # critical path again (~8.5min → ~4.5min on ubuntu-latest; ~2min on the 8-slot
-    # runner box). Node's native --test-shard=N/total takes any denominator — only
-    # this matrix and the TEST_SHARD env below encode the shard count.
-    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
-    strategy:
-      fail-fast: false
-      matrix:
-        shard: [1, 2, 3, 4]
-    env:
-      JWT_SECRET: ci-lint-secret-with-sufficient-length-for-validation
-      API_KEY_SECRET: ci-lint-api-key-secret-long
-      DISABLE_SQLITE_AUTO_BACKUP: "true"
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.CI_NODE_VERSION }}
-          cache: npm
-      - run: npm ci
-      # QW-d: fonte única — o mesmo npm script do CI pesado/local. Fecha dois drifts do
-      # comando inline antigo: os dirs `memory` e `usage` estavam FORA do glob (testes
-      # silenciosamente não rodavam no fast path) e o setupPolyfill não era importado.
-      - run: npm run test:unit:ci:shard
-        env:
-          TEST_SHARD: ${{ matrix.shard }}/4
-
-  # ── Pacote 4 (plano mestre testes+CI, aprovado 2026-07-04) ─────────────────────────
-  # No-new-warnings por PR via ESLint bulk suppressions nativo (>=9.24). O baseline
-  # config/quality/eslint-suppressions.json congela as violações EXISTENTES por
-  # arquivo+regra; qualquer warning NOVO aparece e o --max-warnings 0 falha o job — o
-  # drift de +41/+88 warnings por ciclo passa a morrer no PR que o introduz, em vez de
-  # ser rebaselinado às cegas na release. Aperto do baseline (na reconciliação da
-  # release): npx eslint . --prune-suppressions --suppressions-location config/quality/eslint-suppressions.json
-  #
-  # Princípio Zero: bloqueante SÓ para branches internas (as campanhas/sessões são a
-  # origem do drift). PR de FORK roda em modo report (continue-on-error → o job fica
-  # verde com anotação; a campanha /green-prs aplica o fix via co-autoria — o
-  # contribuidor NUNCA é bloqueado nem cobrado).
-  lint-guard:
-    name: No new ESLint warnings
-    needs: changes
-    if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true') }}
-    runs-on: ubuntu-latest
-    continue-on-error: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.CI_NODE_VERSION }}
-          cache: npm
-      - run: npm ci
-      - name: Restore ESLint file cache
-        uses: actions/cache@v6
-        with:
-          path: |
-            .eslintcache
-            .eslintcache-complexity
-          key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'eslint.complexity-ratchets.config.mjs', 'config/quality/eslint-suppressions.json', 'package-lock.json') }}
-          restore-keys: |
-            eslint-${{ runner.os }}-
-      - name: ESLint (baseline congelado — warning novo = vermelho)
-        # lint:json writes the report; --max-warnings 0 keeps no-new-warnings policy.
-        run: npm run lint:json -- --max-warnings 0
-
-  # Merge-integrity: pega no PR os dois vazamentos crônicos de merge que hoje só
-  # explodem na release-PR. (1) CHANGELOG-eat — o auto-resolve do merge come
-  # bullets vizinhos/seções inteiras (incidente #6193, 2026-07-05: 212 linhas /
-  # 130 bullets); o checkout de PR é refs/pull/N/merge, então comparar contra a
-  # base detecta o eat ANTES do merge. (2) SKILL.md gerado stale vs o catálogo de
-  # agent-skills (#6186 mergeou um id de catálogo sem rodar o gerador → 8 reds de
-  # integration invisíveis até a release).
-  #
-  # Princípio Zero: bloqueante SÓ para branches internas; PR de FORK roda em modo
-  # report (continue-on-error) — a campanha corrige via co-autoria, o contribuidor
-  # nunca é bloqueado.
-  merge-integrity:
-    name: Merge integrity (changelog + generated skills)
-    # Always on non-draft PRs — CHANGELOG/skills can break on docs-only merges too.
-    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) }}
-    runs-on: ubuntu-latest
-    continue-on-error: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true }}
-    env:
-      JWT_SECRET: ci-lint-secret-with-sufficient-length-for-validation
-      API_KEY_SECRET: ci-lint-api-key-secret-long
-      DISABLE_SQLITE_AUTO_BACKUP: "true"
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
-        with:
-          node-version: ${{ env.CI_NODE_VERSION }}
-          cache: npm
-      - run: npm ci
-      - name: CHANGELOG integrity (nenhum bullet da base pode sumir no merge-result)
-        run: npm run check:changelog-integrity
-      - name: Agent-skills generator sync (SKILL.md gerado ≡ catálogo)
-        run: npm run check:agent-skills-sync
+          node --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 "${FILES[@]}"

.github/workflows/wiki-sync.yml

@@ -9,7 +9,7 @@ name: Wiki Sync
 # It does NOT overwrite existing wiki pages by default: several docs sources still carry
 # stale counts (e.g. ARCHITECTURE.md says "177 providers" while the wiki cover is 226),
 # so blind overwrite would regress the wiki. Full content parity (--update-existing) is
-# gated on regenerating those sources first.
+# gated on regenerating those sources — see docs/ops/DOCUMENTATION_AUDIT_REPORT.md.
 
 on:
   push:
@@ -40,7 +40,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v6
         with:
           node-version: "24"
 

.gitignore

@@ -72,7 +72,6 @@ yarn-error.log*
 # env files (can opt-in for committing if needed)
 .env*
 !.env.example
-!.env.homolog.example
 # Provider API keys (never commit)
 *.api-key
 .nvidia-api-key
@@ -162,8 +161,6 @@ typescript
 
 # Superpowers plans/specs (internal tooling, not project code)
 docs/superpowers/
-# Superpowers visual-companion brainstorm mockups (ephemeral)
-.superpowers/
 
 # TIA test-impact map — generated at runtime in CI (build-test-impact-map.mjs), never committed (~21MB)
 config/quality/test-impact-map.json
@@ -230,23 +227,3 @@ docs/prompts/AGENT-OWNERSHIP-PROTOCOL.md
 docs/prompts/AGENT-OWNERSHIP-PROTOCOL.omniroute-mim.md
 docs/prompts/AGENT-OWNERSHIP-PROTOCOL.omniroute-mid.md
 omniroute.md
-
-# mise configuration
-mise.toml
-_artifacts/          # release-green artifacts
-.claude-flow/
-
-# ESLint file cache (npm run lint --cache / complexity ratchets)
-.eslintcache
-.eslintcache-complexity
-
-
-# CI/local quality artifacts (eslint-results.json, quality-ratchet.md, etc.)
-.artifacts/
-
-# Homologation E2E suite (npm run homolog) — real-environment credentials + report output
-.env.homolog
-tests/homolog/.auth/
-tests/homolog/ui/.auth/
-homolog-report/
-docker-compose.yml.bak

.gitleaks.toml

@@ -74,16 +74,3 @@
 #       '''tests/unit/''',
 #     ]
 #
-
-[[rules]]
-  # Falsos-positivos comprovados do generic-api-key — zerados em 2026-07-13 (WS6/D3,
-  # plano v3.8.49). Revisar em v3.9.0. Nenhum é credencial: dois são NOMES DE CAMPO
-  # de métricas de latência; o terceiro é o valor PÚBLICO de um beta header da API
-  # da Anthropic (documentado publicamente, não é segredo).
-  id = "generic-api-key"
-  [rules.allowlist]
-    description = "Field names + public Anthropic beta-header value (não são segredos)"
-    regexes = [
-      '''latencyP\d{2}Ms''',
-      '''interleaved-thinking-2025-05-14''',
-    ]

.husky/pre-push

@@ -1,9 +1,7 @@
 #!/usr/bin/env sh
-# .husky/pre-push — intentionally light.
-# any-budget + tracked-artifacts already run on pre-commit; re-running them on
-# every push only doubles local wall time for the same existence reason (CI still
-# enforces both). Keep this hook as a PATH/npm sanity check + reminder.
-# Intentionally excludes test:unit / typecheck (slow; covered by CI).
+# .husky/pre-push — fast deterministic gates (<10s total)
+# Intentionally excludes test:unit (slow; covered by CI pre-push remote run).
+# Activated: 2026-06-13 (6A.12 — replaced commented-out test:unit stub)
 
 if ! command -v npm >/dev/null 2>&1; then
   echo "⚠️  npm not found in PATH — skipping pre-push hooks"
@@ -11,5 +9,4 @@ if ! command -v npm >/dev/null 2>&1; then
   exit 0
 fi
 
-# No-op success: real local gates live in pre-commit; CI owns the rest.
-exit 0
+npm run check:any-budget:t11 && npm run check:tracked-artifacts

.mcp.json.example

@@ -0,0 +1,17 @@
+{
+  "$comment_purpose": "OPT-IN agent-lsp / LSP-in-the-loop (Quality Gates Fase 7 Task 15). Copy this file to `.mcp.json` to enable. It exposes a TypeScript language server to coding agents (Claude Code, etc.) so they get diagnostics / hover / go-to-definition / blast-radius BEFORE writing code — turning 'invented symbol' review-catches into impossible-at-edit-time. Pairs with `npm run typecheck:core` as a compile-before-claim check.",
+  "$comment_safety": "Shipped as `.example` (NOT `.mcp.json`) on purpose so it never auto-loads an unvetted server into everyone's session. Pick an MCP<->LSP bridge you trust and have verified locally, then drop in its package + args below. A broken MCP entry only logs a connection error; it does not break agent sessions. The underlying language server is `typescript-language-server` (npm, mature) — install via `npm i -g typescript-language-server typescript` or rely on npx.",
+  "mcpServers": {
+    "typescript-lsp": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "<your-mcp-lsp-bridge>",
+        "--lsp",
+        "typescript-language-server",
+        "--stdio"
+      ],
+      "$note": "Replace <your-mcp-lsp-bridge> with the concrete MCP<->LSP adapter you chose. It must speak MCP on stdio and proxy to `typescript-language-server --stdio`. Scope it to this repo's tsconfig (open-sse/tsconfig.json / tsconfig.json) for accurate diagnostics."
+    }
+  }
+}

.mergify.yml

@@ -1,55 +0,0 @@
-# Mergify merge queue — WS3.4/D5 of the v3.8.49 quality/velocity master plan.
-#
-# WHY: ~85-100 active PR authors/month and 300+ PRs/week peaks, all merged by ONE
-# identity. The manual merge-train validated batches by hand; this queue automates
-# it with batching + automatic batch bisection (a red batch of N costs ~log2(N)
-# revalidations instead of N). Mergify Open Source plan: free, unlimited, public repo.
-#
-# GOVERNANCE (non-negotiable, mirrors CLAUDE.md Hard Rules #21/#22 + the owner's
-# pre-merge ⭐ gate):
-#   • A PR enters the queue ONLY via the `queue` label — applied by the owner (or a
-#     session acting for the owner) AFTER the pre-merge ⭐ report/decision. The label
-#     IS the merge approval; Mergify only executes it.
-#   • During a release-freeze (open issue labeled `release-freeze`), do NOT label PRs
-#     targeting the frozen branch — the freeze is a human-honored coordination signal
-#     the queue cannot see. Retarget to the active release/vX+1 first (Hard Rule #21).
-#   • Never label a PR another session is actively working (Hard Rule #22b).
-#   • Fallback path if Mergify misbehaves or the OSS plan changes: the manual
-#     merge-train runbook (docs/ops/MERGE_TRAIN.md) — remove labels, proceed by hand.
-
-queue_rules:
-  - name: release
-    # Any current or future release branch — the reason GitHub's native queue was
-    # rejected (no wildcard support on personal-account repos).
-    queue_conditions:
-      - base~=^release/v\d+\.\d+\.\d+$
-      - label=queue
-      - -draft
-      - -conflict
-    # "Everything that ran is green, nothing still running, AND the always-on
-    # anchor check succeeded" — robust to the path-filtered fast-gates (docs-only
-    # PRs skip code jobs; matrix shard names vary) while never fail-open: a PR with
-    # zero checks cannot vacuously merge, because `Merge integrity` runs on EVERY
-    # non-draft PR (quality.yml) and must be an affirmative success. Review approval
-    # is intentionally NOT a condition here: the owner-applied `queue` label IS the
-    # approval in this repo's single-maintainer model (see governance header).
-    merge_conditions:
-      - "#check-failure=0"
-      - "#check-pending=0"
-      - "#check-success>=1"
-      - check-success=Merge integrity (changelog + generated skills)
-    # Batching: validate up to 10 queued PRs together (the manual train's sweet spot);
-    # don't hold a lone PR hostage waiting for siblings.
-    batch_size: 10
-    batch_max_wait_time: 5 min
-    # Squash keeps the one-commit-per-PR history the CHANGELOG reconciliation expects.
-    merge_method: squash
-
-pull_request_rules:
-  - name: clean up the queue label after merge
-    conditions:
-      - merged
-    actions:
-      label:
-        remove:
-          - queue

.npmrc

@@ -2,13 +2,3 @@
 # Keeping peer auto-install disabled prevents npm from pulling @lobehub/ui/mermaid
 # back into the tree and reopening npm audit findings for unused packages.
 legacy-peer-deps=true
-
-# Network resilience: enlarge npm's fetch retry budget so a transient registry
-# socket reset (ECONNRESET) mid-download retries instead of failing the job.
-# npm defaults to only 2 retries with short timeouts; `npm ci` in
-# electron-release.yml hit ECONNRESET during v3.8.41 publish. Applies to every
-# CI workflow (electron / docker / unit) and local installs.
-fetch-retries=5
-fetch-retry-factor=4
-fetch-retry-mintimeout=20000
-fetch-retry-maxtimeout=120000

.prettierignore

@@ -1,5 +0,0 @@
-# Long reference tables are manually aligned; formatting the whole file causes noisy diffs.
-docs/reference/ENVIRONMENT.md
-
-# Dense auto-generated free-tier budget rows (one object per line) — prettier multi-line expand blows past file-size cap 800.
-open-sse/config/freeModelCatalog.data.ts

.trivyignore

@@ -1,22 +0,0 @@
-# .trivyignore — accepted-risk suppressions for the container image scan
-#
-# Policy (see docs/security/SUPPLY_CHAIN.md):
-#   - The Trivy steps in .github/workflows/docker-publish.yml run with
-#     `ignore-unfixed: true`, so vulnerabilities WITHOUT a published fix are
-#     already excluded from both the blocking CRITICAL gate and the advisory
-#     Security-tab upload. You do NOT need an entry here for an unfixable
-#     base-image OS CVE — it will not be reported.
-#   - This file is the single auditable home for the rare case where a *fixable*
-#     CVE must be temporarily accepted (e.g. the upstream fix is not yet in the
-#     pinned base tag, or the affected package/binary is provably unreachable
-#     from the proxy request surface and rebuilding now is not justified).
-#
-# Format — one CVE id per line, each with a justification comment and, where
-# possible, an expiry, e.g.:
-#   # CVE-XXXX-YYYY — <why accepted>; revisit on next base-image bump (YYYY-MM-DD)
-#   CVE-XXXX-YYYY
-#
-# Keep this list SHORT and reviewed every release. Prefer fixing (rebuild on a
-# patched base / bump the dep) over suppressing. Stale entries are debt.
-#
-# (No accepted-risk suppressions at present — ignore-unfixed covers the noise.)

.vscode/settings.json

@@ -48,19 +48,11 @@
       "**/.build",
       "**/dist",
       "**/coverage",
-      "**/.worktrees",
-      "**/.claude/worktrees",
-      "**/electron",
-      "**/_references",
-      "**/_mono_repo",
-      "**/_tasks"
+      "**/.worktrees"
     ]
   },
 
   // Para esconder os diretórios gerados da árvore do Explorer, descomente:
-  // (MANTIDO comentado — o dono precisa ver _references/_mono_repo/_tasks na árvore.
-  //  A performance é resolvida por watcherExclude + search.exclude + tsserver, sem
-  //  precisar escondê-los do Explorer.)
   // "files.exclude": {
   //   "**/.worktrees": true,
   //   "**/coverage": true,

@omniroute/opencode-plugin/README.md

@@ -165,7 +165,7 @@ npm install --prefix ~/.config/opencode/plugins/omniroute-opencode-plugin-prepro
 | Dynamic `/v1/models`                        | Pulls live catalog (455+ entries on prod) on each refresh, TTL-cached                                                                                                                                                                                                                                                                                                                                       | `provider.models`            |
 | Variants pass-through                       | `-low`/`-medium`/`-high`/`-thinking` ship as first-class IDs from OmniRoute (no client synthesis)                                                                                                                                                                                                                                                                                                           | `provider.models`            |
 | Combo LCD aggregation                       | Combos appear with intersected capabilities + min context/output across members                                                                                                                                                                                                                                                                                                                             | `provider.models` + `config` |
-| `combo/<slug>` namespace + `Combo:` prefix | Combos surface under `combo/claude-primary` (not the upstream UUID) and the picker shows `Combo: claude-primary` so they stand apart from raw provider/model pairs                                                                                                                                                                                                                                          | both hooks                   |
+| `combo/<slug>` namespace + `Combo: ` prefix | Combos surface under `combo/claude-primary` (not the upstream UUID) and the picker shows `Combo: claude-primary` so they stand apart from raw provider/model pairs                                                                                                                                                                                                                                          | both hooks                   |
 | Nice names + cost                           | `/api/pricing/models` display names AND `/api/pricing` per-million-token cost overlaid onto the live catalog                                                                                                                                                                                                                                                                                                | both hooks                   |
 | Canonical-twin dedup + alias-fallback       | `/v1/models` exposes the same upstream model under both short alias (`cc/claude-opus-4-7`) and canonical name (`claude/claude-opus-4-7`); the plugin drops the canonical twin when an alias twin exists (no duplicate rows in the picker) and reverse-maps canonical → alias to pick up enrichment for short aliases (`dg/nova-3 → Deepgram - Nova 3`) that `/api/pricing/models` only indexes by canonical | both hooks                   |
 | Compression pipeline tags                   | Combo names get tagged with their compression pipeline (e.g. `Combo: claude-primary [rtk🟡 → caveman🟠]`) when `features.compressionMetadata: true`. Intensity tokens render as a traffic-light emoji: 🟢 lite/minimal · 🟡 standard · 🟠 aggressive/full · 🔴 ultra                                                                                                                                        | both hooks                   |
@@ -179,33 +179,30 @@ npm install --prefix ~/.config/opencode/plugins/omniroute-opencode-plugin-prepro
 
 ## Plugin options
 
-| Option                | Type     | Default                                    | Description                                                                                           |
-| --------------------- | -------- | ------------------------------------------ | ----------------------------------------------------------------------------------------------------- |
-| `providerId`          | `string` | `"omniroute"`                              | OpenCode provider id; must be unique across plugin entries                                            |
-| `displayName`         | `string` | `"OmniRoute"` or `OmniRoute (<id>)`        | Label in the OC UI                                                                                    |
-| `modelCacheTtl`       | `number` | `300000` (5 min)                           | `/v1/models` TTL in ms                                                                                |
-| `baseURL`             | `string` | resolved from `auth.json` after `/connect` | Override OmniRoute base URL                                                                           |
-| `managementReadToken` | `string` | falls back to `apiKey`                     | Optional read-only token for management catalog GETs; `/v1` inference stays on the connected `apiKey` |
-| `features`            | `object` | see below                                  | Feature toggles (all opt-in/out, defaults preserve v0.1.0)                                            |
-
-For least-privilege deployments, set top-level `managementReadToken` to a read-only management token. It is sent only to catalog reads (`/api/combos`, `/api/combos/auto`, `/api/pricing/models`, `/api/pricing`, `/api/context/combos`, and `/api/providers`). Inference requests under `/v1`, including chat, continue to use the `apiKey` stored by OpenCode. `features.mcpToken` remains independent. If `managementReadToken` is omitted, catalog reads retain the previous `apiKey` behavior.
+| Option          | Type     | Default                                    | Description                                                |
+| --------------- | -------- | ------------------------------------------ | ---------------------------------------------------------- |
+| `providerId`    | `string` | `"omniroute"`                              | OpenCode provider id; must be unique across plugin entries |
+| `displayName`   | `string` | `"OmniRoute"` or `OmniRoute (<id>)`        | Label in the OC UI                                         |
+| `modelCacheTtl` | `number` | `300000` (5 min)                           | `/v1/models` TTL in ms                                     |
+| `baseURL`       | `string` | resolved from `auth.json` after `/connect` | Override OmniRoute base URL                                |
+| `features`      | `object` | see below                                  | Feature toggles (all opt-in/out, defaults preserve v0.1.0) |
 
 ### `features` block
 
 Every field is optional. Defaults mirror v0.1.0 behaviour so existing `opencode.json` files do not need to change.
 
-| Feature               | Type      | Default | What it does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| --------------------- | --------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `combos`              | `boolean` | `true`  | Discover `/api/combos` and surface them as pseudo-models with LCD capabilities. Combos are keyed under the `combo/<slug>` namespace and labelled `Combo: <name>` in the model picker so they're distinguishable from raw provider/model pairs.                                                                                                                                                                                                                                                                                                                       |
-| `enrichment`          | `boolean` | `true`  | Pull display names from `/api/pricing/models` AND per-million-token pricing (`input`, `output`, `cached` → `cacheRead`, `cache_creation` → `cacheWrite`) from `/api/pricing`, then overlay both onto the live catalog (so the UI shows `Claude 4.7 Opus` with `cost.input: 5`, `cost.output: 25` instead of raw IDs and zeroed cost).                                                                                                                                                                                                                                |
-| `compressionMetadata` | `boolean` | `false` | Pull `/api/context/combos` so combo names get tagged with their compression pipeline, e.g. `Combo: claude-primary [rtk🟡 → caveman🟠]`. Intensity tokens render as traffic-light emoji (🟢 lite/minimal · 🟡 standard · 🟠 aggressive/full · 🔴 ultra) so the picker advertises "how compressed" each combo is at a glance.                                                                                                                                                                                                                                          |
-| `providerTag`         | `boolean` | `true`  | Prepend a short upstream-provider label to the enriched display name with `" - "` separator, so `cc/claude-opus-4-7 → Claude - Claude Opus 4.7` differs visibly from `kr/claude-opus-4-7 → Kiro - Claude Opus 4.7` in the OC TUI model picker. Label resolution: use `/api/pricing/models[<alias>].name` verbatim when ≤8 chars (e.g. `Claude`, `Kiro`, `Codex`, `Qwen`), otherwise fall back to `UPPER(alias)` (e.g. `GitHub Models` → `GHM`, `Gemini` → `GEMINI`). Idempotent. Combos intentionally skipped (the `Combo:` prefix already conveys multi-upstream). |
-| `usableOnly`          | `boolean` | `false` | Read `/api/providers` and filter the catalog to providers that have at least one connection with `isActive: true` AND `testStatus: 'active'`. Subtract-filter semantics: providers unknown to BOTH the pricing-models catalog AND the connection table pass through (so synthetic prefixes like `agentrouter/*` survive). On fetch failure the filter is disabled for the refresh — never hides the whole catalog.                                                                                                                                                   |
-| `diskCache`           | `boolean` | `true`  | Persist the last successful `/v1/models` + `/api/combos` + enrichment + connections + compression snapshot to `${OPENCODE_DATA_DIR ?? ~/.local/share/opencode}/plugins/omniroute-<providerId>.json`. On a subsequent cold start where `/v1/models` throws (network down / IP whitelist drop / 5xx) the static block hydrates from the snapshot so OC's model picker survives offline. Soft-fail on read/write — never blocks publishing.                                                                                                                             |
-| `geminiSanitization`  | `boolean` | `true`  | Strip `$schema`/`$ref`/`additionalProperties` from tool params when the model id matches `gemini`                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| `mcpAutoEmit`         | `boolean` | `false` | Auto-write an `mcp.<providerId>` remote entry into the OC config pointing at `<baseURL>/api/mcp/stream` with the resolved Bearer token                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| `mcpToken`            | `string`  | _unset_ | Optional separate Bearer for the auto-emitted MCP entry. Falls back to the provider's `apiKey` (from `auth.json`) when unset                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `fetchInterceptor`    | `boolean` | `true`  | Inject `Authorization: Bearer` + default `Content-Type` on every outbound request targeting `baseURL` (suffix-spoof guarded)                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| Feature               | Type      | Default | What it does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| --------------------- | --------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `combos`              | `boolean` | `true`  | Discover `/api/combos` and surface them as pseudo-models with LCD capabilities. Combos are keyed under the `combo/<slug>` namespace and labelled `Combo: <name>` in the model picker so they're distinguishable from raw provider/model pairs.                                                                                                                                                                                                                                                                                                                               |
+| `enrichment`          | `boolean` | `true`  | Pull display names from `/api/pricing/models` AND per-million-token pricing (`input`, `output`, `cached` → `cacheRead`, `cache_creation` → `cacheWrite`) from `/api/pricing`, then overlay both onto the live catalog (so the UI shows `Claude 4.7 Opus` with `cost.input: 5`, `cost.output: 25` instead of raw IDs and zeroed cost).                                                                                                                                                                                                                                        |
+| `compressionMetadata` | `boolean` | `false` | Pull `/api/context/combos` so combo names get tagged with their compression pipeline, e.g. `Combo: claude-primary [rtk🟡 → caveman🟠]`. Intensity tokens render as traffic-light emoji (🟢 lite/minimal · 🟡 standard · 🟠 aggressive/full · 🔴 ultra) so the picker advertises "how compressed" each combo is at a glance.                                                                                                                                                                                                                                                  |
+| `providerTag`         | `boolean` | `true`  | Prepend a short upstream-provider label to the enriched display name with `" - "` separator, so `cc/claude-opus-4-7 → Claude - Claude Opus 4.7` differs visibly from `kr/claude-opus-4-7 → Kiro - Claude Opus 4.7` in the OC TUI model picker. Label resolution: use `/api/pricing/models[<alias>].name` verbatim when ≤8 chars (e.g. `Claude`, `Kiro`, `Codex`, `Qwen`), otherwise fall back to `UPPER(alias)` (e.g. `GitHub Models` → `GHM`, `Gemini-cli` → `GEMINI-CLI`). Idempotent. Combos intentionally skipped (the `Combo: ` prefix already conveys multi-upstream). |
+| `usableOnly`          | `boolean` | `false` | Read `/api/providers` and filter the catalog to providers that have at least one connection with `isActive: true` AND `testStatus: 'active'`. Subtract-filter semantics: providers unknown to BOTH the pricing-models catalog AND the connection table pass through (so synthetic prefixes like `agentrouter/*` survive). On fetch failure the filter is disabled for the refresh — never hides the whole catalog.                                                                                                                                                           |
+| `diskCache`           | `boolean` | `true`  | Persist the last successful `/v1/models` + `/api/combos` + enrichment + connections + compression snapshot to `${OPENCODE_DATA_DIR ?? ~/.local/share/opencode}/plugins/omniroute-<providerId>.json`. On a subsequent cold start where `/v1/models` throws (network down / IP whitelist drop / 5xx) the static block hydrates from the snapshot so OC's model picker survives offline. Soft-fail on read/write — never blocks publishing.                                                                                                                                     |
+| `geminiSanitization`  | `boolean` | `true`  | Strip `$schema`/`$ref`/`additionalProperties` from tool params when the model id matches `gemini`                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `mcpAutoEmit`         | `boolean` | `false` | Auto-write an `mcp.<providerId>` remote entry into the OC config pointing at `<baseURL>/api/mcp/stream` with the resolved Bearer token                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `mcpToken`            | `string`  | _unset_ | Optional separate Bearer for the auto-emitted MCP entry. Falls back to the provider's `apiKey` (from `auth.json`) when unset                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| `fetchInterceptor`    | `boolean` | `true`  | Inject `Authorization: Bearer` + default `Content-Type` on every outbound request targeting `baseURL` (suffix-spoof guarded)                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 
 #### Example — enrichment + compression tags + MCP auto-emit
 
@@ -217,7 +214,6 @@ Every field is optional. Defaults mirror v0.1.0 behaviour so existing `opencode.
       {
         "providerId": "omniroute",
         "baseURL": "https://or.example.com",
-        "managementReadToken": "<read-only-management-token>",
         "features": {
           "combos": true,
           "enrichment": true,

@omniroute/opencode-plugin/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@omniroute/opencode-plugin",
-  "version": "0.2.0",
+  "version": "0.1.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@omniroute/opencode-plugin",
-      "version": "0.2.0",
+      "version": "0.1.0",
       "license": "MIT",
       "dependencies": {
         "zod": "^4.4.3"

@omniroute/opencode-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@omniroute/opencode-plugin",
-  "version": "0.2.0",
+  "version": "0.1.0",
   "description": "OpenCode plugin for the OmniRoute AI Gateway. Drives dynamic model discovery, /connect auth flow, and multi-instance OmniRoute providers via the official @opencode-ai/plugin contract.",
   "type": "module",
   "main": "./dist/index.js",
@@ -23,7 +23,7 @@
   "scripts": {
     "build": "tsup",
     "clean": "rm -rf dist",
-    "test": "node --import tsx/esm --test tests/scaffold.test.ts tests/auth.test.ts tests/options-schema.test.ts tests/multi-instance.test.ts tests/fetch-interceptor.test.ts tests/provider.test.ts tests/gemini-sanitize.test.ts tests/combos.test.ts tests/config-shim.test.ts tests/features.test.ts tests/usable-combo.test.ts tests/disk-snapshot-perms.test.ts tests/fork-features.test.ts tests/auto-combo-context.test.ts tests/provider-id-routing.test.ts tests/management-read-token.test.ts",
+    "test": "node --import tsx/esm --test tests/scaffold.test.ts tests/auth.test.ts tests/options-schema.test.ts tests/multi-instance.test.ts tests/fetch-interceptor.test.ts tests/provider.test.ts tests/gemini-sanitize.test.ts tests/combos.test.ts tests/config-shim.test.ts tests/features.test.ts tests/usable-combo.test.ts tests/disk-snapshot-perms.test.ts tests/fork-features.test.ts tests/auto-combo-context.test.ts",
     "prepublishOnly": "npm run clean && npm run build && npm test"
   },
   "keywords": [

@omniroute/opencode-plugin/src/index.ts

@@ -91,10 +91,6 @@ import {
  *  - `baseURL`        Override base URL for this OmniRoute instance. When
  *                     absent, the loader falls back to a credential-attached
  *                     baseURL set by `/connect`.
- *  - `managementReadToken` Optional read-only management-plane bearer token.
- *                     Used only for catalog GETs under `/api/*`; `/v1/*`
- *                     inference continues to use the connected `apiKey`.
- *                     Falls back to `apiKey` when unset.
  */
 /**
  * Optional feature toggles. Every field is opt-in/out per call; defaults
@@ -126,9 +122,8 @@ import {
  *                           provider's API key (from auth.json) when unset.
  *                           Useful when a narrower-scoped MCP-only key is
  *                           preferred over the chat/inference key.
- *  - `fetchInterceptor`     Inject Authorization: Bearer + Content-Type only
- *                           on same-origin `/v1/chat/completions` and
- *                           `/v1/models` requests. Default true.
+ *  - `fetchInterceptor`     Inject Authorization: Bearer + Content-Type on
+ *                           every outbound request to baseURL. Default true.
  *  - `debugLog`             Capture every outbound request + response to a
  *                           JSONL file at
  *                           `~/.local/share/opencode/plugins/omniroute-debug-{providerId}.jsonl`.
@@ -191,7 +186,6 @@ const optionsSchema = z
     displayName: z.string().min(1).optional(),
     modelCacheTtl: z.number().positive().optional(),
     baseURL: z.string().url().optional(),
-    managementReadToken: z.string().min(1).optional(),
     features: featuresSchema.optional(),
   })
   .strict();
@@ -242,66 +236,27 @@ function trimLeadingDashes(value: string): string {
  * applying defaults. Centralises the providerId fallback so every hook
  * sees a consistent identifier.
  */
-export function resolveOmniRoutePluginOptions(opts?: OmniRoutePluginOptions): Required<
-  Pick<OmniRoutePluginOptions, "providerId" | "displayName" | "modelCacheTtl">
-> & {
-  /**
-   * #6859: the UNPREFIXED provider id ("omniroute", "omniroute-preprod", …).
-   * `providerId` above is auto-prefixed with "opencode-" ONLY to satisfy OC
-   * 1.17.8+'s native-adapter gate ({openai, anthropic, opencode*}) — that
-   * prefixed value is OC-internal and must be used ONLY for AuthHook.provider
-   * and provider-registration keys (the OC config-hook top-level
-   * `provider.<id>` block). `omnirouteProviderId` MUST be used everywhere an
-   * identifier reaches or represents something OmniRoute's own server parses
-   * (model `id` prefix, `ModelV2.providerID`, combo catalog keys in the
-   * dynamic provider hook) — OmniRoute's `parseModel()` has no alias for
-   * "opencode-<x>", so a prefixed id there is unrecoverable and credential
-   * lookup fails with "No credentials for opencode-<x>".
-   */
-  omnirouteProviderId: string;
-} & Pick<OmniRoutePluginOptions, "baseURL" | "managementReadToken" | "features"> {
-  const rawProviderId = opts?.providerId ?? OMNIROUTE_PROVIDER_KEY;
-  const omnirouteProviderId = trimLeadingOpencodePrefix(rawProviderId);
-  // OC 1.17.8+ native-adapter gate rejects providerID not in
-  // {openai, anthropic, opencode*}. Silently prefix so existing
-  // configs (providerId: "omniroute") keep working.
-  const providerId = rawProviderId.startsWith("opencode-")
-    ? rawProviderId
-    : `opencode-${rawProviderId}`;
+export function resolveOmniRoutePluginOptions(
+  opts?: OmniRoutePluginOptions
+): Required<Pick<OmniRoutePluginOptions, "providerId" | "displayName" | "modelCacheTtl">> &
+  Pick<OmniRoutePluginOptions, "baseURL" | "features"> {
+  const providerId = opts?.providerId ?? OMNIROUTE_PROVIDER_KEY;
   const displayName =
     opts?.displayName ??
-    (providerId === `opencode-${OMNIROUTE_PROVIDER_KEY}`
-      ? "OmniRoute"
-      : `OmniRoute (${providerId})`);
+    (providerId === OMNIROUTE_PROVIDER_KEY ? "OmniRoute" : `OmniRoute (${providerId})`);
   const modelCacheTtl =
     typeof opts?.modelCacheTtl === "number" && opts.modelCacheTtl > 0
       ? opts.modelCacheTtl
       : DEFAULT_MODEL_CACHE_TTL_MS;
   return {
     providerId,
-    omnirouteProviderId,
     displayName,
     modelCacheTtl,
     baseURL: opts?.baseURL,
-    managementReadToken: opts?.managementReadToken,
     features: opts?.features,
   };
 }
 
-/**
- * Strip a leading "opencode-" prefix (added only for the OC native-adapter
- * gate — see `resolveOmniRoutePluginOptions`) so the returned id is safe to
- * embed in anything OmniRoute's own server parses. A user-supplied
- * `providerId: "opencode-omniroute"` (already prefixed) resolves to the same
- * unprefixed "omniroute" as the default, matching `providerId`'s own
- * idempotent-prefix handling above.
- */
-function trimLeadingOpencodePrefix(rawProviderId: string): string {
-  return rawProviderId.startsWith("opencode-")
-    ? rawProviderId.slice("opencode-".length)
-    : rawProviderId;
-}
-
 /**
  * Strict parse of raw plugin options (as received from opencode.json or a
  * direct factory call) into the validated `OmniRoutePluginOptions` shape.
@@ -862,14 +817,6 @@ export interface OmniRouteRawCombo {
   isHidden?: boolean;
   /** When OmniRoute attaches a lifecycle hint we forward it; today it doesn't. */
   release_date?: string;
-  /**
-   * Server-computed context window for this combo (aggregated from member
-   * models using the same logic as /v1/models). When present, the client
-   * uses this value directly instead of re-aggregating from member models.
-   *
-   * Added in 3.9.x — old servers do not send it.
-   */
-  computed_context_length?: number;
 }
 
 /**
@@ -1074,12 +1021,7 @@ export function mapComboToModelV2(
       cache: { read: 0, write: 0 },
     },
     limit: {
-      context:
-        typeof combo.computed_context_length === "number" && combo.computed_context_length > 0
-          ? combo.computed_context_length
-          : contextValues.length > 0
-            ? Math.min(...contextValues)
-            : 0,
+      context: contextValues.length > 0 ? Math.min(...contextValues) : 0,
       ...(everyDeclaresInput ? { input: Math.min(...inputValues) } : {}),
       output: outputValues.length > 0 ? Math.min(...outputValues) : 0,
     },
@@ -1275,7 +1217,7 @@ export interface OmniRouteEnrichmentEntry {
     cacheWrite?: number;
   };
   /**
-   * Provider alias prefix seen in `/v1/models` ids (e.g. `cc`, `gemini`).
+   * Provider alias prefix seen in `/v1/models` ids (e.g. `cc`, `gemini-cli`).
    * Populated by `defaultOmniRouteEnrichmentFetcher` from
    * `/api/pricing/models` keys. Drives the `usableOnly` alias↔canonical
    * resolution.
@@ -1283,7 +1225,7 @@ export interface OmniRouteEnrichmentEntry {
   providerAlias?: string;
   /**
    * Canonical provider id used by `/api/providers` connections (e.g.
-   * `claude`, `gemini`, `kiro`). Populated from the per-provider
+   * `claude`, `gemini-cli`, `kiro`). Populated from the per-provider
    * `entry.id` field inside `/api/pricing/models`.
    */
   providerCanonical?: string;
@@ -2096,7 +2038,7 @@ export function formatCompressionPipeline(pipeline: OmniRouteCompressionStep[]):
 export interface OmniRouteProviderConnection {
   /** Connection UUID. */
   id: string;
-  /** Canonical provider id, e.g. `claude`, `gemini`, `kiro`. Matches `entry.id` in `/api/pricing/models`. */
+  /** Canonical provider id, e.g. `claude`, `gemini-cli`, `kiro`. Matches `entry.id` in `/api/pricing/models`. */
   provider: string;
   /** Connection auth flavor, e.g. `apikey`, `oauth`, `cookie`. */
   authType?: string;
@@ -2175,7 +2117,7 @@ export const defaultOmniRouteProvidersFetcher: OmniRouteProvidersFetcher = async
  * walk only the namespaced keys to derive the alias↔canonical mapping).
  *
  * Returns:
- *   - `aliases`: set of alias prefixes safe to keep (e.g. `cc`, `gemini`).
+ *   - `aliases`: set of alias prefixes safe to keep (e.g. `cc`, `gemini-cli`).
  *   - `canonicals`: set of canonical provider ids (e.g. `claude`, `kiro`).
  *
  * Callers should treat membership in EITHER set as "usable" — raw model
@@ -2224,7 +2166,7 @@ export function usableProviderAliasSet(
   }
   // Always include every usable canonical as an alias too — handles the
   // common case where `/v1/models` ids use the canonical id directly
-  // (e.g. `gemini/gemini-1.5-pro`).
+  // (e.g. `gemini-cli/gemini-1.5-pro`).
   for (const canonical of usableCanonicals) aliases.add(canonical);
   return { aliases, canonicals: usableCanonicals, knownAliases };
 }
@@ -2355,14 +2297,12 @@ export function buildComboKey(
 }
 
 /**
- * Internal cache key: `${baseURL}::sha256(credentialId)`. The credential id
- * combines the inference key and effective management-read token so catalog
- * results fetched under different permissions never share an entry. We hash
- * it so the cache key is safe to inspect without leaking either secret.
- * Different credential tuples MUST keep independent cache entries: a single
- * OC user may register prod + preprod OmniRoute side-by-side with distinct
- * keys, and serving one's catalog from the other's cache would be a
- * correctness bug, not just a privacy one.
+ * Internal cache key: `${baseURL}::sha256(apiKey)`. We hash the apiKey so
+ * the key is safe to log / inspect via debugger without leaking the secret.
+ * Different (baseURL, apiKey) tuples MUST keep independent cache entries:
+ * a single OC user may register prod + preprod OmniRoute side-by-side with
+ * distinct keys, and serving one's catalog from the other's cache would be
+ * a correctness bug, not just a privacy one.
  */
 // codeql[js/insufficient-password-hash]: the input here is an API-key
 // identifier we use solely to derive an in-memory cache lookup key — it is
@@ -2513,9 +2453,6 @@ export function createOmniRouteProviderHook(
         return {};
       }
       const apiKey = (auth as { key: string }).key;
-      // Management-plane catalog reads may use a narrower read-only token.
-      // Backward compatibility: when unset, retain the historical apiKey use.
-      const managementReadToken = resolved.managementReadToken ?? apiKey;
 
       // baseURL resolution: plugin opts first, then credential-attached
       // baseURL (auth backends sometimes stash it next to the key), then the
@@ -2545,7 +2482,7 @@ export function createOmniRouteProviderHook(
         return {};
       }
 
-      const cacheKey = modelsCacheKey(baseURL, `${apiKey}\0${managementReadToken}`);
+      const cacheKey = modelsCacheKey(baseURL, apiKey);
       const t = now();
       const cached = cache.get(cacheKey);
 
@@ -2577,7 +2514,7 @@ export function createOmniRouteProviderHook(
         rawCombos = [];
         if (wantCombos) {
           try {
-            rawCombos = await combosFetcher(baseURL, managementReadToken, 10_000);
+            rawCombos = await combosFetcher(baseURL, apiKey, 10_000);
           } catch (err) {
             console.warn(
               "[omniroute-plugin] combos fetch failed, falling back to models-only catalog",
@@ -2592,7 +2529,7 @@ export function createOmniRouteProviderHook(
         rawAutoCombos = [];
         if (wantAutoCombos) {
           try {
-            rawAutoCombos = await autoCombosFetcher(baseURL, managementReadToken, 5_000);
+            rawAutoCombos = await autoCombosFetcher(baseURL, apiKey, 5_000);
           } catch {
             // Already handled inside the default fetcher — this catch
             // is belt-and-suspenders for injected stubs.
@@ -2604,7 +2541,7 @@ export function createOmniRouteProviderHook(
         rawEnrichment = new Map();
         if (wantEnrichment) {
           try {
-            rawEnrichment = await enrichmentFetcher(baseURL, managementReadToken, 10_000);
+            rawEnrichment = await enrichmentFetcher(baseURL, apiKey, 10_000);
           } catch (err) {
             console.warn(
               "[omniroute-plugin] enrichment fetch failed, falling back to raw ids",
@@ -2618,11 +2555,7 @@ export function createOmniRouteProviderHook(
         rawCompressionCombos = [];
         if (wantCompressionMeta) {
           try {
-            rawCompressionCombos = await compressionMetaFetcher(
-              baseURL,
-              managementReadToken,
-              10_000
-            );
+            rawCompressionCombos = await compressionMetaFetcher(baseURL, apiKey, 10_000);
           } catch (err) {
             console.warn("[omniroute-plugin] compression-metadata fetch failed", err);
           }
@@ -2636,7 +2569,7 @@ export function createOmniRouteProviderHook(
         rawConnections = [];
         if (wantUsableOnly) {
           try {
-            rawConnections = await providersFetcher(baseURL, managementReadToken, 10_000);
+            rawConnections = await providersFetcher(baseURL, apiKey, 10_000);
           } catch (err) {
             console.warn(
               "[omniroute-plugin] /api/providers fetch failed; usableOnly filter disabled for this refresh",
@@ -2720,8 +2653,7 @@ export function createOmniRouteProviderHook(
         if (canonicalDedup.has(entry.id)) continue;
         if (usable && !isUsableRawModelId(entry.id, usable, rawEnrichment)) continue;
         const model = mapRawModelToModelV2(entry, {
-          // #6859: server-facing id — NOT the OC-gate-prefixed `resolved.providerId`.
-          providerId: resolved.omnirouteProviderId,
+          providerId: resolved.providerId,
           baseURL,
           apiFormat: resolved.features?.apiFormat,
         });
@@ -2886,8 +2818,7 @@ export function createOmniRouteProviderHook(
           const mapped = mapComboToModelV2(
             combo,
             memberEntries,
-            // #6859: server-facing id — NOT the OC-gate-prefixed `resolved.providerId`.
-            resolved.omnirouteProviderId,
+            resolved.providerId,
             baseURL,
             features.apiFormat
           );
@@ -2906,8 +2837,7 @@ export function createOmniRouteProviderHook(
             }
           }
 
-          // #6859: server-facing key — NOT the OC-gate-prefixed `resolved.providerId`.
-          const comboKey = buildComboKey(combo, usedComboKeys, resolved.omnirouteProviderId);
+          const comboKey = buildComboKey(combo, usedComboKeys, resolved.providerId);
 
           // Collision policy: combos win. Warn ONCE per (cacheKey, comboKey)
           // when overwriting a same-key raw model so the operator can spot
@@ -3009,8 +2939,7 @@ export function createOmniRouteProviderHook(
             },
             status: "active",
             release_date: "",
-            // #6859: server-facing id — NOT the OC-gate-prefixed `resolved.providerId`.
-            providerID: resolved.omnirouteProviderId,
+            providerID: resolved.providerId,
             options: {},
             headers: {},
           };
@@ -3024,18 +2953,17 @@ export function createOmniRouteProviderHook(
 }
 
 // ────────────────────────────────────────────────────────────────────────────
-// Fetch interceptor (T-04) — Bearer + Content-Type injection on intended
-// same-origin OmniRoute inference requests only
+// Fetch interceptor (T-04) — Bearer + Content-Type injection on outbound
+// provider requests targeting the configured OmniRoute baseURL
 // ────────────────────────────────────────────────────────────────────────────
 
 /**
  * Build a `fetch`-compatible interceptor that injects `Authorization: Bearer`
- * (and a default `Content-Type`) only onto same-origin requests targeting
- * `<base>/chat/completions` or `<base>/models`, where `<base>` is the
- * configured baseURL path normalized to end in `/v1`. Management, MCP, and
- * unrelated inference paths pass through untouched. The apiKey is treated as
- * a secret bound to both the configured OmniRoute origin and these intended
- * inference endpoints, and MUST NOT leak elsewhere.
+ * (and a default `Content-Type`) onto outbound requests targeting the given
+ * `baseURL`. Requests to any other host pass through untouched — the apiKey
+ * is treated as a secret bound to the configured OmniRoute instance and
+ * MUST NOT leak to third-party endpoints (a vector AI-SDKs occasionally
+ * exercise when a tool call rewrites the URL mid-flight).
  *
  * Ported from Alph4d0g's `opencode-omniroute-auth@1.2.1` `createFetchInterceptor`
  * (their `dist/src/plugin.js:477-516`) with these intentional deviations:
@@ -3062,35 +2990,17 @@ export function createOmniRouteFetchInterceptor(config: {
   apiKey: string;
   baseURL: string;
 }): typeof fetch {
-  let baseOrigin: string | undefined;
-  const inferencePaths = new Set<string>();
-  try {
-    const baseUrl = new URL(config.baseURL);
-    baseOrigin = baseUrl.origin;
-    const basePath = ensureV1Suffix(baseUrl.pathname);
-    inferencePaths.add(`${basePath}/chat/completions`);
-    inferencePaths.add(`${basePath}/models`);
-  } catch {
-    // Credential-attached base URLs are not schema-validated. A malformed
-    // value must disable injection rather than broaden the credential scope.
-  }
+  const trimmed = trimTrailingSlashes(config.baseURL);
+  // Use `<base>/` for prefix matching to prevent suffix-spoof attacks
+  // (e.g. baseURL `https://or.example.com/v1` should NOT match
+  // `https://or.example.com/v1-attacker.evil/...`).
+  const prefix = `${trimmed}/`;
   return async (input, init = {}) => {
     const url =
       typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
 
-    let requestUrl: URL | undefined;
-    try {
-      requestUrl = new URL(url);
-    } catch {
-      // Native fetch will report malformed/relative URLs as usual. We only
-      // decline to attach credentials before forwarding the original input.
-    }
-    const normalizedPath = requestUrl ? trimTrailingSlashes(requestUrl.pathname) || "/" : undefined;
-    const targetsInference =
-      requestUrl?.origin === baseOrigin &&
-      normalizedPath !== undefined &&
-      inferencePaths.has(normalizedPath);
-    if (!targetsInference) {
+    const targetsOmniRoute = url === trimmed || url.startsWith(prefix);
+    if (!targetsOmniRoute) {
       return fetch(input, init);
     }
 
@@ -3256,6 +3166,7 @@ export function sanitizeGeminiToolSchemas(payload: unknown): unknown {
  *     `gemini-2.5-flash`, etc.)
  *   - `models/gemini-…` (Google Generative AI canonical id form)
  *   - `google-vertex/gemini-…` (OpenCode + AI-SDK Vertex routing prefix)
+ *   - `gemini-cli/…` (real OmniRoute alias surfaced on b35 prod `/v1/models`)
  *
  * Liberal by design: a false positive (cleaning a payload that didn't
  * need cleaning) costs only a structuredClone + one walk; a false negative
@@ -3939,16 +3850,7 @@ export function buildStaticProviderEntry(
       // `combo/MASTER` as provider=`combo`. Slug collisions across
       // combos are disambiguated with a short UUID-prefix suffix; see
       // `buildComboKey` for the policy.
-      // #6859: server-facing key — NOT the OC-gate-prefixed `opts.providerId`.
-      // OC dispatches the static-catalog `models` map key VERBATIM as the
-      // `model` field of the outbound `@ai-sdk/openai-compatible` request
-      // (only the top-level `provider["<id>"]` segment is stripped for
-      // routing) — so a bare-slug combo key prefixed with the OC-gated
-      // `opts.providerId` reaches OmniRoute's server doubled
-      // (`opencode-omniroute/opencode-omniroute/<slug>`), and `parseModel()`
-      // resolves credentials for the nonexistent provider `opencode-omniroute`
-      // instead of `omniroute`. See #7976.
-      models[buildComboKey(combo, usedComboKeys, opts.omnirouteProviderId)] = entry;
+      models[buildComboKey(combo, usedComboKeys, opts.providerId)] = entry;
 
       // Make this combo's resolved entry available to parent combos
       // that reference it via combo-ref. Use the friendly name since
@@ -4041,9 +3943,7 @@ type AuthJsonShape = Record<string, AuthJsonApiEntry | { type?: string; [k: stri
 
 /** Disk snapshot envelope. Versioned for forward-compat. */
 interface OmniRouteDiskSnapshot {
-  v: 2;
-  /** Opaque identity for normalized baseURL + both effective credentials. */
-  identityFingerprint: string;
+  v: 1;
   rawModels: OmniRouteRawModelEntry[];
   rawCombos: OmniRouteRawCombo[];
   rawAutoCombos?: OmniRouteRawAutoCombo[];
@@ -4063,53 +3963,22 @@ export function diskSnapshotPath(providerId: string): string {
 
 export type OmniRouteDiskSnapshotWriter = (
   providerId: string,
-  entry: Omit<OmniRouteFetchCacheEntry, "expiresAt">,
-  identityFingerprint: string
+  entry: Omit<OmniRouteFetchCacheEntry, "expiresAt">
 ) => Promise<void>;
 
 export type OmniRouteDiskSnapshotReader = (
-  providerId: string,
-  identityFingerprint: string
+  providerId: string
 ) => Promise<Omit<OmniRouteFetchCacheEntry, "expiresAt"> | undefined>;
 
-/**
- * Bind a snapshot to the endpoint and effective credential tuple without
- * persisting any raw token. This opaque value is only stored and compared;
- * it is never logged or included in generated provider configuration.
- */
-function diskSnapshotIdentityFingerprint(
-  baseURL: string,
-  apiKey: string,
-  managementReadToken: string
-): string {
-  let normalizedBaseURL: string;
-  try {
-    const parsed = new URL(baseURL);
-    parsed.hash = "";
-    parsed.pathname = trimTrailingSlashes(parsed.pathname) || "/";
-    normalizedBaseURL = parsed.toString();
-  } catch {
-    normalizedBaseURL = trimTrailingSlashes(baseURL);
-  }
-  return createHash("sha256")
-    .update(JSON.stringify([normalizedBaseURL, apiKey, managementReadToken]))
-    .digest("hex");
-}
-
 /** Best-effort disk write. Soft-fails on any I/O error (no exception thrown). */
-export const defaultDiskSnapshotWriter: OmniRouteDiskSnapshotWriter = async (
-  providerId,
-  entry,
-  identityFingerprint
-) => {
+export const defaultDiskSnapshotWriter: OmniRouteDiskSnapshotWriter = async (providerId, entry) => {
   try {
     const file = diskSnapshotPath(providerId);
     // Restrict perms to the owner: the snapshot lives alongside auth.json
     // (0o600) and embeds provider topology + masked connection records.
     await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
     const snapshot: OmniRouteDiskSnapshot = {
-      v: 2,
-      identityFingerprint,
+      v: 1,
       rawModels: entry.rawModels,
       rawCombos: entry.rawCombos,
       rawAutoCombos: entry.rawAutoCombos,
@@ -4128,22 +3997,12 @@ export const defaultDiskSnapshotWriter: OmniRouteDiskSnapshotWriter = async (
 };
 
 /** Best-effort disk read. Returns `undefined` when missing/corrupt/unreadable. */
-export const defaultDiskSnapshotReader: OmniRouteDiskSnapshotReader = async (
-  providerId,
-  identityFingerprint
-) => {
+export const defaultDiskSnapshotReader: OmniRouteDiskSnapshotReader = async (providerId) => {
   try {
     const file = diskSnapshotPath(providerId);
     const body = await readFile(file, "utf8");
     const parsed = JSON.parse(body) as Partial<OmniRouteDiskSnapshot>;
-    if (
-      !parsed ||
-      parsed.v !== 2 ||
-      typeof parsed.identityFingerprint !== "string" ||
-      parsed.identityFingerprint !== identityFingerprint
-    ) {
-      return undefined;
-    }
+    if (!parsed || parsed.v !== 1) return undefined;
     return {
       rawModels: Array.isArray(parsed.rawModels) ? parsed.rawModels : [],
       rawCombos: Array.isArray(parsed.rawCombos) ? parsed.rawCombos : [],
@@ -4539,24 +4398,8 @@ export function createOmniRouteConfigHook(
       authJson = undefined;
     }
 
-    // Try both prefixed (e.g. opencode-omniroute) and unprefixed (e.g. omniroute)
-    // keys so a user who ran `/connect omniroute` before the auto-prefix fix
-    // does not need to re-auth. Also handles dual-key for auth.json entries
-    // written by a newer OC dispatcher with the prefixed key.
-    const bareKey = resolved.providerId.startsWith("opencode-")
-      ? resolved.providerId.slice("opencode-".length)
-      : resolved.providerId;
-    const lookupKeys = [resolved.providerId];
-    if (bareKey !== resolved.providerId) lookupKeys.push(bareKey);
-    let entry;
-    for (const k of lookupKeys) {
-      const e = authJson?.[k];
-      if (e?.type === "api" && typeof e.key === "string" && e.key.length > 0) {
-        entry = e;
-        break;
-      }
-    }
-    const apiKey = entry?.type === "api" && typeof entry.key === "string" ? entry.key : "";
+    const entry = authJson?.[resolved.providerId] as AuthJsonApiEntry | undefined;
+    const apiKey = entry && entry.type === "api" && typeof entry.key === "string" ? entry.key : "";
 
     if (!apiKey) {
       // (c) no apiKey — silent no-op (with debug breadcrumb). The operator
@@ -4567,9 +4410,6 @@ export function createOmniRouteConfigHook(
       );
       return;
     }
-    // Management-plane catalog reads may use a narrower read-only token.
-    // Backward compatibility: when unset, retain the historical apiKey use.
-    const managementReadToken = resolved.managementReadToken ?? apiKey;
 
     // baseURL resolution: opts.baseURL wins, then auth.json's stored baseURL.
     // No silent localhost default — a misconfigured plugin should surface a
@@ -4586,12 +4426,7 @@ export function createOmniRouteConfigHook(
     // Try the shared cache first. On OC ≥1.14.49 the provider hook may have
     // populated it moments earlier; on OC ≤1.14.48 only this hook runs but
     // the cache still works (single producer + consumer through one Map).
-    const cacheKey = modelsCacheKey(baseURL, `${apiKey}\0${managementReadToken}`);
-    const snapshotFingerprint = diskSnapshotIdentityFingerprint(
-      baseURL,
-      apiKey,
-      managementReadToken
-    );
+    const cacheKey = modelsCacheKey(baseURL, apiKey);
     const t = now();
     const cached = cache.get(cacheKey);
 
@@ -4632,7 +4467,7 @@ export function createOmniRouteConfigHook(
 
       rawCombos = [];
       try {
-        rawCombos = await combosFetcher(baseURL, managementReadToken, 10_000);
+        rawCombos = await combosFetcher(baseURL, apiKey, 10_000);
       } catch (err) {
         logger.warn(
           "[omniroute-plugin] config shim: /api/combos fetch failed; publishing models-only static catalog",
@@ -4643,7 +4478,7 @@ export function createOmniRouteConfigHook(
       rawAutoCombos = [];
       if (wantAutoCombos) {
         try {
-          rawAutoCombos = await autoCombosFetcher(baseURL, managementReadToken, 5_000);
+          rawAutoCombos = await autoCombosFetcher(baseURL, apiKey, 5_000);
         } catch {
           // Already handled inside the default fetcher
         }
@@ -4659,7 +4494,7 @@ export function createOmniRouteConfigHook(
       rawEnrichment = new Map();
       if (wantEnrichment) {
         try {
-          rawEnrichment = await enrichmentFetcher(baseURL, managementReadToken, 10_000);
+          rawEnrichment = await enrichmentFetcher(baseURL, apiKey, 10_000);
         } catch (err) {
           logger.warn(
             "[omniroute-plugin] config shim: /api/pricing/models fetch failed; publishing raw-id static catalog",
@@ -4674,7 +4509,7 @@ export function createOmniRouteConfigHook(
       rawCompressionCombos = [];
       if (wantCompressionMeta) {
         try {
-          rawCompressionCombos = await compressionMetaFetcher(baseURL, managementReadToken, 10_000);
+          rawCompressionCombos = await compressionMetaFetcher(baseURL, apiKey, 10_000);
         } catch (err) {
           logger.warn(
             "[omniroute-plugin] config shim: /api/context/combos fetch failed; publishing combos without compression suffix",
@@ -4690,7 +4525,7 @@ export function createOmniRouteConfigHook(
       rawConnections = [];
       if (wantUsableOnly) {
         try {
-          rawConnections = await providersFetcher(baseURL, managementReadToken, 10_000);
+          rawConnections = await providersFetcher(baseURL, apiKey, 10_000);
         } catch (err) {
           logger.warn(
             "[omniroute-plugin] config shim: /api/providers fetch failed; usableOnly filter disabled for this refresh",
@@ -4706,7 +4541,7 @@ export function createOmniRouteConfigHook(
       // a healthy refresh; staleness is bounded only by how recently the
       // user was online.
       if (modelsFetchThrew && wantDiskCache) {
-        const snapshot = await diskSnapshotReader(resolved.providerId, snapshotFingerprint);
+        const snapshot = await diskSnapshotReader(resolved.providerId);
         if (snapshot && snapshot.rawModels.length > 0) {
           logger.warn(
             `[omniroute-plugin] config shim: /v1/models unreachable; using stale disk cache (${snapshot.rawModels.length} models)`
@@ -4751,18 +4586,14 @@ export function createOmniRouteConfigHook(
       // Best-effort; soft-fail keeps us moving when the data dir isn't
       // writable (e.g. read-only container).
       if (modelsFetchOk && wantDiskCache) {
-        await diskSnapshotWriter(
-          resolved.providerId,
-          {
-            rawModels,
-            rawCombos,
-            rawAutoCombos,
-            rawEnrichment,
-            rawCompressionCombos,
-            rawConnections,
-          },
-          snapshotFingerprint
-        );
+        await diskSnapshotWriter(resolved.providerId, {
+          rawModels,
+          rawCombos,
+          rawAutoCombos,
+          rawEnrichment,
+          rawCompressionCombos,
+          rawConnections,
+        });
       }
     }
 

@omniroute/opencode-plugin/tests/auth.test.ts

@@ -13,12 +13,12 @@ import { createOmniRouteAuthHook } from "../src/index.js";
 
 test("createOmniRouteAuthHook: default providerId is 'omniroute'", () => {
   const hook = createOmniRouteAuthHook();
-  assert.equal(hook.provider, "opencode-omniroute");
+  assert.equal(hook.provider, "omniroute");
 });
 
 test("createOmniRouteAuthHook: custom providerId binds to hook.provider (multi-instance)", () => {
   const hook = createOmniRouteAuthHook({ providerId: "omniroute-preprod" });
-  assert.equal(hook.provider, "opencode-omniroute-preprod");
+  assert.equal(hook.provider, "omniroute-preprod");
 });
 
 test("createOmniRouteAuthHook: methods[0] is type 'api' with label including displayName", () => {
@@ -30,7 +30,7 @@ test("createOmniRouteAuthHook: methods[0] is type 'api' with label including dis
   assert.equal(m.label, "OmniRoute API Key");
 
   const custom = createOmniRouteAuthHook({ providerId: "omniroute-preprod" });
-  assert.equal(custom.methods[0].label, "OmniRoute (opencode-omniroute-preprod) API Key");
+  assert.equal(custom.methods[0].label, "OmniRoute (omniroute-preprod) API Key");
 });
 
 test("createOmniRouteAuthHook: prompts[0] uses key='apiKey' per @opencode-ai/plugin contract", () => {

@omniroute/opencode-plugin/tests/config-shim.test.ts

@@ -203,7 +203,7 @@ function makeInput(initialProvider: Record<string, unknown> = {}): Config {
 
 test("config: with valid auth.json + apiKey + baseURL → mutates input.provider[id] with stripped models block", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test-1", baseURL: "https://or.example.com/v1" },
+    omniroute: { type: "api", key: "sk-test-1", baseURL: "https://or.example.com/v1" },
   });
   const fetcher = stubModelsFetcher([MODEL_CLAUDE, MODEL_GEMINI]);
   const combosFetcher = stubCombosFetcher([COMBO_CLAUDE_TIER]);
@@ -217,8 +217,8 @@ test("config: with valid auth.json + apiKey + baseURL → mutates input.provider
   await hook(input);
 
   const provider = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider;
-  const entry = provider["opencode-omniroute"];
-  assert.ok(entry, "input.provider['opencode-omniroute'] set");
+  const entry = provider.omniroute;
+  assert.ok(entry, "input.provider.omniroute set");
   assert.equal(entry.npm, "@ai-sdk/openai-compatible");
   assert.equal(entry.name, "OmniRoute");
   assert.equal(entry.options.baseURL, "https://or.example.com/v1");
@@ -227,7 +227,7 @@ test("config: with valid auth.json + apiKey + baseURL → mutates input.provider
   // Stripped per-model shape: name + cap flags + modalities + (optional)
   // cost. OC's SDK static schema accepts only `limit.{context,output}` —
   // `limit.input` is NOT in the SDK shape and gets dropped silently.
-  const claude = entry.models["opencode-omniroute/claude-sonnet-4-6"];
+  const claude = entry.models["omniroute/claude-sonnet-4-6"];
   assert.ok(claude, "claude model surfaced");
   assert.equal(claude.name, "claude-sonnet-4-6");
   assert.equal(claude.attachment, true);
@@ -256,65 +256,6 @@ test("config: with valid auth.json + apiKey + baseURL → mutates input.provider
   assert.equal(combo.limit?.context, 200_000, "LCD: min(200_000, 1_000_000)");
 });
 
-// ────────────────────────────────────────────────────────────────────────────
-// 1b. Dual-key fallback (#5027) — auth.json stored under the BARE providerId
-//     (pre-auto-prefix login) must still resolve when the active providerId is
-//     prefixed (`opencode-omniroute`). Without the fallback the lookup misses
-//     the stored key and the user is forced to re-auth.
-// ────────────────────────────────────────────────────────────────────────────
-
-test("config: auth.json under bare key (pre-prefix login) resolves via dual-key fallback", async () => {
-  // Stored under bare `omniroute` (the key OC wrote before the auto-prefix fix),
-  // but the resolved providerId is now `opencode-omniroute`.
-  const readAuthJson = stubReadAuthJson({
-    omniroute: { type: "api", key: "sk-bare-1", baseURL: "https://or.example.com/v1" },
-  });
-  const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
-  const combosFetcher = stubCombosFetcher([]);
-  const logger = captureWarn();
-
-  const hook = createOmniRouteConfigHook(
-    { providerId: "omniroute" }, // resolves to opencode-omniroute internally
-    { readAuthJson, fetcher, combosFetcher, logger }
-  );
-  const input = makeInput();
-  await hook(input);
-
-  const provider = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider;
-  const entry = provider["opencode-omniroute"];
-  assert.ok(entry, "provider entry published from bare-key apiKey");
-  assert.equal(entry.options.apiKey, "sk-bare-1", "apiKey resolved from the bare auth.json key");
-  assert.equal(entry.options.baseURL, "https://or.example.com/v1");
-});
-
-test("config: prefixed key wins over bare key when both present (dual-key precedence)", async () => {
-  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-prefixed", baseURL: "https://pref.example/v1" },
-    omniroute: { type: "api", key: "sk-bare", baseURL: "https://bare.example/v1" },
-  });
-  const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
-  const combosFetcher = stubCombosFetcher([]);
-  const logger = captureWarn();
-
-  const hook = createOmniRouteConfigHook(
-    { providerId: "omniroute" },
-    { readAuthJson, fetcher, combosFetcher, logger }
-  );
-  const input = makeInput();
-  await hook(input);
-
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
-  assert.ok(entry);
-  assert.equal(
-    entry.options.apiKey,
-    "sk-prefixed",
-    "prefixed key takes precedence (looked up first)"
-  );
-  assert.equal(entry.options.baseURL, "https://pref.example/v1");
-});
-
 // ────────────────────────────────────────────────────────────────────────────
 // 2. Missing auth.json → no-op, no throw, no mutation
 // ────────────────────────────────────────────────────────────────────────────
@@ -382,7 +323,7 @@ test("config: existing input.provider[id] → no overwrite (respect manual overr
     models: { "manual-model": { name: "manual-model" } },
   };
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
   });
   const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
   const combosFetcher = stubCombosFetcher([]);
@@ -392,11 +333,11 @@ test("config: existing input.provider[id] → no overwrite (respect manual overr
     { providerId: "omniroute" },
     { readAuthJson, fetcher, combosFetcher, logger }
   );
-  const input = makeInput({ "opencode-omniroute": manual });
+  const input = makeInput({ omniroute: manual });
   await hook(input);
 
   const provider = (input as { provider: Record<string, unknown> }).provider;
-  assert.equal(provider["opencode-omniroute"], manual, "manual override preserved by reference");
+  assert.equal(provider.omniroute, manual, "manual override preserved by reference");
   assert.equal(fetcher.callCount(), 0, "no fetch — short-circuited before I/O");
   assert.equal(readAuthJson.callCount(), 0, "no auth.json read either");
   assert.ok(
@@ -411,7 +352,7 @@ test("config: existing input.provider[id] → no overwrite (respect manual overr
 
 test("config: fetchers throw → warn + emit stub entry with models: {}", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
   });
   const fetcher = throwingModelsFetcher();
   const combosFetcher = throwingCombosFetcher();
@@ -427,9 +368,8 @@ test("config: fetchers throw → warn + emit stub entry with models: {}", async
   const input = makeInput();
   await hook(input);
 
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
   assert.ok(entry, "stub provider entry published even when fetchers fail");
   assert.equal(entry.npm, "@ai-sdk/openai-compatible");
   assert.deepEqual(entry.models, {}, "models stub is empty object");
@@ -452,7 +392,7 @@ test("config: fetchers throw → warn + emit stub entry with models: {}", async
 
 test("config: combos fetcher throws → emit models-only catalog (no combos in models block)", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
   });
   const fetcher = stubModelsFetcher([MODEL_CLAUDE, MODEL_GEMINI]);
   const combosFetcher = throwingCombosFetcher();
@@ -465,15 +405,11 @@ test("config: combos fetcher throws → emit models-only catalog (no combos in m
   const input = makeInput();
   await hook(input);
 
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
   assert.ok(entry);
   const ids = Object.keys(entry.models).sort();
-  assert.deepEqual(ids, [
-    "opencode-omniroute/claude-sonnet-4-6",
-    "opencode-omniroute/gemini-3-flash",
-  ]);
+  assert.deepEqual(ids, ["omniroute/claude-sonnet-4-6", "omniroute/gemini-3-flash"]);
   assert.equal(entry.models["omniroute/claude-tier"], undefined, "no combo entry");
   assert.ok(
     logger.entries.some((e) => String(e[0]).includes("/api/combos fetch failed")),
@@ -487,7 +423,7 @@ test("config: combos fetcher throws → emit models-only catalog (no combos in m
 
 test("config: baseURL from auth.json takes precedence when opts.baseURL absent", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://creds.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://creds.example/v1" },
   });
   const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
   const combosFetcher = stubCombosFetcher([]);
@@ -501,15 +437,14 @@ test("config: baseURL from auth.json takes precedence when opts.baseURL absent",
   await hook(input);
 
   assert.equal(fetcher.callsBy()[0][0], "https://creds.example/v1");
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
   assert.equal(entry.options.baseURL, "https://creds.example/v1");
 });
 
 test("config: opts.baseURL wins over auth.json's stored baseURL", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://creds.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://creds.example/v1" },
   });
   const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
   const combosFetcher = stubCombosFetcher([]);
@@ -523,15 +458,14 @@ test("config: opts.baseURL wins over auth.json's stored baseURL", async () => {
   await hook(input);
 
   assert.equal(fetcher.callsBy()[0][0], "https://opts.example/v1");
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
   assert.equal(entry.options.baseURL, "https://opts.example/v1");
 });
 
 test("config: no baseURL resolvable (no opts, no auth.json baseURL) → no-op", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test" }, // NO baseURL on the credential
+    omniroute: { type: "api", key: "sk-test" }, // NO baseURL on the credential
   });
   const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
   const combosFetcher = stubCombosFetcher([]);
@@ -559,12 +493,12 @@ test("config: no baseURL resolvable (no opts, no auth.json baseURL) → no-op",
 
 test("config: multi-instance — two plugins with different providerIds publish to their own keys without collision", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute-prod": {
+    "omniroute-prod": {
       type: "api",
       key: "sk-prod",
       baseURL: "https://prod.example/v1",
     },
-    "opencode-omniroute-preprod": {
+    "omniroute-preprod": {
       type: "api",
       key: "sk-preprod",
       baseURL: "https://preprod.example/v1",
@@ -588,18 +522,15 @@ test("config: multi-instance — two plugins with different providerIds publish
   await hookB(input);
 
   const provider = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider;
-  assert.ok(provider["opencode-omniroute-prod"], "prod block present");
-  assert.ok(provider["opencode-omniroute-preprod"], "preprod block present");
-  assert.equal(provider["opencode-omniroute-prod"].options.apiKey, "sk-prod");
-  assert.equal(provider["opencode-omniroute-preprod"].options.apiKey, "sk-preprod");
-  assert.equal(provider["opencode-omniroute-prod"].options.baseURL, "https://prod.example/v1");
-  assert.equal(
-    provider["opencode-omniroute-preprod"].options.baseURL,
-    "https://preprod.example/v1"
-  );
+  assert.ok(provider["omniroute-prod"], "prod block present");
+  assert.ok(provider["omniroute-preprod"], "preprod block present");
+  assert.equal(provider["omniroute-prod"].options.apiKey, "sk-prod");
+  assert.equal(provider["omniroute-preprod"].options.apiKey, "sk-preprod");
+  assert.equal(provider["omniroute-prod"].options.baseURL, "https://prod.example/v1");
+  assert.equal(provider["omniroute-preprod"].options.baseURL, "https://preprod.example/v1");
   assert.notEqual(
-    provider["opencode-omniroute-prod"],
-    provider["opencode-omniroute-preprod"],
+    provider["omniroute-prod"],
+    provider["omniroute-preprod"],
     "blocks are distinct references"
   );
 });
@@ -611,7 +542,7 @@ test("config: multi-instance — two plugins with different providerIds publish
 
 test("config + provider share cache: second call uses cached fetch result (single fetch per TTL)", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-shared", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-shared", baseURL: "https://or.example/v1" },
   });
   const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
   const combosFetcher = stubCombosFetcher([COMBO_CLAUDE_TIER]);
@@ -643,7 +574,7 @@ test("config + provider share cache: second call uses cached fetch result (singl
 
 test("provider → config order also dedupes (cache populated by provider, consumed by config)", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-reverse", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-reverse", baseURL: "https://or.example/v1" },
   });
   const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
   const combosFetcher = stubCombosFetcher([]);
@@ -723,7 +654,7 @@ test("buildStaticProviderEntry: stripped per-model shape matches sibling @omniro
   }
 
   // Sanity: claude entry has all expected stripped fields.
-  const claude = block.models["opencode-omniroute/claude-sonnet-4-6"];
+  const claude = block.models["omniroute/claude-sonnet-4-6"];
   assert.equal(typeof claude.name, "string");
   assert.equal(typeof claude.attachment, "boolean");
   assert.equal(typeof claude.reasoning, "boolean");
@@ -749,7 +680,7 @@ test("buildStaticProviderEntry: hidden combos are excluded", () => {
     "sk-test"
   );
   assert.equal(block.models["omniroute/claude-tier"], undefined);
-  assert.ok(block.models["opencode-omniroute/claude-sonnet-4-6"]);
+  assert.ok(block.models["omniroute/claude-sonnet-4-6"]);
 });
 
 // ────────────────────────────────────────────────────────────────────────────
@@ -765,7 +696,7 @@ test("buildStaticProviderEntry: emits modalities.input from raw.input_modalities
     "https://or.example/v1",
     "sk-test"
   );
-  const claude = block.models["opencode-omniroute/claude-sonnet-4-6"];
+  const claude = block.models["omniroute/claude-sonnet-4-6"];
   assert.deepEqual(claude.modalities?.input, ["text", "image"]);
   assert.deepEqual(claude.modalities?.output, ["text"]);
 });
@@ -779,7 +710,7 @@ test("buildStaticProviderEntry: never emits limit.input (OC SDK rejects it)", ()
     "https://or.example/v1",
     "sk-test"
   );
-  const claude = block.models["opencode-omniroute/claude-sonnet-4-6"];
+  const claude = block.models["omniroute/claude-sonnet-4-6"];
   assert.equal((claude.limit as Record<string, unknown>).input, undefined);
   assert.equal(typeof claude.limit?.context, "number");
   assert.equal(typeof claude.limit?.output, "number");
@@ -807,7 +738,7 @@ test("buildStaticProviderEntry: emits cost when enrichment carries pricing", ()
     "sk-test",
     enrichment
   );
-  const claude = block.models["opencode-omniroute/claude-sonnet-4-6"];
+  const claude = block.models["omniroute/claude-sonnet-4-6"];
   assert.equal(claude.cost?.input, 3);
   assert.equal(claude.cost?.output, 15);
   assert.equal(claude.cost?.cache_read, 0.3);
@@ -828,8 +759,8 @@ test("buildStaticProviderEntry: emits release_date when raw carries it; omits wh
     "https://or.example/v1",
     "sk-test"
   );
-  assert.equal(block.models["opencode-omniroute/claude-with-date"].release_date, "2026-02-19");
-  assert.equal(block.models["opencode-omniroute/gemini-3-flash"].release_date, undefined);
+  assert.equal(block.models["omniroute/claude-with-date"].release_date, "2026-02-19");
+  assert.equal(block.models["omniroute/gemini-3-flash"].release_date, undefined);
 });
 
 test("buildStaticProviderEntry: combo modalities = intersection of members (LCD)", () => {
@@ -882,7 +813,7 @@ test("OmniRoutePlugin factory exposes config hook alongside auth + provider", as
 
 test("config: auth.json entry of wrong type (oauth) → no-op", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "oauth", refresh: "r", access: "a", expires: 0 },
+    omniroute: { type: "oauth", refresh: "r", access: "a", expires: 0 },
   });
   const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
   const combosFetcher = stubCombosFetcher([]);
@@ -919,7 +850,7 @@ test("config: readAuthJson throws → treat as missing file (silent fallback)",
 
 test("config: initialises input.provider when undefined", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk", baseURL: "https://or.example/v1" },
   });
   const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
   const combosFetcher = stubCombosFetcher([]);
@@ -934,7 +865,7 @@ test("config: initialises input.provider when undefined", async () => {
   await hook(input);
   const provider = (input as { provider?: Record<string, unknown> }).provider;
   assert.ok(provider, "provider bag initialised");
-  assert.ok(provider!["opencode-omniroute"]);
+  assert.ok(provider!.omniroute);
 });
 
 // ────────────────────────────────────────────────────────────────────────────
@@ -944,7 +875,7 @@ test("config: initialises input.provider when undefined", async () => {
 
 test("config: enrichment fetched + name overlaid on raw-model entries", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
   });
   const fetcher = stubModelsFetcher([MODEL_CLAUDE, MODEL_GEMINI]);
   const combosFetcher = stubCombosFetcher([COMBO_CLAUDE_TIER]);
@@ -963,12 +894,11 @@ test("config: enrichment fetched + name overlaid on raw-model entries", async ()
   const input = makeInput();
   await hook(input);
 
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
   assert.ok(entry);
-  assert.equal(entry.models["opencode-omniroute/claude-sonnet-4-6"].name, "Claude Sonnet 4.6");
-  assert.equal(entry.models["opencode-omniroute/gemini-3-flash"].name, "Gemini 3 Flash");
+  assert.equal(entry.models["omniroute/claude-sonnet-4-6"].name, "Claude Sonnet 4.6");
+  assert.equal(entry.models["omniroute/gemini-3-flash"].name, "Gemini 3 Flash");
   // Combo names still come from /api/combos — enrichment overlay does NOT touch combos.
   assert.equal(entry.models["omniroute/claude-tier"].name, "Claude Tier");
   assert.equal(enrichmentFetcher.callCount(), 1);
@@ -976,7 +906,7 @@ test("config: enrichment fetched + name overlaid on raw-model entries", async ()
 
 test("config: features.enrichment=false skips enrichment fetch + keeps raw-id names", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
   });
   const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
   const combosFetcher = stubCombosFetcher([]);
@@ -994,13 +924,12 @@ test("config: features.enrichment=false skips enrichment fetch + keeps raw-id na
   const input = makeInput();
   await hook(input);
 
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
   assert.ok(entry);
   assert.equal(enrichmentFetcher.callCount(), 0, "enrichment fetch suppressed by feature flag");
   assert.equal(
-    entry.models["opencode-omniroute/claude-sonnet-4-6"].name,
+    entry.models["omniroute/claude-sonnet-4-6"].name,
     "claude-sonnet-4-6",
     "raw id retained"
   );
@@ -1008,7 +937,7 @@ test("config: features.enrichment=false skips enrichment fetch + keeps raw-id na
 
 test("config: enrichment fetcher throws → soft-fail (warn + raw-id static catalog)", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
   });
   const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
   const combosFetcher = stubCombosFetcher([]);
@@ -1022,12 +951,11 @@ test("config: enrichment fetcher throws → soft-fail (warn + raw-id static cata
   const input = makeInput();
   await hook(input);
 
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
   assert.ok(entry, "static block still published on enrichment failure");
   assert.equal(
-    entry.models["opencode-omniroute/claude-sonnet-4-6"].name,
+    entry.models["omniroute/claude-sonnet-4-6"].name,
     "claude-sonnet-4-6",
     "raw id retained"
   );
@@ -1071,7 +999,7 @@ const MODEL_NV_LLAMA: OmniRouteRawModelEntry = {
 
 test("config: usableOnly=false → no filter (existing behavior)", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
   });
   const fetcher = stubModelsFetcher([MODEL_CC_OPUS, MODEL_NV_LLAMA]);
   const combosFetcher = stubCombosFetcher([]);
@@ -1093,9 +1021,8 @@ test("config: usableOnly=false → no filter (existing behavior)", async () => {
   const input = makeInput();
   await hook(input);
 
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
   assert.ok(entry.models["cc/claude-opus-4-7"], "claude kept");
   assert.ok(entry.models["nvidia/llama-3-70b"], "nvidia kept (filter off)");
   assert.equal(providersFetcher.callCount(), 0, "providers fetch not called when feature off");
@@ -1103,7 +1030,7 @@ test("config: usableOnly=false → no filter (existing behavior)", async () => {
 
 test("config: usableOnly=true → drops models for non-usable providers, keeps usable + unknown", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
   });
   const fetcher = stubModelsFetcher([
     MODEL_CC_OPUS,
@@ -1143,9 +1070,8 @@ test("config: usableOnly=true → drops models for non-usable providers, keeps u
   const input = makeInput();
   await hook(input);
 
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
   assert.ok(entry.models["cc/claude-opus-4-7"], "claude kept (active)");
   assert.equal(entry.models["nvidia/llama-3-70b"], undefined, "nvidia dropped (error status)");
   assert.ok(entry.models["agentrouter/synthetic-1"], "unknown prefix kept (subtract-filter)");
@@ -1154,7 +1080,7 @@ test("config: usableOnly=true → drops models for non-usable providers, keeps u
 
 test("config: usableOnly=true + providers fetch fails → soft-fail keeps everything", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
   });
   const fetcher = stubModelsFetcher([MODEL_CC_OPUS, MODEL_NV_LLAMA]);
   const combosFetcher = stubCombosFetcher([]);
@@ -1175,9 +1101,8 @@ test("config: usableOnly=true + providers fetch fails → soft-fail keeps everyt
   const input = makeInput();
   await hook(input);
 
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
   assert.ok(entry.models["cc/claude-opus-4-7"]);
   assert.ok(entry.models["nvidia/llama-3-70b"], "soft-fail keeps both");
   assert.ok(
@@ -1188,7 +1113,7 @@ test("config: usableOnly=true + providers fetch fails → soft-fail keeps everyt
 
 test("config: diskCache hydrates stale snapshot when /v1/models throws", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
   });
   const fetcher = throwingModelsFetcher();
   const combosFetcher = stubCombosFetcher([]);
@@ -1225,15 +1150,14 @@ test("config: diskCache hydrates stale snapshot when /v1/models throws", async (
   const input = makeInput();
   await hook(input);
 
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
   assert.ok(
-    entry.models["opencode-omniroute/claude-sonnet-4-6"],
+    entry.models["omniroute/claude-sonnet-4-6"],
     "stale snapshot hydrated into static block"
   );
   assert.equal(
-    entry.models["opencode-omniroute/claude-sonnet-4-6"].name,
+    entry.models["omniroute/claude-sonnet-4-6"].name,
     "Claude Sonnet 4.6 (cached)",
     "stale enrichment also reused"
   );
@@ -1246,7 +1170,7 @@ test("config: diskCache hydrates stale snapshot when /v1/models throws", async (
 
 test("config: cached rawEnrichment from earlier provider hook is reused (no refetch)", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-shared", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-shared", baseURL: "https://or.example/v1" },
   });
   const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
   const combosFetcher = stubCombosFetcher([]);
@@ -1278,10 +1202,9 @@ test("config: cached rawEnrichment from earlier provider hook is reused (no refe
   await configHook(input);
   assert.equal(enrichmentFetcher.callCount(), 1, "config reused cached enrichment");
 
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
-  assert.equal(entry.models["opencode-omniroute/claude-sonnet-4-6"].name, "Claude Sonnet 4.6");
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
+  assert.equal(entry.models["omniroute/claude-sonnet-4-6"].name, "Claude Sonnet 4.6");
 });
 
 // ─────────────────────────────────────────────────────────────────────
@@ -1292,7 +1215,7 @@ test("config: cached rawEnrichment from earlier provider hook is reused (no refe
 
 test("config: providerTag (default-on) prepends '<provider> - ' to enriched raw-model names", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
   });
   const fetcher = stubModelsFetcher([MODEL_CLAUDE, MODEL_GEMINI]);
   const combosFetcher = stubCombosFetcher([COMBO_CLAUDE_TIER]);
@@ -1311,9 +1234,9 @@ test("config: providerTag (default-on) prepends '<provider> - ' to enriched raw-
         "gemini-3-flash",
         {
           name: "Gemini 3 Flash",
-          providerAlias: "gemini",
-          providerCanonical: "gemini",
-          providerDisplayName: "Gemini",
+          providerAlias: "gemini-cli",
+          providerCanonical: "gemini-cli",
+          providerDisplayName: "Gemini-cli",
         },
       ],
     ])
@@ -1327,22 +1250,18 @@ test("config: providerTag (default-on) prepends '<provider> - ' to enriched raw-
   const input = makeInput();
   await hook(input);
 
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
   assert.ok(entry);
-  assert.equal(
-    entry.models["opencode-omniroute/claude-sonnet-4-6"].name,
-    "Claude - Claude Sonnet 4.6"
-  );
-  assert.equal(entry.models["opencode-omniroute/gemini-3-flash"].name, "Gemini - Gemini 3 Flash");
+  assert.equal(entry.models["omniroute/claude-sonnet-4-6"].name, "Claude - Claude Sonnet 4.6");
+  assert.equal(entry.models["omniroute/gemini-3-flash"].name, "Gemini-cli - Gemini 3 Flash");
   // Combos stay untouched — `Combo: ` prefix already conveys multi-upstream.
   assert.equal(entry.models["omniroute/claude-tier"].name, "Claude Tier");
 });
 
 test("config: providerTag=false suppresses the suffix", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
   });
   const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
   const combosFetcher = stubCombosFetcher([]);
@@ -1360,11 +1279,10 @@ test("config: providerTag=false suppresses the suffix", async () => {
   const input = makeInput();
   await hook(input);
 
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
   assert.equal(
-    entry.models["opencode-omniroute/claude-sonnet-4-6"].name,
+    entry.models["omniroute/claude-sonnet-4-6"].name,
     "Claude Sonnet 4.6",
     "enriched name kept, provider tag suppressed"
   );
@@ -1372,7 +1290,7 @@ test("config: providerTag=false suppresses the suffix", async () => {
 
 test("config: providerTag falls back to UPPER(alias) when providerDisplayName missing", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
   });
   const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
   const combosFetcher = stubCombosFetcher([]);
@@ -1393,15 +1311,14 @@ test("config: providerTag falls back to UPPER(alias) when providerDisplayName mi
   const input = makeInput();
   await hook(input);
 
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
-  assert.equal(entry.models["opencode-omniroute/claude-sonnet-4-6"].name, "CC - Claude Sonnet 4.6");
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
+  assert.equal(entry.models["omniroute/claude-sonnet-4-6"].name, "CC - Claude Sonnet 4.6");
 });
 
 test("config: providerTag skipped entirely when neither providerDisplayName nor providerAlias set", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
   });
   const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
   const combosFetcher = stubCombosFetcher([]);
@@ -1420,15 +1337,14 @@ test("config: providerTag skipped entirely when neither providerDisplayName nor
   const input = makeInput();
   await hook(input);
 
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
-  assert.equal(entry.models["opencode-omniroute/claude-sonnet-4-6"].name, "Claude Sonnet 4.6");
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
+  assert.equal(entry.models["omniroute/claude-sonnet-4-6"].name, "Claude Sonnet 4.6");
 });
 
 test("config: providerTag is idempotent — second hook call doesn't double-suffix", async () => {
   const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
   });
   const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
   const combosFetcher = stubCombosFetcher([]);
@@ -1447,24 +1363,16 @@ test("config: providerTag is idempotent — second hook call doesn't double-suff
 
   const inputA = makeInput();
   await hook(inputA);
-  const entryA = (inputA as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
-  assert.equal(
-    entryA.models["opencode-omniroute/claude-sonnet-4-6"].name,
-    "Claude - Claude Sonnet 4.6"
-  );
+  const entryA = (inputA as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
+  assert.equal(entryA.models["omniroute/claude-sonnet-4-6"].name, "Claude - Claude Sonnet 4.6");
 
   // Second invocation (cache hit) — name must still be single-suffixed.
   const inputB = makeInput();
   await hook(inputB);
-  const entryB = (inputB as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
-  assert.equal(
-    entryB.models["opencode-omniroute/claude-sonnet-4-6"].name,
-    "Claude - Claude Sonnet 4.6"
-  );
+  const entryB = (inputB as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
+  assert.equal(entryB.models["omniroute/claude-sonnet-4-6"].name, "Claude - Claude Sonnet 4.6");
 });
 
 // ────────────────────────────────────────────────────────────────────────────

@omniroute/opencode-plugin/tests/disk-snapshot-perms.test.ts

@@ -40,7 +40,7 @@ test("defaultDiskSnapshotWriter writes an owner-only (no group/other) snapshot",
   process.env.OPENCODE_DATA_DIR = tmp;
 
   try {
-    await defaultDiskSnapshotWriter("perm-test", makeEntry(), "test-snapshot-identity");
+    await defaultDiskSnapshotWriter("perm-test", makeEntry());
 
     const file = diskSnapshotPath("perm-test");
     assert.ok(fs.existsSync(file), "snapshot file should be written");

@omniroute/opencode-plugin/tests/features.test.ts

@@ -376,7 +376,6 @@ test("provider hook: enrichment fetcher called when features.enrichment !== fals
   );
   const out = await hook.models!({} as never, { auth: apiAuth("sk") as never });
   assert.equal(called, 1, "enrichment fetcher called once");
-  // #6859: dynamic-hook catalog keys use the unprefixed omnirouteProviderId.
   const m = out["omniroute/claude-sonnet-4-6"];
   assert.equal(m.name, "Claude Sonnet 4.6", "enrichment name overlay applied");
   assert.equal(m.cost.input, 3, "enrichment pricing applied");
@@ -402,11 +401,7 @@ test("provider hook: enrichment fetcher NOT called when features.enrichment:fals
   );
   const out = await hook.models!({} as never, { auth: apiAuth("sk") as never });
   assert.equal(called, 0, "enrichment fetcher NOT called when gated off");
-  assert.equal(
-    out["omniroute/claude-sonnet-4-6"].name,
-    "claude-sonnet-4-6",
-    "raw id preserved"
-  );
+  assert.equal(out["omniroute/claude-sonnet-4-6"].name, "claude-sonnet-4-6", "raw id preserved");
 });
 
 test("provider hook: compression metadata fetcher NOT called by default (opt-in)", async () => {
@@ -478,7 +473,7 @@ test("provider hook: compression metadata fetcher called when opted in", async (
 // ─────────────────────────────────────────────────────────────────────────
 
 const stubAuthJson = (apiKey: string) => async () => ({
-  "opencode-omniroute": { type: "api" as const, key: apiKey },
+  omniroute: { type: "api" as const, key: apiKey },
 });
 
 test("config hook: MCP auto-emit OFF by default (no mcp entry)", async () => {
@@ -493,7 +488,7 @@ test("config hook: MCP auto-emit OFF by default (no mcp entry)", async () => {
   );
   const input: { provider?: Record<string, unknown>; mcp?: Record<string, unknown> } = {};
   await hook(input as never);
-  assert.ok(input.provider?.["opencode-omniroute"], "provider block written");
+  assert.ok(input.provider?.omniroute, "provider block written");
   assert.equal(input.mcp, undefined, "no mcp block written");
 });
 
@@ -513,7 +508,7 @@ test("config hook: features.mcpAutoEmit:true writes mcp entry with provider apiK
   );
   const input: { provider?: Record<string, unknown>; mcp?: Record<string, unknown> } = {};
   await hook(input as never);
-  const entry = input.mcp?.["opencode-omniroute"] as
+  const entry = input.mcp?.omniroute as
     | { type: string; url: string; enabled: boolean; headers: Record<string, string> }
     | undefined;
   assert.ok(entry, "mcp entry written");
@@ -543,7 +538,7 @@ test("config hook: features.mcpToken overrides provider apiKey in mcp Bearer", a
   );
   const input: { provider?: Record<string, unknown>; mcp?: Record<string, unknown> } = {};
   await hook(input as never);
-  const entry = input.mcp?.["opencode-omniroute"] as { headers: Record<string, string> };
+  const entry = input.mcp?.omniroute as { headers: Record<string, string> };
   assert.equal(
     entry.headers.Authorization,
     "Bearer sk-mcp-narrower",
@@ -566,11 +561,11 @@ test("config hook: existing operator mcp.<providerId> wins (no overwrite)", asyn
     }
   );
   const input: { provider?: Record<string, unknown>; mcp?: Record<string, unknown> } = {
-    mcp: { "opencode-omniroute": { type: "custom-user-entry", url: "https://manual.example/mcp" } },
+    mcp: { omniroute: { type: "custom-user-entry", url: "https://manual.example/mcp" } },
   };
   await hook(input as never);
   assert.deepEqual(
-    input.mcp?.["opencode-omniroute"],
+    input.mcp?.omniroute,
     { type: "custom-user-entry", url: "https://manual.example/mcp" },
     "operator override preserved"
   );
@@ -585,7 +580,7 @@ test("config hook: features.mcpAutoEmit:true with /v1 in baseURL → strips corr
     },
     {
       readAuthJson: async () => ({
-        "opencode-omniroute-preprod": { type: "api" as const, key: "sk-preprod" },
+        "omniroute-preprod": { type: "api" as const, key: "sk-preprod" },
       }),
       fetcher: async () => SAMPLE_RAW,
       combosFetcher: async () => [],
@@ -594,7 +589,7 @@ test("config hook: features.mcpAutoEmit:true with /v1 in baseURL → strips corr
   );
   const input: { provider?: Record<string, unknown>; mcp?: Record<string, unknown> } = {};
   await hook(input as never);
-  const entry = input.mcp?.["opencode-omniroute-preprod"] as { url: string };
+  const entry = input.mcp?.["omniroute-preprod"] as { url: string };
   assert.equal(
     entry.url,
     "https://or-preprod.example.com/api/mcp/stream",

@omniroute/opencode-plugin/tests/fetch-interceptor.test.ts

@@ -50,52 +50,6 @@ test("createOmniRouteFetchInterceptor: targets baseURL → Authorization header
   }
 });
 
-test("createOmniRouteFetchInterceptor: path-prefixed baseURL scopes auth to its normalized inference paths", async () => {
-  const { calls, restore } = installFetchRecorder();
-  try {
-    const prefixedBase = "https://or.example.com/tenant-a/v1";
-    const f = createOmniRouteFetchInterceptor({
-      apiKey: KEY,
-      baseURL: `${prefixedBase}///`,
-    });
-    const streamingBody = '{"stream":true}';
-
-    await f(`${prefixedBase}/chat/completions?trace=1`, {
-      method: "POST",
-      body: streamingBody,
-      headers: { Accept: "text/event-stream" },
-    });
-    await f(`${prefixedBase}/models/?refresh=1`);
-    await f("https://or.example.com/v1/chat/completions", { method: "POST", body: "{}" });
-    await f("https://or.example.com/v1/models");
-    await f("https://or.example.com/tenant-b/v1/chat/completions", {
-      method: "POST",
-      body: "{}",
-    });
-    await f(`${prefixedBase}/chat/completions/batch`, { method: "POST", body: "{}" });
-
-    const headers = calls.map(({ init }) => new Headers(init?.headers));
-    assert.equal(headers[0]?.get("Authorization"), `Bearer ${KEY}`);
-    assert.equal(headers[1]?.get("Authorization"), `Bearer ${KEY}`);
-    for (const index of [2, 3, 4, 5]) {
-      assert.equal(headers[index]?.get("Authorization"), null);
-    }
-    assert.equal(calls[0]?.input, `${prefixedBase}/chat/completions?trace=1`);
-    assert.equal(calls[0]?.init?.body, streamingBody);
-    assert.equal(headers[0]?.get("Accept"), "text/event-stream");
-
-    const suffixingInterceptor = createOmniRouteFetchInterceptor({
-      apiKey: KEY,
-      baseURL: "https://or.example.com/tenant-a/",
-    });
-    await suffixingInterceptor(`${prefixedBase}/models`);
-    const suffixedHeaders = new Headers(calls[6]?.init?.headers);
-    assert.equal(suffixedHeaders.get("Authorization"), `Bearer ${KEY}`);
-  } finally {
-    restore();
-  }
-});
-
 test("createOmniRouteFetchInterceptor: targets baseURL → Authorization OVERRIDES caller-supplied Bearer", async () => {
   const { calls, restore } = installFetchRecorder();
   try {
@@ -305,7 +259,7 @@ test("loader integration: wired interceptor actually injects Bearer when invoked
       {} as never
     );
     const wiredFetch = (result as { fetch: typeof fetch }).fetch;
-    await wiredFetch(`${BASE}/models`, {});
+    await wiredFetch(`${BASE}/v1/models`, {});
     assert.equal(calls.length, 1);
     const sentHeaders = new Headers((calls[0]!.init as RequestInit).headers);
     assert.equal(sentHeaders.get("Authorization"), `Bearer ${KEY}`);

@omniroute/opencode-plugin/tests/gemini-sanitize.test.ts

@@ -212,8 +212,8 @@ test("shouldSanitizeForGemini: google-vertex/gemini-1.5-flash → true", () => {
   assert.equal(shouldSanitizeForGemini({ model: "google-vertex/gemini-1.5-flash" }), true);
 });
 
-test("shouldSanitizeForGemini: gemini/gemini-2.5-pro → true", () => {
-  assert.equal(shouldSanitizeForGemini({ model: "gemini/gemini-2.5-pro" }), true);
+test("shouldSanitizeForGemini: gemini-cli/gemini-2.5-pro → true (real OmniRoute alias)", () => {
+  assert.equal(shouldSanitizeForGemini({ model: "gemini-cli/gemini-2.5-pro" }), true);
 });
 
 test("shouldSanitizeForGemini: claude-sonnet-4 → false", () => {

@omniroute/opencode-plugin/tests/management-read-token.test.ts

@@ -1,271 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-
-import {
-  createOmniRouteAuthHook,
-  createOmniRouteConfigHook,
-  createOmniRouteProviderHook,
-  parseOmniRoutePluginOptions,
-  type OmniRouteCompressionMetaFetcher,
-  type OmniRouteEnrichmentFetcher,
-  type OmniRouteProvidersFetcher,
-  type OmniRouteRawModelEntry,
-} from "../src/index.js";
-
-const BASE_URL = "https://or.example.com/v1";
-const API_KEY = "sk-inference-only";
-const MANAGEMENT_READ_TOKEN = "sk-management-read-only";
-
-const RAW_MODELS: OmniRouteRawModelEntry[] = [
-  {
-    id: "openai/gpt-test",
-    context_length: 16_000,
-    max_output_tokens: 4_000,
-    capabilities: {
-      tool_calling: true,
-      reasoning: false,
-      vision: false,
-      thinking: false,
-      temperature: true,
-    },
-    input_modalities: ["text"],
-    output_modalities: ["text"],
-  },
-];
-
-function apiAuth(key: string) {
-  return { type: "api" as const, key };
-}
-
-test("options: managementReadToken is accepted and preserved", () => {
-  const parsed = parseOmniRoutePluginOptions({ managementReadToken: MANAGEMENT_READ_TOKEN });
-  assert.equal(parsed.managementReadToken, MANAGEMENT_READ_TOKEN);
-});
-
-test("provider hook: management GET fetchers use managementReadToken while /v1 uses apiKey", async () => {
-  const calls: Array<[string, string]> = [];
-  const enrichmentFetcher: OmniRouteEnrichmentFetcher = async (_baseURL, token) => {
-    calls.push(["pricing", token]);
-    return new Map();
-  };
-  const compressionMetaFetcher: OmniRouteCompressionMetaFetcher = async (_baseURL, token) => {
-    calls.push(["context", token]);
-    return [];
-  };
-  const providersFetcher: OmniRouteProvidersFetcher = async (_baseURL, token) => {
-    calls.push(["providers", token]);
-    return [];
-  };
-
-  const hook = createOmniRouteProviderHook(
-    {
-      baseURL: BASE_URL,
-      managementReadToken: MANAGEMENT_READ_TOKEN,
-      features: { compressionMetadata: true, usableOnly: true },
-    },
-    {
-      fetcher: async (_baseURL, token) => {
-        calls.push(["models", token]);
-        return RAW_MODELS;
-      },
-      combosFetcher: async (_baseURL, token) => {
-        calls.push(["combos", token]);
-        return [];
-      },
-      autoCombosFetcher: async (_baseURL, token) => {
-        calls.push(["auto-combos", token]);
-        return [];
-      },
-      enrichmentFetcher,
-      compressionMetaFetcher,
-      providersFetcher,
-    }
-  );
-
-  await hook.models!({} as never, { auth: apiAuth(API_KEY) as never });
-
-  assert.deepEqual(calls, [
-    ["models", API_KEY],
-    ["combos", MANAGEMENT_READ_TOKEN],
-    ["auto-combos", MANAGEMENT_READ_TOKEN],
-    ["pricing", MANAGEMENT_READ_TOKEN],
-    ["context", MANAGEMENT_READ_TOKEN],
-    ["providers", MANAGEMENT_READ_TOKEN],
-  ]);
-});
-
-test("provider hook: absent managementReadToken preserves apiKey fallback", async () => {
-  const calls: Array<[string, string]> = [];
-  const hook = createOmniRouteProviderHook(
-    { baseURL: BASE_URL, features: { enrichment: false, autoCombos: false } },
-    {
-      fetcher: async (_baseURL, token) => {
-        calls.push(["models", token]);
-        return RAW_MODELS;
-      },
-      combosFetcher: async (_baseURL, token) => {
-        calls.push(["combos", token]);
-        return [];
-      },
-    }
-  );
-
-  await hook.models!({} as never, { auth: apiAuth(API_KEY) as never });
-
-  assert.deepEqual(calls, [
-    ["models", API_KEY],
-    ["combos", API_KEY],
-  ]);
-});
-
-test("config hook: managementReadToken stays out of provider inference and MCP config", async () => {
-  const calls: Array<[string, string]> = [];
-  const hook = createOmniRouteConfigHook(
-    {
-      baseURL: BASE_URL,
-      managementReadToken: MANAGEMENT_READ_TOKEN,
-      features: { enrichment: false, autoCombos: false, diskCache: false, mcpAutoEmit: true },
-    },
-    {
-      readAuthJson: async () => ({
-        "opencode-omniroute": { type: "api" as const, key: API_KEY },
-      }),
-      fetcher: async (_baseURL, token) => {
-        calls.push(["models", token]);
-        return RAW_MODELS;
-      },
-      combosFetcher: async (_baseURL, token) => {
-        calls.push(["combos", token]);
-        return [];
-      },
-      logger: { warn: () => {} },
-    }
-  );
-  const input: { provider?: Record<string, any>; mcp?: Record<string, any> } = {};
-
-  await hook(input as never);
-
-  assert.deepEqual(calls, [
-    ["models", API_KEY],
-    ["combos", MANAGEMENT_READ_TOKEN],
-  ]);
-  assert.equal(input.provider?.["opencode-omniroute"]?.options?.apiKey, API_KEY);
-  assert.equal(
-    input.mcp?.["opencode-omniroute"]?.headers?.Authorization,
-    `Bearer ${API_KEY}`,
-    "mcpAutoEmit remains independent of managementReadToken"
-  );
-});
-
-test("auth fetch: only intended same-origin inference paths receive apiKey", async () => {
-  const calls: Array<{ input: RequestInfo | URL; init?: RequestInit }> = [];
-  const originalFetch = globalThis.fetch;
-  globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
-    calls.push({ input, init });
-    return new Response("ok");
-  }) as typeof fetch;
-
-  try {
-    const hook = createOmniRouteAuthHook({
-      baseURL: `${BASE_URL}/`,
-      managementReadToken: MANAGEMENT_READ_TOKEN,
-    });
-    const loaded = await hook.loader!(async () => apiAuth(API_KEY) as never, {} as never);
-    const interceptedFetch = (loaded as { fetch: typeof fetch }).fetch;
-
-    const streamingBody = '{"stream":true}';
-    await interceptedFetch(`${BASE_URL}/chat/completions?trace=1`, {
-      method: "POST",
-      body: streamingBody,
-      headers: { Accept: "text/event-stream" },
-    });
-    await interceptedFetch(`${BASE_URL}/models/?refresh=1`);
-    await interceptedFetch("https://or.example.com/api/combos");
-    await interceptedFetch("https://or.example.com/api/mcp/stream");
-    await interceptedFetch("https://or.example.com/v1/embeddings");
-    await interceptedFetch("https://third-party.example/v1/chat/completions", {
-      method: "POST",
-      body: "{}",
-    });
-
-    const headers = calls.map(({ init }) => new Headers(init?.headers));
-    assert.equal(headers[0]?.get("Authorization"), `Bearer ${API_KEY}`);
-    assert.equal(headers[1]?.get("Authorization"), `Bearer ${API_KEY}`);
-    for (const index of [2, 3, 4, 5]) {
-      assert.equal(headers[index]?.get("Authorization"), null);
-    }
-    assert.equal(calls[0]?.input, `${BASE_URL}/chat/completions?trace=1`);
-    assert.equal(calls[0]?.init?.body, streamingBody);
-    assert.equal(headers[0]?.get("Accept"), "text/event-stream");
-    assert.equal(
-      calls.some(({ init }) =>
-        [...new Headers(init?.headers).values()].some((value) =>
-          value.includes(MANAGEMENT_READ_TOKEN)
-        )
-      ),
-      false,
-      "managementReadToken must never enter inference fetch headers"
-    );
-  } finally {
-    globalThis.fetch = originalFetch;
-  }
-});
-
-test("disk cache: snapshot written under management token A is rejected under token B", async () => {
-  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-token-snapshot-"));
-  const previousDataDir = process.env.OPENCODE_DATA_DIR;
-  process.env.OPENCODE_DATA_DIR = tmp;
-
-  try {
-    const commonDeps = {
-      readAuthJson: async () => ({
-        "opencode-omniroute": {
-          type: "api" as const,
-          key: API_KEY,
-          baseURL: BASE_URL,
-        },
-      }),
-      combosFetcher: async () => [],
-      logger: { warn: () => {} },
-    };
-    const features = {
-      enrichment: false,
-      autoCombos: false,
-      diskCache: true,
-    } as const;
-
-    const tokenAHook = createOmniRouteConfigHook(
-      { managementReadToken: "token-A", features },
-      {
-        ...commonDeps,
-        fetcher: async () => RAW_MODELS,
-      }
-    );
-    await tokenAHook({} as never);
-
-    const tokenBHook = createOmniRouteConfigHook(
-      { managementReadToken: "token-B", features },
-      {
-        ...commonDeps,
-        fetcher: async () => {
-          throw new Error("offline");
-        },
-      }
-    );
-    const input: { provider?: Record<string, { models: Record<string, unknown> }> } = {};
-    await tokenBHook(input as never);
-
-    assert.deepEqual(
-      input.provider?.["opencode-omniroute"]?.models,
-      {},
-      "catalog from token A must not hydrate after switching to token B"
-    );
-  } finally {
-    if (previousDataDir === undefined) delete process.env.OPENCODE_DATA_DIR;
-    else process.env.OPENCODE_DATA_DIR = previousDataDir;
-    fs.rmSync(tmp, { recursive: true, force: true });
-  }
-});

@omniroute/opencode-plugin/tests/multi-instance.test.ts

@@ -38,8 +38,8 @@ test("multi-instance: two plugin invocations bind to their own providerId", asyn
     baseURL: "https://b.example/v1",
   });
 
-  assert.equal(a.auth?.provider, "opencode-omniroute-prod");
-  assert.equal(b.auth?.provider, "opencode-omniroute-preprod");
+  assert.equal(a.auth?.provider, "omniroute-prod");
+  assert.equal(b.auth?.provider, "omniroute-preprod");
 });
 
 test("multi-instance: hook objects + nested arrays are independent references", async () => {
@@ -70,8 +70,8 @@ test("multi-instance: identical opts twice still yield independent objects", asy
   assert.notEqual(first.auth, second.auth);
   assert.notEqual(first.auth?.methods, second.auth?.methods);
   // Same provider id is fine — what matters is no shared mutable state.
-  assert.equal(first.auth?.provider, "opencode-twin");
-  assert.equal(second.auth?.provider, "opencode-twin");
+  assert.equal(first.auth?.provider, "twin");
+  assert.equal(second.auth?.provider, "twin");
 });
 
 test("multi-instance: mutating instance A's auth.methods does not affect instance B", async () => {
@@ -132,5 +132,5 @@ test("multi-instance: invalid opts on one instance does not poison the other", a
     providerId: "recovered",
     baseURL: "https://ok.example/v1",
   });
-  assert.equal(ok.auth?.provider, "opencode-recovered");
+  assert.equal(ok.auth?.provider, "recovered");
 });

@omniroute/opencode-plugin/tests/provider-id-routing.test.ts

@@ -1,141 +0,0 @@
-/**
- * Regression test for #6859.
- *
- * `resolveOmniRoutePluginOptions()` auto-prefixes `providerId` with
- * `"opencode-"` (commit 75b52e286) so OpenCode 1.17.8+'s native-adapter gate
- * accepts it as an OC-registered provider id. That prefixed value must stay
- * OC-internal (AuthHook.provider / provider registration keys) — it must
- * NEVER leak into the identifiers OmniRoute's own server parses to resolve
- * credentials (`mapRawModelToModelV2`'s `id`/`providerID`,
- * `mapComboToModelV2`'s `providerID`, and the dynamic-hook catalog keys).
- *
- * OmniRoute's server-side `parseModel()` (open-sse/services/model.ts) splits
- * a dispatched model string on `/` to recover the provider name and look up
- * credentials. If the plugin embeds the OC-gate-prefixed id in that string,
- * the server looks up credentials for a provider named "opencode-omniroute"
- * (which never exists in `src/shared/constants/providers.ts`) instead of
- * "omniroute" — producing the exact "No credentials for opencode-omniroute" /
- * "No active credentials for provider: opencode-omniroute" errors reported
- * in #6859.
- */
-
-import test from "node:test";
-import assert from "node:assert/strict";
-import {
-  buildStaticProviderEntry,
-  createOmniRouteProviderHook,
-  mapRawModelToModelV2,
-  resolveOmniRoutePluginOptions,
-  type OmniRouteRawCombo,
-} from "../src/index.js";
-
-/**
- * Minimal stand-in for OmniRoute's own `parseModel()` (open-sse/services/
- * model.ts), which splits a dispatched `<providerID>/<modelID>` string on the
- * FIRST "/" to recover the provider name used for credential lookup. Kept
- * local (rather than cross-importing the real module) so this package's
- * self-contained test suite (`cd @omniroute/opencode-plugin && npm test`)
- * doesn't depend on the root repo's `@/*` path-alias resolution.
- */
-function splitProviderFromDispatchedModel(modelStr: string): string {
-  const idx = modelStr.indexOf("/");
-  return idx === -1 ? modelStr : modelStr.slice(0, idx);
-}
-
-const apiAuth = (key: string) => ({ type: "api" as const, key });
-
-test("#6859: server-facing model id/providerID must resolve to the unprefixed provider name", () => {
-  const resolved = resolveOmniRoutePluginOptions();
-
-  // The OC-gate-compatible id stays prefixed — it is legitimate for
-  // AuthHook.provider / provider registration.
-  assert.equal(resolved.providerId, "opencode-omniroute");
-
-  // A second, unprefixed id must be exposed for anything that reaches
-  // OmniRoute's own server (model id prefix, ModelV2.providerID, combo keys).
-  assert.equal(
-    resolved.omnirouteProviderId,
-    "omniroute",
-    "resolveOmniRoutePluginOptions() must expose an unprefixed omnirouteProviderId"
-  );
-
-  // A bare raw /v1/models entry (no existing "/" in its id — the common
-  // case for OmniRoute's catalog) mapped with the server-facing id.
-  const model = mapRawModelToModelV2(
-    { id: "claude-opus-4-7" },
-    { providerId: resolved.omnirouteProviderId, baseURL: "http://localhost:20128" }
-  );
-
-  assert.equal(model.providerID, "omniroute");
-  assert.equal(model.id, "omniroute/claude-opus-4-7");
-
-  // OpenCode dispatches back to OmniRoute using `providerID/modelKey`
-  // (matches the issue's own repro: `-m opencode-omniroute/oc/big-pickle`).
-  const dispatchedModelString = `${model.providerID}/claude-opus-4-7`;
-  const parsedProvider = splitProviderFromDispatchedModel(dispatchedModelString);
-
-  assert.equal(
-    parsedProvider,
-    "omniroute",
-    `server-side provider split resolved '${parsedProvider}', expected 'omniroute' — ` +
-      `credentials lookup would fail for an OC-gate-prefixed provider id`
-  );
-});
-
-test("#6859: createOmniRouteProviderHook end-to-end — catalog keys/providerID never carry the OC-gate prefix", async () => {
-  const hook = createOmniRouteProviderHook(
-    { baseURL: "https://or.example.com/v1" },
-    {
-      fetcher: async () => [{ id: "claude-opus-4-7" }],
-      combosFetcher: async () => [],
-    }
-  );
-  const out = await hook.models!({} as never, { auth: apiAuth("sk-test") as never });
-  const model = out["omniroute/claude-opus-4-7"];
-  assert.ok(model, "catalog keyed under the unprefixed provider name");
-  assert.equal(model.providerID, "omniroute");
-  assert.ok(
-    !model.providerID.startsWith("opencode-"),
-    "the OC-gate prefix must never leak into ModelV2.providerID"
-  );
-});
-
-// #7976: buildStaticProviderEntry (the STATIC provider() config-hook path,
-// exercised when the plugin writes `opencode.json` up front rather than
-// registering the dynamic `provider.models()` hook) never received the
-// #6859 fix. OC dispatches a static-catalog `models` map key verbatim as
-// the `model` field of the outbound request — only the top-level
-// `provider["<id>"]` segment is stripped for routing — so a bare-slug combo
-// key built with the OC-gated `providerId` reaches OmniRoute's server
-// doubled and fails credential lookup for the nonexistent provider
-// `opencode-omniroute`. Confirmed against the issue's own curl repro
-// (`model: "opencode-omniroute/hermes-smart-stack"` → "No active
-// credentials for provider: opencode-omniroute").
-test("#7976: buildStaticProviderEntry keys bare-slug combo ids with the unprefixed omnirouteProviderId (no double OC-gate prefix)", () => {
-  const resolved = resolveOmniRoutePluginOptions({ providerId: "omniroute" });
-  assert.equal(resolved.providerId, "opencode-omniroute");
-  assert.equal(resolved.omnirouteProviderId, "omniroute");
-
-  const combo = {
-    id: "combo-abc123",
-    name: "Hermes Smart Stack",
-    isHidden: false,
-    models: [],
-  } as unknown as OmniRouteRawCombo;
-
-  const block = buildStaticProviderEntry(
-    [],
-    [combo],
-    resolved,
-    "https://or.example/v1",
-    "sk-test"
-  );
-
-  assert.deepEqual(Object.keys(block.models), ["omniroute/hermes-smart-stack"]);
-  assert.equal(
-    block.models["opencode-omniroute/hermes-smart-stack"],
-    undefined,
-    "combo key must not carry the OC-gate-prefixed providerId — it doubles up once " +
-      "OC dispatches it verbatim as the `model` field"
-  );
-});

@omniroute/opencode-plugin/tests/provider.test.ts

@@ -75,7 +75,7 @@ const apiAuth = (key: string, baseURL?: string): unknown =>
 
 test("createOmniRouteProviderHook: default providerId is 'omniroute'", () => {
   const hook = createOmniRouteProviderHook(undefined, { combosFetcher: async () => [] });
-  assert.equal(hook.id, "opencode-omniroute");
+  assert.equal(hook.id, "omniroute");
 });
 
 test("createOmniRouteProviderHook: custom providerId binds to hook.id (multi-instance)", () => {
@@ -87,8 +87,8 @@ test("createOmniRouteProviderHook: custom providerId binds to hook.id (multi-ins
     { providerId: "omniroute-local" },
     { combosFetcher: async () => [] }
   );
-  assert.equal(a.id, "opencode-omniroute-preprod");
-  assert.equal(b.id, "opencode-omniroute-local");
+  assert.equal(a.id, "omniroute-preprod");
+  assert.equal(b.id, "omniroute-local");
 });
 
 test("models: extracts apiKey from ctx.auth (type=api) and calls fetcher with it", async () => {
@@ -101,9 +101,6 @@ test("models: extracts apiKey from ctx.auth (type=api) and calls fetcher with it
   assert.equal(fetcher.callCount(), 1);
   assert.deepEqual(fetcher.callsBy()[0], ["https://or.example.com/v1", "sk-abc"]);
   assert.equal(Object.keys(out).length, 3);
-  // #6859: dynamic-hook catalog keys use the unprefixed omnirouteProviderId
-  // ("omniroute"), not the OC-gate-prefixed hook.id ("opencode-omniroute") —
-  // that prefix must never leak into anything OmniRoute's server parses.
   assert.ok(out["omniroute/claude-primary"]);
 });
 
@@ -155,10 +152,6 @@ test("models: maps a sample /v1/models entry to ModelV2 (sanity)", async () => {
     { fetcher, combosFetcher: async () => [] }
   );
   const out = await hook.models!({} as never, { auth: apiAuth("sk-abc") as never });
-  // #6859: dynamic-hook catalog keys/ids/providerID use the unprefixed
-  // omnirouteProviderId ("omniroute") — the OC-gate prefix ("opencode-")
-  // must stay OC-internal (hook.id / AuthHook.provider) and never leak into
-  // anything OmniRoute's own server parses for credential lookup.
   const claude = out["omniroute/claude-primary"];
   assert.ok(claude, "claude-primary present");
   // `mapRawModelToModelV2` stamps the provider prefix on the id so OC's

@omniroute/opencode-plugin/tests/scaffold.test.ts

@@ -26,7 +26,7 @@ test("scaffold: default export is v1 plugin shape { id, server: OmniRoutePlugin
 
 test("resolveOmniRoutePluginOptions: defaults", () => {
   const r = resolveOmniRoutePluginOptions();
-  assert.equal(r.providerId, "opencode-omniroute");
+  assert.equal(r.providerId, "omniroute");
   assert.equal(r.displayName, "OmniRoute");
   assert.equal(r.modelCacheTtl, 300_000);
   assert.equal(r.baseURL, undefined);
@@ -34,8 +34,8 @@ test("resolveOmniRoutePluginOptions: defaults", () => {
 
 test("resolveOmniRoutePluginOptions: custom providerId derives displayName", () => {
   const r = resolveOmniRoutePluginOptions({ providerId: "omniroute-preprod" });
-  assert.equal(r.providerId, "opencode-omniroute-preprod");
-  assert.equal(r.displayName, "OmniRoute (opencode-omniroute-preprod)");
+  assert.equal(r.providerId, "omniroute-preprod");
+  assert.equal(r.displayName, "OmniRoute (omniroute-preprod)");
 });
 
 test("resolveOmniRoutePluginOptions: explicit displayName wins", () => {

AGENTS.md

@@ -3,14 +3,14 @@
 ## Project
 
 Unified AI proxy/router — route any LLM through one endpoint. Multi-provider support
-with **290 provider entries** (OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Fireworks,
+with **231 provider entries** (OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Fireworks,
 Cohere, NVIDIA, Cerebras, Pollinations, Puter, Cloudflare AI, HuggingFace, DeepInfra,
 SambaNova, Meta Llama API, Moonshot AI, AI21 Labs, Databricks, Snowflake, and many more)
-with **MCP Server** (104 tools), **A2A v0.3 Protocol**, and **Electron desktop app**.
+with **MCP Server** (87 tools), **A2A v0.3 Protocol**, and **Electron desktop app**.
 
-> **Live counts (v3.8.49)**: providers 290 · MCP tools 104 · MCP scopes 30 · A2A skills 6 ·
-> open-sse services 134 · routing strategies 17 · auto-combo scoring factors 12 ·
-> DB modules 95 · DB migrations 110 · base tables 17 · search providers 11 ·
+> **Live counts (v3.8.31)**: providers 231 · MCP tools 87 · MCP scopes 30 · A2A skills 6 ·
+> open-sse services 115 · routing strategies 15 · auto-combo scoring factors 9 ·
+> DB modules 83 · DB migrations 97 · base tables 17 · search providers 11 ·
 > i18n locales 42. **Refresh with `npm run check:docs-all`.**
 
 ## Doc Accuracy Discipline (read before writing any doc)
@@ -178,7 +178,7 @@ Always run `prettier --write` on changed files.
 
 ### Data Layer (`src/lib/db/`)
 
-All persistence uses SQLite through **95 domain-specific modules** in `src/lib/db/`. Top modules:
+All persistence uses SQLite through **83 domain-specific modules** in `src/lib/db/`. Top modules:
 
 - Core: `core.ts`, `migrationRunner.ts`, `encryption.ts`, `stateReset.ts`
 - Providers / catalog: `providers.ts`, `models.ts`, `providerLimits.ts`, `compressionAnalytics.ts`
@@ -188,8 +188,8 @@ All persistence uses SQLite through **95 domain-specific modules** in `src/lib/d
 - Storage: `backup.ts`, `cleanup.ts`, `jsonMigration.ts`, `healthCheck.ts`, `databaseSettings.ts`
 - Extension modules: `evals.ts`, `webhooks.ts`, `reasoningCache.ts`, `readCache.ts`, `tierConfig.ts`, `compressionCombos.ts`, `compressionScheduler.ts`, `batches.ts`, `files.ts`, `syncTokens.ts`, `proxies.ts`, `oneproxy.ts`, `upstreamProxy.ts`, `versionManager.ts`, `cliToolState.ts`, `prompts.ts`, `detailedLogs.ts`, `contextHandoffs.ts`, `compression.ts`, `stats.ts`
 
-Live count: `ls src/lib/db/*.ts | wc -l` (currently 95). Drift detection: `npm run check:docs-counts`.
-Schema migrations live in `db/migrations/` (**110 files** as of v3.8.43) and run via `migrationRunner.ts`.
+Live count: `ls src/lib/db/*.ts | wc -l` (currently 83). Drift detection: `npm run check:docs-counts`.
+Schema migrations live in `db/migrations/` (**97 files** as of v3.8.24) and run via `migrationRunner.ts`.
 `src/lib/localDb.ts` is a **re-export layer only** — never add logic there.
 
 #### DB Internals
@@ -198,7 +198,7 @@ Schema migrations live in `db/migrations/` (**110 files** as of v3.8.43) and run
   journaling. `SCHEMA_SQL` defines **17 base tables** (verify with `grep -c "CREATE TABLE" src/lib/db/core.ts` minus 1 for the bookkeeping `_omniroute_migrations` table). Helpers: `rowToCamel`, `encryptConnectionFields`.
 - **`migrationRunner.ts`**: Applies versioned SQL files from `db/migrations/` inside transactions.
   Tracks applied migrations in `_omniroute_migrations` table.
-- **Migrations**: 110 files (`001_initial_schema.sql` → `110_*.sql`).
+- **Migrations**: 97 files (`001_initial_schema.sql` → `099_*.sql`).
   Each migration is idempotent and runs in a transaction. Live count: `ls src/lib/db/migrations/*.sql | wc -l`.
 - **Domain modules** import `getDbInstance()` from `core.ts` for all CRUD operations.
   Each module owns a specific table/set of tables (e.g., `providers.ts` → `provider_connections`,
@@ -267,8 +267,8 @@ Zod schemas, and unit tests aligned when editing.
 
 ### Provider Categories
 
-- **Free** (2): Qoder AI, Kiro AI
-- **OAuth** (13): Claude Code, Antigravity, Codex, GitHub Copilot, Cursor, Kimi Coding, Kilo Code, Cline, Kiro, Qoder, Gemini, Windsurf (v3.8), GitLab Duo (v3.8)
+- **Free** (4): Qoder AI, Qwen Code, Gemini CLI (deprecated), Kiro AI
+- **OAuth** (14): Claude Code, Antigravity, Codex, GitHub Copilot, Cursor, Kimi Coding, Kilo Code, Cline, Qwen (⚠️ free tier discontinued 2026-04-15), Kiro, Qoder, Gemini, Windsurf (v3.8), GitLab Duo (v3.8)
 - **API Key** (120+): OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Perplexity,
   Together, Fireworks, Cerebras, Cohere, NVIDIA, Nebius, SiliconFlow, Hyperbolic,
   HuggingFace, OpenRouter, Vertex AI, Cloudflare AI, Scaleway, AI/ML API, Pollinations,
@@ -291,7 +291,7 @@ Providers are registered in `src/shared/constants/providers.ts` with Zod validat
 ### Executors (`open-sse/executors/`)
 
 Provider-specific request executors: `base.ts`, `default.ts`, `cursor.ts`, `codex.ts`,
-`antigravity.ts`, `github.ts`, `kiro.ts`, `qoder.ts`, `vertex.ts`,
+`antigravity.ts`, `github.ts`, `gemini-cli.ts`, `kiro.ts`, `qoder.ts`, `vertex.ts`,
 `cloudflare-ai.ts`, `opencode.ts`, `pollinations.ts`, `puter.ts`.
 
 #### Executor Internals
@@ -336,7 +336,7 @@ Includes request/response translators with helpers for image handling.
 
 ### Services (`open-sse/services/`)
 
-134 service modules in `open-sse/services/` (top-level only; more including sub-dirs like `autoCombo/` and `compression/`). Refresh: `ls open-sse/services/*.ts | wc -l`. Key modules:
+115 service modules in `open-sse/services/` (top-level only; 184 including sub-dirs like `autoCombo/` and `compression/`). Refresh: `ls open-sse/services/*.ts | wc -l`. Key modules:
 `combo.ts` (routing engine), `usage.ts`, `tokenRefresh.ts`,
 `rateLimitManager.ts`, `accountFallback.ts`, `sessionManager.ts`, `wildcardRouter.ts`,
 `autoCombo/`, `intentClassifier.ts`, `taskAwareRouter.ts`, `thinkingBudget.ts`,
@@ -378,8 +378,8 @@ Modular prompt compression that runs proactively before the existing reactive co
   and iterates through targets in order until one succeeds or all fail.
 - **`resolveComboTargets()`**: Expands a combo configuration into an ordered array of
   `ResolvedComboTarget[]`, each specifying provider + model + account + credentials.
-- **Strategies** (17): priority, weighted, fill-first, round-robin, P2C, random, least-used, reset-aware (v3.8),
-  reset-window, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, headroom, fusion. Source: `ROUTING_STRATEGY_VALUES` in `src/shared/constants/routingStrategies.ts`.
+- **Strategies** (15): priority, weighted, fill-first, round-robin, P2C, random, least-used, reset-aware (v3.8),
+  reset-window, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay. Source: `ROUTING_STRATEGY_VALUES` in `src/shared/constants/routingStrategies.ts`.
 - Each target calls **`handleSingleModel()`** which wraps `handleChatCore()` with
   per-target error handling and circuit breaker checks.
 
@@ -391,7 +391,7 @@ Policy engine modules: `policyEngine.ts`, `comboResolver.ts`, `costRules.ts`,
 
 ### MCP Server (`open-sse/mcp-server/`)
 
-**104 tools** total (`TOTAL_MCP_TOOL_COUNT`, `open-sse/mcp-server/server.ts`): a 42-entry base registry (`MCP_TOOLS` in `schemas/tools.ts`, bundling the core / cache / compression / 1proxy / advanced tools) **plus** standalone module sets — memory (3), skill (4), agentSkill (3), pool (6), gamification (8), plugin (8), notion (6), obsidian (22). 3 transports (stdio / SSE / Streamable HTTP). Scoped auth (31 scopes — see `OMNIROUTE_MCP_SCOPES`), Zod schemas. See [`docs/frameworks/MCP-SERVER.md`](docs/frameworks/MCP-SERVER.md).
+**87 tools** total (`TOTAL_MCP_TOOL_COUNT`, `open-sse/mcp-server/server.ts`): a 33-entry base registry (`MCP_TOOLS` in `schemas/tools.ts`, bundling the core / cache / compression / 1proxy / advanced tools) **plus** standalone module sets — memory (3), skill (4), agentSkill (3), gamification (8), plugin (8), notion (6), obsidian (22). 3 transports (stdio / SSE / Streamable HTTP). Scoped auth (30 scopes — see `OMNIROUTE_MCP_SCOPES`), Zod schemas. See [`docs/frameworks/MCP-SERVER.md`](docs/frameworks/MCP-SERVER.md).
 
 **Core tools** (20): get_health, list_combos, get_combo_metrics, switch_combo, check_quota,
 route_request, cost_report, list_models_catalog, web_search, simulate_route, set_budget_guard,
@@ -489,7 +489,7 @@ Request middleware including `promptInjectionGuard.ts`.
 
 ### Guardrails (`src/lib/guardrails/`)
 
-Hot-reloadable guardrails framework (3 built-in: pii-masker, prompt-injection, vision-bridge). Fail-open. The `pii-masker` guardrail is registered and runs on every request, but its data-mutating logic is **opt-in** and OFF by default — it only redacts when `PII_REDACTION_ENABLED` (request) / `PII_RESPONSE_SANITIZATION` (response + streaming) are enabled (both `defaultValue: "false"`); with them off, payloads pass through untouched. A request can additionally opt OUT of any guardrail via header (`x-omniroute-disabled-guardrails`). Never make PII default-on (Hard Rule #20). See [`docs/security/GUARDRAILS.md`](docs/security/GUARDRAILS.md).
+Hot-reloadable guardrails framework (3 built-in: pii-masker, prompt-injection, vision-bridge). Fail-open; per-request opt-out via header. See [`docs/security/GUARDRAILS.md`](docs/security/GUARDRAILS.md).
 
 ### Cloud Agents (`src/lib/cloudAgent/`)
 
@@ -534,33 +534,33 @@ Cloudflare Quick/Named, ngrok, Tailscale Funnel. See [`docs/ops/TUNNELS_GUIDE.md
 
 For any non-trivial change, read the matching deep-dive first:
 
-| Area                                       | Doc                                                                                                             |
-| ------------------------------------------ | --------------------------------------------------------------------------------------------------------------- |
-| Repo navigation                            | [`docs/architecture/REPOSITORY_MAP.md`](docs/architecture/REPOSITORY_MAP.md)                                    |
-| Architecture                               | [`docs/architecture/ARCHITECTURE.md`](docs/architecture/ARCHITECTURE.md)                                        |
-| Engineering reference                      | [`docs/architecture/CODEBASE_DOCUMENTATION.md`](docs/architecture/CODEBASE_DOCUMENTATION.md)                    |
-| Auto-Combo (12-factor, 18 strategies)      | [`docs/routing/AUTO-COMBO.md`](docs/routing/AUTO-COMBO.md)                                                      |
-| Resilience (3 layers)                      | [`docs/architecture/RESILIENCE_GUIDE.md`](docs/architecture/RESILIENCE_GUIDE.md)                                |
-| Skills                                     | [`docs/frameworks/SKILLS.md`](docs/frameworks/SKILLS.md)                                                        |
-| Memory                                     | [`docs/frameworks/MEMORY.md`](docs/frameworks/MEMORY.md)                                                        |
-| Cloud agents                               | [`docs/frameworks/CLOUD_AGENT.md`](docs/frameworks/CLOUD_AGENT.md)                                              |
-| Guardrails                                 | [`docs/security/GUARDRAILS.md`](docs/security/GUARDRAILS.md)                                                    |
-| Evals                                      | [`docs/frameworks/EVALS.md`](docs/frameworks/EVALS.md)                                                          |
-| Compliance                                 | [`docs/security/COMPLIANCE.md`](docs/security/COMPLIANCE.md)                                                    |
-| Webhooks                                   | [`docs/frameworks/WEBHOOKS.md`](docs/frameworks/WEBHOOKS.md)                                                    |
-| Authz                                      | [`docs/architecture/AUTHZ_GUIDE.md`](docs/architecture/AUTHZ_GUIDE.md)                                          |
-| Stealth                                    | [`docs/security/STEALTH_GUIDE.md`](docs/security/STEALTH_GUIDE.md)                                              |
-| Reasoning replay                           | [`docs/routing/REASONING_REPLAY.md`](docs/routing/REASONING_REPLAY.md)                                          |
-| Agent protocols (A2A / ACP / Cloud)        | [`docs/frameworks/AGENT_PROTOCOLS_GUIDE.md`](docs/frameworks/AGENT_PROTOCOLS_GUIDE.md)                          |
-| MCP server                                 | [`docs/frameworks/MCP-SERVER.md`](docs/frameworks/MCP-SERVER.md)                                                |
-| A2A server                                 | [`docs/frameworks/A2A-SERVER.md`](docs/frameworks/A2A-SERVER.md)                                                |
-| API reference                              | [`docs/reference/API_REFERENCE.md`](docs/reference/API_REFERENCE.md) + [`docs/openapi.yaml`](docs/openapi.yaml) |
-| Provider catalog (auto-generated)          | [`docs/reference/PROVIDER_REFERENCE.md`](docs/reference/PROVIDER_REFERENCE.md)                                  |
-| Tunnels                                    | [`docs/ops/TUNNELS_GUIDE.md`](docs/ops/TUNNELS_GUIDE.md)                                                        |
-| Electron desktop                           | [`docs/guides/ELECTRON_GUIDE.md`](docs/guides/ELECTRON_GUIDE.md)                                                |
-| Release flow                               | [`docs/ops/RELEASE_CHECKLIST.md`](docs/ops/RELEASE_CHECKLIST.md)                                                |
-| Quality gates (35 gates, allowlist policy) | [`docs/architecture/QUALITY_GATES.md`](docs/architecture/QUALITY_GATES.md)                                      |
-| Cluster opt-in profiles (memory, bifrost)  | [`docs/architecture/cluster-decisions.md`](docs/architecture/cluster-decisions.md)                              |
+| Area                                       | Doc                                                                                                                                 |
+| ------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------- |
+| Repo navigation                            | [`docs/architecture/REPOSITORY_MAP.md`](docs/architecture/REPOSITORY_MAP.md)                                                        |
+| Architecture                               | [`docs/architecture/ARCHITECTURE.md`](docs/architecture/ARCHITECTURE.md)                                                            |
+| Engineering reference                      | [`docs/architecture/CODEBASE_DOCUMENTATION.md`](docs/architecture/CODEBASE_DOCUMENTATION.md)                                        |
+| Auto-Combo (12-factor, 15 strategies)      | [`docs/routing/AUTO-COMBO.md`](docs/routing/AUTO-COMBO.md)                                                                          |
+| Resilience (3 layers)                      | [`docs/architecture/RESILIENCE_GUIDE.md`](docs/architecture/RESILIENCE_GUIDE.md)                                                    |
+| Skills                                     | [`docs/frameworks/SKILLS.md`](docs/frameworks/SKILLS.md)                                                                            |
+| Memory                                     | [`docs/frameworks/MEMORY.md`](docs/frameworks/MEMORY.md)                                                                            |
+| Cloud agents                               | [`docs/frameworks/CLOUD_AGENT.md`](docs/frameworks/CLOUD_AGENT.md)                                                                  |
+| Guardrails                                 | [`docs/security/GUARDRAILS.md`](docs/security/GUARDRAILS.md)                                                                        |
+| Evals                                      | [`docs/frameworks/EVALS.md`](docs/frameworks/EVALS.md)                                                                              |
+| Compliance                                 | [`docs/security/COMPLIANCE.md`](docs/security/COMPLIANCE.md)                                                                        |
+| Webhooks                                   | [`docs/frameworks/WEBHOOKS.md`](docs/frameworks/WEBHOOKS.md)                                                                        |
+| Authz                                      | [`docs/architecture/AUTHZ_GUIDE.md`](docs/architecture/AUTHZ_GUIDE.md)                                                              |
+| Stealth                                    | [`docs/security/STEALTH_GUIDE.md`](docs/security/STEALTH_GUIDE.md)                                                                  |
+| Reasoning replay                           | [`docs/routing/REASONING_REPLAY.md`](docs/routing/REASONING_REPLAY.md)                                                              |
+| Agent protocols (A2A / ACP / Cloud)        | [`docs/frameworks/AGENT_PROTOCOLS_GUIDE.md`](docs/frameworks/AGENT_PROTOCOLS_GUIDE.md)                                              |
+| MCP server                                 | [`docs/frameworks/MCP-SERVER.md`](docs/frameworks/MCP-SERVER.md)                                                                    |
+| A2A server                                 | [`docs/frameworks/A2A-SERVER.md`](docs/frameworks/A2A-SERVER.md)                                                                    |
+| API reference                              | [`docs/reference/API_REFERENCE.md`](docs/reference/API_REFERENCE.md) + [`docs/reference/openapi.yaml`](docs/reference/openapi.yaml) |
+| Provider catalog (auto-generated)          | [`docs/reference/PROVIDER_REFERENCE.md`](docs/reference/PROVIDER_REFERENCE.md)                                                      |
+| Tunnels                                    | [`docs/ops/TUNNELS_GUIDE.md`](docs/ops/TUNNELS_GUIDE.md)                                                                            |
+| Electron desktop                           | [`docs/guides/ELECTRON_GUIDE.md`](docs/guides/ELECTRON_GUIDE.md)                                                                    |
+| Release flow                               | [`docs/ops/RELEASE_CHECKLIST.md`](docs/ops/RELEASE_CHECKLIST.md)                                                                    |
+| Quality gates (35 gates, allowlist policy) | [`docs/architecture/QUALITY_GATES.md`](docs/architecture/QUALITY_GATES.md)                                                          |
+| Cluster opt-in profiles (memory, bifrost)  | [`docs/architecture/cluster-decisions.md`](docs/architecture/cluster-decisions.md)                                                  |
 
 ---
 

CLAUDE.md

@@ -35,22 +35,22 @@ For full test matrix, see `CONTRIBUTING.md` → "Running Tests". For deep archit
 
 ## Project at a Glance
 
-**OmniRoute** — unified AI proxy/router. One endpoint, 290 LLM providers, auto-fallback.
+**OmniRoute** — unified AI proxy/router. One endpoint, 231 LLM providers, auto-fallback.
 
-| Layer         | Location                | Purpose                                                                                                                                                 |
-| ------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| API Routes    | `src/app/api/v1/`       | Next.js App Router — entry points                                                                                                                       |
-| Handlers      | `open-sse/handlers/`    | Request processing (chat, embeddings, etc)                                                                                                              |
-| Executors     | `open-sse/executors/`   | Provider-specific HTTP dispatch                                                                                                                         |
-| Translators   | `open-sse/translator/`  | Format conversion (OpenAI↔Claude↔Gemini)                                                                                                                |
-| Transformer   | `open-sse/transformer/` | Responses API ↔ Chat Completions                                                                                                                        |
-| Services      | `open-sse/services/`    | Combo routing, rate limits, caching, etc                                                                                                                |
-| Database      | `src/lib/db/`           | SQLite domain modules (95 files, 110 migrations)                                                                                                        |
-| Domain/Policy | `src/domain/`           | Policy engine, cost rules, fallback logic                                                                                                               |
-| MCP Server    | `open-sse/mcp-server/`  | 104 tools (42 base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules), 3 transports (stdio / SSE / Streamable HTTP), 31 scopes |
-| A2A Server    | `src/lib/a2a/`          | JSON-RPC 2.0 agent protocol                                                                                                                             |
-| Skills        | `src/lib/skills/`       | Extensible skill framework                                                                                                                              |
-| Memory        | `src/lib/memory/`       | Persistent conversational memory                                                                                                                        |
+| Layer         | Location                | Purpose                                                                                                                                |
+| ------------- | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
+| API Routes    | `src/app/api/v1/`       | Next.js App Router — entry points                                                                                                      |
+| Handlers      | `open-sse/handlers/`    | Request processing (chat, embeddings, etc)                                                                                             |
+| Executors     | `open-sse/executors/`   | Provider-specific HTTP dispatch                                                                                                        |
+| Translators   | `open-sse/translator/`  | Format conversion (OpenAI↔Claude↔Gemini)                                                                                               |
+| Transformer   | `open-sse/transformer/` | Responses API ↔ Chat Completions                                                                                                       |
+| Services      | `open-sse/services/`    | Combo routing, rate limits, caching, etc                                                                                               |
+| Database      | `src/lib/db/`           | SQLite domain modules (83 files, 97 migrations)                                                                                        |
+| Domain/Policy | `src/domain/`           | Policy engine, cost rules, fallback logic                                                                                              |
+| MCP Server    | `open-sse/mcp-server/`  | 87 tools (33 base + memory/skill/notion/obsidian/gamification/plugin modules), 3 transports (stdio / SSE / Streamable HTTP), 30 scopes |
+| A2A Server    | `src/lib/a2a/`          | JSON-RPC 2.0 agent protocol                                                                                                            |
+| Skills        | `src/lib/skills/`       | Extensible skill framework                                                                                                             |
+| Memory        | `src/lib/memory/`       | Persistent conversational memory                                                                                                       |
 
 Monorepo: `src/` (Next.js 16 app), `open-sse/` (streaming engine workspace), `electron/` (desktop app), `tests/`, `bin/` (CLI entry point).
 
@@ -72,7 +72,7 @@ Client → /v1/chat/completions (Next.js route)
 
 API routes follow a consistent pattern: `Route → CORS preflight → Zod body validation → Optional auth (extractApiKey/isValidApiKey) → API key policy enforcement → Handler delegation (open-sse)`. No global Next.js middleware — interception is route-specific.
 
-**Combo routing** (`open-sse/services/combo.ts`): 18 strategies (priority, weighted, fill-first, round-robin, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline). Each target calls `handleSingleModel()` which wraps `handleChatCore()` with per-target error handling and circuit breaker checks. The `fusion` strategy is the exception: it fans out to a panel of models in parallel, then a judge model synthesizes one final answer (`open-sse/services/fusion.ts`). See `docs/routing/AUTO-COMBO.md` for the 12-factor Auto-Combo scoring + the full strategy table and `docs/architecture/RESILIENCE_GUIDE.md` for the 3 resilience layers.
+**Combo routing** (`open-sse/services/combo.ts`): 15 strategies (priority, weighted, fill-first, round-robin, P2C, random, least-used, cost-optimized, reset-aware, reset-window, strict-random, auto, lkgp, context-optimized, context-relay). Each target calls `handleSingleModel()` which wraps `handleChatCore()` with per-target error handling and circuit breaker checks. See `docs/routing/AUTO-COMBO.md` for the 9-factor Auto-Combo scoring and `docs/architecture/RESILIENCE_GUIDE.md` for the 3 resilience layers.
 
 ---
 
@@ -221,7 +221,7 @@ connection continue serving other models.
 - **2 spaces**, semicolons, double quotes, 100 char width, es5 trailing commas (enforced by lint-staged via Prettier)
 - **Imports**: external → internal (`@/`, `@omniroute/open-sse`) → relative
 - **Naming**: files=camelCase/kebab, components=PascalCase, constants=UPPER_SNAKE
-- **ESLint**: `no-eval`, `no-implied-eval`, `no-new-func` = error everywhere; `no-explicit-any` = **error** in `open-sse/` and `tests/` (since #6218 — pre-existing violations are frozen in `config/quality/eslint-suppressions.json`, new ones must be fixed; `npm run lint` applies the suppressions and is what CI runs)
+- **ESLint**: `no-eval`, `no-implied-eval`, `no-new-func` = error everywhere; `no-explicit-any` = warn in `open-sse/` and `tests/`
 - **TypeScript**: `strict: false`, target ES2022, module esnext, resolution bundler. Prefer explicit types.
 
 ### Database
@@ -311,7 +311,7 @@ connection continue serving other models.
 4. Create 7 API endpoints under `src/app/api/services/{name}/` (`_lib.ts`, `install`, `start`, `stop`, `restart`, `update`, `status`, `auto-start`). All delegate errors through `createErrorResponse()`. The shared `logs` endpoint is already wired via `[name]/logs/route.ts`.
 5. Verify `/api/services/` is in `LOCAL_ONLY_API_PREFIXES` in `src/server/authz/routeGuard.ts`; add a test asserting `isLocalOnlyPath()` returns `true` for the new prefix if you add one (hard rule #17).
 6. Add a UI tab in `src/app/(dashboard)/dashboard/providers/services/tabs/` reusing `ServiceStatusCard`, `ServiceLifecycleButtons`, `ServiceLogsPanel`.
-7. Document in `docs/frameworks/EMBEDDED-SERVICES.md` (update §1 service table + §4 API reference) and `docs/openapi.yaml`.
+7. Document in `docs/frameworks/EMBEDDED-SERVICES.md` (update §1 service table + §4 API reference) and `docs/reference/openapi.yaml`.
 8. Write tests: unit (`tests/unit/services/`), integration (`tests/integration/services/`, gated by `RUN_SERVICES_INT=1`), and update `docs/ops/RELEASE_CHECKLIST.md` smoke section.
 
 ### Adding a New Guardrail / Eval / Skill / Webhook event
@@ -327,33 +327,33 @@ connection continue serving other models.
 
 For any non-trivial change, read the matching deep-dive first:
 
-| Area                                          | Doc                                                     |
-| --------------------------------------------- | ------------------------------------------------------- |
-| Repo navigation                               | `docs/architecture/REPOSITORY_MAP.md`                   |
-| Architecture                                  | `docs/architecture/ARCHITECTURE.md`                     |
-| Engineering reference                         | `docs/architecture/CODEBASE_DOCUMENTATION.md`           |
-| Auto-Combo (12-factor scoring, 18 strategies) | `docs/routing/AUTO-COMBO.md`                            |
-| Resilience (3 mechanisms)                     | `docs/architecture/RESILIENCE_GUIDE.md`                 |
-| Reasoning replay                              | `docs/routing/REASONING_REPLAY.md`                      |
-| Skills framework                              | `docs/frameworks/SKILLS.md`                             |
-| Memory system (FTS5 + Qdrant)                 | `docs/frameworks/MEMORY.md`                             |
-| Cloud agents                                  | `docs/frameworks/CLOUD_AGENT.md`                        |
-| Guardrails (PII / injection / vision)         | `docs/security/GUARDRAILS.md`                           |
-| Public upstream credentials (Gemini/etc.)     | `docs/security/PUBLIC_CREDS.md`                         |
-| Error message sanitization                    | `docs/security/ERROR_SANITIZATION.md`                   |
-| Evals                                         | `docs/frameworks/EVALS.md`                              |
-| Compliance / audit                            | `docs/security/COMPLIANCE.md`                           |
-| Webhooks                                      | `docs/frameworks/WEBHOOKS.md`                           |
-| Authorization pipeline                        | `docs/architecture/AUTHZ_GUIDE.md`                      |
-| Stealth (TLS / fingerprint)                   | `docs/security/STEALTH_GUIDE.md`                        |
-| Agent protocols (A2A / ACP / Cloud)           | `docs/frameworks/AGENT_PROTOCOLS_GUIDE.md`              |
-| MCP server                                    | `docs/frameworks/MCP-SERVER.md`                         |
-| A2A server                                    | `docs/frameworks/A2A-SERVER.md`                         |
-| API reference + OpenAPI                       | `docs/reference/API_REFERENCE.md` + `docs/openapi.yaml` |
-| Provider catalog (auto-generated)             | `docs/reference/PROVIDER_REFERENCE.md`                  |
-| Release flow                                  | `docs/ops/RELEASE_CHECKLIST.md`                         |
-| Embedded services                             | `docs/frameworks/EMBEDDED-SERVICES.md`                  |
-| Quality gates (~48 scripts, allowlist policy) | `docs/architecture/QUALITY_GATES.md`                    |
+| Area                                          | Doc                                                               |
+| --------------------------------------------- | ----------------------------------------------------------------- |
+| Repo navigation                               | `docs/architecture/REPOSITORY_MAP.md`                             |
+| Architecture                                  | `docs/architecture/ARCHITECTURE.md`                               |
+| Engineering reference                         | `docs/architecture/CODEBASE_DOCUMENTATION.md`                     |
+| Auto-Combo (9-factor scoring, 15 strategies)  | `docs/routing/AUTO-COMBO.md`                                      |
+| Resilience (3 mechanisms)                     | `docs/architecture/RESILIENCE_GUIDE.md`                           |
+| Reasoning replay                              | `docs/routing/REASONING_REPLAY.md`                                |
+| Skills framework                              | `docs/frameworks/SKILLS.md`                                       |
+| Memory system (FTS5 + Qdrant)                 | `docs/frameworks/MEMORY.md`                                       |
+| Cloud agents                                  | `docs/frameworks/CLOUD_AGENT.md`                                  |
+| Guardrails (PII / injection / vision)         | `docs/security/GUARDRAILS.md`                                     |
+| Public upstream credentials (Gemini/etc.)     | `docs/security/PUBLIC_CREDS.md`                                   |
+| Error message sanitization                    | `docs/security/ERROR_SANITIZATION.md`                             |
+| Evals                                         | `docs/frameworks/EVALS.md`                                        |
+| Compliance / audit                            | `docs/security/COMPLIANCE.md`                                     |
+| Webhooks                                      | `docs/frameworks/WEBHOOKS.md`                                     |
+| Authorization pipeline                        | `docs/architecture/AUTHZ_GUIDE.md`                                |
+| Stealth (TLS / fingerprint)                   | `docs/security/STEALTH_GUIDE.md`                                  |
+| Agent protocols (A2A / ACP / Cloud)           | `docs/frameworks/AGENT_PROTOCOLS_GUIDE.md`                        |
+| MCP server                                    | `docs/frameworks/MCP-SERVER.md`                                   |
+| A2A server                                    | `docs/frameworks/A2A-SERVER.md`                                   |
+| API reference + OpenAPI                       | `docs/reference/API_REFERENCE.md` + `docs/reference/openapi.yaml` |
+| Provider catalog (auto-generated)             | `docs/reference/PROVIDER_REFERENCE.md`                            |
+| Release flow                                  | `docs/ops/RELEASE_CHECKLIST.md`                                   |
+| Embedded services                             | `docs/frameworks/EMBEDDED-SERVICES.md`                            |
+| Quality gates (~48 scripts, allowlist policy) | `docs/architecture/QUALITY_GATES.md`                              |
 
 ---
 
@@ -388,31 +388,6 @@ Why this matters: fixing bug A while opening bug B is worse than not fixing at a
 
 ---
 
-## Planning & Research Artifacts (superpowers, deep-research)
-
-`_tasks/` is a **separate, isolated git repository** that is gitignored by the main
-repo (`.gitignore` → `_tasks/`). It is the canonical home for working artifacts —
-plans, specs/designs, research, hand-offs — so they stay **versioned in their own
-repo** instead of polluting the main OmniRoute tree.
-
-**Hard rule — never write superpowers / planning / research output under `docs/` or
-the repo root.** The superpowers skills ship with defaults that point at `docs/…`
-(`writing-plans` → `docs/superpowers/plans/`, `brainstorming` → `docs/superpowers/specs/`).
-Those defaults are **overridden here**. Whenever you invoke superpowers (or any
-plan/spec/research generator) in this project, save to `_tasks/` instead, using the
-same filename convention:
-
-| Artifact (skill)                   | Default (do NOT use)      | Save here instead                                             |
-| ---------------------------------- | ------------------------- | ------------------------------------------------------------- |
-| Plans (`writing-plans`)            | `docs/superpowers/plans/` | `_tasks/superpowers/plans/YYYY-MM-DD-<feature>.md`            |
-| Specs / design (`brainstorming`)   | `docs/superpowers/specs/` | `_tasks/superpowers/specs/YYYY-MM-DD-<topic>-design.md`       |
-| Research (`deep-research`, ad-hoc) | `docs/research/`          | `_tasks/research/…`                                           |
-| Hand-offs (`/handoff`)             | —                         | `_tasks/hands-off/<YYYY-MM-DD>_<branch>_v<versão>_sess-<id>/` |
-
-When a superpowers skill announces a path like "saved to `docs/superpowers/plans/…`",
-rewrite it to the `_tasks/…` equivalent before writing. Commit those artifacts inside
-the `_tasks/` repo (`git -C _tasks …`), never in the main repo.
-
 ## Git Workflow
 
 ```bash
@@ -428,10 +403,8 @@ git push -u origin feat/your-feature
 
 **Husky hooks**:
 
-- **pre-commit**: lint-staged + `check-docs-sync` + `check:any-budget:t11` + `check:tracked-artifacts`
-- **pre-push**: intentionally light (PATH/npm sanity only). `any-budget` + `tracked-artifacts`
-  already run on pre-commit; re-running them on every push was pure double-pay. CI still
-  enforces both. (Was Fase 6A.12 full pre-push gate; folded into pre-commit in #6716.)
+- **pre-commit**: lint-staged + `check-docs-sync` + `check:any-budget:t11`
+- **pre-push**: fast deterministic gates (`check:any-budget:t11` + `check:tracked-artifacts`); intentionally excludes `test:unit` (slow — covered by the CI `test-unit` job). Activated 2026-06-13 (Quality Gates Fase 6A.12).
 
 ### Worktree isolation (MANDATORY for every development task)
 
@@ -446,33 +419,25 @@ own dedicated branch, and you MUST confirm the base branch with the operator bef
    `AskUserQuestion`, unless they already told you) from which branch the new worktree/branch
    should be cut. Do NOT assume `main` or "whatever I'm on" — the answer is usually the active
    `release/vX.Y.Z`, but it can be another feature/release branch. Get the base explicitly.
-2. **Create an isolated worktree + branch off that base** (never reuse the main checkout).
-   **🔴 MANDATORY PATH: every worktree lives under `.claude/worktrees/` — and nowhere else.**
-   This is the single canonical location (the same dir the native `EnterWorktree` tool uses). It
-   is gitignored AND in the `tsconfig.json` / `.dockerignore` excludes, so worktrees never leak
-   into the build scope. **Never** use `.worktrees/`, repo-root, or any other path — a worktree
-   outside `.claude/worktrees/` (a) escapes the build-scope excludes and poisons `next build` (the
-   `tsconfig` `include: **/*` globs ~70× the codebase → OOM; incident 2026-06-25) and (b) scatters
-   worktrees across two dirs.
+2. **Create an isolated worktree + branch off that base** (never reuse the main checkout):
 
    ```bash
    BASE_BRANCH="release/vX.Y.Z"          # ← the branch the operator confirmed in step 1
    TASK="feat/your-feature"               # feat/ fix/ refactor/ docs/ test/ chore/
    git fetch origin "$BASE_BRANCH"
-   git worktree add ".claude/worktrees/${TASK##*/}" -b "$TASK" "origin/$BASE_BRANCH"
-   cd ".claude/worktrees/${TASK##*/}"
+   git worktree add ".worktrees/${TASK##*/}" -b "$TASK" "origin/$BASE_BRANCH"
+   cd ".worktrees/${TASK##*/}"
    # symlink node_modules from the main checkout to skip a per-worktree npm install:
    ln -s "$(git -C <main_checkout> rev-parse --show-toplevel)/node_modules" node_modules
    ```
 
-   In Claude Code prefer the native `EnterWorktree` tool (it already creates worktrees under
-   `.claude/worktrees/`): create the worktree with the command above, then call `EnterWorktree`
-   with its `path`.
+   In Claude Code prefer the native `EnterWorktree` tool (create the worktree with the command
+   above, then call `EnterWorktree` with its `path`).
 
 3. **Work, commit, push, open the PR — all from inside the worktree.** Never `git checkout` a
    different branch inside a worktree another session might share.
 4. **Tear down only your own** worktree + branch when done, from the main checkout:
-   `git worktree remove .claude/worktrees/<dir>` then `git branch -D <task>`. Never blanket-delete
+   `git worktree remove .worktrees/<dir>` then `git branch -D <task>`. Never blanket-delete
    `fix/*`/`feat/*` — other sessions keep their own; delete only the branches you created, by name.
 5. **Never touch another session's worktree, branch, or uncommitted changes.** If `git worktree
 list` shows worktrees you didn't create, leave them alone. End every session with the main
@@ -482,8 +447,7 @@ list` shows worktrees you didn't create, leave them alone. End every session wit
 
 ## Environment
 
-- **Runtime**: Node.js ≥22.0.0 <23 || ≥24.0.0 <27, ES Modules. This is the **only supported** runtime for the published `omniroute` CLI, the server, and the test suites (`node:test` + vitest) — `engines.node` is authoritative and end users never need Bun. A **best-effort `bun:sqlite` compatibility path** exists so a global Bun install (`bun install -g omniroute`) can start without `better-sqlite3` (driver adapter + Bun-aware process spawning); it is **not** a supported runtime — no support guarantees — and every Bun-specific runtime change MUST preserve the Node driver/fallback chain and ship a Bun test (`test:bun:db`) or an explicit reason why the path is Node-only.
-- **Bun (build/dev script runner + compatibility smoke only)**: Bun `1.3.14` is pinned as an **exact devDependency** (provisioned through the existing `npm ci` via the lockfile's `@oven/bun-*` platform binaries — no `setup-bun`/ad-hoc install). It is used **only** to execute a small, allow-listed set of TypeScript **gate/generator scripts** (replacing `node --import tsx` for startup speed): the CI checks `check:provider-consistency`, `check:compression-budget`, `check:known-symbols`, and the non-CI `gen:provider-reference`, `bench:compression` — plus the focused `test:bun:db` compatibility smoke suite for the best-effort `bun:sqlite` path. **Do NOT** widen Bun to `npm install`, the build (`build:cli*`), `check:pack-artifact`, the supported published runtime, or the main test runners — those stay on Node. Any new Bun-invoking gate/generator script must be validated byte-identical against its `node --import tsx` output first. After pulling the lockfile change, run `npm install` so `bun` resolves locally (a stale `node_modules` will fail those scripts with `bun: not found`).
+- **Runtime**: Node.js ≥22.0.0 <23 || ≥24.0.0 <27, ES Modules
 - **TypeScript**: 6.0+, target ES2022, module esnext, resolution bundler
 - **Path aliases**: `@/*` → `src/`, `@omniroute/open-sse` → `open-sse/`, `@omniroute/open-sse/*` → `open-sse/*`
 - **Default port**: 20128 (API + dashboard on same port)
@@ -541,11 +505,6 @@ the stale-enforcement added in Fase 6A.3.
 17. Never expose routes under `/api/services/` or `/dashboard/providers/services/*/embed/` without `isLocalOnlyPath()` classification in `src/server/authz/routeGuard.ts`. These routes can spawn child processes (`npm install`, `node`). Loopback enforcement happens unconditionally before any auth check — a leaked JWT via tunnel cannot trigger process spawning. See `docs/security/ROUTE_GUARD_TIERS.md`.
 18. Every bug fix must be validated before shipping: a failing-then-passing unit/integration test (TDD) OR a documented live test on the production VPS (192.168.0.15). A fix without either is not merged. See Testing → "Bug fix / issue triage protocol" for the full decision tree.
 19. Never develop on the shared main checkout. Every development task runs in its own git worktree on its own dedicated branch, and you MUST confirm the base branch with the operator (e.g. via `AskUserQuestion`) before creating the worktree/branch — never assume `main` or the currently checked-out branch. A `git checkout` in the shared checkout silently destroys other sessions' uncommitted work. Tear down only the worktrees/branches you created (by name, never `fix/*`/`feat/*` wildcards), leave other sessions' worktrees untouched, and end on the branch you started on (the active `release/vX.Y.Z`, never `main`). See Git Workflow → "Worktree isolation".
-20. PII redaction/sanitization is **opt-in — never on by default**. OmniRoute proxies for self-hosted/local LLMs where the operator owns the data, so mutating request/response payloads by default would silently corrupt legitimate traffic. The two data-mutating PII feature flags **MUST** keep `defaultValue: "false"` in `src/shared/constants/featureFlagDefinitions.ts`: `PII_REDACTION_ENABLED` (request-side) and `PII_RESPONSE_SANITIZATION` (response + streaming). All three application points — `src/lib/guardrails/piiMasker.ts` (request guardrail), `src/lib/piiSanitizer.ts` (response), `src/lib/streamingPiiTransform.ts` (SSE) — are gated on these flags; with both off the `pii-masker` guardrail still runs but never mutates payloads (data passes through untouched). Flipping either default to `"true"` requires explicit operator approval. The regression guard is `tests/unit/pii-opt-in-default.test.ts` (asserts both definition defaults + behavioral pass-through). Opt-in is per-operator via env or the settings/DB override (`src/lib/db/featureFlags.ts`), never a silent default. See `docs/security/GUARDRAILS.md`.
-21. **Release-freeze — the FROZEN release branch belongs to the release captain; development does NOT stop (parallel-cycle model, 2026-07-04).** `/generate-release` opens a marker issue labeled `release-freeze` at the start of reconciliation (Phase 0a), **immediately cuts the next cycle's branch `release/vX+1` from the frozen tip (Phase 0a.0b — bump + living release PR + re-home of open PRs)**, and closes the freeze once the release PR squash-merges to `main`. Before merging **any** PR, every campaign workflow (`/review-prs`, `/review-group-prs`, `/merge-prs`, `/triage-fix-bugs`, `/implement-fix-bugs`, `/triage-features`, `/implement-features`, `/green-prs`, `/port-upstream-*`) **MUST** check `gh issue list --repo diegosouzapw/OmniRoute --label release-freeze --state open` — if a freeze is active: **NEVER merge into the frozen `release/vX.Y.Z` named in the freeze title**; instead resolve the ACTIVE development branch (the **highest** `release/v*` by semver — normally `release/vX+1`, announced in a freeze-issue comment) and **retarget the PR there** (`gh pr edit <N> --base release/vX+1`, then VERIFY with `gh pr view <N> --json baseRefName` — the edit fails silently) and merge normally. **HOLD only when the highest release/v\* branch IS the frozen one** (the short window before 0a.0b completes, or a pre-parallel-cycle release) — in that case leave the PR ready and open, tell the operator, and resume when the next branch appears or the freeze lifts. The just-shipped fixes reach `release/vX+1` via the Phase 5 sync-back (`scripts/release/sync-next-cycle.mjs`); do not try to sync mid-release. This is a **coordination signal, not a permission lock**: the release captain and the campaign sessions share the `diegosouzapw` identity, so a GitHub branch-protection lock cannot distinguish them — only this honored marker prevents the mid-release commit races that forced full CHANGELOG re-reconciliation in v3.8.40/v3.8.41 (a parallel campaign advanced `release/vX.Y.Z` by 34 commits mid-run). The release captain's own reconciliation/cycle-open pushes are exempt — they _are_ the release. Fixes that must land during a freeze (a homologation finding) follow the post-merge read-only rule: land on `main` first via `fix/release-vX.Y.Z-*`. **⛔ ONLY `/generate-release` may raise a release-freeze, and ONLY at its Phase 0a (start of generating a new version) — lifted at Phase 12c after the squash-merge to `main`.** No campaign, session, or agent may open a `release-freeze` marker at any other time — a freeze is **never** a mid-development coordination tool. If a session ever believes a freeze is genuinely, unavoidably necessary outside the `/generate-release` flow, it **MUST first ask the operator (`diegosouzapw`) in chat, explicitly alert "estou criando um freeze" and get an explicit yes** — never open, extend, or re-open a `release-freeze` autonomously. Conversely, do **not** close/lift an active `/generate-release` freeze to unblock campaign merges: it protects the captain's single clean CI run and auto-lifts at Phase 12c — closing it early re-triggers the exact commit race it prevents. Verify a freeze is legitimate before acting on it: an open `release-freeze` whose title/body references an **OPEN** release PR (`gh pr view <N> --json state`) is the authorized captain freeze — hold, don't touch.
-22. **Cross-session safety — this repo is worked by MANY parallel sessions/agents at once; never step on another's in-flight work.** Two absolute bans, both recurring incidents (this rule exists because they keep happening):
-    - **(a) Never `git stash` / `git stash pop` — ANYWHERE in this repo, including inside an isolated worktree, and including inside any subagent you dispatch.** `git stash` operates on the **shared repository object store**, not the per-worktree working tree — so a stash pushed or popped in one session can silently clobber or resurrect another parallel session's uncommitted changes. This is not hypothetical: 2026-07-02 a `#5923` quotaCache change leaked into the unrelated `#2296` worktree via a global `stash pop`, and the same class reincided through a **subagent**. To compare working changes against a base ref **without** stashing, use `git show <ref>:<path>` or `git diff <ref> -- <path>`; to confirm a typecheck/lint error is pre-existing on the base, inspect the base ref directly (`git show origin/release/vX.Y.Z:<path>`) — never stash your tree away to "get it clean". **Put this ban verbatim in the prompt of every subagent that touches git** (agents don't inherit this file's context — the recurrence was a subagent).
-    - **(b) Never merge, push, rebase, or force-push a PR / branch / worktree that another session is actively working.** An open PR whose head is a live fix worktree in `.claude/worktrees/` you did **not** create (e.g. `fix-5852`/`fix-5923` carrying fresh commits, even when they share your `diegosouzapw` identity), or any branch another session owns, is **off-limits — HOLD**, and let the owning session merge it. **Before** merging or pushing to any PR you did not create _this_ session, run `git worktree list` to check for a matching in-flight worktree and re-check `gh pr view <N> --json state,headRefOid`. Only the owning session merges its own in-flight PR; mid-flight merges race the owner and re-trigger the exact commit/CHANGELOG races Rule #19 and Rule #21 guard against. (Reinforces Rule #19.)
 
 ---
 

CONTRIBUTING.md

@@ -103,19 +103,13 @@ Default URLs:
 ## Git Workflow
 
 > ⚠️ **NEVER commit directly to `main`.** Always use feature branches.
->
-> **PR base:** target the active `release/vX.Y.Z` branch (not `main`). See
-> [`docs/ops/BRANCHING_MODEL.md`](docs/ops/BRANCHING_MODEL.md) for the
-> release-per-branch + tag-at-ship model.
 
 ```bash
-# Branch from the active release tip (example: release/v3.8.49)
-git fetch origin
-git checkout -b feat/your-feature-name origin/release/v3.8.49
+git checkout -b feat/your-feature-name
 # ... make changes ...
 git commit -m "feat: describe your change"
 git push -u origin feat/your-feature-name
-# Open a Pull Request with base = release/v3.8.49
+# Open a Pull Request on GitHub
 ```
 
 ### Branch Naming
@@ -166,31 +160,19 @@ npm run test:protocols:e2e
 # Ecosystem compatibility tests
 npm run test:ecosystem
 
-# Coverage gate: 60% statements/lines/functions/branches
+# Coverage gate: 75% statements/lines/functions, 70% branches
 npm run test:coverage
 npm run coverage:report
 
 # Lint + format check
 npm run lint
 npm run check
-
-# Gated real-upstream combo smoke (requires VPS access + real provider credits)
-# Hits REAL providers — costs a little. NEVER runs in CI. Skips cleanly without the gate.
-# Needs: ssh root@192.168.0.15 access (sources a read-only DB snapshot from the VPS).
-RUN_COMBO_LIVE=1 npm run test:combo:live
-
-# Phase-3 VPS live smoke — plain Node ESM scripts, hit the live .15 server directly.
-# Requires: ssh root@192.168.0.15 access (combos created/torn down via SSH sqlite).
-# Hits REAL providers (small cost). Creates/deletes only __live_test__* combos. NEVER runs in CI.
-# REQUIRE_API_KEY=false on .15 so no API key needed, but honors COMBO_LIVE_BASE_URL / COMBO_LIVE_API_KEY if set.
-npm run test:combo:live:vps              # 7 HTTP scenarios (priority/round-robin/weighted/cost/fusion/auto + health)
-npm run test:combo:live:vps:failover     # adds a real cross-provider failover scenario (8 total)
 ```
 
 Coverage notes:
 
 - `npm run test:coverage` measures source coverage for the main unit test suite, excludes `tests/**`, and includes `open-sse/**`
-- Pull requests must keep the coverage gate at **60%+** statements/lines/functions/branches
+- Pull requests must keep the coverage gate at **75%+** statements/lines/functions and **70%+** branches
 - If a PR changes production code in `src/`, `open-sse/`, `electron/`, or `bin/`, it must add or update automated tests in the same PR
 - `npm run coverage:report` prints the detailed file-by-file report from the latest coverage run
 - `npm run test:coverage:legacy` preserves the older metric for historical comparison
@@ -202,7 +184,7 @@ Before opening or merging a PR:
 
 - Run `npm run test:unit`
 - Run `npm run test:coverage`
-- Ensure the coverage gate stays at **60%+** statements/lines/functions/branches
+- Ensure the coverage gate stays at **75%+** statements/lines/functions, **70%+** branches
 - Include the changed or added test files in the PR description when production code changed
 - Check the SonarQube result on the PR when the project secrets are configured in CI
 
@@ -347,7 +329,7 @@ Write unit tests in `tests/unit/` covering at minimum:
 - [ ] Error responses route through `buildErrorBody()` / `sanitizeErrorMessage()` — no raw stack traces in response bodies (see [`docs/security/ERROR_SANITIZATION.md`](./docs/security/ERROR_SANITIZATION.md))
 - [ ] Shell commands (`exec` / `spawn`) pass runtime values via `env`, not via string interpolation
 - [ ] All inputs validated with Zod schemas
-- [ ] Changelog **fragment** added under `changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md` for user-facing changes (see [`changelog.d/README.md`](./changelog.d/README.md)) — do **not** edit `CHANGELOG.md` directly; fragments are aggregated at release time and never conflict between PRs
+- [ ] CHANGELOG updated (if user-facing change)
 - [ ] Documentation updated (if applicable)
 - [ ] No new CodeQL / Secret-Scanning alerts opened, or each one dismissed with technical justification referencing the relevant `docs/security/` doc
 - [ ] Routes that spawn child processes (`/api/mcp/`, `/api/cli-tools/runtime/`) classified as `isLocalOnlyPath()` in `src/server/authz/routeGuard.ts` — see [Hard Rule #15](docs/security/ROUTE_GUARD_TIERS.md)

DESING.md

@@ -0,0 +1,254 @@
+# OmniRoute — Design System & Visual Identity
+
+> **Status:** analysis + standardization plan (no code applied yet — this doc is the spec to approve before implementation).
+> **Date:** 2026-06-16 · **Scope:** unify the OmniRoute dashboard (`src/`) with the marketing site (`_mono_repo/omnirouteSite/`) into **one visual identity** — same graph-paper grid background, same color tokens, standardized components.
+
+---
+
+## 1. Purpose
+
+The marketing site (`viral.omniroute.online`, `why.omniroute.online`, `omniroute.online`) and the product dashboard should look like **one product**. The site already borrowed its palette from the dashboard — its `css/tokens.css` even says _"Palette mirrors the OmniRoute dashboard (src/app/globals.css)"_. So the two are already ~80% aligned at the color level. What's missing on the dashboard:
+
+1. The **graph-paper grid wallpaper** the site uses on every page.
+2. A handful of **shared design tokens** the site has but the dashboard lacks (radius scale, brand gradient, `surface-2`, mono font).
+3. **Component-level consistency** — a number of dashboard components bypass the theme tokens with hardcoded hex/rgba.
+
+This document is the analysis and the plan. **Nothing is changed until approved.**
+
+---
+
+## 2. Principles
+
+- **Single source of truth = `src/app/globals.css`.** The site mirrors the dashboard, never the other way around. New tokens land in `globals.css` first.
+- **Tokens, never literals.** Components consume semantic tokens (`bg-surface`, `text-primary`, `border-border`), never raw `#hex`.
+- **Subtle, not loud.** The grid is a faint wallpaper that sits behind content — it must never reduce text contrast or fight the UI.
+- **Theme-aware.** Everything works in both `.dark` (default-ish, the product's signature look) and light.
+- **Surgical rollout.** Ship the grid + tokens first (low risk, high visibility), then component cleanups in waves.
+
+---
+
+## 3. Current state — what's already aligned vs. what's not
+
+### 3.1 Colors — already unified ✅
+
+Every brand color and surface already matches the site **by value** (only the names differ — dashboard prefixes with `--color-`). Verified in `src/app/globals.css:30-128`:
+
+| Concept                    | Site token (`tokens.css`)                   | Dashboard token (`globals.css`) | Match        |
+| -------------------------- | ------------------------------------------- | ------------------------------- | ------------ |
+| primary                    | `--primary #e54d5e`                         | `--color-primary #e54d5e`       | ✅           |
+| primary-hover              | `--primary-hover #c93d4e`                   | `--color-primary-hover #c93d4e` | ✅           |
+| accent                     | `--accent #6366f1`                          | `--color-accent #6366f1`        | ✅           |
+| accent-2                   | `--accent-2 #8b5cf6`                        | `--color-accent-hover #8b5cf6`  | ✅ (renamed) |
+| accent-3                   | `--accent-3 #a855f7`                        | `--color-accent-light #a855f7`  | ✅ (renamed) |
+| success / warning / error  | `#22c55e / #f59e0b / #ef4444`               | identical                       | ✅           |
+| traffic lights             | `#ff5f56 / #ffbd2e / #27c93f`               | identical                       | ✅           |
+| dark bg / surface / border | `#0b0e14 / #161b22 / rgba(255,255,255,.08)` | identical                       | ✅           |
+| light bg / surface / text  | `#f9f9fb / #fff / #1a1a2e`                  | identical                       | ✅           |
+
+**Conclusion:** there is no color migration to do. The identity is already shared; we are _finishing_ it, not rebuilding it.
+
+### 3.2 Gaps — what the dashboard is missing
+
+| Gap                     | Site has                                                                       | Dashboard                                                  | Action                 |
+| ----------------------- | ------------------------------------------------------------------------------ | ---------------------------------------------------------- | ---------------------- |
+| **Grid wallpaper**      | `body::before` graph-paper, `--grid-line`, `--grid-size 46px`, `--section-alt` | none (flat `--color-bg`)                                   | **Part A**             |
+| **Radius scale**        | `--radius 14px`, `--radius-sm 9px`                                             | none — primitives use ad-hoc `rounded-md/lg/xl` (6/8/12px) | **Part B**             |
+| **Brand gradient**      | `--grad-brand 135deg primary→accent-3`                                         | none — only a one-off `.bg-hero-gradient`                  | **Part B**             |
+| **Nested surface**      | `--surface-2 #1c2230`                                                          | none                                                       | **Part B**             |
+| **Mono font**           | `--font-mono` (ui-monospace stack)                                             | none (code/terminal areas have no token)                   | **Part B**             |
+| **`text-muted` (dark)** | `#8b8b9e`                                                                      | `#a1a1aa` (zinc-400)                                       | reconcile — **Part B** |
+
+### 3.3 Theming mechanics (so we don't break anything)
+
+- **Tailwind v4, CSS-first** (no `tailwind.config.*`). Tokens are defined in `:root`/`.dark` and exposed to utilities via `@theme inline` (`globals.css:130-179`).
+- **Dark via `.dark` class** on `<html>` (`@custom-variant dark` at `globals.css:22`), toggled by a custom Zustand store (`src/store/themeStore.ts`), default theme = `system` (`src/shared/constants/appConfig.ts:11`). The site uses `html[data-theme="light"]` instead — **the mechanisms differ but never meet** (separate origins), so no conflict. We keep the dashboard's `.dark` mechanism.
+- **Runtime primary override** exists (`themeStore.ts:85-97`, presets in `COLOR_THEMES`) — users can swap `--color-primary`. Any new token (gradient, etc.) that references `--color-primary` will inherit those overrides for free. ✅
+
+---
+
+## 4. Part A — The graph-paper grid background (headline ask)
+
+### 4.1 What it is
+
+The exact recipe from the site (`_mono_repo/omnirouteSite/css/base.css`): a **fixed, full-viewport pseudo-element** painting two 1px line gradients, sitting at `z-index:-1` behind all content.
+
+```css
+body::before {
+  content: "";
+  position: fixed;
+  inset: 0;
+  z-index: -1;
+  pointer-events: none;
+  background-image:
+    linear-gradient(to right, var(--grid-line) 1px, transparent 1px),
+    linear-gradient(to bottom, var(--grid-line) 1px, transparent 1px);
+  background-size: var(--grid-size) var(--grid-size);
+}
+```
+
+**Why this works even though `body` has an opaque `background-color`:** a `::before` with `z-index:-1` paints _above_ the element's own background but _below_ its in-flow content. So `--color-bg` is the base fill, the grid is layered on top of it, and the app renders above the grid.
+
+### 4.2 Precedent already in the codebase
+
+`src/app/landing/page.tsx:16-26` **already implements this same grid per-page** — but with **red** lines (`#E54D5E`, opacity `0.06`) at **50px**, plus animated orbs. So the pattern is proven in the product; we are promoting it to a **global, theme-aware** wallpaper and (optionally) retiring the duplicate.
+
+### 4.3 Tokens to add (in `globals.css`)
+
+```css
+:root {
+  /* light */
+  --grid-line: rgba(0, 0, 0, 0.045);
+  --grid-size: 46px;
+  --section-alt: rgba(0, 0, 0, 0.022);
+}
+.dark {
+  /* dark */
+  --grid-line: rgba(255, 255, 255, 0.035);
+  --section-alt: rgba(255, 255, 255, 0.018);
+}
+```
+
+### 4.4 The single blocker
+
+The grid is global by construction (it covers the panel, `auth`/`login`, error pages — every route — at once). Exactly **one** element hides it inside the panel:
+
+- `src/shared/components/layouts/DashboardLayout.tsx:62` — the outer wrapper paints an opaque `bg-bg`:
+
+  ```jsx
+  <div className="flex h-dvh min-h-0 w-full overflow-hidden bg-bg">
+  ```
+
+  Everything below it is already transparent — `<main>` (`:93`), the scroll container (`:102`), the `max-w-7xl` inner (`:103`). So **removing `bg-bg` from this one line** lets the body grid show through the entire content area (the body's `--color-bg` remains the base fill underneath the grid).
+
+  ```diff
+  - <div className="flex h-dvh min-h-0 w-full overflow-hidden bg-bg">
+  + <div className="flex h-dvh min-h-0 w-full overflow-hidden">
+  ```
+
+### 4.5 Chrome interaction (sidebar / header)
+
+- `Header` (`src/shared/components/Header.tsx:207`, `bg-bg`) and `Sidebar` (`src/shared/components/Sidebar.tsx:430`, `bg-sidebar`) stay **opaque** → the grid shows in the **content area only**, with solid chrome framing it. This is the recommended, calm default and matches how the site separates chrome from canvas.
+- _Optional vibrancy variant:_ make the header translucent (`bg-bg/80 backdrop-blur`) so the grid runs behind it. A `.bg-vibrancy` helper already exists (`globals.css:370`). **Decision D3 below.**
+
+### 4.6 Login / auth / error pages
+
+These render directly under `<body>` (no panel chrome) and their page wrappers are mostly transparent — the global grid appears behind them automatically. One exception: `src/app/login/page.tsx:124,139` uses opaque `bg-bg` wrappers; soften the same way if we want the grid there too (minor, **D4**).
+
+### 4.7 Landing page
+
+`landing/page.tsx` keeps its richer animated background (orbs + vignette). Options: (a) leave it as-is (its own splash identity), or (b) align its grid to the global tokens (46px, neutral lines) for consistency. **Recommend (a)** — it's a marketing splash, not a panel screen. **Decision D5.**
+
+---
+
+## 5. Part B — Token unification
+
+Add to `globals.css` (`:root` + `@theme inline`) so the dashboard gains the site's missing tokens. None of these change existing colors; they add the _missing_ primitives.
+
+```css
+:root {
+  --surface-2: #f5f5fa; /* light: nested panels */
+  --radius: 14px;
+  --radius-sm: 9px;
+  --grad-brand: linear-gradient(135deg, var(--color-primary), var(--color-accent-light));
+  --font-mono: ui-monospace, "JetBrains Mono", "Fira Code", "SF Mono", monospace;
+}
+.dark {
+  --surface-2: #1c2230;
+}
+
+@theme inline {
+  --color-surface-2: var(--surface-2); /* enables bg-surface-2 */
+  --radius-lg: var(--radius); /* enables rounded-lg = 14px */
+  --radius-md: var(--radius-sm); /* enables rounded-md = 9px */
+  --font-mono: var(--font-mono); /* enables font-mono */
+}
+```
+
+| Token                      | Why                                                             | Consumers                                                   |
+| -------------------------- | --------------------------------------------------------------- | ----------------------------------------------------------- |
+| `--radius` / `--radius-sm` | One radius scale (14/9) instead of 6/8/12 ad-hoc                | Button, Card, Modal, Input, Select                          |
+| `--grad-brand`             | Brand gradient for primary CTAs (red→violet), matching the site | Button `primary`, hero/CTA surfaces                         |
+| `--surface-2`              | Nested panels / table headers / inset rows                      | Card.Section, DataTable header, inputs                      |
+| `--font-mono`              | Code blocks, terminal, IDs, endpoints                           | ConsoleLogViewer, code snippets, `localhost:20128/v1` chips |
+| `--text-muted` reconcile   | Pick one value site↔panel                                       | global                                                      |
+
+**Decision D2 (text-muted):** site `#8b8b9e` vs dashboard `#a1a1aa`. Recommend keeping the **dashboard's `#a1a1aa`** (it's the live product, slightly higher contrast) and updating the _site_ to match. Low priority, cosmetic.
+
+---
+
+## 6. Part C — Component standardization
+
+The component layer is **custom** (no shadcn/Radix), Tailwind v4, semantic tokens **mostly** adopted (`bg-surface`, `border-white/10`, `ring-primary`) — good adoption (195 files import the shared barrel). The work is removing the **bypasses**. Home: `src/shared/components/`.
+
+Ranked by impact × reach:
+
+| #   | Item                                       | File(s)                                                                                                                                                                                       | Problem → Target                                                                                                                                                                                                                                 |
+| --- | ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| C1  | **Radius alignment**                       | `Button.tsx:14-18`, `Card.tsx:39`, `Modal.tsx`, `Input.tsx`, `Select.tsx`                                                                                                                     | mixed 6/8/12px → repoint to `--radius`/`--radius-sm` (14/9)                                                                                                                                                                                      |
+| C2  | **Button gradient + `accent` variant**     | `Button.tsx:5-12`                                                                                                                                                                             | primary is flat red→red (`from-primary to-primary-hover`); align to `--grad-brand` (red→violet) and add the missing `accent` variant (indigo `#6366f1` is unused by buttons) — **highest visibility, ~195 importers**. **Decision D1.**          |
+| C3  | **Tables**                                 | `DataTable.tsx:122-176`, `logTableStyles.ts`, `globals.css:405-414` (Ant remnants)                                                                                                            | `DataTable` is 100% inline hardcoded rgba + references non-existent vars (`--text-secondary`, `--bg-table-header`); migrate to tokens, retire the 2 divergent table styles. Tables are everywhere (providers/connections/logs) — worst offender. |
+| C4  | **Centralize status colors**               | `flow/edgeStyles.ts:7-12`, `TokenHealthBadge.tsx:14-19`, `DegradationBadge.tsx`, `ProviderCascadeNode.tsx`, `Badge.tsx`, +5 `statusColor` helpers                                             | 6+ copies of the same `#22c55e/#f59e0b/#ef4444` hex; create one `statusColors` module driven off `--color-success/warning/error`. Critical for circuit-breaker / cooldown / lockout badges to read consistently.                                 |
+| C5  | **Card border**                            | `Card.tsx:39`                                                                                                                                                                                 | uses `border-white/5`; brand border is `/8` → align                                                                                                                                                                                              |
+| C6  | **Focus ring reconcile**                   | `globals.css:183` vs component `ring-primary/30`                                                                                                                                              | global `:focus-visible` is indigo (`--color-accent`), components are red (`ring-primary`) — pick one (recommend **accent/indigo** globally, it reads as the "interactive" color)                                                                 |
+| C7  | **Add `Checkbox` + `Textarea` primitives** | currently raw `<input>`/`<textarea>` with inline `accentColor:#6366f1` (e.g. `ColumnToggle.tsx:91`)                                                                                           | create token-driven primitives                                                                                                                                                                                                                   |
+| C8  | **Hardcoded-hex sweep**                    | `ConsoleLogViewer.tsx:240` (`#161b22`/`#30363d`), `ComboLiveStudio.tsx:306` (`#6366f120`), Modal traffic dots `Modal.tsx:149-159`, ~14 chart/component files with literal `#6366f1`/`#a855f7` | replace literals with `bg-surface`/`border-border`/`text-accent` etc.                                                                                                                                                                            |
+| C9  | **`cn()` → clsx + tailwind-merge**         | `src/shared/utils/cn.ts`                                                                                                                                                                      | current `cn` just joins; conflicting classes stack (a `className="rounded-2xl"` override won't replace a primitive's `rounded-lg`). Needed for C1 overrides to behave.                                                                           |
+
+**Already on-brand (token-driven, only need radius):** `Badge`, `Toggle`, `SegmentedControl`, `Input`, `Select`.
+
+---
+
+## 7. Rollout plan (phased, each phase shippable + testable)
+
+- **Phase 1 — Grid + tokens (low risk, high visibility).**
+  1. Add grid + identity tokens to `globals.css` (Part A §4.3, Part B §5).
+  2. Add `body::before` grid.
+  3. Remove `bg-bg` from `DashboardLayout.tsx:62`.
+  4. Verify across themes + key screens (dashboard, providers, logs, login, an error page). Confirm contrast unchanged.
+     → _Delivers the headline ask. Reversible in one commit._
+
+- **Phase 2 — Primitives radius + Button (C1, C2, C5, C9).** The visible "feel" pass. `cn()` upgrade first so overrides behave.
+
+- **Phase 3 — Tables + status colors (C3, C4).** The largest consistency win; touch the data-heavy screens.
+
+- **Phase 4 — Cleanup (C6, C7, C8).** Focus ring, new primitives, hardcoded-hex sweep.
+
+Each phase: `npm run lint` + `npm run typecheck:core` + a visual pass. Per repo rule, production-code changes ship with tests where applicable (token/CSS changes are visual — validated by screenshots; component API changes get unit coverage).
+
+---
+
+## 8. Open decisions (need your call before/while implementing)
+
+- **D1 — Button primary look.** Keep the current **red→red** gradient, or switch the product's primary buttons to the **red→violet `--grad-brand`** (matches the site CTAs)? _(Affects every primary button.)_ Recommend: **red→violet**, with `--grad-brand`.
+- **D2 — Grid line color.** **Neutral** lines (site style: faint white/black, `rgba(255,255,255,0.035)`) — calm, content-first — **or** the landing's **brand-red** lines? Recommend: **neutral** (matches the site's interior pages; red is louder and can tint readability). Size **46px** (site) to retire the landing's 50px drift.
+- **D3 — Chrome vibrancy.** Sidebar/header stay **solid** (grid in content area only), or go **translucent** so the grid runs behind them? Recommend: **solid** (calmer; less risk).
+- **D4 — Auth/login grid.** Soften `login/page.tsx` wrappers so the grid shows there too? Recommend: **yes** (cheap, more cohesive).
+- **D5 — Landing page.** Leave its animated splash bg as-is, or align it to the global grid? Recommend: **leave as-is**.
+- **D6 — Radius value.** Adopt **14/9** everywhere (bigger, softer, site-matching) — confirm you want this product-wide shift. Recommend: **yes**, it's the single biggest "one identity" signal.
+- **D7 — Scope of first PR.** Ship **Phase 1 only** first (grid + tokens), then iterate? Recommend: **yes** — validate the wallpaper live before the component waves.
+
+---
+
+## 9. Out of scope / risks
+
+- **No palette change** — colors already match; we only add missing tokens. Zero risk of recoloring the product.
+- **No theme-engine change** — keep `.dark` + Zustand store; don't migrate to `next-themes` or to the site's `data-theme`.
+- **Radius shift is broad** (D6) — it touches every card/button/input; that's the point, but it's the one change worth eyeballing on busy screens (tables, modals) before merge.
+- **Tables (C3)** carry the most hardcoded styling and the highest regression surface — isolate in its own PR with before/after screenshots.
+- **Worktree isolation (repo hard-rule #19):** implementation runs in a dedicated worktree on a branch cut from the confirmed base (likely `release/v3.8.28`), never on the shared checkout. This doc is the only artifact written to the working tree so far.
+
+---
+
+## 10. Reference index
+
+| Area                       | Path                                                                                                                                     |
+| -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
+| Dashboard tokens           | `src/app/globals.css:30-179` (`:root`, `.dark`, `@theme inline`), `body` `:206`                                                          |
+| Theme store                | `src/store/themeStore.ts`, `src/shared/components/ThemeProvider.tsx`, `src/shared/constants/appConfig.ts:9-11`                           |
+| Panel shell (grid blocker) | `src/shared/components/layouts/DashboardLayout.tsx:62`                                                                                   |
+| Chrome                     | `src/shared/components/Header.tsx:207`, `src/shared/components/Sidebar.tsx:430`                                                          |
+| Grid precedent             | `src/app/landing/page.tsx:16-26`                                                                                                         |
+| Primitives                 | `src/shared/components/{Button,Card,Input,Select,Badge,Modal,Toggle,SegmentedControl,Loading,Tooltip,DataTable}.tsx`, barrel `index.tsx` |
+| Status-color sources       | `flow/edgeStyles.ts`, `TokenHealthBadge.tsx`, `DegradationBadge.tsx`, `logTableStyles.ts`                                                |
+| `cn` util                  | `src/shared/utils/cn.ts`                                                                                                                 |
+| Site reference             | `_mono_repo/omnirouteSite/css/tokens.css`, `css/base.css` (grid `body::before`)                                                          |

Dockerfile

@@ -2,46 +2,24 @@
 FROM node:24-trixie-slim AS base
 WORKDIR /app
 
-# `apt-get upgrade` pulls the security-patched versions of the Debian (trixie)
-# base-image packages at build time — clears the subset of container-scan CVEs
-# (perl / util-linux / systemd / ncurses / zlib / tar / sqlite / shadow / pam …)
-# that already have a fix published in trixie. CVEs without an upstream fix yet
-# (local-only TOCTOU, etc.) remain until the distro patches them and the image
-# is rebuilt; none are reachable from the proxy's request surface at runtime.
-RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=shared \
-  --mount=type=cache,id=apt-lists,target=/var/lib/apt/lists,sharing=shared \
+RUN --mount=type=cache,target=/var/cache/apt,sharing=shared \
+  --mount=type=cache,target=/var/lib/apt/lists,sharing=shared \
   apt-get update \
-  && apt-get upgrade -y \
   && apt-get install -y --no-install-recommends libsecret-1-0 ca-certificates \
   && rm -rf /var/lib/apt/lists/*
 
-# Refresh the globally-installed npm so its *bundled* node_modules (undici, tar)
-# ship the patched versions. These are npm's own internals — not application
-# dependencies (our app already resolves undici@8.5.0 / tar@7.5.16, both fixed) —
-# but the container scanner flags the stale copies under
-# /usr/local/lib/node_modules/npm/node_modules. npm is not invoked at runtime in
-# the runner stages, so this is hygiene, not an exploitable runtime path.
-RUN npm install -g npm@latest \
-  && npm cache clean --force
-
 # ── Builder ────────────────────────────────────────────────────────────────
 FROM base AS builder
 
 # Build tools for native module compilation
 # apt-get update needed here because base's rm -rf clears the shared cache
-RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=shared \
-  --mount=type=cache,id=apt-lists,target=/var/lib/apt/lists,sharing=shared \
+RUN --mount=type=cache,target=/var/cache/apt,sharing=shared \
+  --mount=type=cache,target=/var/lib/apt/lists,sharing=shared \
   apt-get update \
   && apt-get install -y --no-install-recommends python3 make g++ \
   && rm -rf /var/lib/apt/lists/*
 
 COPY package*.json ./
-# Workspace package manifests MUST be present before `npm ci` so npm materializes
-# the workspace and installs its *workspace-only* deps (e.g. safe-regex,
-# @toon-format/toon — declared in open-sse/package.json, not hoisted to root).
-# Without this, `npm ci` skips them and the application build fails with "Module not
-# found" (root cause of the v3.8.39 Docker build break). workspaces = ["open-sse"].
-COPY open-sse/package.json ./open-sse/package.json
 COPY scripts/build/postinstall.mjs ./scripts/build/postinstall.mjs
 COPY scripts/build/postinstallSupport.mjs ./scripts/build/postinstallSupport.mjs
 COPY scripts/build/native-binary-compat.mjs ./scripts/build/native-binary-compat.mjs
@@ -55,65 +33,32 @@ ENV NPM_CONFIG_LEGACY_PEER_DEPS=true
 # are reproducible.
 RUN test -f package-lock.json \
   || (echo "package-lock.json is required for reproducible Docker builds" >&2 && exit 1)
-# `npm rebuild <pkg>` re-runs the package's own install script, so under npm 11 +
-# `--ignore-scripts` on the parent `npm ci` it depends on npm's script-allowlist
-# machinery correctly re-enabling that one package's script. Some self-hosted build
-# environments (e.g. Dokploy) hit a broken/incomplete better-sqlite3 native binding
-# from that indirection. Invoking `node-gyp rebuild` directly inside the package
-# directory bypasses npm's script-running layer entirely and is deterministic
-# regardless of npm version or ignore-scripts allowlist behavior.
-# node-gyp comes from npm's own bundled copy (deterministic, already in the image)
-# instead of `npx --yes`, which would install an arbitrary registry version
-# on-demand and run its lifecycle scripts (Sonar docker:S6505).
-#
-# tls-client-node (chatgpt-web/claude-web/grok-web/lmarena/perplexity-web TLS
-# impersonation) hits the same --ignore-scripts wall: its own postinstall.js
-# fetches a platform .so/.dylib/.dll from the bogdanfinn/tls-client GitHub
-# Releases API and is never invoked when npm ci skips lifecycle scripts. Unlike
-# better-sqlite3 above, that script never throws on failure — it only
-# `console.warn`s and exits 0 — so a rate-limited or offline build would
-# otherwise succeed silently with an empty bin/ and only fail at first request
-# in production (TlsClientUnavailableError, #7802). Run it explicitly here so
-# a broken/rate-limited fetch fails the BUILD loudly instead of shipping a
-# broken image.
-RUN --mount=type=cache,id=npm-cache,target=/root/.npm \
+RUN --mount=type=cache,target=/root/.npm \
   npm ci --no-audit --no-fund --legacy-peer-deps --ignore-scripts \
-  && (cd node_modules/better-sqlite3 \
-      && node /usr/local/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js rebuild) \
-  && node -e "require('better-sqlite3')(':memory:').close()" \
-  && node node_modules/tls-client-node/scripts/postinstall.js \
-  && (test -n "$(find node_modules/tls-client-node/bin -mindepth 1 -print -quit 2>/dev/null)" \
-      || (echo "tls-client-node native binary missing after postinstall — GitHub API fetch likely rate-limited or failed (#7802)" >&2 && exit 1))
+  && npm rebuild better-sqlite3 \
+  && node -e "require('better-sqlite3')(':memory:').close()"
 
-# Build with Turbopack (stable in Next 16, the repo default). The v3.8.27-era
-# TurbopackInternalError panic ("entered unreachable code: there must be a path to a
-# root" in ImportTracer::get_traces) no longer reproduces on Next 16.2.9 — validated
-# 2026-07-05 with clean amd64 (12min14s, image smoke-tested: /api/monitoring/health
-# 200) and arm64 (qemu, exit 0, zero panic strings) builds. Turbopack cut the bare
-# build from 17min to 9min on the same 32-core box. Webpack stays available as the
-# escape hatch: `--build-arg`/-e OMNIROUTE_USE_TURBOPACK=0.
+# Build with webpack (stable). Turbopack hit a non-recoverable internal panic on this
+# Next.js version during the v3.8.27 release build — TurbopackInternalError "entered
+# unreachable code: there must be a path to a root" in ImportTracer::get_traces, on both
+# linux/amd64 and linux/arm64. Webpack is the proven engine (build:release / VPS / CI Build
+# all green). Re-enable Turbopack (=1) once the upstream tracer bug is fixed.
 # See docs/ops/QUALITY_GATE_PLAYBOOK.md Parte 6.
-ENV OMNIROUTE_USE_TURBOPACK=1
-
-# Docker containers cannot run the MITM/Agent-Bridge stack (no host DNS/cert
-# access), so keep @/mitm/manager on the graceful stub (#3390). This flag is
-# Docker-only: npm/Electron/VPS builds must bundle the REAL manager (#6344).
-ENV OMNIROUTE_MITM_STUB=1
+ENV OMNIROUTE_USE_TURBOPACK=0
 
 # Raise the V8 heap ceiling for the build. The webpack production optimization
-# pass needs more than V8's default ceiling (~2 GB) for a codebase this size; a
-# memory-constrained Docker build otherwise dies with "FATAL ERROR: ... JavaScript
-# heap out of memory" during the builder stage (#4076). Turbopack's compile is
-# native (Rust) and less V8-heap-bound, but the prerender/export phase still runs
-# on V8, so keep the ceiling. NODE_OPTIONS propagates to the spawned `next build`
-# child (build-next-isolated.mjs → resolveNextBuildEnv spreads process.env).
-# Build-only; the runtime heap is set separately on the runner stage
-# (OMNIROUTE_MEMORY_MB). Override: `--build-arg OMNIROUTE_BUILD_MEMORY_MB=6144`.
+# pass (forced above since Turbopack panics) needs more than V8's default ceiling
+# (~2 GB) for a codebase this size; a memory-constrained Docker build otherwise
+# dies with "FATAL ERROR: ... JavaScript heap out of memory" at `[builder] npm run
+# build` (#4076). NODE_OPTIONS propagates to the spawned `next build` child
+# (build-next-isolated.mjs → resolveNextBuildEnv spreads process.env). Build-only;
+# the runtime heap is set separately on the runner stage (OMNIROUTE_MEMORY_MB).
+# Override for hosts with more/less RAM: `--build-arg OMNIROUTE_BUILD_MEMORY_MB=6144`.
 ARG OMNIROUTE_BUILD_MEMORY_MB=4096
 ENV NODE_OPTIONS="--max-old-space-size=${OMNIROUTE_BUILD_MEMORY_MB}"
 
 COPY . ./
-RUN --mount=type=cache,id=next-cache,target=/app/.build/next/cache \
+RUN --mount=type=cache,target=/app/.build/next/cache \
   mkdir -p /app/data && npm run build
 
 # ── Runner base ────────────────────────────────────────────────────────────
@@ -128,12 +73,6 @@ LABEL org.opencontainers.image.title="omniroute" \
 ENV NODE_ENV=production
 ENV PORT=20128
 ENV HOSTNAME=0.0.0.0
-# Runtime heap ceiling. 1024MB is enough for normal traffic but can be tight
-# for large fusion-combo panels (many models fanned out in parallel, each
-# response buffered in full — see open-sse/services/fusion.ts::FUSION_DEFAULTS
-# .maxPanel, issue #1905). Override at `docker run` time with
-# `-e OMNIROUTE_MEMORY_MB=2048` (or higher) if you raise fusionTuning.maxPanel
-# above the default cap.
 ENV OMNIROUTE_MEMORY_MB=1024
 ENV NODE_OPTIONS="--max-old-space-size=${OMNIROUTE_MEMORY_MB}"
 
@@ -215,8 +154,8 @@ COPY --from=builder /app/node_modules/playwright ./node_modules/playwright
 # browsers land under /home/node which persists across image layers and is
 # accessible to the non-root runtime user.
 ENV PLAYWRIGHT_BROWSERS_PATH=/home/node/.cache/ms-playwright
-RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=locked \
-  --mount=type=cache,id=apt-lists,target=/var/lib/apt/lists,sharing=locked \
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+  --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
   apt-get update \
   && node node_modules/playwright/cli.js install chromium --with-deps \
   && chown -R node:node /home/node/.cache \
@@ -232,15 +171,15 @@ FROM runner-base AS runner-cli
 USER root
 
 # Install system dependencies required by openclaw (git+ssh references).
-RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=locked \
-  --mount=type=cache,id=apt-lists,target=/var/lib/apt/lists,sharing=locked \
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+  --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
   apt-get update \
   && apt-get install -y --no-install-recommends git ca-certificates docker.io docker-compose \
   && rm -rf /var/lib/apt/lists/* \
   && git config --system url."https://github.com/".insteadOf "ssh://git@github.com/"
 
 # Install CLI tools globally. Separate layer from apt for better cache reuse.
-RUN --mount=type=cache,id=npm-cache,target=/root/.npm \
+RUN --mount=type=cache,target=/root/.npm \
   npm install -g --no-audit --no-fund @openai/codex @anthropic-ai/claude-code droid openclaw@latest
 
 USER node

SECURITY.md

@@ -42,7 +42,7 @@ Request → CORS → Authz pipeline (classify → policies → enforce)
 | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
 | **Dashboard Login**   | Password-based auth with JWT tokens (HttpOnly cookies)                                                                                    |
 | **API Key Auth**      | HMAC-signed keys with CRC validation                                                                                                      |
-| **OAuth 2.0 + PKCE**  | 13 providers (Claude, Codex, GitHub, Cursor, Antigravity, Gemini, Kimi Coding, Kilo Code, Cline, Kiro, Qoder, Windsurf, GitLab Duo)       |
+| **OAuth 2.0 + PKCE**  | 14 providers (Claude, Codex, GitHub, Cursor, Antigravity, Gemini, Kimi Coding, Kilo Code, Cline, Qwen, Kiro, Qoder, Windsurf, GitLab Duo) |
 | **Token Refresh**     | Automatic OAuth token refresh before expiry                                                                                               |
 | **Secure Cookies**    | `AUTH_COOKIE_SECURE=true` for HTTPS environments                                                                                          |
 | **Authz Pipeline**    | Route classification (PUBLIC / CLIENT_API / MANAGEMENT) — see `docs/architecture/AUTHZ_GUIDE.md`                                          |
@@ -77,28 +77,21 @@ Custom guardrails register via `registerGuardrail(new MyGuardrail())`. The model
 
 ### 🧠 Prompt Injection Guard
 
-Best-effort heuristic middleware that detects prompt injection patterns in LLM requests.
-**Not a complete prompt-injection firewall** — can produce false positives (benign
-persona/RPG prompts) and false negatives (leetspeak, spacing, non-English patterns).
+Middleware that detects and blocks prompt injection attacks in LLM requests:
 
 | Pattern Type        | Severity | Example                                        |
 | ------------------- | -------- | ---------------------------------------------- |
 | System Override     | High     | "ignore all previous instructions"             |
-| Role Hijack         | Medium   | "you are now DAN, you can do anything"         |
-| Delimiter Injection | High     | Encoded separators to break context boundaries |
-| DAN/Jailbreak       | Medium   | Known jailbreak prompt patterns                |
-| Instruction Leak    | High     | "show me your system prompt"                   |
-| Encoding Evasion    | Medium   | base64/rot13/hex decode + instruction keywords |
-
-Only **High** severity detections are blocked in `block` mode. Medium-severity
-families are logged but never blocked by `sanitizeRequest`.
+| Role Hijack         | High     | "you are now DAN, you can do anything"         |
+| Delimiter Injection | Medium   | Encoded separators to break context boundaries |
+| DAN/Jailbreak       | High     | Known jailbreak prompt patterns                |
+| Instruction Leak    | Medium   | "show me your system prompt"                   |
 
 Configure via dashboard (Settings → Security) or `.env`:
 
 ```env
 INPUT_SANITIZER_ENABLED=true
-INPUT_SANITIZER_MODE=block    # warn | block (injection policy; legacy "redact" does not strip injection text)
-INPUT_SANITIZER_BLOCK_THRESHOLD=high  # high (default) | medium | low — severities at/above this are blocked in block mode
+INPUT_SANITIZER_MODE=block    # warn | block | redact
 ```
 
 ### 🔒 PII Redaction
@@ -115,20 +108,19 @@ Automatic detection and optional redaction of personally identifiable informatio
 | SSN (US)      | `123-45-6789`         | `[SSN_REDACTED]`   |
 
 ```env
-PII_REDACTION_ENABLED=true   # request PII rewrite; independent of INPUT_SANITIZER_MODE
-PII_RESPONSE_SANITIZATION=true  # optional: redact PII in provider responses returned to clients
+PII_REDACTION_ENABLED=true
 ```
 
 ### 🌐 Network Security
 
-| Feature                  | Description                                                                    |
-| ------------------------ | ------------------------------------------------------------------------------ |
-| **CORS**                 | Explicit cross-origin allowlist (`CORS_ALLOWED_ORIGINS`; legacy `CORS_ORIGIN`) |
-| **IP Filtering**         | Allowlist/blocklist IP ranges in dashboard                                     |
-| **Rate Limiting**        | Per-provider rate limits with automatic backoff                                |
-| **Anti-Thundering Herd** | Mutex + per-connection locking prevents cascading 502s                         |
-| **TLS Fingerprint**      | Browser-like TLS fingerprint spoofing to reduce bot detection                  |
-| **CLI Fingerprint**      | Per-provider header/body ordering to match native CLI signatures               |
+| Feature                  | Description                                                      |
+| ------------------------ | ---------------------------------------------------------------- |
+| **CORS**                 | Configurable origin control (`CORS_ORIGIN` env var, default `*`) |
+| **IP Filtering**         | Allowlist/blocklist IP ranges in dashboard                       |
+| **Rate Limiting**        | Per-provider rate limits with automatic backoff                  |
+| **Anti-Thundering Herd** | Mutex + per-connection locking prevents cascading 502s           |
+| **TLS Fingerprint**      | Browser-like TLS fingerprint spoofing to reduce bot detection    |
+| **CLI Fingerprint**      | Per-provider header/body ordering to match native CLI signatures |
 
 ### 🔌 Resilience & Availability
 

bin/_ops-common.sh

@@ -1,70 +0,0 @@
-# bin/_ops-common.sh — shared helpers for the OmniRoute ops runbook scripts.
-#
-# Sourced (not executed) by rollback.sh / snapshot-data.sh / restore-data.sh /
-# restore-policies.sh / cold-start-bench.sh — the self-hoster incident-recovery
-# and cold-start ops tooling. Each script documents its own contract via --help.
-#
-# Path resolution mirrors the app (src/lib/db/core.ts): the SQLite store is
-# $DATA_DIR/storage.sqlite and managed backups go to $DATA_DIR/db_backups
-# (overridable via DB_BACKUPS_DIR), so snapshots created here are interchangeable
-# with the ones the server writes on migrations.
-
-# Recompute the data-dir-derived paths. Called once on source, and again by
-# scripts that accept a --data-dir override.
-ops_set_data_dir() {
-  OMNIROUTE_DATA_DIR="$1"
-  OMNIROUTE_SQLITE="${OMNIROUTE_DATA_DIR}/storage.sqlite"
-  OMNIROUTE_BACKUPS_DIR="${DB_BACKUPS_DIR:-${OMNIROUTE_DATA_DIR}/db_backups}"
-}
-ops_set_data_dir "${DATA_DIR:-$HOME/.omniroute}"
-
-ops_log() { printf '[%s] %s\n' "${SCRIPT_NAME:-ops}" "$*" >&2; }
-ops_die() {
-  printf '[%s] ERROR: %s\n' "${SCRIPT_NAME:-ops}" "$*" >&2
-  exit 1
-}
-
-ops_require_cmd() {
-  command -v "$1" >/dev/null 2>&1 || ops_die "required command not found: $1"
-}
-
-# ops_confirm "<prompt>" — return 0 to proceed. Honors ASSUME_YES=1 (set by the
-# --yes flag) and REFUSES a destructive action on a non-interactive stdin unless
-# ASSUME_YES is set, so an unattended/CI invocation can never silently destroy data.
-ops_confirm() {
-  local prompt="$1" reply
-  if [ "${ASSUME_YES:-0}" = "1" ]; then return 0; fi
-  if [ ! -t 0 ]; then
-    ops_die "refusing a destructive action without a TTY; pass --yes to proceed non-interactively"
-  fi
-  read -r -p "$prompt [y/N] " reply
-  case "$reply" in
-    [yY] | [yY][eE][sS]) return 0 ;;
-    *) return 1 ;;
-  esac
-}
-
-# ops_find_snapshot <id> — resolve a snapshot identifier (a snapshot dir name,
-# a bare timestamp/sha, or an explicit path) to a directory containing
-# storage.sqlite. Echoes the resolved dir or dies.
-ops_find_snapshot() {
-  local id="$1" cand
-  [ -n "$id" ] || ops_die "snapshot id required (a timestamp/sha, dir name, or path)"
-  for cand in \
-    "$id" \
-    "$id/" \
-    "$OMNIROUTE_BACKUPS_DIR/$id" \
-    "$OMNIROUTE_BACKUPS_DIR/snapshot_$id"; do
-    if [ -f "${cand%/}/storage.sqlite" ]; then
-      printf '%s\n' "${cand%/}"
-      return 0
-    fi
-  done
-  # Fall back to a prefix match against snapshot_* dirs (e.g. a short sha/date).
-  if [ -d "$OMNIROUTE_BACKUPS_DIR" ]; then
-    for cand in "$OMNIROUTE_BACKUPS_DIR"/snapshot_*"$id"*; do
-      [ -f "$cand/storage.sqlite" ] && { printf '%s\n' "$cand"; return 0; }
-    done
-  fi
-  ops_die "no snapshot matching '$id' under $OMNIROUTE_BACKUPS_DIR (run bin/snapshot-data.sh first)"
-}

bin/aliasResolver.mjs

@@ -1,230 +0,0 @@
-/**
- * ESM path-alias resolver for global installs.
- *
- * Problem (#7791): when OmniRoute is installed via `npm i -g omniroute`, the
- * package files live under `node_modules/omniroute/`. tsx's tsconfig-path
- * resolution does not apply there, so specifiers like `@/shared/utils/featureFlags`
- * (declared in tsconfig.json `paths` as `@/* → ./src/*`) or
- * `@omniroute/open-sse/services/usage` fail with `ERR_MODULE_NOT_FOUND`.
- * The CLI crashes before any command can run.
- *
- * Fix: register a Node ESM `resolve` hook that rewrites alias specifiers to
- * absolute file URLs. Covers all tsconfig.json `paths` entries:
- *   - `@/*`             → `./src/*`
- *   - `@omniroute/open-sse`    → `./open-sse/index.ts`
- *   - `@omniroute/open-sse/*`  → `./open-sse/*`
- * The hook runs after tsx so `.ts` extensions are already handled, and only
- * intercepts matched prefixes — everything else falls through to Node's
- * default resolver.
- *
- * Exposed as pure functions so the mapping logic is unit-testable without a
- * running module loader.
- */
-
-import { existsSync, statSync } from "node:fs";
-import { dirname, join, relative, isAbsolute } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-
-/**
- * Alias mapping table — mirrors tsconfig.json `paths`.
- * Processed top-to-bottom; first matching prefix wins.
- *
- * Each entry:
- *   prefix  — specifier prefix to match (e.g. `"@/"`, `"@omniroute/open-sse/"`)
- *   target  — directory name under the package root (e.g. `"src"`, `"open-sse"`)
- *   exact   — if true, the prefix also matches when the specifier equals the
- *             prefix *without* a trailing slash (e.g. `@omniroute/open-sse` →
- *             `<root>/open-sse/index.ts`).
- *
- * Exported for tests/consumers.
- */
-export const ALIAS_MAP = [
-  { prefix: "@/", target: "src", exact: false },
-  { prefix: "@omniroute/open-sse/", target: "open-sse", exact: false },
-  { prefix: "@omniroute/open-sse", target: "open-sse", exact: true },
-];
-
-/** @deprecated Use ALIAS_MAP instead. Kept for backward compat. */
-export const ALIAS_PREFIX = "@/";
-
-// This file is ESM (no CJS __dirname global) — derive it from import.meta.url
-// so the pathToFileURL(join(__dirname, ...)) call below resolves correctly
-// regardless of the caller's cwd.
-const __dirname = dirname(fileURLToPath(import.meta.url));
-
-/**
- * Resolve an alias specifier to an absolute file URL.
- *
- * Rules mirror tsconfig.json `paths` via `ALIAS_MAP`:
- *   "@/..."                     → <root>/src/...
- *   "@omniroute/open-sse/..."   → <root>/open-sse/...
- *   "@omniroute/open-sse"       → <root>/open-sse/index.*
- *
- * - Strips the matched alias prefix and joins the remainder against the
- *   corresponding target directory.
- * - Probes the underlying filesystem for the actual source file: the specifier
- *   itself, then with common source extensions (`.ts`, `.tsx`, `.js`, `.mjs`,
- *   `.cjs`, `.json`), then `<dir>/index.*`. Returns the first existing match
- *   as a `file://` URL.
- * - Returns `null` for specifiers that do not match any alias, for malformed
- *   escapes, for path-traversal attempts, or when no corresponding source
- *   file exists on disk. The caller treats `null` as "defer to the default
- *   resolver".
- *
- * @param {string} specifier  Module specifier from an `import` statement.
- * @param {string} root       Absolute path to the package root.
- * @returns {string|null}     Absolute `file://` URL, or `null` when unresolved.
- */
-const SOURCE_EXTENSIONS = [".ts", ".tsx", ".js", ".mjs", ".cjs", ".json"];
-
-export function resolveAlias(specifier, root) {
-  if (typeof specifier !== "string" || !root || typeof root !== "string") {
-    return null;
-  }
-
-  // Find the first matching alias entry (top-to-bottom order).
-  let matchedEntry = null;
-  let rest = null;
-  for (const entry of ALIAS_MAP) {
-    if (specifier.startsWith(entry.prefix)) {
-      // For non-exact entries, require at least one char after the prefix
-      // to avoid matching bare "@/" as "nothing".
-      const after = specifier.slice(entry.prefix.length);
-      if (after.length === 0 && !entry.exact) continue;
-      matchedEntry = entry;
-      rest = after;
-      break;
-    }
-  }
-  if (!matchedEntry) return null;
-
-  const targetDir = join(root, matchedEntry.target);
-
-  // Exact match (e.g. `@omniroute/open-sse` with no trailing path) →
-  // resolve to `<target>/index.*`.
-  if (rest === "" || rest === undefined) {
-    return probeIndex(targetDir);
-  }
-
-  // Guard against absolute-ish escapes (`@//etc/passwd`, `@/\x00`).
-  if (rest.startsWith("/") || rest.startsWith("\\")) {
-    return null;
-  }
-  // Guard against path-traversal escapes (`@/../../../etc/hostname`).
-  const segments = rest.split(/[\\\/]+/);
-  if (segments.includes("..")) {
-    return null;
-  }
-  const base = join(targetDir, rest);
-  if (!isWithinRoot(targetDir, base)) {
-    return null;
-  }
-  return probeFile(base) ?? probeIndex(base) ?? null;
-}
-
-/**
- * Probe a bare path and its extension variants. Returns the first existing
- * match as a `file://` URL, or `null`.
- */
-function probeFile(base) {
-  // Try extension variants first — a bare `base` that happens to be a directory
-  // would match existsSync() but should NOT be returned as a file URL (the
-  // caller expects a file, not a directory). Extension-probing avoids this
-  // false positive (e.g. `usage` vs `usage.ts` vs `usage/`).
-  for (const ext of SOURCE_EXTENSIONS) {
-    const candidate = base + ext;
-    if (existsSync(candidate)) return pathToFileURL(candidate).href;
-  }
-  // Only accept the bare path if it is NOT a directory.
-  if (existsSync(base)) {
-    try {
-      const st = statSync(base);
-      if (!st.isDirectory()) return pathToFileURL(base).href;
-    } catch {}
-  }
-  return null;
-}
-
-/**
- * Probe a directory for an `index.*` entry. Returns the first existing
- * match as a `file://` URL, or `null`.
- */
-function probeIndex(dir) {
-  const indexBase = join(dir, "index");
-  for (const ext of SOURCE_EXTENSIONS) {
-    const candidate = indexBase + ext;
-    if (existsSync(candidate)) return pathToFileURL(candidate).href;
-  }
-  return null;
-}
-
-/**
- * True when `candidate` resolves to a location inside `ancestor` (or is
- * `ancestor` itself). Used as a second, path-normalization-aware layer of
- * defense against traversal beyond the literal `..` segment check above.
- *
- * @param {string} ancestor
- * @param {string} candidate
- * @returns {boolean}
- */
-function isWithinRoot(ancestor, candidate) {
-  const rel = relative(ancestor, candidate);
-  return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
-}
-
-/**
- * Register the ESM resolve hook for the current process. Safe to call multiple
- * times — subsequent calls are no-ops once the hook is installed.
- *
- * Uses Node's stable `module.register()` API (available since Node 20.6,
- * required Node 22+ here). The hook runs in a worker thread but only reads the
- * captured `root`, so no shared-state hazards.
- *
- * @param {string} root  Absolute path to the package root.
- * @returns {Promise<boolean>}  Resolves `true` once registered (or if already
- *   registered), `false` on environments where `module.register` is unavailable.
- */
-let _registered = false;
-export async function registerAliasResolver(root) {
-  // Validate input FIRST, before the _registered short-circuit. Otherwise the
-  // second call in the same process (e.g. a test suite that already registered
-  // once) would silently return `true` for invalid input instead of rejecting,
-  // masking programmer errors. Input validation must be unconditional.
-  if (!root || typeof root !== "string") {
-    throw new TypeError("registerAliasResolver: root must be a non-empty string");
-  }
-  if (_registered) return true;
-  // if the directory does not exist we would only mask a real misconfiguration
-  // by installing a hook that rewrites to nowhere.
-  if (!existsSync(join(root, "src"))) {
-    return false;
-  }
-
-  try {
-    const { register } = await import("node:module");
-    // #7808: load the hook from a real file on disk via pathToFileURL() instead
-    // of building a `data:text/javascript,...` URL dynamically. CodeQL's
-    // `js/incomplete-url-substring-sanitization` flagged the interpolated
-    // `new URL(...)` call; a file URL produced by pathToFileURL() is a trusted,
-    // fully-parsed URL — no sanitization ambiguity. The hook source lives in
-    // `bin/aliasResolverHook.mjs` (sibling of this file), shipped via
-    // package.json "files": ["bin/"].
-    const hookPath = join(__dirname, "aliasResolverHook.mjs");
-    const hookUrl = pathToFileURL(hookPath);
-    register(hookUrl, { data: { root } });
-    _registered = true;
-    return true;
-  } catch {
-    // Older Node or sandboxed env without module.register — fall back to the
-    // default resolver. The bug will resurface only in the exact global-install
-    // scenario, which is what we explicitly patched; other entry points still
-    // work because they import via relative paths.
-    return false;
-  }
-}
-
-// #7808: the ESM loader hook source now lives in `bin/aliasResolverHook.mjs`,
-// loaded via `pathToFileURL()` above. The previous inline `HOOK_SOURCE` template
-// literal was removed because its `new URL(\`data:text/javascript,...\`)` wrapper
-// triggered CodeQL `js/incomplete-url-substring-sanitization`. The hook logic
-// itself is unchanged — see aliasResolverHook.mjs for the resolver behaviour.

bin/aliasResolverHook.mjs

@@ -1,126 +0,0 @@
-/**
- * ESM loader hook for path-alias resolution (#7791 + #7808).
- *
- * This file runs in Node's loader worker thread after being registered via
- * `module.register(url, data)` from `bin/aliasResolver.mjs`. It MUST NOT import
- * anything from the parent module — all inputs arrive through `initialize(data)`.
- *
- * Behaviour:
- * - Rewrites alias specifiers to absolute filesystem paths, mirroring
- *   tsconfig.json `paths`:
- *     - `@/*`                    → <root>/src/*
- *     - `@omniroute/open-sse`     → <root>/open-sse/index.*
- *     - `@omniroute/open-sse/*`   → <root>/open-sse/*
- * - Probes the usual source extensions (`.ts`, `.tsx`, `.js`, `.mjs`, `.cjs`,
- *   `.json`) plus `index.*` for directory imports.
- * - Returns `shortCircuit: true` only when a candidate file exists on disk;
- *   otherwise delegates to the next resolver (tsx/Node) so unrelated imports
- *   and legitimate "module not found" errors pass through unchanged.
- *
- * Why a separate file instead of an inline `data:` URL?
- * CodeQL's `js/incomplete-url-substring-sanitization` flags dynamic `new URL(...)`
- * construction with interpolated strings. A real file URL produced by
- * `pathToFileURL()` is a trusted, fully-parsed URL — no sanitization ambiguity.
- */
-import { pathToFileURL } from "node:url";
-import { join, relative, isAbsolute } from "node:path";
-import { existsSync, statSync } from "node:fs";
-
-let ROOT = "";
-
-export function initialize(data) {
-  ROOT = (data && data.root) || "";
-}
-
-const EXTENSIONS = [".ts", ".tsx", ".js", ".mjs", ".cjs", ".json"];
-
-/**
- * Alias prefix table — mirrors ALIAS_MAP in aliasResolver.mjs and
- * tsconfig.json `paths`. Processed top-to-bottom; first match wins.
- *
- * @type {Array<{prefix: string, target: string, exact: boolean}>}
- */
-const ALIAS_TABLE = [
-  { prefix: "@/", target: "src", exact: false },
-  { prefix: "@omniroute/open-sse/", target: "open-sse", exact: false },
-  { prefix: "@omniroute/open-sse", target: "open-sse", exact: true },
-];
-
-function tryResolveAliasFsPath(specifier) {
-  if (!ROOT || typeof specifier !== "string") return null;
-
-  // Find the first matching alias entry.
-  let matchedEntry = null;
-  let rest = null;
-  for (const entry of ALIAS_TABLE) {
-    if (specifier.startsWith(entry.prefix)) {
-      const after = specifier.slice(entry.prefix.length);
-      if (after.length === 0 && !entry.exact) continue;
-      matchedEntry = entry;
-      rest = after;
-      break;
-    }
-  }
-  if (!matchedEntry) return null;
-
-  const targetDir = join(ROOT, matchedEntry.target);
-
-  // Exact match (e.g. `@omniroute/open-sse`) → resolve to `<target>/index.*`.
-  if (rest === "" || rest === undefined) {
-    return probeIndex(targetDir);
-  }
-
-  // Guard against absolute-ish escapes.
-  if (rest.startsWith("/") || rest.startsWith("\\")) return null;
-  // Guard against path-traversal escapes.
-  const segments = rest.split(/[\\\/]+/);
-  if (segments.includes("..")) return null;
-
-  const base = join(targetDir, rest);
-  if (!isWithinRoot(targetDir, base)) return null;
-  return probeFile(base) ?? probeIndex(base) ?? null;
-}
-
-function probeFile(base) {
-  // Extension variants first — avoids matching a bare directory name.
-  for (const ext of EXTENSIONS) {
-    const candidate = base + ext;
-    if (existsSync(candidate)) return candidate;
-  }
-  if (existsSync(base)) {
-    try {
-      const st = statSync(base);
-      if (!st.isDirectory()) return base;
-    } catch {}
-  }
-  return null;
-}
-
-function probeIndex(dir) {
-  const indexBase = join(dir, "index");
-  for (const ext of EXTENSIONS) {
-    const candidate = indexBase + ext;
-    if (existsSync(candidate)) return candidate;
-  }
-  return null;
-}
-
-/**
- * True when `candidate` resolves to a location inside `ancestor` (or is
- * `ancestor` itself). Path-normalization-aware defense against traversal.
- */
-function isWithinRoot(ancestor, candidate) {
-  const rel = relative(ancestor, candidate);
-  return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
-}
-
-export function resolve(specifier, context, nextResolve) {
-  const fsPath = tryResolveAliasFsPath(specifier);
-  if (fsPath) {
-    return {
-      url: pathToFileURL(fsPath).href,
-      shortCircuit: true,
-    };
-  }
-  return nextResolve(specifier, context);
-}

bin/cli/api-commands/agent-skills.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/agentbridge.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/api-keys.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/audio.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/chat.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/cli-tools.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/cloud.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/combos.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/compression.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/embedded-services.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/embeddings.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/fallback.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/images.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/memory.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/messages.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/models.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/moderations.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/oauth.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/playground.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/pricing.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/provider-nodes.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/providers.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/quota.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/rerank.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/responses.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/settings.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/system.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/telemetry.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/traffic-inspector.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/translator.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/api-commands/usage.mjs

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";

bin/cli/commands/auth-export.mjs

@@ -1,163 +0,0 @@
-import { chmodSync, existsSync, writeFileSync } from "node:fs";
-import { decryptCredential } from "../encryption.mjs";
-import { findProviderConnection, listProviderConnections } from "../provider-store.mjs";
-import { openOmniRouteDb } from "../sqlite.mjs";
-import { t } from "../i18n.mjs";
-
-/**
- * Local-only, operator-invoked command that dumps DECRYPTED provider credentials
- * (apiKey/accessToken/refreshToken/idToken). This never runs inside the HTTP server
- * process and must never be reachable over the network — no src/app/api/ route wraps
- * this. See docs/security/ for the threat-model writeup referenced in issue #6683.
- */
-
-const CREDENTIAL_FIELDS = [
-  { key: "apiKey", envSuffix: "API_KEY" },
-  { key: "accessToken", envSuffix: "ACCESS_TOKEN" },
-  { key: "refreshToken", envSuffix: "REFRESH_TOKEN" },
-  { key: "idToken", envSuffix: "ID_TOKEN" },
-];
-
-const VALID_FORMATS = new Set(["json", "env"]);
-const SECURE_FILE_MODE = 0o600;
-
-export function registerAuthExport(program) {
-  program
-    .command("auth export")
-    .description(t("authExport.description"))
-    .option("--id <id>", t("authExport.idOpt"))
-    .option("--format <format>", t("authExport.formatOpt"), "json")
-    .option("--out <file>", t("authExport.outOpt"))
-    .option("--force", t("authExport.forceOpt"))
-    .action(async (opts, cmd) => {
-      const globalOpts = cmd.optsWithGlobals();
-      const exitCode = await runAuthExportCommand({ ...opts, ...globalOpts });
-      if (exitCode !== 0) process.exit(exitCode);
-    });
-}
-
-export async function runAuthExportCommand(opts = {}) {
-  // Security control (a): confirmation gate BEFORE any DB access — a dry invocation
-  // never opens the database and never decrypts anything.
-  if (!opts.force) {
-    printConfirmationGate();
-    return 0;
-  }
-
-  const format = opts.format || "json";
-  if (!VALID_FORMATS.has(format)) {
-    console.error(t("authExport.invalidFormat", { format }));
-    return 1;
-  }
-
-  if (!process.env.STORAGE_ENCRYPTION_KEY) {
-    console.error(t("authExport.missingKey"));
-    return 1;
-  }
-
-  // Security control (b): stderr warning banner BEFORE any plaintext is emitted.
-  process.stderr.write(t("authExport.warning") + "\n");
-
-  const rows = await loadTargetConnections(opts.id);
-  if (rows === null) {
-    console.error(t("authExport.notFound", { id: opts.id }));
-    return 1;
-  }
-
-  const exported = rows.map(exportConnection);
-  const content = format === "env" ? formatAsEnv(exported) : formatAsJson(exported);
-
-  if (opts.out) {
-    writeSecureFile(opts.out, content);
-  } else {
-    console.log(content);
-  }
-
-  return 0;
-}
-
-function printConfirmationGate() {
-  console.log(
-    `\n${t("authExport.confirmHeading")}\n\n${t("authExport.confirmBody")}\n\n${t("authExport.confirmFooter")}\n`
-  );
-}
-
-async function loadTargetConnections(id) {
-  const { db } = await openOmniRouteDb();
-  try {
-    if (!id) return listProviderConnections(db);
-    const connection = findProviderConnection(db, id);
-    return connection ? [connection] : null;
-  } finally {
-    db.close();
-  }
-}
-
-function decryptField(rawValue) {
-  // Security control (d): a per-field decrypt failure surfaces as a boolean flag,
-  // never the caught error text. Security control (e): the caught error is never
-  // interpolated into any message.
-  try {
-    return { value: decryptCredential(rawValue), failed: false };
-  } catch {
-    return { value: null, failed: true };
-  }
-}
-
-function exportConnection(connection) {
-  const result = {
-    id: connection.id,
-    provider: connection.provider,
-    name: connection.name,
-    authType: connection.authType,
-  };
-
-  for (const { key } of CREDENTIAL_FIELDS) {
-    const rawValue = connection[key];
-    if (!rawValue) {
-      result[key] = null;
-      result[`${key}DecryptFailed`] = false;
-      continue;
-    }
-    const { value, failed } = decryptField(rawValue);
-    result[key] = value;
-    result[`${key}DecryptFailed`] = failed;
-  }
-
-  return result;
-}
-
-function formatAsJson(rows) {
-  return JSON.stringify(rows, null, 2);
-}
-
-function envSafeSegment(value) {
-  return String(value || "")
-    .toUpperCase()
-    .replace(/[^A-Z0-9]+/g, "_")
-    .replace(/^_+|_+$/g, "");
-}
-
-function formatAsEnv(rows) {
-  const lines = [];
-  for (const row of rows) {
-    lines.push(`# ${row.provider} (${row.id})`);
-    const providerSegment = envSafeSegment(row.provider);
-    for (const { key, envSuffix } of CREDENTIAL_FIELDS) {
-      const value = row[key];
-      if (!value) continue;
-      lines.push(`OMNIROUTE_${providerSegment}_${envSuffix}=${value}`);
-    }
-  }
-  return lines.join("\n");
-}
-
-function writeSecureFile(filePath, content) {
-  // Security control (c): file output written with mode 0o600 (plus chmodSync if the
-  // file pre-existed, belt-and-suspenders against an already world-readable file).
-  const preExisted = existsSync(filePath);
-  writeFileSync(filePath, content, { mode: SECURE_FILE_MODE });
-  if (preExisted) {
-    chmodSync(filePath, SECURE_FILE_MODE);
-  }
-}

bin/cli/commands/completion.mjs

@@ -15,11 +15,7 @@ function readCache() {
   try {
     const raw = JSON.parse(readFileSync(cachePath(), "utf8"));
     if (raw && typeof raw.ts === "number" && Date.now() - raw.ts < CACHE_TTL_MS) return raw;
-  } catch (err) {
-    if (process.env.OMNIROUTE_DEBUG_COMPLETION) {
-      console.error("[omniroute completion] readCache failed:", err?.message ?? err);
-    }
-  }
+  } catch {}
   return null;
 }
 
@@ -45,20 +41,12 @@ async function refreshCache(opts = {}) {
       const j = await mr.value.json();
       models = (Array.isArray(j) ? j : j.data || []).map((m) => m.id).filter(Boolean);
     }
-  } catch (err) {
-    if (process.env.OMNIROUTE_DEBUG_COMPLETION) {
-      console.error("[omniroute completion] refreshCache failed:", err?.message ?? err);
-    }
-  }
+  } catch {}
   const data = { combos, providers, models, ts: Date.now() };
   try {
     mkdirSync(dirname(cachePath()), { recursive: true });
     writeFileSync(cachePath(), JSON.stringify(data));
-  } catch (err) {
-    if (process.env.OMNIROUTE_DEBUG_COMPLETION) {
-      console.error("[omniroute completion] writeCache failed:", err?.message ?? err);
-    }
-  }
+  } catch {}
   return data;
 }
 

bin/cli/commands/compression.mjs

@@ -24,7 +24,7 @@ async function restCompressionStatus() {
   const combosBody = combosRes.ok ? await combosRes.json() : { combos: [] };
   const analytics = analyticsRes && analyticsRes.ok ? await analyticsRes.json() : null;
   return {
-    strategy: settings.defaultMode || "standard",
+    engine: settings.engine ?? null,
     settings,
     combos: combosBody.combos ?? combosBody,
     analytics,
@@ -33,10 +33,7 @@ async function restCompressionStatus() {
 
 async function restCompressionConfigure(config) {
   const body = { ...config };
-  if (body.strategy) {
-    body.defaultMode = body.strategy === "caveman" ? "standard" : normalizeEngine(body.strategy);
-    delete body.strategy;
-  }
+  if (body.engine) body.engine = normalizeEngine(body.engine);
   const res = await apiFetch("/api/settings/compression", { method: "PUT", body });
   if (!res.ok) {
     process.stderr.write(`Error: ${res.status}\n`);
@@ -46,10 +43,9 @@ async function restCompressionConfigure(config) {
 }
 
 async function restSetEngine(name) {
-  const normalized = normalizeEngine(name);
   const res = await apiFetch("/api/settings/compression", {
     method: "PUT",
-    body: { defaultMode: normalized === "caveman" ? "standard" : normalized },
+    body: { engine: normalizeEngine(name) },
   });
   if (!res.ok) {
     process.stderr.write(`Error: ${res.status}\n`);
@@ -107,11 +103,7 @@ export async function runCompressionStatus(opts, cmd) {
 
 export async function runCompressionConfigure(opts, cmd) {
   const config = {};
-  // #6571 — both the MCP tool schema (compressionConfigureInput) and
-  // handleCompressionConfigure expect `strategy`, not `engine`; a non-strict
-  // MCP schema silently strips an unrecognized `engine` key on the primary
-  // (MCP-mounted) path, so this must be `strategy` on both paths.
-  if (opts.engine) config.strategy = normalizeEngine(opts.engine);
+  if (opts.engine) config.engine = opts.engine;
   if (opts.cavemanAggressiveness !== undefined)
     config.caveman = { aggressiveness: opts.cavemanAggressiveness };
   if (opts.rtkBudget !== undefined) config.rtk = { tokenBudget: opts.rtkBudget };
@@ -171,7 +163,7 @@ export function registerCompression(program) {
   engine.command("set <name>").action(runCompressionEngineSet);
   engine.command("get").action(async (opts, cmd) => {
     const data = await mcpCall("omniroute_compression_status", {}, restCompressionStatus);
-    process.stdout.write(`${data.strategy ?? "(default)"}\n`);
+    process.stdout.write(`${data.engine ?? "(default)"}\n`);
   });
 
   const combos = cmp.command("combos").description(t("compression.combos.description"));

bin/cli/commands/dashboard.mjs

@@ -1,22 +1,17 @@
 import { execFile } from "node:child_process";
 import { t } from "../i18n.mjs";
 
-function parsePort(value, fallback) {
-  const parsed = parseInt(String(value), 10);
-  return Number.isFinite(parsed) && parsed > 0 && parsed <= 65535 ? parsed : fallback;
-}
-
 export function registerDashboard(program) {
   program
     .command("dashboard")
     .description(t("dashboard.description"))
     .option("--url", t("dashboard.urlOnly"))
-    .option("--port <port>", "Port the server is running on")
+    .option("--port <port>", "Port the server is running on", "20128")
     .option("--tui", t("dashboard.tui") || "Open interactive TUI dashboard (terminal UI)")
     .action(async (opts, cmd) => {
       if (opts.tui) {
         const globalOpts = cmd.optsWithGlobals();
-        const port = parsePort(opts.port ?? process.env.PORT ?? "20128", 20128);
+        const port = opts.port ? parseInt(String(opts.port), 10) : 20128;
         const baseUrl = globalOpts.baseUrl ?? `http://localhost:${port}`;
         const apiKey = globalOpts.apiKey ?? null;
         const { startInteractiveTui } = await import("../tui/Dashboard.jsx");
@@ -29,7 +24,7 @@ export function registerDashboard(program) {
 }
 
 export async function runDashboardCommand(opts = {}) {
-  const port = parsePort(opts.port ?? process.env.PORT ?? "20128", 20128);
+  const port = opts.port ? parseInt(String(opts.port), 10) : 20128;
   const dashboardUrl = `http://localhost:${port}`;
 
   if (opts.url) {
@@ -49,22 +44,22 @@ export async function runDashboardCommand(opts = {}) {
   return 0;
 }
 
-/**
- * Resolve the command and args to open a URL in the default browser
- * for a given platform. Exported for testing — callers should use openFallback().
- * @param {"darwin"|"win32"|string} platform
- * @param {string} url
- * @returns {{ cmd: string, args: string[] }}
- */
-export function resolveOpenCommand(platform, url) {
-  if (platform === "darwin") return { cmd: "open", args: [url] };
-  if (platform === "win32") return { cmd: "rundll32", args: ["url.dll,FileProtocolHandler", url] };
-  return { cmd: "xdg-open", args: [url] };
-}
-
 function openFallback(url) {
   return new Promise((resolve) => {
-    const { cmd, args } = resolveOpenCommand(process.platform, url);
+    const { platform } = process;
+    let cmd, args;
+
+    if (platform === "darwin") {
+      cmd = "open";
+      args = [url];
+    } else if (platform === "win32") {
+      cmd = "cmd";
+      args = ["/c", "start", "", url];
+    } else {
+      cmd = "xdg-open";
+      args = [url];
+    }
+
     execFile(cmd, args, { stdio: "ignore" }, () => resolve());
   });
 }

bin/cli/commands/doctor.mjs

@@ -3,7 +3,7 @@ import net from "node:net";
 import os from "node:os";
 import path from "node:path";
 import { createDecipheriv, scryptSync } from "node:crypto";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { pathToFileURL } from "node:url";
 import { resolveDataDir, resolveStoragePath } from "../data-dir.mjs";
 import { printHeading } from "../io.mjs";
 import { t } from "../i18n.mjs";
@@ -380,67 +380,24 @@ function resolveLivenessUrl(options = {}) {
   return `http://${formatHostForUrl(host || "127.0.0.1")}:${dashboardPort}/api/health/degradation`;
 }
 
-async function probeUrl(url) {
-  try {
-    const response = await fetchWithTimeout(url);
-    return { ok: response.ok, status: response.status };
-  } catch {
-    return { ok: false, status: 0 };
-  }
-}
-
 async function checkServerLiveness(options = {}) {
   const url = resolveLivenessUrl(options);
 
-  // First attempt: configured health endpoint (may require auth token).
-  const primary = await probeUrl(url);
-  if (primary.ok) {
-    return ok("Server liveness", "Server health endpoint is reachable", { url, status: primary.status });
-  }
-
-  // #6162: /api/health and /api/health/degradation require a management token.
-  // When unauthenticated, fall back to probing a publicly served static asset
-  // (favicon.ico) to confirm the Next.js server is alive and reachable.
-  // Derive the fallback URL from the primary URL (preserving protocol/host/port)
-  // so custom liveness URL configurations are honored. Fall back to defaults
-  // only if the primary URL can't be parsed.
-  let fallbackUrl;
   try {
-    const parsed = new URL(url);
-    parsed.pathname = "/favicon.ico";
-    parsed.search = "";
-    parsed.hash = "";
-    fallbackUrl = parsed.toString();
+    const response = await fetchWithTimeout(url);
+    if (!response.ok) {
+      return warn("Server liveness", `Server responded with HTTP ${response.status}`, { url });
+    }
+    return ok("Server liveness", "Server health endpoint is reachable", { url });
   } catch {
-    const port = parsePort(process.env.PORT || "20128", 20128);
-    const dashboardPort = parsePort(process.env.DASHBOARD_PORT || String(port), port);
-    const host = String(options.livenessHost || process.env.OMNIROUTE_DOCTOR_HOST || "127.0.0.1")
-      .trim()
-      .replace(/^https?:\/\//, "")
-      .replace(/\/.*$/, "");
-    fallbackUrl = `http://${formatHostForUrl(host || "127.0.0.1")}:${dashboardPort}/favicon.ico`;
+    return warn("Server liveness", "Server health endpoint is not reachable", { url });
   }
-  const fallback = await probeUrl(fallbackUrl);
-
-  if (fallback.ok) {
-    return ok(
-      "Server liveness",
-      `Server reachable (health endpoint returned ${primary.status}, likely requires MANAGEMENT_TOKEN)`,
-      { primaryUrl: url, primaryStatus: primary.status, fallbackUrl, fallbackStatus: fallback.status }
-    );
-  }
-
-  return warn(
-    "Server liveness",
-    `Server health endpoint returned HTTP ${primary.status || "no-response"} and fallback probe failed`,
-    { primaryUrl: url, primaryStatus: primary.status, fallbackUrl, fallbackStatus: fallback.status }
-  );
 }
 
 export async function collectDoctorChecks(context = {}, options = {}) {
   const rootDir =
     context.rootDir ||
-    path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
+    path.resolve(path.dirname(new URL(import.meta.url).pathname), "..", "..", "..");
   const dataDir = resolveDataDir();
   const dbPath = resolveStoragePath(dataDir);
 

bin/cli/commands/health.mjs

@@ -48,11 +48,7 @@ export async function runHealthCommand(opts = {}) {
   }
 
   try {
-    const res = await apiFetch("/api/monitoring/health", {
-      retry: false,
-      timeout: 5000,
-      acceptNotOk: true,
-    });
+    const res = await apiFetch("/api/health", { retry: false, timeout: 5000, acceptNotOk: true });
     if (!res.ok) {
       console.error(t("common.error", { message: `HTTP ${res.status}` }));
       return 1;
@@ -70,22 +66,29 @@ export async function runHealthCommand(opts = {}) {
     if (health.uptime) console.log(t("health.uptime", { uptime: health.uptime }));
     if (health.version) console.log(`  Version: ${health.version}`);
 
-    if (health.activeConnections !== undefined) {
-      console.log(t("health.requests", { count: health.activeConnections }));
+    if (health.requests !== undefined) {
+      console.log(t("health.requests", { count: health.requests }));
     }
 
-    if (health.circuitBreakers && opts.verbose) {
+    if (health.breakers && opts.verbose) {
       console.log("\n  \x1b[1mCircuit Breakers\x1b[0m");
-      const { open = 0, halfOpen = 0, closed = 0 } = health.circuitBreakers;
-      console.log(`    \x1b[32m● closed\x1b[0m     ${closed}`);
-      console.log(`    \x1b[33m○ half-open\x1b[0m  ${halfOpen}`);
-      console.log(`    \x1b[31m○ open\x1b[0m       ${open}`);
+      for (const [name, status] of Object.entries(health.breakers)) {
+        const state =
+          status.state === "closed" ? "\x1b[32m● closed\x1b[0m" : "\x1b[33m○ open\x1b[0m";
+        console.log(`    ${name.padEnd(20)} ${state}`);
+      }
     }
 
-    if (opts.verbose && health.memoryUsage) {
+    if (health.cache && opts.verbose) {
+      console.log("\n  \x1b[1mCache\x1b[0m");
+      console.log(`    Semantic hits:   ${health.cache.semanticHits || 0}`);
+      console.log(`    Signature hits:  ${health.cache.signatureHits || 0}`);
+    }
+
+    if (opts.verbose && health.memory) {
       console.log("\n  \x1b[1mMemory\x1b[0m");
-      console.log(`    RSS:        ${health.memoryUsage.rss || "N/A"}`);
-      console.log(`    Heap used:  ${health.memoryUsage.heapUsed || "N/A"}`);
+      console.log(`    RSS:        ${health.memory.rss || "N/A"}`);
+      console.log(`    Heap used:  ${health.memory.heapUsed || "N/A"}`);
     }
 
     return 0;
@@ -97,17 +100,13 @@ export async function runHealthCommand(opts = {}) {
 
 export async function runHealthComponentsCommand(opts = {}) {
   try {
-    const res = await apiFetch("/api/monitoring/health", {
-      retry: false,
-      timeout: 5000,
-      acceptNotOk: true,
-    });
+    const res = await apiFetch("/api/health", { retry: false, timeout: 5000, acceptNotOk: true });
     if (!res.ok) {
       console.error(`HTTP ${res.status}`);
       return 1;
     }
     const health = await res.json();
-    const components = health.components || health.circuitBreakers || {};
+    const components = health.components || health.breakers || {};
     for (const [name, info] of Object.entries(components)) {
       const status =
         typeof info === "object" ? info.state || info.status || "unknown" : String(info);

bin/cli/commands/launch-codex.mjs

@@ -19,16 +19,6 @@ const STRIPPED_CODEX_ENV_KEYS = [
 /** Placeholder so codex's `env_key` is always satisfied when the backend is open. */
 const NO_AUTH_SENTINEL = "omniroute-no-auth";
 
-// On Windows the `codex` binary is an npm `.cmd` shim that `spawn` cannot resolve
-// without a shell (bare "codex" → ENOENT). Mirror the qodercli Windows fix (#6263):
-// spawn `codex.cmd` through a shell on win32, and the bare binary elsewhere.
-export function resolveCodexSpawn(platform) {
-  if (platform === "win32") {
-    return { command: "codex.cmd", shell: true };
-  }
-  return { command: "codex", shell: undefined };
-}
-
 function stripTrailingSlash(value) {
   let s = String(value);
   let end = s.length;
@@ -136,10 +126,10 @@ export async function runLaunchCodexCommand(opts = {}, codexArgs = []) {
 
   if (!(await healthCheck(baseUrl))) {
     console.error(
-      (
-        t("launch.notRunning") ||
-        "OmniRoute is not reachable at {port}. Start it with 'omniroute serve'."
-      ).replace("{port}", baseUrl)
+      (t("launch.notRunning") || "OmniRoute is not reachable at {port}. Start it with 'omniroute serve'.").replace(
+        "{port}",
+        baseUrl
+      )
     );
     return 1;
   }
@@ -152,12 +142,7 @@ export async function runLaunchCodexCommand(opts = {}, codexArgs = []) {
   const env = buildCodexEnv(process.env, authToken);
 
   return await new Promise((resolve) => {
-    const { command: codexLaunch, shell: shellValue } = resolveCodexSpawn(process.platform);
-    const child = spawn(codexLaunch, extraArgs, {
-      env,
-      stdio: "inherit",
-      shell: shellValue,
-    });
+    const child = spawn("codex", extraArgs, { env, stdio: "inherit" });
     child.on("error", (err) => {
       if (err?.code === "ENOENT") {
         console.error(
@@ -180,16 +165,10 @@ export function registerLaunchCodex(program) {
       t("launchCodex.description") || "Launch Codex CLI pointed at OmniRoute (local or remote VPS)"
     )
     .option("--port <port>", "Local OmniRoute port (ignored when --remote is set)", "20128")
-    .option(
-      "--remote <url>",
-      "Remote OmniRoute base URL, e.g. http://192.168.0.15:20128 (overrides --port + context)"
-    )
+    .option("--remote <url>", "Remote OmniRoute base URL, e.g. http://192.168.0.15:20128 (overrides --port + context)")
     .option("--profile <name>", "Codex profile to activate (passed as --profile <name>)")
     .option("-p, --p <name>", "Alias for --profile")
-    .option(
-      "--api-key <key>",
-      "OmniRoute API key (overrides OMNIROUTE_API_KEY env var for this invocation)"
-    )
+    .option("--api-key <key>", "OmniRoute API key (overrides OMNIROUTE_API_KEY env var for this invocation)")
     .allowUnknownOption(true)
     .allowExcessArguments(true)
     .argument("[codexArgs...]", "arguments passed through to the codex binary")

bin/cli/commands/launch.mjs

@@ -106,10 +106,10 @@ export async function runLaunchCommand(opts = {}, claudeArgs = []) {
     if (!res.ok) throw new Error(`status ${res.status}`);
   } catch {
     console.error(
-      (
-        t("launch.notRunning") ||
-        "OmniRoute is not reachable at {port}. Start it with 'omniroute serve'."
-      ).replace("{port}", baseUrl)
+      (t("launch.notRunning") || "OmniRoute is not reachable at {port}. Start it with 'omniroute serve'.").replace(
+        "{port}",
+        baseUrl
+      )
     );
     return 1;
   }
@@ -120,14 +120,7 @@ export async function runLaunchCommand(opts = {}, claudeArgs = []) {
   const env = buildClaudeEnv(process.env, baseUrl, authToken, { configDir });
 
   return await new Promise((resolve) => {
-    // #8246: on Windows, npm installs claude as a .cmd shim — spawn() without
-    // shell:true cannot resolve PATHEXT shims and fails with ENOENT.
-    const claudeCommand = process.platform === "win32" ? "claude.cmd" : "claude";
-    const child = spawn(claudeCommand, claudeArgs, {
-      env,
-      stdio: "inherit",
-      ...(process.platform === "win32" ? { shell: true, windowsHide: true } : {}),
-    });
+    const child = spawn("claude", claudeArgs, { env, stdio: "inherit" });
     child.on("error", (err) => {
       if (err && err.code === "ENOENT") {
         console.error(t("launch.notFound") || "The 'claude' CLI was not found in PATH.");
@@ -149,10 +142,7 @@ export function registerLaunch(program) {
     )
     .option("--port <port>", t("serve.port") || "Proxy port", "20128")
     .option("--remote <url>", "Remote OmniRoute base URL (overrides --port and the active context)")
-    .option(
-      "--profile <name>",
-      "Claude Code profile to use (CLAUDE_CONFIG_DIR ~/.claude/profiles/<name>)"
-    )
+    .option("--profile <name>", "Claude Code profile to use (CLAUDE_CONFIG_DIR ~/.claude/profiles/<name>)")
     .option("--token <token>", t("launch.token") || "Token Claude sends (ANTHROPIC_AUTH_TOKEN)")
     .option("--api-key <key>", "Alias for --token (OmniRoute access token / API key)")
     .allowUnknownOption(true)

bin/cli/commands/login.mjs

@@ -1,192 +0,0 @@
-import { createServer } from "node:http";
-import { randomUUID } from "node:crypto";
-
-/**
- * `omniroute login antigravity` — local OAuth helper for remote installs.
- *
- * Why this exists: Google's `firstparty/nativeapp` consent for the embedded
- * Antigravity desktop client only releases the authorization code when the
- * loopback redirect (127.0.0.1:<port>) is REACHABLE. On a remote VPS install the
- * loopback is unreachable, so the consent hangs forever and never emits a code —
- * the dashboard's "paste the callback URL" fallback has nothing to paste. (The
- * same flow works locally and over an SSH tunnel, where the loopback IS reachable.)
- *
- * This command runs the OAuth on the user's OWN machine — where 127.0.0.1 works —
- * captures the code on a local loopback server, exchanges it for tokens, and
- * prints a single-line credential blob. The user pastes that blob into the remote
- * dashboard (Antigravity → "Paste credentials"), which decodes it, finalizes the
- * onboarding server-side, and persists the connection.
- *
- * It talks ONLY to Google (no OmniRoute server needed locally), so it works even
- * if the remote VPS is firewalled from the user's machine.
- */
-
-const PROVIDER = "antigravity";
-
-/** Open the system browser; no-op if the optional `open` dependency is missing. */
-async function defaultOpenBrowser(url) {
-  try {
-    const { default: open } = await import("open");
-    await open(url);
-  } catch {
-    // `open` not available — the caller already printed the URL to paste manually.
-  }
-}
-
-/**
- * Start a loopback HTTP server bound to 127.0.0.1 (NOT 0.0.0.0 — we never want to
- * expose the callback to the LAN). Resolves to { port, waitForCallback, close }.
- */
-function defaultStartServer(preferredPort) {
-  return new Promise((resolve, reject) => {
-    let resolveCallback;
-    const callbackPromise = new Promise((r) => {
-      resolveCallback = r;
-    });
-
-    const server = createServer((req, res) => {
-      const url = new URL(req.url, "http://127.0.0.1");
-      if (url.pathname !== "/callback" && url.pathname !== "/auth/callback") {
-        res.writeHead(404).end();
-        return;
-      }
-      const params = Object.fromEntries(url.searchParams.entries());
-      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      res.end(
-        "<!doctype html><meta charset=utf-8><title>OmniRoute</title>" +
-          "<body style=\"font-family:system-ui;padding:2rem\">" +
-          "<h2>✅ Authorization received</h2>" +
-          "<p>Return to your terminal — you can close this tab.</p></body>"
-      );
-      resolveCallback(params);
-    });
-
-    server.on("error", reject);
-    server.listen(preferredPort || 0, "127.0.0.1", () => {
-      const { port } = server.address();
-      resolve({
-        port,
-        waitForCallback: () => callbackPromise,
-        close: () => new Promise((r) => server.close(() => r())),
-      });
-    });
-  });
-}
-
-/** Lazy-load the antigravity provider + blob codec (TS source via tsx). */
-async function loadDeps() {
-  const { antigravity } = await import("../../../src/lib/oauth/providers/antigravity.ts");
-  const { encodeCredentialBlob } = await import("../../../src/lib/oauth/credentialBlob.ts");
-  return { antigravity, encodeCredentialBlob };
-}
-
-/**
- * Build the Google authorization request for a given loopback port. Uses a plain
- * authorization_code grant (NO PKCE code_challenge) — matching the working flow:
- * a code_challenge here would force the exchange to require a code_verifier.
- */
-export async function buildAntigravityAuthRequest(port, makeState = randomUUID) {
-  const { antigravity } = await loadDeps();
-  const redirectUri = `http://127.0.0.1:${port}/callback`;
-  const state = makeState();
-  const authUrl = antigravity.buildAuthUrl(antigravity.config, redirectUri, state);
-  return { redirectUri, state, authUrl };
-}
-
-/** Exchange the captured code for raw Google tokens (no code_verifier — no PKCE). */
-export async function exchangeAntigravityCode(code, redirectUri) {
-  const { antigravity } = await loadDeps();
-  return antigravity.exchangeToken(antigravity.config, code, redirectUri);
-}
-
-/**
- * Orchestrate the local login. Dependencies are injectable for testing; the real
- * path uses a 127.0.0.1 loopback server, the system browser, and a live token
- * exchange against Google. Returns the credential blob string.
- */
-export async function runAntigravityLogin(opts = {}, deps = {}) {
-  const startServer = deps.startServer ?? defaultStartServer;
-  const openBrowser = deps.openBrowser ?? defaultOpenBrowser;
-  const exchange = deps.exchange ?? exchangeAntigravityCode;
-  const makeState = deps.makeState ?? randomUUID;
-  const print = deps.print ?? ((s) => process.stdout.write(s));
-  const log = deps.log ?? ((s) => process.stderr.write(s));
-  const { encodeCredentialBlob } = await loadDeps();
-
-  const server = await startServer(opts.port);
-  const { redirectUri, state, authUrl } = await buildAntigravityAuthRequest(server.port, makeState);
-
-  log(`\nOpen this URL to authorize Antigravity (it will open automatically):\n\n  ${authUrl}\n\n`);
-  if (opts.browser !== false) await openBrowser(authUrl);
-  log("Waiting for Google to redirect back to the local loopback...\n");
-
-  const timeoutMs = opts.timeout ?? 300000;
-  let timer;
-  let params;
-  try {
-    params = await Promise.race([
-      server.waitForCallback(),
-      new Promise((_, reject) => {
-        timer = setTimeout(
-          () => reject(new Error("Timed out waiting for the OAuth callback")),
-          timeoutMs
-        );
-        // Don't keep the event loop alive solely for this timer.
-        if (typeof timer.unref === "function") timer.unref();
-      }),
-    ]);
-  } finally {
-    clearTimeout(timer);
-    await server.close();
-  }
-
-  if (params.error) {
-    throw new Error(`Authorization failed: ${params.error_description || params.error}`);
-  }
-  if (params.state !== state) {
-    throw new Error("State mismatch — aborting (possible CSRF). Please retry the login.");
-  }
-  if (!params.code) {
-    throw new Error("No authorization code returned by Google.");
-  }
-
-  const tokens = await exchange(params.code, redirectUri);
-  const blob = encodeCredentialBlob({ provider: PROVIDER, tokens });
-
-  print(
-    "\n" +
-      "Antigravity authorized. Copy the line below and paste it into your remote\n" +
-      "OmniRoute dashboard: Providers → Antigravity → Connect → \"Paste credentials\".\n" +
-      "(This contains a refresh token — treat it like a password.)\n\n" +
-      blob +
-      "\n\n"
-  );
-  return blob;
-}
-
-async function runLoginAntigravity(opts) {
-  try {
-    await runAntigravityLogin({
-      browser: opts.browser,
-      timeout: opts.timeout,
-      port: opts.port,
-    });
-  } catch (err) {
-    process.stderr.write(`\nLogin failed: ${err?.message || err}\n`);
-    process.exit(1);
-  }
-}
-
-export function registerLogin(program) {
-  const login = program
-    .command("login")
-    .description("Local OAuth helpers for remote OmniRoute installs (run on your own machine)");
-
-  login
-    .command("antigravity")
-    .description("Authorize Antigravity locally and print a credential blob to paste remotely")
-    .option("--no-browser", "Do not auto-open the browser; print the URL instead")
-    .option("--port <n>", "Fixed loopback port (default: OS-assigned)", (v) => parseInt(v, 10))
-    .option("--timeout <ms>", "How long to wait for the callback", (v) => parseInt(v, 10), 300000)
-    .action(runLoginAntigravity);
-}

bin/cli/commands/logs.mjs

@@ -1,6 +1,5 @@
 import { writeFileSync, appendFileSync, existsSync, unlinkSync } from "node:fs";
 import { t } from "../i18n.mjs";
-import { getBaseUrl, buildHeaders } from "../api.mjs";
 
 export function registerLogs(program) {
   program
@@ -10,7 +9,7 @@ export function registerLogs(program) {
     .option("--filter <level>", t("logs.filter"))
     .option("--lines <n>", t("logs.lines"), "100")
     .option("--timeout <ms>", t("logs.timeout"), "30000")
-    .option("--base-url <url>", t("logs.baseUrl"))
+    .option("--base-url <url>", t("logs.baseUrl"), "http://localhost:20128")
     .option("--request-id <id>", t("logs.requestId"))
     .option("--api-key <key>", t("logs.apiKey"))
     .option("--combo <name>", t("logs.combo"))
@@ -20,14 +19,7 @@ export function registerLogs(program) {
     .option("--export <path>", t("logs.export"))
     .action(async (opts, cmd) => {
       const globalOpts = cmd.optsWithGlobals();
-      // `--context` and `--output` are global options, so forward them explicitly:
-      // runLogsCommand resolves the base URL via getBaseUrl({ context }), and without
-      // this a user's `--context` would be silently dropped.
-      const exitCode = await runLogsCommand({
-        ...opts,
-        context: globalOpts.context,
-        output: globalOpts.output,
-      });
+      const exitCode = await runLogsCommand({ ...opts, output: globalOpts.output });
       if (exitCode !== 0) process.exit(exitCode);
     });
 }
@@ -75,10 +67,7 @@ function buildLogFilter(opts) {
 }
 
 export async function runLogsCommand(opts = {}) {
-  // Resolve the base URL the same way every other CLI command does: an explicit
-  // --base-url wins, otherwise fall back to the active context / env / localhost.
-  // Without this, `logs` always hit localhost and ignored a connected remote.
-  const baseUrl = opts.baseUrl || opts["base-url"] || getBaseUrl({ context: opts.context });
+  const baseUrl = opts.baseUrl || opts["base-url"] || "http://localhost:20128";
   const follow = opts.follow ?? false;
   const timeout = parseInt(String(opts.timeout || "30000"), 10);
   const isJson = opts.output === "json";
@@ -93,21 +82,8 @@ export async function runLogsCommand(opts = {}) {
   // Pass only level filters to the stream (server-side); other filters are client-side
   const levelFilters = opts.filter ? opts.filter.split(",").map((f) => f.trim()) : [];
 
-  // Authenticate the log stream. The /api/cli-tools/logs endpoint requires the
-  // management token; build the same headers (scoped context token + CLI token)
-  // that apiFetch uses, so `logs` works against authenticated/remote servers.
-  // NOTE: --api-key here is a client-side log *filter* (see buildLogFilter), not
-  // an auth credential, so it is deliberately not forwarded to buildHeaders.
-  const headers = await buildHeaders({ baseUrl, context: opts.context });
-
   const { createLogStream } = await import("../../../src/lib/cli-helper/log-streamer.js");
-  const { stream, stop } = createLogStream({
-    baseUrl,
-    filters: levelFilters,
-    follow,
-    timeout,
-    headers,
-  });
+  const { stream, stop } = createLogStream({ baseUrl, filters: levelFilters, follow, timeout });
 
   const reader = stream.getReader();
   const decoder = new TextDecoder();

bin/cli/commands/oauth.mjs

@@ -7,6 +7,7 @@ const PROVIDERS_WITH_OAUTH = [
   { id: "gemini", name: "Google Gemini", flow: "browser" },
   { id: "antigravity", name: "Antigravity", flow: "browser" },
   { id: "windsurf", name: "Windsurf", flow: "browser" },
+  { id: "qwen", name: "Qwen Code", flow: "browser" },
   { id: "cursor", name: "Cursor", flow: "import" },
   { id: "zed", name: "Zed", flow: "import" },
   { id: "kiro", name: "Amazon Kiro", flow: "social" },