Merge remote-tracking branch 'origin/release/v3.8.50' into fix/release-v3.8.50-basereds

`assertValidEngine()` valida id, apply, compress, getConfigSchema e
validateConfig — não exige `metadata`. Uma engine registrada sem esse campo é,
portanto, um registro legal. Mas `canRunAtCompressionStage` lia
`engine.metadata.executionStages` sem guarda, então essa engine legal derrubava o
pipeline inteiro com `TypeError: Cannot read properties of undefined` em vez de
falhar aberto, que é o contrato da compressão.

Metadata ausente é o mesmo caso de "não declarou executionStages" e passa a cair
no mesmo fallback documentado: só pre-translation.

Isso destravava também `tests/unit/compression/pipeline-circuit-breaker.test.ts`,
que registra uma engine de teste sem metadata e vinha 8/9 na base — agora 9/9. O
teste novo torna o contrato explícito, em vez de deixá-lo dependendo de uma
reprodução incidental noutro arquivo.

.env.example

@@ -65,12 +65,6 @@ INITIAL_PASSWORD=CHANGEME
 # OMNIROUTE_RELEASE_REF=origin/main
 # OMNIROUTE_ALLOW_CANARY_BUILD=1
 
-# Build-phase signal (#10060). Set to 1 by scripts/build/build-next-isolated.mjs and
-# inherited by every spawned build worker so the DB layer returns a no-op stub instead
-# of loading the native better-sqlite3 addon (which aborts the worker on exit).
-# Never set this for the running server. Used by: src/lib/buildPhase.ts, src/lib/db/core.ts
-# OMNIROUTE_BUILDING=1
-
 # Encryption key for SQLite database encryption at rest.
 # Used by: src/lib/db/encryption.ts — encrypts the entire SQLite database.
 # Generate: openssl rand -hex 32  |  Leave empty to disable DB encryption.
@@ -93,10 +87,6 @@ DISABLE_SQLITE_AUTO_BACKUP=false
 # Used by: src/shared/utils/rateLimiter.ts
 # Example: redis://localhost:6379 (or redis://redis:6379 in Docker)
 # REDIS_URL=redis://localhost:6379
-# Namespace prefix for ALL OmniRoute Redis keys (rate limiter + auth cache +
-# quota store). Prevents key collisions when OmniRoute shares a Redis instance
-# with other apps (e.g. on 127.0.0.1:6379). Default when unset: omniroute:
-# REDIS_KEY_PREFIX=omniroute:
 # Host interface docker-compose publishes the Redis sidecar on.
 # Default: 127.0.0.1 (loopback only). The compose Redis runs WITHOUT
 # `requirepass`, and app containers reach it over the compose network
@@ -138,11 +128,6 @@ PORT=20128
 # Optional: set the public origin *with* the same path so OAuth and display URLs
 # stay consistent without relying on window.location.origin alone:
 # NEXT_PUBLIC_BASE_URL=https://host/omniroute
-#
-# Explicit path probed by the container health check. Unset, the probe derives it
-# from OMNIROUTE_BASE_PATH; setting it opts back into the deep monitoring endpoint.
-# Used by: scripts/dev/healthcheck.mjs
-# OMNIROUTE_HEALTHCHECK_PATH=/api/monitoring/health
 
 # Opt-in iframe embedding of the OmniRoute HTML pages (issue #10273). Off by default:
 # every route ships `frame-ancestors 'none'` + `X-Frame-Options: DENY`, which is why the
@@ -153,8 +138,6 @@ PORT=20128
 # (/api, /v1, /v1beta, /a2a, /healthz and the root-level aliases) keeps the strict
 # headers regardless. Only `vscode` is recognised; `1`/`true` do NOT enable it.
 # Used by: next.config.mjs via scripts/build/dashboardEmbed.mjs — build-time, rebuild after changing.
-# Docker: pass it as a build arg (`docker build --build-arg DASHBOARD_ALLOW_EMBED=vscode`);
-# setting it on an already-built server or image does nothing.
 # DASHBOARD_ALLOW_EMBED=vscode
 
 # Split-port mode: serve Dashboard and API on separate ports for network isolation.
@@ -239,15 +222,6 @@ PORT=20128
 # unaffected by this dev-only flag).
 OMNIROUTE_USE_TURBOPACK=1
 
-# Disable systemd sd_notify (Type=notify / WatchdogSec=) even when running
-# under a systemd unit with NOTIFY_SOCKET set.
-# Used by: scripts/dev/systemd-notify.mjs. Set to 1 to disable.
-# OMNIROUTE_DISABLE_SD_NOTIFY=1
-
-# Injected by systemd when running under a service unit (sd_notify protocol).
-# Read by scripts/dev/systemd-notify.mjs — never set this yourself.
-# NOTIFY_SOCKET=/run/systemd/notify
-
 # Skip the SQLite integrity health check on startup (faster boot on large DBs).
 # Used by: src/lib/db/core.ts, src/lib/db/healthCheck.ts. Set to 1 to skip.
 # OMNIROUTE_SKIP_DB_HEALTHCHECK=1
@@ -283,11 +257,6 @@ OMNIROUTE_USE_TURBOPACK=1
 # so a missing/corrupt cache never breaks tab-completion.
 # OMNIROUTE_DEBUG_COMPLETION=1
 
-# Set to 1 to print per-request timing diagnostics from the CLI quota commands
-# to stderr (`[omniroute] GET <path> completed in Nms`).
-# Used by: bin/cli/commands/quota.mjs
-# OMNIROUTE_DEBUG=1
-
 # Docker production port mappings (docker-compose.prod.yml only).
 # These set the HOST-side published ports. Container ports use PORT/API_PORT.
 # PROD_DASHBOARD_PORT=20130
@@ -382,8 +351,9 @@ ALLOW_API_KEY_REVEAL=false
 # NO_LOG_API_KEY_IDS=key_abc123,key_def456
 
 # Fallback per-day request budget applied to API keys whose `rate_limits`
-# column is null. Default (unset/empty) is unlimited (no implicit caps).
-# Malformed values preserve the legacy 1000/day, 5000/week, 20000/month windows.
+# column is null. Default (unset/empty/malformed) preserves the legacy
+# 1000/day, 5000/week, 20000/month windows so existing deployments do not
+# silently lose rate limiting on upgrade.
 # Set explicitly to "0" to opt out entirely (unlimited fallback). Any
 # positive integer N enables N/day, 5N/week, 20N/month.
 # Used by: src/shared/utils/apiKeyPolicy.ts — checkRateLimit() fallback.
@@ -426,15 +396,6 @@ ALLOW_API_KEY_REVEAL=false
 # by OMNIROUTE_CHAT_MAX_HEAVY_IN_FLIGHT and the heap-pressure shed instead. Set a positive
 # value only on memory-constrained deployments that need a hard ceiling.
 # OMNIROUTE_CHAT_HARD_MAX_MESSAGES=0
-
-# Skip OmniRoute's local context-window and max-input-token check for direct
-# single-model requests. Default: false (dangerous opt-in).
-# The upstream provider still enforces its real limits, so enabling this can
-# replace an early OmniRoute 400 with an upstream context-length error.
-# Prompt compression and the model's own output-token cap remain active.
-# Also configurable from Dashboard > Settings > Feature Flags; no restart is
-# required. Used by: src/shared/utils/featureFlags.ts and open-sse/handlers/chatCore.ts.
-# DISABLE_CONTEXT_WINDOW_CHECKS=false
 # How long a heavy request waits for heavyweight capacity before a retryable 503.
 # A short bounded wait serializes agent bursts instead of an instant 503; 0 = instant.
 # Default 2000 (2s).
@@ -723,11 +684,6 @@ NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
 # ALL_PROXY=socks5://127.0.0.1:7890
 # NO_PROXY=localhost,127.0.0.1
 
-# Pin the echo-IP target used by proxy egress probes. Unset, the probe tries
-# api64.ipify.org then api4.ipify.org so IPv4-only tunnels are not reported dead.
-# Used by: src/lib/proxyEchoTarget.ts.
-# OMNIROUTE_PROXY_ECHO_URL=https://api4.ipify.org?format=json
-
 # Max concurrent sockets per cached HTTP/SOCKS proxy dispatcher.
 # Long-lived SSE streams such as Codex /v1/responses need more than one
 # connection when multiple requests share the same account-level proxy.
@@ -805,25 +761,11 @@ NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
 # CLI_CURSOR_BIN=agent
 # CLI_CLINE_BIN=cline
 # CLI_CONTINUE_BIN=cn
-# CLI_QODER_BIN=qodercli
+# CLI_QODER_BIN=qoder
 # CLI_QWEN_BIN=qwen
 # CLI_AIDER_BIN=aider
 # CLI_GOOSE_BIN=goose
 # CLI_GEMINI_BIN=gemini
-# CLI_KILO_BIN=kilocode
-# CLI_OPENCODE_BIN=opencode
-# CLI_HERMES_BIN=hermes
-# CLI_FORGE_BIN=forge
-# CLI_JCODE_BIN=jcode
-# CLI_DEEPSEEK_TUI_BIN=deepseek-tui
-# CLI_CODEWHALE_BIN=codewhale
-# CLI_SMELT_BIN=smelt
-# CLI_PI_BIN=pi
-# CLI_CRUSH_BIN=crush
-# CLI_OMP_BIN=omp
-# CLI_LETTA_BIN=letta
-# Windsurf has no default binary — set this to enable binary detection for it.
-# CLI_WINDSURF_BIN=windsurf
 # CLI_AUGGIE_BIN=auggie
 # AUGGIE_BIN=auggie
 
@@ -908,21 +850,13 @@ NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
 # Set to 0/false/off to skip compression entirely. Default: rtk
 # OMNIROUTE_MCP_DESCRIPTION_COMPRESSION=rtk
 
-# Abort budget (ms) for MCP-server internal management reads (health, resilience,
-# combos, quota, usage). Default: 10000. Used by: open-sse/mcp-server/fetchTimeout.ts
-# OMNIROUTE_MCP_FETCH_TIMEOUT_MS=10000
-
-# Abort budget (ms) for MCP hops that wait on a provider (route_request, web_search,
-# web_fetch). Default: 60000. Used by: open-sse/mcp-server/fetchTimeout.ts
-# OMNIROUTE_MCP_UPSTREAM_TIMEOUT_MS=60000
-
 # Model catalog sync interval in hours.
 # Used by: src/shared/services/modelSyncScheduler.ts — periodic model refresh.
 # Default: 24
 # MODEL_SYNC_INTERVAL_HOURS=24
 
 # Provider limits sync interval in minutes (rate limit windows, quotas).
-# Used by: src/lib/usage/providerLimits.ts — polls provider health endpoints.
+# Used by: src/server-init.ts — polls provider health endpoints.
 # Default: 70
 PROVIDER_LIMITS_SYNC_INTERVAL_MINUTES=70
 
@@ -1073,10 +1007,6 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # Used by: src/lib/db/core.ts::getDbHealthCheckIntervalMs().
 #OMNIROUTE_DB_HEALTHCHECK_INTERVAL_MS=21600000
 
-# WAL truncate cadence override (ms).  Set to 0 to disable.  Default: 21600000 (6h).
-# Used by: src/lib/db/core.ts::getWalTruncateIntervalMs().
-#OMNIROUTE_WAL_TRUNCATE_INTERVAL_MS=21600000
-
 # Skip the Redis-backed auth cache used by API key lookups (forces DB reads).
 # Used by: src/lib/db/apiKeys.ts.  Set to 1 to disable.  Default: enabled.
 #OMNIROUTE_DISABLE_REDIS_AUTH_CACHE=0
@@ -1309,36 +1239,6 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # set to true/1/yes to enable. Used by: open-sse/executors/codex.ts.
 # OMNIROUTE_CODEX_DROP_NONSTANDARD_EVENTS=true
 
-# Codex app-server WebSocket transport (opt-in). When a WebSocket URL and a
-# capability token are both provided, Codex requests are routed through a local
-# `codex app-server` sidecar over JSON-RPC instead of the HTTP Responses API.
-# Each var is also settable per-connection via providerSpecificData; the env var
-# is the process-wide fallback. Used by:
-# open-sse/executors/codex/appServerConfig.ts.
-#
-# WebSocket endpoint of the codex app-server (ws:// or wss://). Required to
-# enable the transport; leaving it unset keeps Codex on its HTTP transports.
-# OMNIROUTE_CODEX_APPSERVER_WS=ws://127.0.0.1:8081
-# Inline capability/bearer token presented to the app-server.
-# OMNIROUTE_CODEX_APPSERVER_WS_TOKEN=deadbeef...
-# Path to a file holding the capability token (produced by
-# `codex app-server --ws-token-file <path>`). Used when the inline token above
-# is not set.
-# OMNIROUTE_CODEX_APPSERVER_WS_TOKEN_FILE=/run/codex-ws-token
-# Working directory the app-server turn runs in (defaults to /tmp).
-# OMNIROUTE_CODEX_APPSERVER_CWD=/tmp
-# Approval policy passed to the app-server turn (e.g. never, on-request).
-# OMNIROUTE_CODEX_APPSERVER_APPROVAL=never
-# Sandbox policy passed to the app-server turn (e.g. read-only,
-# workspace-write, danger-full-access). When unset, the executor defaults to
-# "workspace-write" (hardened; used to be "danger-full-access").
-# OMNIROUTE_CODEX_APPSERVER_SANDBOX=read-only
-# Auto-approve the app-server's own approval prompts (command/file/permission
-# execution on the host). Defaults to OFF — prompts are auto-denied. Set to
-# true/1/yes only when you trust the deployment to run codex-decided host
-# commands. Per-connection override: providerSpecificData.codexAppServerAutoApprove.
-# OMNIROUTE_CODEX_APPSERVER_AUTO_APPROVE=false
-
 # ═══════════════════════════════════════════════════════════════════════════════
 # 13. CLI FINGERPRINT COMPATIBILITY (Anti-Detection)
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -1422,14 +1322,6 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # FETCH_BODY_TIMEOUT_MS=600000       # Time to receive full response body
 # FETCH_CONNECT_TIMEOUT_MS=30000     # TCP connection establishment (default: 30s)
 # FETCH_KEEPALIVE_TIMEOUT_MS=4000    # Keep-alive socket idle timeout (default: 4s)
-# OMNIROUTE_DIRECT_HEADERS_TIMEOUT_MS=30000  # Bounded response-start window per direct
-#                                     # (no-proxy) attempt (#10214). A silently-dropped
-#                                     # pooled keep-alive socket surfaces no transport
-#                                     # error, so without this bound a direct request can
-#                                     # stall until undici's headersTimeout (600s) or the
-#                                     # caller's deadline; on expiry the request retries
-#                                     # once on a fresh no-keep-alive socket. 0 disables
-#                                     # the bound (default: 30000 = 30s).
 
 # Default timeout (ms) for src/shared/utils/fetchTimeout.ts. Acts as the
 # fallback when FETCH_TIMEOUT_MS is unset. Default: 120000 (2 min).
@@ -1484,14 +1376,6 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # OMNIROUTE_PPLX_TLS_TIMEOUT_MS=30000
 # OMNIROUTE_PPLX_TLS_GRACE_MS=10000
 
-# ── Perplexity web: built-in-search hint ──
-# Used by: open-sse/executors/perplexity-web/protocol.ts — appends "You have
-# built-in web search. Answer questions directly using search results." to the
-# caller's system message. Off by default: Perplexity's answer engine searches
-# anyway, and for coding clients the sentence leaks into replies as
-# meta-commentary. Set to 1/true/yes/on to restore the old behavior.
-# OMNIROUTE_PPLX_SEARCH_HINT=0
-
 # ── Grok web TLS sidecar (Chrome-fingerprinted client) ──
 # Used by: open-sse/services/grokTlsClient.ts — wire-level timeout for the
 # bogdanfinn/tls-client koffi binding and the JS-side grace window layered on
@@ -1522,20 +1406,6 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # OMNIROUTE_BROWSER_POOL=on
 # WEB_COOKIE_USE_BROWSER=0
 
-# ── Kimi Web (international kimi.ai Connect-RPC) ──
-# Used by: open-sse/executors/kimi-web.ts. Override the base/chat URLs only if
-# you need a mirror or proxy endpoint; defaults target https://www.kimi.ai with
-# the Connect-RPC chat path /apiv2/kimi.gateway.chat.v1.ChatService/Chat.
-# KIMI_WEB_BASE_URL=https://www.kimi.ai
-# KIMI_WEB_CHAT_URL=https://www.kimi.ai/apiv2/kimi.gateway.chat.v1.ChatService/Chat
-
-# When OIDC is enabled, disable password login so users can only authenticate
-# via OIDC Single Sign-On. The bare alias OIDC_DISABLE_PASSWORD_LOGIN is also
-# accepted; the Dashboard Feature Flag takes precedence. Used by:
-# src/app/api/auth/login/route.ts, src/app/api/settings/require-login/route.ts.
-# OMNIROUTE_OIDC_DISABLE_PASSWORD_LOGIN=false
-# OIDC_DISABLE_PASSWORD_LOGIN=false
-
 # ── Adobe Firefly browser sign-in (system Chrome/Edge CDP) ──
 # Used by: open-sse/services/adobeFireflyBrowserLogin.ts. The Firefly login
 # flow drives a real, system-installed Chrome or Microsoft Edge via CDP so the
@@ -1980,6 +1850,10 @@ APP_LOG_TO_FILE=true
 # Default: 300000 (5 minutes)
 # SEARCH_CACHE_TTL_MS=300000
 
+# ── OpenAI-compatible multi-connection ──
+# Allow multiple simultaneous connections per OpenAI-compatible provider node.
+# Used by: src/app/api/providers/route.ts
+# ALLOW_MULTI_CONNECTIONS_PER_COMPAT_NODE=false
 
 # ── CC-compatible provider (experimental) ──
 # Enable the Claude Code compatible provider endpoint.
@@ -2075,16 +1949,6 @@ APP_LOG_TO_FILE=true
 # Reachability probe target for the scheduler and the auto-test endpoint.
 # Point it at an internal/self-hosted URL to avoid the public default.
 # PROXY_HEALTH_TEST_URL=https://httpbin.org/ip
-# Probes started at once per batch, for the scheduler and the auto-test endpoint.
-# Floored at 1 and capped at 50. Default: 10.
-# PROXY_HEALTH_TEST_CONCURRENCY=10
-# Delay in ms between two probe departures inside a batch. Without it the whole batch
-# leaves at once and a shared egress IP can trip a rate-limited target. 0 disables the
-# spacing; capped at 5000. Default: 100.
-# PROXY_HEALTH_TEST_STAGGER_MS=100
-# Set "false" to stop probing the real host of a proxy's assigned provider (GET /models,
-# no API key) and always use the generic target above instead. Default: enabled.
-# PROXY_HEALTH_USE_PROVIDER_TARGET=true
 # Set "true" to let the scheduler auto-remove proxies after repeated failures.
 # PROXY_AUTO_REMOVE=false
 # Consecutive failures before an auto-remove fires. Default: 3.
@@ -2227,19 +2091,6 @@ APP_LOG_TO_FILE=true
 # Used by: open-sse/utils/cursorAgentCliVersion.ts. Default: detect local install, else pin.
 # CURSOR_AGENT_CLI_VERSION=2026.07.08-0c04a8a
 
-# Path to the Cursor Agent binary used for image generation.
-# Used by: open-sse/handlers/imageGeneration/providers (CURSOR_IMAGE.md).
-# CURSOR_AGENT_BIN=/path/to/agent
-
-# Cursor image-generation wall clock (ms). Default: 210000.
-# CURSOR_IMG_TIMEOUT_MS=210000
-
-# Shared-seat concurrency gate for Cursor image jobs. Default: 2.
-# CURSOR_IMG_MAX_CONCURRENT=2
-
-# Override Cursor CLI --model for image jobs. Default: request model / auto.
-# CURSOR_IMG_MODEL=auto
-
 # Cursor Agent CLI data directory override (versions live under <dir>/versions/).
 # Used by: open-sse/utils/cursorAgentCliVersion.ts. Default: ~/.local/share/cursor-agent (unix)
 # or %LOCALAPPDATA%\cursor-agent (win32). Official agent CLI also honors this var.
@@ -2613,11 +2464,6 @@ APP_LOG_TO_FILE=true
 # intended to be published as `omniroute-secure`. See SECURITY.md.
 # OMNIROUTE_BUILD_PROFILE=full
 
-# Override the standalone build output directory consumed by the post-build
-# colocation step. Default: the real Next.js standalone output under .build/.
-# Used by: scripts/build/colocate-standalone.mjs (build tooling, not runtime).
-# OMNIROUTE_STANDALONE_DIR=
-
 # Skip emitting `.tar.gz` tarballs during optional-pack staging for the Electron
 # standalone tree (pack directories + optional-packs.index.json are still produced).
 # Used by the desktop release workflow to trim artifact upload size.
@@ -2632,8 +2478,6 @@ APP_LOG_TO_FILE=true
 # ELECTRON_SMOKE_DATA_DIR=
 # ELECTRON_SMOKE_KEEP_DATA=0
 # ELECTRON_SMOKE_STREAM_LOGS=0
-# #7592: second launch against the same DATA_DIR must pick the native driver.
-# ELECTRON_SMOKE_COLD_RESTART=0
 
 # Playground Studio
 # Default model used by the improve-prompt route (optional; falls back to model in request body).
@@ -2973,14 +2817,18 @@ QUOTA_STORE_DRIVER=sqlite
 # Minimum spacing between submissions and the extra pause after every third success.
 # ADOBE_FIREFLY_MIN_SUBMIT_GAP_MS=12000
 # ADOBE_FIREFLY_BATCH_EXTRA_GAP_MS=15000
-# Browser used by Adobe Firefly renewal. True headless is debug-only: Adobe
-# colligo normally rejects risk tokens minted without a headed browser.
-# Used by: open-sse/services/adobeFireflyBrowserLogin.ts
+# Chrome CDP runtime used by Adobe Firefly renewal. True headless is debug-only:
+# Adobe colligo normally rejects risk tokens minted without a headed browser.
+# ADOBE_FIREFLY_CHROME_CDP_PORT=9334
+# ADOBE_FIREFLY_CHROME_VISIBLE=0
+# ADOBE_FIREFLY_CHROME_HEADED=0  # Legacy alias for ADOBE_FIREFLY_CHROME_VISIBLE=1
 # ADOBE_FIREFLY_CHROME_HEADLESS=0
-# The CDP-attached Chrome runtime (adobeFireflyChromeRuntime.ts) was removed in
-# #9255 along with its knobs — ADOBE_FIREFLY_CHROME_CDP_PORT, _VISIBLE, _HEADED,
-# _PING, _FORCE_RESTART, ADOBE_FIREFLY_LOGIN_WAIT_MS and _FORTER_WAIT_MS are read
-# nowhere and have no effect.
+# ADOBE_FIREFLY_CHROME_FORCE_RESTART=0
+# ADOBE_FIREFLY_CHROME_PING=auto
+# ADOBE_FIREFLY_LOGIN_WAIT_MS=0
+# ADOBE_FIREFLY_FORTER_WAIT_MS=45000
+# Optional absolute Chrome executable; auto-detected when unset.
+# CHROME_PATH=
 
 # Telegram Mini App bridge. The update endpoint remains disabled while the bot
 # token is unset. Used by: src/lib/telegram/* and src/app/api/telegram/update/route.ts.

.gitattributes

@@ -1,11 +0,0 @@
-# Shell scripts must always be checked out with LF line endings.
-#
-# On Windows, core.autocrlf=true converts text files to CRLF in the working
-# tree. Scripts that are kernel-exec'd (Docker ENTRYPOINT, bin/*.sh on Linux
-# hosts) then fail with `exec ...: no such file or directory` because the
-# shebang becomes "#!/bin/sh\r". eol=lf overrides autocrlf for these files.
-*.sh text eol=lf
-
-# This file must stay LF too: git parses it as-is, and a trailing CR would
-# corrupt every pattern (e.g. "*.sh\r" matches nothing).
-.gitattributes text eol=lf

.github/dependabot.yml

@@ -50,13 +50,13 @@ updates:
       # bumps; majors here need their own PR and a deliberate migration review.
       - dependency-name: "ioredis"
         update-types: ["version-update:semver-major"]
-      # @huggingface/transformers is VPS-validated at ^4.2.0 (migrated intentionally in
-      # #9962). It is load-bearing for the LLMLingua ONNX compression engine (open-sse/
-      # services/compression/engines/llmlingua/ — @atjsh/llmlingua-2@2.0.5 peers on
-      # "@huggingface/transformers": "^3.5.2 || ^4.0.0") and for local memory embeddings
-      # (src/lib/memory/embedding/transformersLocal.ts). Further majors must be re-validated
-      # on the VPS — so keep auto-bumps frozen (no update-types = ignore every version).
-      # Migrate it intentionally, not via dependabot (#4050).
+      # @huggingface/transformers is HARD-PINNED at 3.5.2 (exact, no caret) — FROZEN.
+      # It is load-bearing for the LLMLingua ONNX compression engine (open-sse/services/
+      # compression/engines/llmlingua/ — worker.ts pins @huggingface/transformers@3.5.2)
+      # and for local memory embeddings (src/lib/memory/embedding/transformersLocal.ts),
+      # and was VPS-validated at 3.5.2 (#4014). 4.x breaks both, and even 3.x minors must
+      # be re-validated on the VPS — so freeze ALL auto-bumps (no update-types = ignore
+      # every version). Migrate it intentionally, not via dependabot (#4050).
       - dependency-name: "@huggingface/transformers"
 
   - package-ecosystem: "github-actions"

.github/workflows/codeql.yml

@@ -22,10 +22,10 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+      - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           languages: javascript-typescript
           queries: security-extended
-      - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+      - uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           category: "/language:javascript-typescript"

.github/workflows/dast-smoke.yml

@@ -46,7 +46,6 @@ jobs:
         env:
           PORT: "20128"
           INJECTION_GUARD_MODE: block
-          REQUIRE_API_KEY: "false"
         run: |
           node dist/server.js > server.log 2>&1 &
           echo $! > server.pid
@@ -65,20 +64,16 @@ jobs:
           # those 302s as "the API accepted a schema-violating request" and the configured-off
           # 400 as "rejected a schema-compliant request". Documenting the flow in the spec is
           # still right (operators need it); fuzzing it is not what this smoke is for.
-          # /api/auth/login has brute-force rate limiting: repeated failed logins return 429,
-          # which Schemathesis flags as rejection of schema-compliant requests.
           schemathesis run docs/openapi.yaml --url http://localhost:20128 \
             --include-path-regex '^/v1/(chat/completions|models)$|^/api/(auth|keys)' \
-            --exclude-path-regex '^/api/auth/(oidc/|login)' \
+            --exclude-path-regex '^/api/auth/oidc/' \
             --max-examples 8 --workers 4 --checks all --max-response-time 30 \
             --request-timeout 20 --suppress-health-check all --no-color
-      - name: Install promptfoo
-        run: npm install -g promptfoo@0.122.0
       - name: promptfoo injection-guard (blocking)
         env:
           OMNIROUTE_URL: http://localhost:20128
           OMNIROUTE_API_KEY: not-needed-blocked-before-upstream
-        run: promptfoo eval -c promptfooconfig.yaml --no-cache
+        run: npx --yes promptfoo@latest eval -c promptfooconfig.yaml --no-cache
       - name: Stop server
         if: always()
         run: kill "$(cat server.pid)" || true

.github/workflows/docker-publish.yml

@@ -183,55 +183,15 @@ jobs:
         env:
           DOCKER_BUILDKIT_INLINE_CACHE: 1
 
-      - name: Build and push BUN base platform image by digest
-        id: build-bun-base
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
-        with:
-          context: .
-          file: Dockerfile.bun
-          target: runner-base
-          platforms: ${{ matrix.platform }}
-          outputs: type=image,push-by-digest=true,name-canonical=true,push=true
-          tags: |
-            ${{ env.IMAGE_NAME }}
-            ${{ env.GHCR_IMAGE_NAME }}
-          cache-from: type=gha,scope=docker-bun-base-${{ matrix.arch }}
-          cache-to: type=gha,scope=docker-bun-base-${{ matrix.arch }},mode=max
-          no-cache: false
-        env:
-          DOCKER_BUILDKIT_INLINE_CACHE: 1
-
-      - name: Build and push BUN web platform image by digest
-        id: build-bun-web
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
-        with:
-          context: .
-          file: Dockerfile.bun
-          target: runner-web
-          platforms: ${{ matrix.platform }}
-          outputs: type=image,push-by-digest=true,name-canonical=true,push=true
-          tags: |
-            ${{ env.IMAGE_NAME }}
-            ${{ env.GHCR_IMAGE_NAME }}
-          cache-from: type=gha,scope=docker-bun-web-${{ matrix.arch }}
-          cache-to: type=gha,scope=docker-bun-web-${{ matrix.arch }},mode=max
-          no-cache: false
-        env:
-          DOCKER_BUILDKIT_INLINE_CACHE: 1
-
       - name: Export digests
         env:
           DIGEST_BASE: ${{ steps.build.outputs.digest }}
           DIGEST_WEB: ${{ steps.build-web.outputs.digest }}
-          DIGEST_BUN_BASE: ${{ steps.build-bun-base.outputs.digest }}
-          DIGEST_BUN_WEB: ${{ steps.build-bun-web.outputs.digest }}
         run: |
           set -euo pipefail
-          mkdir -p /tmp/digests/base /tmp/digests/web /tmp/digests/bun-base /tmp/digests/bun-web
+          mkdir -p /tmp/digests/base /tmp/digests/web
           touch "/tmp/digests/base/${DIGEST_BASE#sha256:}"
           touch "/tmp/digests/web/${DIGEST_WEB#sha256:}"
-          touch "/tmp/digests/bun-base/${DIGEST_BUN_BASE#sha256:}"
-          touch "/tmp/digests/bun-web/${DIGEST_BUN_WEB#sha256:}"
 
       - name: Upload base digests
         uses: actions/upload-artifact@v7
@@ -249,22 +209,6 @@ jobs:
           if-no-files-found: error
           retention-days: 1
 
-      - name: Upload bun-base digests
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: digests-bun-base-${{ matrix.arch }}
-          path: /tmp/digests/bun-base/*
-          if-no-files-found: error
-          retention-days: 1
-
-      - name: Upload bun-web digests
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: digests-bun-web-${{ matrix.arch }}
-          path: /tmp/digests/bun-web/*
-          if-no-files-found: error
-          retention-days: 1
-
   merge:
     name: Publish multi-arch manifests
     needs:
@@ -319,20 +263,6 @@ jobs:
           path: /tmp/digests/web
           merge-multiple: true
 
-      - name: Download bun-base digests
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          pattern: digests-bun-base-*
-          path: /tmp/digests/bun-base
-          merge-multiple: true
-
-      - name: Download bun-web digests
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          pattern: digests-bun-web-*
-          path: /tmp/digests/bun-web
-          merge-multiple: true
-
       - name: Create Docker Hub manifest
         run: |
           set -euo pipefail
@@ -356,8 +286,6 @@ jobs:
 
           create_manifest "${IMAGE_NAME}" "" /tmp/digests/base
           create_manifest "${IMAGE_NAME}" "-web" /tmp/digests/web
-          create_manifest "${IMAGE_NAME}" "-bun" /tmp/digests/bun-base
-          create_manifest "${IMAGE_NAME}" "-web-bun" /tmp/digests/bun-web
 
       - name: Create GHCR manifest
         run: |
@@ -382,8 +310,6 @@ jobs:
 
           create_manifest "${GHCR_IMAGE_NAME}" "" /tmp/digests/base
           create_manifest "${GHCR_IMAGE_NAME}" "-web" /tmp/digests/web
-          create_manifest "${GHCR_IMAGE_NAME}" "-bun" /tmp/digests/bun-base
-          create_manifest "${GHCR_IMAGE_NAME}" "-web-bun" /tmp/digests/bun-web
 
       - name: Inspect image
         if: needs.prepare.outputs.version != 'main'
@@ -446,7 +372,7 @@ jobs:
       - name: Upload Trivy SARIF to Security tab
         if: needs.prepare.outputs.version != 'main'
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@v4.37.7
+        uses: github/codeql-action/upload-sarif@v4.37.6
         with:
           sarif_file: trivy-results.sarif
           category: trivy-image

.github/workflows/electron-release.yml

@@ -279,14 +279,9 @@ jobs:
 
       - name: Smoke packaged Electron app (Linux)
         if: matrix.platform == 'linux'
-        # #7592: also cold-restart against the same DATA_DIR and assert a
-        # native SQLite driver (not the sql.js WASM fallback) is selected on
-        # the second launch — blocking here since Linux has no Windows-style
-        # sandbox caveats that would make it flaky.
         env:
           ELECTRON_SMOKE_TIMEOUT_MS: 60000
           ELECTRON_SMOKE_STREAM_LOGS: "1"
-          ELECTRON_SMOKE_COLD_RESTART: "1"
         run: xvfb-run -a npm run electron:smoke:packaged
 
       - name: Collect installers

.github/workflows/opencode-plugin-ci.yml

@@ -2,11 +2,11 @@ name: opencode-plugin CI
 
 on:
   push:
-    branches: [main, "release/**"]
+    branches: [main, release/v3.8.2]
     paths:
       - "@omniroute/opencode-plugin/**"
   pull_request:
-    branches: [main, "release/**"]
+    branches: [main, release/v3.8.2]
     paths:
       - "@omniroute/opencode-plugin/**"
     types: [opened, synchronize, reopened, ready_for_review]

.github/workflows/radar-export.yml

@@ -1,64 +0,0 @@
-# Publica o export estável do catálogo consumido pelo OmniRoute Radar numa URL
-# fixa (asset de release `radar-export-latest`), para o servidor privado do Radar
-# (1 GB RAM, nunca clona/builda o OmniRoute) baixá-lo via `RADAR_EXPORT_URL` em
-# vez de depender do snapshot gravado no deploy. Fonte: scripts/release/radar-export.mjs.
-#
-# A URL estável resultante (definir em RADAR_EXPORT_URL no .env do radar-server):
-#   https://github.com/diegosouzapw/OmniRoute/releases/download/radar-export-latest/export-omniroute.json
-name: Radar Export
-
-on:
-  workflow_dispatch: # o operador pode publicar sob demanda (de qualquer ref)
-  push:
-    branches: [main] # produção: só o catálogo do main clobra o asset estável
-    paths:
-      - open-sse/config/freeModelCatalog.data.ts
-      - open-sse/config/freeModelCatalog.ts
-      - open-sse/config/providerRegistry.ts
-      - open-sse/config/providers/**
-      - scripts/release/radar-export.mjs
-      - .github/workflows/radar-export.yml
-  schedule:
-    - cron: "17 6 * * 1" # semanal (segunda 06:17 UTC): mantém geradoEm/proveniência frescos
-
-permissions:
-  contents: read
-
-concurrency:
-  group: radar-export-${{ github.ref }}
-  cancel-in-progress: true
-
-env:
-  CI_NODE_VERSION: "24"
-
-jobs:
-  publish-export:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write # gh release upload — clobra o asset estável do export
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false # publish usa GH_TOKEN via gh release, não a credencial do checkout
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.CI_NODE_VERSION }}
-          cache: npm
-      - run: npm ci
-      - name: Generate catalog export with provenance
-        run: node --import tsx/esm scripts/release/radar-export.mjs "$RUNNER_TEMP/export-omniroute.json"
-      - name: Publish to the stable release asset
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          TAG="radar-export-latest"
-          # Cria o release estável na primeira vez; nas seguintes só re-anexa o asset.
-          if ! gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
-            gh release create "$TAG" \
-              --repo "$GITHUB_REPOSITORY" \
-              --title "Radar catalog export (rolling)" \
-              --notes "Export estável do catálogo OmniRoute para o Radar. Atualizado automaticamente; NÃO é um release de versão do produto." \
-              --latest=false
-          fi
-          gh release upload "$TAG" "$RUNNER_TEMP/export-omniroute.json" --repo "$GITHUB_REPOSITORY" --clobber

.gitignore

@@ -291,4 +291,3 @@ docker-compose.yml.bak
 
 # Ad-hoc test sandboxes (never tracked — may contain local DBs)
 /.sandbox/
-.aider*

.gitleaks.toml

@@ -92,9 +92,5 @@
       # - x-api-key PUBLICO do Firefly web (documentado em open-sse/utils/publicCreds.ts:207);
       #   as duas ocorrencias sinalizadas estao em COMENTARIOS JSDoc, o runtime le de resolvePublicCred().
       '''omniroute-kimi-sponsor-banner-dismissed-v\d+''',
-      # CheaperInference sponsor banner localStorage key (upstream #11196 /
-      # eb5797370). Same UI-identifier pattern as the kimi banner above, not a
-      # credential; the generic-api-key rule flags the long hyphenated string.
-      '''omniroute-cheaperinference-sponsor-banner-dismissed-v\d+''',
       '''SunbreakWebUI1''',
     ]

@omniroute/opencode-plugin/package.json

@@ -23,7 +23,7 @@
   "scripts": {
     "build": "tsup",
     "clean": "rm -rf dist",
-    "test": "node --import tsx/esm --test tests/scaffold.test.ts tests/auth.test.ts tests/options-schema.test.ts tests/multi-instance.test.ts tests/fetch-interceptor.test.ts tests/provider.test.ts tests/gemini-sanitize.test.ts tests/combos.test.ts tests/config-shim.test.ts tests/features.test.ts tests/feature-defaults.test.ts tests/usable-combo.test.ts tests/disk-snapshot-perms.test.ts tests/fork-features.test.ts tests/auto-combo-context.test.ts tests/provider-id-routing.test.ts tests/management-read-token.test.ts tests/auto-sync.test.ts tests/model-allowlist.test.ts tests/log-level.test.ts tests/effort-tier-variants.test.ts",
+    "test": "node --import tsx/esm --test tests/scaffold.test.ts tests/auth.test.ts tests/options-schema.test.ts tests/multi-instance.test.ts tests/fetch-interceptor.test.ts tests/provider.test.ts tests/gemini-sanitize.test.ts tests/combos.test.ts tests/config-shim.test.ts tests/features.test.ts tests/feature-defaults.test.ts tests/usable-combo.test.ts tests/disk-snapshot-perms.test.ts tests/fork-features.test.ts tests/auto-combo-context.test.ts tests/provider-id-routing.test.ts tests/management-read-token.test.ts tests/auto-sync.test.ts tests/model-allowlist.test.ts tests/log-level.test.ts",
     "prepublishOnly": "npm run clean && npm run build && npm test"
   },
   "keywords": [

@omniroute/opencode-plugin/src/index.ts

@@ -76,17 +76,6 @@ import {
   type FreeModelFreeType,
 } from "./naming.js";
 
-/**
- * Minimal leveled logger sink accepted by the default fetchers and the static
- * catalog builder. A full `Logger` satisfies it structurally; the config hook
- * injects the same partial shape (see `createOmniRouteConfigHook` deps).
- */
-type OmniRouteLoggerSink = {
-  error?: (message: string, ...args: unknown[]) => void;
-  warn: (message: string, ...args: unknown[]) => void;
-  debug?: (message: string, ...args: unknown[]) => void;
-};
-
 /**
  * Zod schema for plugin options accepted as the second element of the
  * `plugin: [name, opts]` tuple in opencode.json. Strict by design — unknown
@@ -802,18 +791,13 @@ export async function forceSyncOmniRouteModels(args: {
       try {
         rawCombos = await combosFetcher(auth.baseURL, auth.managementReadToken, 10_000);
       } catch (err) {
-        logger.warn("force sync: combos fetch failed", err);
+        console.warn("[omniroute-plugin] force sync: combos fetch failed", err);
       }
     }
     let rawAutoCombos: OmniRouteRawAutoCombo[] = [];
     if (wantAutoCombos) {
       try {
-        rawAutoCombos = await autoCombosFetcher(
-          auth.baseURL,
-          auth.managementReadToken,
-          5_000,
-          logger
-        );
+        rawAutoCombos = await autoCombosFetcher(auth.baseURL, auth.managementReadToken, 5_000);
       } catch {
         /* soft-fail */
       }
@@ -1105,7 +1089,7 @@ export const OmniRoutePlugin: Plugin = async (_input, options) => {
 
   return {
     auth: createOmniRouteAuthHook(resolved),
-    provider: createOmniRouteProviderHook(resolved, { cache: sharedCache, logger }),
+    provider: createOmniRouteProviderHook(resolved, { cache: sharedCache }),
     config: configWithSyncCommand,
     tool: {
       omniroute_sync_models: syncTool,
@@ -1161,8 +1145,6 @@ export interface OmniRouteRawModelEntry {
     attachment?: boolean;
     structured_output?: boolean;
     temperature?: boolean;
-    /** Runtime-learned or synced reasoning tiers (server-gated, blind-mapped). */
-    effort_tiers?: string[];
   };
   release_date?: string;
   last_updated?: string;
@@ -1304,18 +1286,6 @@ export function mapRawModelToModelV2(
   ctx: { providerId: string; baseURL: string; apiFormat?: { anthropicPrefixes?: string[] } }
 ): ModelV2 {
   const caps = raw.capabilities ?? {};
-  // effort_tiers loop: server-declared tiers become ModelV2 variants so the
-  // UI offers exactly the tiers OmniRoute vouches for (instead of opencode's
-  // invented [low, medium, high] fallback). Blind: filtering/exclusion rules
-  // live server-side. Absent/empty/malformed => key omitted ENTIRELY (an
-  // empty variants object would suppress opencode's fallback for this model).
-  const declaredTiers = Array.isArray(caps.effort_tiers)
-    ? caps.effort_tiers.filter((t): t is string => typeof t === "string" && t.length > 0)
-    : [];
-  const variants =
-    declaredTiers.length > 0
-      ? Object.fromEntries(declaredTiers.map((tier) => [tier, { reasoningEffort: tier }]))
-      : undefined;
   const inMods = new Set(raw.input_modalities ?? ["text"]);
   const outMods = new Set(raw.output_modalities ?? ["text"]);
 
@@ -1324,12 +1294,10 @@ export function mapRawModelToModelV2(
     // `(providerID, modelID)`. If the raw id is already provider-prefixed
     // (e.g. `cc/claude-opus-4-7` from the `cc` Claude Code alias, or
     // `nvidia/llama-3-70b` from a provider that ships prefixed ids), leave
-    // it as-is — double-prefixing breaks OC's lookup. Bare **combo** ids
-    // (`owned_by: "combo"`, e.g. `gpt-5.6-sol`) must also stay unprefixed:
-    // OpenCode looks up `-m <plugin>/<combo>` as model id `<combo>` under
-    // the plugin provider (#10345). Other bare ids still prefix with
-    // `providerId` so credentials resolve as `(omniroute, model)`.
-    id: raw.id.includes("/") || raw.owned_by === "combo" ? raw.id : `${ctx.providerId}/${raw.id}`,
+    // it as-is — double-prefixing breaks OC's lookup. Otherwise prefix with
+    // the resolved `providerId` so a bare key like `claude-opus-4` parses as
+    // `(omniroute, claude-opus-4)` and the credentials resolve correctly.
+    id: raw.id.includes("/") ? raw.id : `${ctx.providerId}/${raw.id}`,
     /**
      * Display name. Falls back to raw.id when no enrichment is available;
      * the caller (`createOmniRouteProviderHook`) overlays
@@ -1368,7 +1336,6 @@ export function mapRawModelToModelV2(
       ...(typeof raw.max_input_tokens === "number" ? { input: raw.max_input_tokens } : {}),
       output: typeof raw.max_output_tokens === "number" ? raw.max_output_tokens : 0,
     },
-    ...(variants ? { variants } : {}),
     status: "active",
     options: {},
     headers: {},
@@ -1704,8 +1671,7 @@ export interface OmniRouteRawAutoCombo {
 export type OmniRouteAutoCombosFetcher = (
   baseURL: string,
   apiKey: string,
-  timeoutMs?: number,
-  logger?: OmniRouteLoggerSink
+  timeoutMs?: number
 ) => Promise<OmniRouteRawAutoCombo[]>;
 
 /**
@@ -1717,11 +1683,9 @@ export type OmniRouteAutoCombosFetcher = (
 export const defaultOmniRouteAutoCombosFetcher: OmniRouteAutoCombosFetcher = async (
   baseURL,
   apiKey,
-  timeoutMs = 5_000,
-  logger?: OmniRouteLoggerSink
+  timeoutMs = 5_000
 ) => {
   if (!apiKey || !baseURL) return [];
-  const log = logger ?? _logger;
 
   const trimmed = trimTrailingSlashes(baseURL);
   const root = trimmed.replace(/\/v\d+$/, "");
@@ -1740,11 +1704,15 @@ export const defaultOmniRouteAutoCombosFetcher: OmniRouteAutoCombosFetcher = asy
     });
     // 404 = endpoint not deployed yet — expected during rollout
     if (res.status === 404) {
-      log.warn(`/api/combos/auto not available (404) — auto combos disabled`);
+      console.warn(
+        `[omniroute-plugin] /api/combos/auto not available (404) — auto combos disabled`
+      );
       return [];
     }
     if (!res.ok) {
-      log.warn(`/api/combos/auto failed: ${res.status} ${res.statusText} — auto combos disabled`);
+      console.warn(
+        `[omniroute-plugin] /api/combos/auto failed: ${res.status} ${res.statusText} — auto combos disabled`
+      );
       return [];
     }
     const body = (await res.json()) as unknown;
@@ -1762,8 +1730,8 @@ export const defaultOmniRouteAutoCombosFetcher: OmniRouteAutoCombosFetcher = asy
     return out;
   } catch (err) {
     // Network error, timeout, abort — all non-fatal
-    log.warn(
-      `/api/combos/auto fetch failed: ${err instanceof Error ? err.message : String(err)} — auto combos disabled`
+    console.warn(
+      `[omniroute-plugin] /api/combos/auto fetch failed: ${err instanceof Error ? err.message : String(err)} — auto combos disabled`
     );
     return [];
   } finally {
@@ -2962,7 +2930,10 @@ export function passesModelAllowlist(
  * filter is set, all combos pass. Combos with zero resolvable members pass
  * (mirrors `isUsableCombo` semantics).
  */
-export function passesComboAllowlist(combo: OmniRouteRawCombo, visible?: ModelListFilter): boolean {
+export function passesComboAllowlist(
+  combo: OmniRouteRawCombo,
+  visible?: ModelListFilter
+): boolean {
   if (!visible) return true;
   const steps = Array.isArray(combo.models) ? combo.models : [];
   if (steps.length === 0) return true;
@@ -3154,15 +3125,9 @@ export function createOmniRouteProviderHook(
     providersFetcher?: OmniRouteProvidersFetcher;
     now?: () => number;
     cache?: OmniRouteFetchCache;
-    logger?: _Logger;
   } = {}
 ): ProviderHook {
   const resolved = resolveOmniRoutePluginOptions(opts);
-  const logger =
-    deps.logger ??
-    createLogger(
-      resolved.features?.startupDebug ? "debug" : (resolved.features?.logLevel ?? "warn")
-    );
   const fetcher = deps.fetcher ?? defaultOmniRouteModelsFetcher;
   // T-05: combo discovery merges `/api/combos` entries into the same map as
   // `/v1/models`. Default fetcher is declared further down the file; the
@@ -3236,8 +3201,8 @@ export function createOmniRouteProviderHook(
           : undefined) ??
         "";
       if (!baseURL) {
-        logger.error(
-          `provider.models(${resolved.providerId}): ` +
+        console.warn(
+          `[omniroute-plugin] provider.models(${resolved.providerId}): ` +
             `no baseURL resolvable — checked plugin opts, auth.json, and provider config. ` +
             `Set baseURL in opencode.json plugin options or run \`opencode connect ${resolved.providerId}\` with a baseURL.`
         );
@@ -3268,8 +3233,8 @@ export function createOmniRouteProviderHook(
         rawModels = await fetcher(baseURL, apiKey, 10_000);
 
         // T-05: combos fetch is best-effort, gated by features.combos.
-        // Soft-fail on any error: emit a warn-level diagnostic and fall back
-        // to a models-only catalog. Rationale: /api/combos requires a
+        // Soft-fail on any error: emit a console.warn and fall back to a
+        // models-only catalog. Rationale: /api/combos requires a
         // management-scoped key and OmniRoute may not have any combos
         // provisioned. Hard-failing when combos are optional would
         // silently hide the whole provider from OC's picker.
@@ -3278,7 +3243,10 @@ export function createOmniRouteProviderHook(
           try {
             rawCombos = await combosFetcher(baseURL, managementReadToken, 10_000);
           } catch (err) {
-            logger.warn("combos fetch failed, falling back to models-only catalog", err);
+            console.warn(
+              "[omniroute-plugin] combos fetch failed, falling back to models-only catalog",
+              err
+            );
           }
         }
 
@@ -3288,7 +3256,7 @@ export function createOmniRouteProviderHook(
         rawAutoCombos = [];
         if (wantAutoCombos) {
           try {
-            rawAutoCombos = await autoCombosFetcher(baseURL, managementReadToken, 5_000, logger);
+            rawAutoCombos = await autoCombosFetcher(baseURL, managementReadToken, 5_000);
           } catch {
             // Already handled inside the default fetcher — this catch
             // is belt-and-suspenders for injected stubs.
@@ -3302,7 +3270,10 @@ export function createOmniRouteProviderHook(
           try {
             rawEnrichment = await enrichmentFetcher(baseURL, managementReadToken, 10_000);
           } catch (err) {
-            logger.warn("enrichment fetch failed, falling back to raw ids", err);
+            console.warn(
+              "[omniroute-plugin] enrichment fetch failed, falling back to raw ids",
+              err
+            );
           }
         }
 
@@ -3317,7 +3288,7 @@ export function createOmniRouteProviderHook(
               10_000
             );
           } catch (err) {
-            logger.warn("compression-metadata fetch failed", err);
+            console.warn("[omniroute-plugin] compression-metadata fetch failed", err);
           }
         }
 
@@ -3331,8 +3302,8 @@ export function createOmniRouteProviderHook(
           try {
             rawConnections = await providersFetcher(baseURL, managementReadToken, 10_000);
           } catch (err) {
-            logger.warn(
-              "/api/providers fetch failed; usableOnly filter disabled for this refresh",
+            console.warn(
+              "[omniroute-plugin] /api/providers fetch failed; usableOnly filter disabled for this refresh",
               err
             );
           }
@@ -3351,9 +3322,8 @@ export function createOmniRouteProviderHook(
         // Debug breadcrumb: surface fetch result so operators can confirm
         // the dynamic pipeline fired and how much catalog OmniRoute returned.
         // Emitted once per cache miss (TTL refresh) — quiet on cache hits.
-        // Info-level: hidden at the default `warn` level (see #8982).
-        logger.info(
-          `catalog refreshed for providerId=${resolved.providerId} baseURL=${baseURL}: ` +
+        console.warn(
+          `[omniroute-plugin] catalog refreshed for providerId=${resolved.providerId} baseURL=${baseURL}: ` +
             `${rawModels.length} models + ${rawCombos.length} combos + ` +
             `${rawEnrichment.size} enrichment entries + ` +
             `${rawCompressionCombos.length} compression combos + ` +
@@ -3633,7 +3603,9 @@ export function createOmniRouteProviderHook(
               const dedupeKey = `${cacheKey}::${comboKey}`;
               if (!collisionWarned.has(dedupeKey)) {
                 collisionWarned.add(dedupeKey);
-                logger.warn(`combo key "${comboKey}" collides with a model id; combo wins.`);
+                console.warn(
+                  `[omniroute-plugin] combo key "${comboKey}" collides with a model id; combo wins.`
+                );
               }
             }
           }
@@ -3651,8 +3623,8 @@ export function createOmniRouteProviderHook(
       }
 
       if (pending.length > 0) {
-        logger.warn(
-          `${pending.length} combo(s) could not resolve all nested combo-refs after ${MAX_COMBO_PASSES} passes; they will advertise context=0 to avoid over-claiming.`
+        console.warn(
+          `[omniroute-plugin] ${pending.length} combo(s) could not resolve all nested combo-refs after ${MAX_COMBO_PASSES} passes; they will advertise context=0 to avoid over-claiming.`
         );
       }
 
@@ -4296,10 +4268,8 @@ export function buildStaticProviderEntry(
   enrichment?: OmniRouteEnrichmentMap,
   compressionCombos?: OmniRouteCompressionCombo[],
   connections?: OmniRouteProviderConnection[],
-  rawAutoCombos?: OmniRouteRawAutoCombo[],
-  logger?: OmniRouteLoggerSink
+  rawAutoCombos?: OmniRouteRawAutoCombo[]
 ): OmniRouteStaticProviderEntry {
-  const log = logger ?? _logger;
   const models: Record<string, OmniRouteStaticModelEntry> = {};
   const rawModelKeys = new Set<string>();
 
@@ -4677,8 +4647,8 @@ export function buildStaticProviderEntry(
   }
 
   if (pendingStatic.length > 0) {
-    log.warn(
-      `${pendingStatic.length} combo(s) in the static catalog could not resolve all nested combo-refs after ${MAX_STATIC_COMBO_PASSES} passes; they will be omitted.`
+    console.warn(
+      `[omniroute-plugin] ${pendingStatic.length} combo(s) in the static catalog could not resolve all nested combo-refs after ${MAX_STATIC_COMBO_PASSES} passes; they will be omitted.`
     );
   }
 
@@ -4699,7 +4669,9 @@ export function buildStaticProviderEntry(
         const isExpectedRawTwin = autoCombo.id === key && rawModelKeys.has(key);
         if (!isExpectedRawTwin && !reportedCollisions.has(key)) {
           reportedCollisions.add(key);
-          log.warn(`auto combo key "${key}" collides with an existing model; auto combo wins.`);
+          console.warn(
+            `[omniroute-plugin] auto combo key "${key}" collides with an existing model; auto combo wins.`
+          );
         }
       }
       models[key] = entry;
@@ -5370,8 +5342,7 @@ export function createOmniRouteConfigHook(
           warmSnapshot = snapshotResult;
           // Log snapshot age (accept any age — instant beats empty).
           const age = (snapshotResult as { writtenAt?: number }).writtenAt;
-          const ageLabel =
-            typeof age === "number" ? `${Math.round((Date.now() - age) / 3_600_000)}h` : "unknown";
+          const ageLabel = typeof age === "number" ? `${Math.round((Date.now() - age) / 3_600_000)}h` : "unknown";
           logAt(
             "warn",
             `config shim: warm startup from disk snapshot (${snapshotResult.rawModels.length} models, age ${ageLabel})`
@@ -5423,12 +5394,7 @@ export function createOmniRouteConfigHook(
         const doAutoCombos = async (): Promise<void> => {
           if (!wantAutoCombos) return;
           try {
-            localRawAutoCombos = await autoCombosFetcher(
-              baseURL,
-              managementReadToken,
-              5_000,
-              logger
-            );
+            localRawAutoCombos = await autoCombosFetcher(baseURL, managementReadToken, 5_000);
           } catch {
             // Already handled inside the default fetcher
           }
@@ -5449,11 +5415,7 @@ export function createOmniRouteConfigHook(
         const doCompression = async (): Promise<void> => {
           if (!wantCompressionMeta) return;
           try {
-            localRawCompressionCombos = await compressionMetaFetcher(
-              baseURL,
-              managementReadToken,
-              10_000
-            );
+            localRawCompressionCombos = await compressionMetaFetcher(baseURL, managementReadToken, 10_000);
           } catch (err) {
             logAt(
               "error",
@@ -5566,8 +5528,7 @@ export function createOmniRouteConfigHook(
             localRawEnrichment,
             localRawCompressionCombos,
             localRawConnections,
-            localRawAutoCombos,
-            logger
+            localRawAutoCombos
           );
           const inputWithProvider2 = input as { provider?: Record<string, unknown> };
           if (inputWithProvider2.provider) {
@@ -5657,8 +5618,7 @@ export function createOmniRouteConfigHook(
       rawEnrichment,
       rawCompressionCombos,
       rawConnections,
-      rawAutoCombos,
-      logger
+      rawAutoCombos
     );
 
     // Mutate the input.provider map. The Config type declares

@omniroute/opencode-plugin/tests/bare-combo-ids-10345.test.ts

@@ -1,34 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-
-import { mapRawModelToModelV2 } from "../src/index.ts";
-
-test("mapRawModelToModelV2: bare combo ids stay unprefixed (#10345)", () => {
-  const combo = mapRawModelToModelV2(
-    {
-      id: "gpt-5.6-sol",
-      owned_by: "combo",
-      context_length: 272000,
-      max_output_tokens: 8192,
-    },
-    { providerId: "omniroute", baseURL: "https://or.example.com/v1" }
-  );
-  assert.equal(combo.id, "gpt-5.6-sol");
-  assert.equal(combo.providerID, "omniroute");
-
-  const slashed = mapRawModelToModelV2(
-    {
-      id: "cx/gpt-5.6-sol",
-      owned_by: "combo",
-      context_length: 272000,
-    },
-    { providerId: "omniroute", baseURL: "https://or.example.com/v1" }
-  );
-  assert.equal(slashed.id, "cx/gpt-5.6-sol");
-
-  const ordinary = mapRawModelToModelV2(
-    { id: "claude-primary", context_length: 200000 },
-    { providerId: "omniroute", baseURL: "https://or.example.com/v1" }
-  );
-  assert.equal(ordinary.id, "omniroute/claude-primary");
-});

@omniroute/opencode-plugin/tests/effort-tier-variants.test.ts

@@ -1,62 +0,0 @@
-/**
- * effort_tiers loop — plugin maps server-declared tiers to ModelV2 variants.
- * Blind mapping (I3): no owned_by/provider knowledge here — the SERVER gates
- * eligibility (shouldExposeSyncedEffortVariants). Absence semantics (M3):
- * no tiers => NO variants key at all (an empty object would also kill
- * opencode's own fallback for non-tiered models).
- */
-import test from "node:test";
-import assert from "node:assert/strict";
-import { mapRawModelToModelV2, type OmniRouteRawModelEntry } from "../src/index.js";
-
-const CTX = { providerId: "omniroute", baseURL: "http://127.0.0.1:20128" } as const;
-
-test("maps declared tiers to reasoningEffort variants", () => {
-  const raw: OmniRouteRawModelEntry = {
-    id: "oc/x-preview-f-free",
-    owned_by: "opencode",
-    capabilities: { reasoning: true, effort_tiers: ["low", "high", "max"] },
-  };
-  const model = mapRawModelToModelV2(raw, { ...CTX });
-  const variants = (model as unknown as Record<string, unknown>).variants as
-    Record<string, Record<string, unknown>> | undefined;
-  assert.ok(variants, "variants key present when tiers declared");
-  assert.deepEqual(Object.keys(variants).sort(), ["high", "low", "max"]);
-  assert.deepEqual(variants.max, { reasoningEffort: "max" });
-  assert.deepEqual(variants.low, { reasoningEffort: "low" });
-});
-
-test("no tiers => NO variants key (not an empty object)", () => {
-  const raw: OmniRouteRawModelEntry = {
-    id: "plain-model",
-    capabilities: { reasoning: true },
-  };
-  const model = mapRawModelToModelV2(raw, { ...CTX }) as unknown as Record<string, unknown>;
-  assert.equal("variants" in model, false);
-});
-
-test("empty or malformed tiers array => NO variants key", () => {
-  const empty = mapRawModelToModelV2(
-    { id: "m", capabilities: { effort_tiers: [] } },
-    { ...CTX }
-  ) as unknown as Record<string, unknown>;
-  assert.equal("variants" in empty, false);
-
-  const junk = mapRawModelToModelV2(
-    { id: "m", capabilities: { effort_tiers: [42, null, "ok"] as unknown as string[] } },
-    { ...CTX }
-  ) as unknown as Record<string, unknown>;
-  const variants = junk.variants as Record<string, Record<string, unknown>> | undefined;
-  assert.deepEqual(Object.keys(variants ?? {}), ["ok"], "non-string tokens dropped");
-});
-
-test("static registry entry WITH tiers also gets variants (N1 blast radius)", () => {
-  const raw: OmniRouteRawModelEntry = {
-    id: "some-static-model",
-    owned_by: "registry",
-    capabilities: { effort_tiers: ["minimal", "high"] },
-  };
-  const model = mapRawModelToModelV2(raw, { ...CTX }) as unknown as Record<string, unknown>;
-  const variants = model.variants as Record<string, Record<string, unknown>> | undefined;
-  assert.deepEqual(Object.keys(variants ?? {}).sort(), ["high", "minimal"]);
-});

@omniroute/opencode-plugin/tests/log-level.test.ts

@@ -5,14 +5,8 @@ import { join } from "node:path";
 import test from "node:test";
 import type { Config } from "@opencode-ai/plugin";
 
-import {
-  createOmniRouteConfigHook,
-  createOmniRouteProviderHook,
-  defaultOmniRouteAutoCombosFetcher,
-  OmniRoutePlugin,
-  type OmniRouteRawModelEntry,
-} from "../src/index.js";
-import { createLogger, getLogLevel, logger, setLogLevel, type LogLevel } from "../src/logger.js";
+import { createOmniRouteConfigHook, OmniRoutePlugin } from "../src/index.js";
+import { getLogLevel, logger, setLogLevel, type LogLevel } from "../src/logger.js";
 
 type ConsoleMethod = "error" | "info" | "log" | "warn";
 type ConsoleEntries = Record<ConsoleMethod, unknown[][]>;
@@ -222,105 +216,3 @@ test("logger error output remains visible at error level", async () => {
     setLogLevel(previousLevel);
   }
 });
-
-const MINIMAL_MODELS: OmniRouteRawModelEntry[] = [
-  {
-    id: "claude-primary",
-    object: "model",
-    owned_by: "combo",
-    capabilities: { tool_calling: true, reasoning: true, vision: true, thinking: true },
-    context_length: 200000,
-    max_output_tokens: 64000,
-    input_modalities: ["text", "image"],
-    output_modalities: ["text"],
-  },
-];
-
-function providerHookWithLevel(level: LogLevel, baseURL?: string) {
-  return createOmniRouteProviderHook(
-    {
-      baseURL,
-      features: { autoCombos: false, enrichment: false, logLevel: level },
-    },
-    {
-      fetcher: async () => MINIMAL_MODELS,
-      combosFetcher: async () => {
-        throw new Error("combos boom");
-      },
-    }
-  );
-}
-
-test("logLevel error suppresses provider.models() fallback warnings and the catalog-refresh breadcrumb", async () => {
-  const hook = providerHookWithLevel("error", "https://or.example.com/v1");
-  const lines = rendered(
-    await captureConsole(async () => {
-      await hook.models!({} as never, { auth: { type: "api", key: "sk-x" } as never });
-    })
-  );
-
-  assert.equal(lines.filter((line) => line.includes("combos fetch failed")).length, 0);
-  assert.equal(lines.filter((line) => line.includes("catalog refreshed")).length, 0);
-});
-
-test("logLevel debug preserves the provider.models() catalog-refresh breadcrumb", async () => {
-  const hook = providerHookWithLevel("debug", "https://or.example.com/v1");
-  const lines = rendered(
-    await captureConsole(async () => {
-      await hook.models!({} as never, { auth: { type: "api", key: "sk-x" } as never });
-    })
-  );
-
-  assert.ok(
-    lines.some((line) => line.includes("catalog refreshed")),
-    "catalog-refresh breadcrumb emitted at debug level"
-  );
-});
-
-test("no baseURL resolvable stays visible at error level", async () => {
-  const hook = providerHookWithLevel("error");
-  const lines = rendered(
-    await captureConsole(async () => {
-      await hook.models!({} as never, { auth: { type: "api", key: "sk-x" } as never });
-    })
-  );
-
-  assert.ok(
-    lines.some((line) => line.includes("no baseURL resolvable")),
-    "genuine misconfiguration error remains visible at error level"
-  );
-});
-
-test("default auto-combos fetcher 404 warning respects the threaded logger level", async () => {
-  const originalFetch = globalThis.fetch;
-  (globalThis as { fetch: unknown }).fetch = (async () => ({
-    status: 404,
-    ok: false,
-  })) as typeof fetch;
-  try {
-    const silent = await captureConsole(async () => {
-      await defaultOmniRouteAutoCombosFetcher(
-        "https://or.example.com/v1",
-        "sk-x",
-        5_000,
-        createLogger("error")
-      );
-    });
-    assert.equal(rendered(silent).length, 0, "404 warning suppressed at error level");
-
-    const loud = await captureConsole(async () => {
-      await defaultOmniRouteAutoCombosFetcher(
-        "https://or.example.com/v1",
-        "sk-x",
-        5_000,
-        createLogger("warn")
-      );
-    });
-    assert.ok(
-      rendered(loud).some((line) => line.includes("/api/combos/auto not available")),
-      "404 warning emitted at warn level"
-    );
-  } finally {
-    globalThis.fetch = originalFetch;
-  }
-});

@omniroute/opencode-plugin/tests/provider.test.ts

@@ -104,10 +104,7 @@ test("models: extracts apiKey from ctx.auth (type=api) and calls fetcher with it
   // #6859: dynamic-hook catalog keys use the unprefixed omnirouteProviderId
   // ("omniroute"), not the OC-gate-prefixed hook.id ("opencode-omniroute") —
   // that prefix must never leak into anything OmniRoute's server parses.
-  // #10345/#10821: bare combo ids (owned_by: "combo") stay unprefixed —
-  // OpenCode looks up `-m <plugin>/<combo>` as model id `<combo>` under the
-  // plugin provider, so `claude-primary` here carries no provider prefix.
-  assert.ok(out["claude-primary"]);
+  assert.ok(out["omniroute/claude-primary"]);
 });
 
 test("models: returns {} when ctx.auth is null/undefined/wrong-type/empty-key", async () => {
@@ -162,15 +159,11 @@ test("models: maps a sample /v1/models entry to ModelV2 (sanity)", async () => {
   // omnirouteProviderId ("omniroute") — the OC-gate prefix ("opencode-")
   // must stay OC-internal (hook.id / AuthHook.provider) and never leak into
   // anything OmniRoute's own server parses for credential lookup.
-  // #10345/#10821: bare **combo** ids (owned_by: "combo", e.g.
-  // "claude-primary") must also stay unprefixed — OpenCode looks up
-  // `-m <plugin>/<combo>` as model id `<combo>` under the plugin provider.
-  const claude = out["claude-primary"];
+  const claude = out["omniroute/claude-primary"];
   assert.ok(claude, "claude-primary present");
-  // `mapRawModelToModelV2` leaves bare combo ids unprefixed (see
-  // src/index.ts mapRawModelToModelV2) so OC's `-m <plugin>/<combo>` lookup
-  // resolves the combo id directly.
-  assert.equal(claude.id, "claude-primary");
+  // `mapRawModelToModelV2` stamps the provider prefix on the id so OC's
+  // static-catalog reader resolves `(providerID, modelID)` from the key.
+  assert.equal(claude.id, "omniroute/claude-primary");
   assert.equal(claude.name, "claude-primary");
   assert.equal(claude.providerID, "omniroute");
   assert.equal(claude.api.id, "openai-compatible");

AGENTS.md

@@ -46,7 +46,7 @@ Repository map and Reference Documentation sections below.
 
 ## Project at a Glance
 
-**OmniRoute** — unified AI proxy/router. One endpoint, 350 LLM providers, auto-fallback.
+**OmniRoute** — unified AI proxy/router. One endpoint, 340 LLM providers, auto-fallback.
 
 | Layer         | Location                | Purpose                                                                                                                                                                   |
 | ------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -56,9 +56,9 @@ Repository map and Reference Documentation sections below.
 | Translators   | `open-sse/translator/`  | Format conversion (OpenAI↔Claude↔Gemini)                                                                                                                                  |
 | Transformer   | `open-sse/transformer/` | Responses API ↔ Chat Completions                                                                                                                                          |
 | Services      | `open-sse/services/`    | Combo routing, rate limits, caching, etc                                                                                                                                  |
-| Database      | `src/lib/db/`           | SQLite domain modules (159 migrations)                                                                                                                                    |
+| Database      | `src/lib/db/`           | SQLite domain modules (153 migrations)                                                                                                                                    |
 | Domain/Policy | `src/domain/`           | Policy engine, cost rules, fallback logic                                                                                                                                 |
-| MCP Server    | `open-sse/mcp-server/`  | 110 tools (44 canonical + memory/skill/GitHub/pool/gamification/plugin/Notion/Obsidian/local-corpus/RTK modules), 3 transports (stdio / SSE / Streamable HTTP), 33 scopes |
+| MCP Server    | `open-sse/mcp-server/`  | 109 tools (44 canonical + memory/skill/GitHub/pool/gamification/plugin/Notion/Obsidian/local-corpus/RTK modules), 3 transports (stdio / SSE / Streamable HTTP), 33 scopes |
 | A2A Server    | `src/lib/a2a/`          | JSON-RPC 2.0 agent protocol                                                                                                                                               |
 | Skills        | `src/lib/skills/`       | Extensible skill framework                                                                                                                                                |
 | Memory        | `src/lib/memory/`       | Persistent conversational memory                                                                                                                                          |

CHANGELOG.md

@@ -2,18 +2,6 @@
 
 ## [Unreleased]
 
-### ✨ New Features
-
-- **feat(sse): STRICT_ZERO_COST** — opt-in, off-by-default `freeAccessPolicy: "strict"` setting
-  that hard-verifies every auto-combo candidate against live quota state and per-connection
-  economic safety before it can be dispatched, going beyond `hidePaidModels`'s static catalog
-  check. Adds curated `hardStopGuaranteed` metadata to `FREE_MODEL_BUDGETS`, a short-TTL quota
-  cache reusing `getUsageForProvider()`, and a connection-safety guarantee: a candidate backed
-  by multiple accounts has its `allowedConnectionIds` narrowed to exactly the connections
-  independently verified `SAFE`, so dispatch can never use an unverified account. An
-  `excludeTosAvoid` guard (default `false`) is available separately for contractual risk. See
-  `docs/routing/STRICT_ZERO_COST.md`.
-
 ---
 
 ## [3.8.50] — TBD
@@ -21,7 +9,6 @@
 _Living section — regenerated 2026-08-12 from all cycle commits (cycle open `ed2db6cb19` → tip). Bullets carry the merged PR and its author; direct pushes listed separately._
 
 ### ✨ New Features
-- **feat(search):** first-class X Search provider (`x-search`) on `POST /v1/search` and MCP `omniroute_x_search` using SuperGrok / xAI server-side `x_search`. Explicit provider or `search_type: "x"` only — never auto-selected for web. Reuses `xai-oauth` / `xao` / `xai` credentials. Not the X Developer Platform MCP. ([#10985](https://github.com/diegosouzapw/OmniRoute/issues/10985))
 - **feat(core):** add Layer A capability filter at router (#5696)
 - **feat(providers):** add DeepAI as paid API-key image provider ([#6671](https://github.com/diegosouzapw/OmniRoute/issues/6671))
 - **feat(providers):** add Naga.ac and ChatAnywhere aggregator gateway providers (#6674 — thanks @chirag127)
@@ -180,9 +167,7 @@ _Living section — regenerated 2026-08-12 from all cycle commits (cycle open `e
 
 ### 🐛 Bug Fixes
 
-- **security(search)**: block SSRF via `/v1/search` `provider_options.baseUrl` for the Firecrawl search provider — the client-controlled override is now validated as a public URL before it is used to build the server-side fetch target, so a caller with a valid API key can no longer redirect search requests at loopback, RFC1918, or cloud-metadata hosts — thanks @zmf963
 - **providers**: honor `PATCH /api/providers/[id]` so `omniroute providers rotate` stops 405ing (the OpenAPI spec and CLI already use PATCH) (PR #10366)
-- **cli**: route provider test commands through configured connection test endpoints (#10570)
 - **executors**: fix internal timeout misclassified as client disconnect (499) for 7 niche executors — pass TimeoutError reason to controller.abort() (#8197 side-finding)
 - test(combo): guard auto/best-free never leaks the combo name as a model (#7754)
 - fix(vision-bridge): describe-model no longer returns unreachable "openai/gpt-4o-mini" when every vision-capable provider is unreachable on the instance — returns null instead and surfaces a clear error (#8430)

CLAUDE.md

@@ -47,21 +47,6 @@ rewrite it to the `_tasks/…` equivalent before writing:
 
 Commit those artifacts inside the `_tasks/` repo (`git -C _tasks …`), never in the main repo.
 
-## Scratch / temporary files — use `_artifacts/`, not `/tmp`
-
-This project overrides the harness's default session scratchpad (`/tmp/claude-*/…`). Write
-temporary/working files — exports, generated zips, one-off intermediate outputs, anything you'd
-otherwise put in `/tmp` — to `/home/diegosouzapw/dev/proxys/OmniRoute/_artifacts/` instead.
-
-- `_artifacts/` is a root `_*` path: already gitignored (`AGENTS.md` → "Root `_*` paths"), lives
-  on disk only, never tracked.
-- Reason: keeping scratch output inside the project (vs `/tmp`) makes it trivial for the operator
-  to find and delete everything temporary in one place, instead of hunting across ephemeral
-  session-specific `/tmp` directories that vanish or accumulate untracked.
-- Do **not** confuse this with `_tasks/` (Hard Rule #23, its own private git repo for durable
-  plans/specs/research/hand-offs) — `_artifacts/` is for disposable working files only, nothing
-  here needs to survive or be versioned.
-
 ## Base-green before opening PRs
 
 Before cutting a branch or opening a PR, run the base-green check (`AGENTS.md` → Git Workflow →

Dockerfile

@@ -59,12 +59,6 @@ RUN set -eux; \
 # ── Builder ────────────────────────────────────────────────────────────────
 FROM base AS builder
 
-# No telemetry, anywhere. Disable Next.js's anonymous build-time telemetry
-# (it otherwise pings Vercel during `next build`). Set on the builder stage so
-# every image build is silent; the runtime never builds, so this covers the
-# only phase Next telemetry can fire.
-ENV NEXT_TELEMETRY_DISABLED=1
-
 # Build tools for native module compilation
 # apt-get update needed here because base's rm -rf clears the shared cache
 RUN --mount=type=cache,id=s/92ca8a61-c1ba-421f-a389-d48ac7258c2d-apt-cache,target=/var/cache/apt,sharing=locked \
@@ -146,18 +140,6 @@ ENV OMNIROUTE_USE_TURBOPACK="${OMNIROUTE_USE_TURBOPACK}"
 ARG OMNIROUTE_BASE_PATH=""
 ENV OMNIROUTE_BASE_PATH=$OMNIROUTE_BASE_PATH
 
-# #10273: the dashboard's `frame-ancestors` policy is compiled into the route
-# manifest by next.config.mjs (via scripts/build/dashboardEmbed.mjs), so it is
-# fixed when the image is built and cannot be flipped with `-e` on a running
-# container. Build with `--build-arg DASHBOARD_ALLOW_EMBED=vscode` to produce an
-# image whose HTML pages may be framed by the VS Code Simple Browser
-# (OmniCopilot's `dashboardOpen: "editor"`). Unset — the default — keeps every
-# route on `frame-ancestors 'none'` + X-Frame-Options: DENY. Builder-stage only:
-# the runner stage deliberately does not carry it, because a runtime value would
-# suggest an effect it cannot have.
-ARG DASHBOARD_ALLOW_EMBED=""
-ENV DASHBOARD_ALLOW_EMBED=$DASHBOARD_ALLOW_EMBED
-
 # Docker containers cannot run the MITM/Agent-Bridge stack (no host DNS/cert
 # access), so keep @/mitm/manager on the graceful stub (#3390). This flag is
 # Docker-only: npm/Electron/VPS builds must bundle the REAL manager (#6344).
@@ -172,25 +154,14 @@ ENV OMNIROUTE_MITM_STUB=1
 # child (build-next-isolated.mjs → resolveNextBuildEnv spreads process.env).
 # Build-only; the runtime heap is set separately on the runner stage
 # (OMNIROUTE_MEMORY_MB). Override: `--build-arg OMNIROUTE_BUILD_MEMORY_MB=6144`.
-# Default raised 4096 → 6144 (#10060): the Next 16 production pass on a codebase
-# this size intermittently OOMs a build worker at 4 GB on memory-tight hosts.
-ARG OMNIROUTE_BUILD_MEMORY_MB=6144
+ARG OMNIROUTE_BUILD_MEMORY_MB=4096
 ENV NODE_OPTIONS="--max-old-space-size=${OMNIROUTE_BUILD_MEMORY_MB}"
 
-# Cap Next.js build worker pools. Next 16 defaults to `os.cpus().length - 1`
-# workers for page-data collection (31 on a 32-core builder); on memory-tight
-# hosts 31 workers + webpack's multi-GB heap blow past RAM and a worker dies
-# with SIGSEGV at teardown ("worker exited with code: null and signal: SIGSEGV"),
-# silently leaving no standalone bundle. Next derives the default worker count
-# from CIRCLE_NODE_TOTAL (workers = N-1), so N=8 → 7 workers: fast enough while
-# fitting comfortably in RAM on any host. (#10060)
-ENV CIRCLE_NODE_TOTAL=8
-
 COPY . ./
 RUN --mount=type=cache,id=s/92ca8a61-c1ba-421f-a389-d48ac7258c2d-next-cache,target=/app/.build/next/cache \
   mkdir -p /app/data \
   && npm run build \
-  && node --input-type=module -e "import { createRequire } from 'node:module'; import { pathToFileURL } from 'node:url'; const standaloneRoot = '/app/.build/next/standalone/node_modules/'; const require = createRequire('/app/.build/next/standalone/package.json'); for (const pkg of ['@atjsh/llmlingua-2', '@huggingface/transformers', 'js-tiktoken']) { const resolved = require.resolve(pkg); if (!resolved.startsWith(standaloneRoot)) throw new Error(pkg + ' resolved outside standalone: ' + resolved); await import(pathToFileURL(resolved).href); } const onnxRuntime = require.resolve('onnxruntime-node'); if (!onnxRuntime.startsWith(standaloneRoot)) throw new Error('onnxruntime-node resolved outside standalone: ' + onnxRuntime); await import(pathToFileURL(onnxRuntime).href);"
+  && node --input-type=module -e "import { createRequire } from 'node:module'; import { pathToFileURL } from 'node:url'; const standaloneRoot = '/app/.build/next/standalone/node_modules/'; const require = createRequire('/app/.build/next/standalone/package.json'); for (const pkg of ['@atjsh/llmlingua-2', '@huggingface/transformers', '@tensorflow/tfjs', 'js-tiktoken']) { const resolved = require.resolve(pkg); if (!resolved.startsWith(standaloneRoot)) throw new Error(pkg + ' resolved outside standalone: ' + resolved); await import(pathToFileURL(resolved).href); } const onnxRuntime = require.resolve('onnxruntime-node'); if (!onnxRuntime.startsWith(standaloneRoot)) throw new Error('onnxruntime-node resolved outside standalone: ' + onnxRuntime); await import(pathToFileURL(onnxRuntime).href);"
 
 # ── Runner base ────────────────────────────────────────────────────────────
 FROM base AS runner-base

Dockerfile.bun

@@ -1,146 +0,0 @@
-# ── Multi-stage Dockerfile for Native Bun Runtime (web-latest-bun) ───────────
-FROM oven/bun:1.3.14-slim AS base
-WORKDIR /app
-
-RUN apt-get update \
-  && apt-get upgrade -y \
-  && apt-get install -y --no-install-recommends \
-     build-essential \
-     python3 \
-     python-is-python3 \
-     make \
-     g++ \
-     libsecret-1-0 \
-     ca-certificates \
-     curl \
-  && rm -rf /var/lib/apt/lists/*
-
-# ── Builder stage (100% Bun Native Install & Build) ─────────────────────────
-FROM base AS builder
-WORKDIR /app
-
-COPY . .
-
-# Fast Bun native package install
-RUN bun install --include=optional --quiet
-
-# Compile native better-sqlite3 Node-API addon under Bun
-RUN if [ -d "node_modules/better-sqlite3" ]; then \
-      (cd node_modules/better-sqlite3 && bunx node-gyp rebuild); \
-    fi
-
-# Fetch tls-client-node native binary if script exists
-RUN if [ -f "node_modules/tls-client-node/scripts/postinstall.js" ]; then \
-      bun node_modules/tls-client-node/scripts/postinstall.js || true; \
-    fi
-
-# Disable Turbopack for Bun builder stage (Turbopack V8 internal worker bindings require Node)
-ENV OMNIROUTE_USE_TURBOPACK=0
-
-ARG OMNIROUTE_BASE_PATH=""
-ENV OMNIROUTE_BASE_PATH=$OMNIROUTE_BASE_PATH
-
-ARG DASHBOARD_ALLOW_EMBED=""
-ENV DASHBOARD_ALLOW_EMBED=$DASHBOARD_ALLOW_EMBED
-
-ENV NEXT_TELEMETRY_DISABLED=1
-ENV NODE_ENV=production
-
-# Bun native Next.js build execution
-RUN bun run --quiet build
-
-# ── Runner Base stage (100% Bun Native Production Runtime) ──────────────────
-FROM oven/bun:1.3.14-slim AS runner-base
-
-LABEL org.opencontainers.image.title="omniroute" \
-  org.opencontainers.image.description="Unified AI proxy — route any LLM through one endpoint (Bun Native)" \
-  org.opencontainers.image.url="https://omniroute.online" \
-  org.opencontainers.image.source="https://github.com/diegosouzapw/OmniRoute" \
-  org.opencontainers.image.licenses="MIT"
-
-WORKDIR /app
-
-RUN apt-get update \
-  && apt-get install -y --no-install-recommends \
-     libsecret-1-0 \
-     ca-certificates \
-     curl \
-  && rm -rf /var/lib/apt/lists/*
-
-ENV NODE_ENV=production
-ENV PORT=20128
-ENV HOSTNAME=0.0.0.0
-ENV OMNIROUTE_MEMORY_MB=1024
-
-ENV DATA_DIR=/app/data
-RUN mkdir -p /app/data
-
-COPY --from=builder /app/.build/next/standalone ./
-COPY --from=builder /app/node_modules/better-sqlite3 ./node_modules/better-sqlite3
-ENV OMNIROUTE_MIGRATIONS_DIR=/app/migrations
-
-COPY --from=builder /app/scripts/dev/healthcheck.mjs ./healthcheck.mjs
-
-EXPOSE 20128
-
-HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
-  CMD bun healthcheck.mjs || exit 1
-
-ENTRYPOINT ["bun", "dev/run-standalone.mjs"]
-
-# ── Runner Web stage (Bun Native + Chromium/Playwright for Web providers) ───
-FROM runner-base AS runner-web
-
-USER root
-
-RUN apt-get update \
-  && apt-get install -y --no-install-recommends \
-     chromium \
-     chromium-driver \
-     fonts-liberation \
-     libasound2t64 \
-     gconf-service \
-     libatk-bridge2.0-0 \
-     libatk1.0-0 \
-     libc6 \
-     libcairo2 \
-     libcups2 \
-     libdbus-1-3 \
-     libexpat1 \
-     libfontconfig1 \
-     libgbm1 \
-     libgcc-s1 \
-     libglib2.0-0 \
-     libgtk-3-0 \
-     libnspr4 \
-     libnss3 \
-     libpango-1.0-0 \
-     pangocairo-1.0-0 \
-     stdc++6 \
-     libx11-6 \
-     libx11-xcb1 \
-     libxcb1 \
-     libxcomposite1 \
-     libxcursor1 \
-     libxdamage1 \
-     libxext6 \
-     libxfixes3 \
-     libxi6 \
-     libxrandr2 \
-     libxrender1 \
-     libxss1 \
-     libxtst6 \
-     ca-certificates \
-     fonts-gargi \
-     fonts-ipafont-gothic \
-     fonts-kacst \
-     fonts-thai-tlwg \
-     fonts-wqy-zenhei \
-  && rm -rf /var/lib/apt/lists/*
-
-ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
-ENV PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=/usr/bin/chromium
-
-# Return to the base image non-root user after the apt install (mirrors the
-# Node Dockerfile runner-web stage, which re-asserts USER node).
-USER bun

PROVIDER_REFERENCE.md

@@ -1,447 +0,0 @@
----
-title: "Provider Reference"
-version: 3.8.50
-lastUpdated: 2026-08-21
----
-
-# Provider Reference
-
-> **Auto-generated** from `src/shared/constants/providers.ts` — do not edit by hand.
-> Regenerate with: `npm run gen:provider-reference`
-> **Last generated:** 2026-08-21
-
-Total providers: **349**. See category breakdown below.
-
-## Categories
-
-- **Free** — free tier with API key (configured via dashboard)
-- **No-auth** — public endpoints that require no key or sign-in at all
-- **OAuth** — sign-in flow handled by OmniRoute, no API key needed
-- **Web cookie** — wraps the provider's web app via cookie auth
-- **API key** — paid provider configured via API key (free credits may apply)
-- **Local** — runs on the user's machine (Ollama, LM Studio, vLLM, etc.)
-- **Search** — web search providers
-- **Audio** — audio-only providers (TTS/STT)
-- **Upstream proxy** — providers that proxy to other providers
-- **Cloud agent** — long-running coding agents (Codex Cloud, Devin, Jules)
-- **System** — OmniRoute-internal providers (loopback, etc.)
-
-Additional tags: `image`, `video`, `aggregator`, `enterprise`, `embed/rerank`, `self-hosted`.
-
-`Tool calling` (where shown): `native` — real function-calling API; `emulated` — the `tools` array is prompt-emulated via `webTools.ts` (regex-parsed `<tool>{...}</tool>` blocks); `none` — `tools` is currently silently dropped. See #7286.
-
-Use the dashboard at `/dashboard/providers` to enable, configure, and test each provider.
-
----
-
-## No-auth Providers (no key required) (11)
-
-| ID | Alias | Name | Tags | Website | Notes | Tool calling |
-|----|-------|------|------|---------|-------|--------------|
-| `aihorde` | `horde` | AI Horde | No-auth | [link](https://aihorde.net) | No API key required — uses AI Horde's documented anonymous key. Adding a free aihorde.net key is optional and only buys higher queue priority (kudos). | — |
-| `auggie` | `aug` | Augment (Auggie CLI) | No-auth | [link](https://augmentcode.com) | No API key stored by OmniRoute. Install the Auggie CLI and run `auggie login` on this machine, then OmniRoute spawns it locally for each request. | — |
-| `chipotle` | `pepper` | Chipotle Pepper AI (Free) | No-auth | [link](https://amelia.chipotle.com) | No credentials required. Uses Chipotle's public support chatbot via reverse-engineered SockJS/STOMP protocol. | — |
-| `cloudflare-playground` | `cfp` | Cloudflare AI Playground | No-auth | [link](https://playground.ai.cloudflare.com) | No credentials required — anonymous browser sessions over a reverse-engineered cf_agent WebSocket protocol (Playwright transport). | — |
-| `devin-cli-agentic` | `dva` | Devin CLI Agentic Bridge | No-auth | [link](https://docs.devin.ai/work-with-devin/devin-cli) | Authentication is owned by the official Devin CLI in its isolated bridge volume. | emulated |
-| `duckduckgo-web` | `ddgw` | DuckDuckGo AI Chat | No-auth | [link](https://duckduckgo.com/duckchat) | No credentials required — DuckDuckGo AI Chat is anonymous and free. | emulated |
-| `felo-web` | `felo` | Felo | No-auth | [link](https://felo.ai) | No credentials required — Felo is a free, no-signup chat/search aggregator. | — |
-| `opencode` | `oc` | OpenCode Free | No-auth | [link](https://opencode.ai) | No API key required — uses OpenCode's public free endpoint. | — |
-| `theoldllm` | `tllm` | The Old LLM (Free) | No-auth | [link](https://theoldllm.vercel.app) | No credentials required. The executor auto-generates access tokens via an embedded Playwright browser instance. | — |
-| `veoaifree-web` | `veo-free` | Veo AI Free | No-auth, video | [link](https://veoaifree.com) | No auth required. Rate limited to 6 requests/hour per IP. | — |
-| `zcode` | `zc` | ZCode (GLM Coding Plan) | No-auth | [link](https://zcode.z.ai) | No API key stored by OmniRoute. The local ZCode app-server uses the existing builtin:zai-coding-plan login. | — |
-
-## OAuth Providers (25)
-
-| ID | Alias | Name | Tags | Website | Notes |
-|----|-------|------|------|---------|-------|
-| `agy` | `agy` | Antigravity CLI | OAuth | [link](https://antigravity.google) | Import your Antigravity CLI (`agy`) login (paste/upload its token file), auto-detect a local CLI login, or sign in with Google. Shares the Antigravity backend (incl. Claude models). |
-| `amazon-q` | `aq` | Amazon Q | OAuth | [link](https://aws.amazon.com/q/developer/) | Uses the same AWS Builder ID or imported refresh-token flow as Kiro, but keeps Amazon Q connections separate. |
-| `antigravity` | — | Antigravity | OAuth | — | — |
-| `claude` | `cc` | Claude Code | OAuth | — | — |
-| `cline` | `cl` | Cline | OAuth | — | — |
-| `clinepass` | `cp` | ClinePass | OAuth | [link](https://cline.bot/cline-pass) | ClinePass is Cline's $9.99/mo subscription bundling 10 open coding models. Sign in with your Cline account (same login as the Cline CLI/IDE), or paste a direct ClinePass API key (app.cline.bot → Settings → API Keys). A ClinePass subscription unlocks the cline-pass/* models. Reuses the Cline WorkOS OAuth flow. |
-| `codebuddy-cn` | `cbcn` | CodeBuddy CN | OAuth | [link](https://copilot.tencent.com) | Tencent CodeBuddy CN (copilot.tencent.com). Sign in via the official CLI device-code flow, or paste a direct API key (sent as Authorization: Bearer). Catalog: GLM / Kimi / MiniMax / DeepSeek / Hunyuan. |
-| `codex` | `cx` | OpenAI Codex | OAuth | — | — |
-| `cursor` | `cu` | Cursor IDE | OAuth | — | — |
-| `devin-cli` | `dv` | Devin CLI | OAuth | [link](https://cli.devin.ai) | Requires the Devin CLI binary. Run `devin auth login` to authenticate, or provide your WINDSURF_API_KEY. Install: https://cli.devin.ai |
-| `devin-desktop` | — | Devin Desktop | OAuth | [link](https://devin.ai) | Paste an existing Devin API key from an authenticated Devin session. Key export availability and steps vary by Devin version and account. |
-| `ghe-copilot` | `ghe-copilot` | GitHub Enterprise Copilot | OAuth | — | Enter your GHE instance URL (e.g., https://ghe.company.com) in provider settings, then authenticate via device flow. |
-| `github` | `gh` | GitHub Copilot | OAuth | — | — |
-| `gitlab-duo` | `gitlab-duo` | GitLab Duo | OAuth | [link](https://docs.gitlab.com/user/duo_agent_platform/code_suggestions/) | GitLab Duo OAuth is not configured. Register an OAuth application at https://gitlab.com/-/profile/applications with redirect URI http://localhost:20128/callback and scopes "ai_features read_user", then set GITLAB_DUO_OAUTH_CLIENT_ID (and optionally GITLAB_DUO_OAUTH_CLIENT_SECRET) and restart. |
-| `grok-cli` | `gc` | Grok Build | OAuth | — | Sign in with your browser, or paste your ~/.grok/auth.json (or the JWT access token) from the Grok Build CLI; refresh_token is rotated automatically either way. |
-| `kilocode` | `kc` | Kilo Code | OAuth | — | — |
-| `kimi-coding` | `kmc` | Kimi Code CLI | OAuth | [link](https://www.kimi.com/code?aff=omniroute) | Sign in with the same Kimi account used by Kimi Code CLI. OmniRoute uses the CLI OAuth flow and Kimi Coding Plan endpoints. |
-| `kiro` | `kr` | Kiro AI | OAuth | — | Free tier: 50 credits/month (~25K–100K tokens). ⚠️ Kiro ToS prohibits third-party proxy/harness use. |
-| `openference` | `of` | Openference | OAuth | [link](https://openference.com) | Sign in with your Openference account to route requests through api.openference.com. An active plan is required for inference — OAuth may authenticate but return 402 without one. |
-| `qoder` | `if` | Qoder | OAuth | — | — |
-| `raycast` | `rc` | Raycast Pro AI | OAuth | [link](https://raycast.com/ai) | Unofficial integration — uses your Raycast Pro subscription via credentials from the macOS app (Auto-Import or manual capture). May break on Raycast updates. Not for redistribution; personal use only. |
-| `trae` | `tr` | Trae | OAuth | [link](https://trae.ai) | Trae is an AI-native IDE by ByteDance (SOLO remote agent). Authorize via trae.ai in the popup, or sign in at solo.trae.ai and paste the Cloud-IDE-JWT (sent as 'Authorization: Cloud-IDE-JWT <token>', ~14-day lifetime) as the access token; web_id/biz_user_id/user_unique_id/scope/tenant/region propagate via providerSpecificData. No headless refresh for pasted tokens — re-paste on expiry. |
-| `xai-oauth` | `xao` | xAI OAuth (Grok) | OAuth | [link](https://x.ai) | Sign in with xAI to use api.x.ai models such as Grok 4.5. This is separate from Grok Build JWT sessions, which use cli-chat-proxy.grok.com and grok-build model aliases. |
-| `zed` | `zd` | Zed IDE | OAuth | [link](https://zed.dev) | Zed stores LLM provider credentials (OpenAI, Anthropic, Google, Mistral, xAI) in the OS keychain. Use the Import button below to discover and import them automatically. |
-| `zed-hosted` | — | Zed Hosted Models | OAuth | [link](https://zed.dev) | Sign in with your Zed account (native-app sign-in). OmniRoute generates a one-time RSA keypair and opens zed.dev to authorize it — on a remote/headless install, copy the resulting 127.0.0.1 callback URL from your browser's address bar and paste it back here. Distinct from the 'Zed IDE' credential-import entry above: this proxies chat completions through Zed's own hosted model aggregator (cloud.zed.dev), fronting Anthropic/OpenAI/Google/xAI models under your Zed plan. |
-
-## Web Cookie Providers (35)
-
-| ID | Alias | Name | Tags | Website | Notes | Tool calling |
-|----|-------|------|------|---------|-------|--------------|
-| `adapta-web` | `adp-web` | Adapta.org (Adapta One Web) | Web cookie | [link](https://agent.adapta.one) | Paste your __client cookie value from .clerk.agent.adapta.one (DevTools → Application → Cookies) | emulated |
-| `adobe-firefly` | `firefly` | Adobe Firefly (Image/Video) | Web cookie | [link](https://firefly.adobe.com) | RECOMMENDED: firefly.adobe.com signed-in → F12 → Network → click firefly-3p.ff.adobe.io (generate-async or models/discovery) → Request Headers → Authorization → copy the token AFTER 'Bearer ' (starts with eyJ…). Cookie-only from firefly.adobe.com mints a GUEST token → 401/403; only multi-domain IMS cookies (adobelogin.com) or that Bearer JWT work. Unofficial/experimental media + Limits. | — |
-| `blackbox-web` | `bb-web` | Blackbox Web (Subscription) | Web cookie | [link](https://app.blackbox.ai) | Paste your __Secure-authjs.session-token value or full cookie header from app.blackbox.ai | emulated |
-| `chatgpt-web` | `cgpt-web` | ChatGPT Web (Plus/Pro) | Web cookie | [link](https://chatgpt.com) | Paste your __Secure-next-auth.session-token cookie value from chatgpt.com | emulated |
-| `chatgpt-web-codex` | `cgpt-codex` | ChatGPT Web (Codex) | Web cookie | [link](https://chatgpt.com) | Paste the full ChatGPT Cookie header. OmniRoute verifies it in an isolated headless browser profile. | native |
-| `claude-web` | `cw` | Claude Web | Web cookie | [link](https://claude.ai) | Paste your session cookie from claude.ai | none |
-| `conol-web` | `cnl` | Conol (Unofficial/Experimental) | Web cookie | [link](https://conol.ai) | Use browser sign-in, or paste the full Cookie header from conol.ai. The __Secure-better-auth.session_token cookie is required. | — |
-| `copilot-m365-web` | `m365copilot` | Microsoft 365 Copilot (BizChat) | Web cookie | [link](https://m365.cloud.microsoft/chat) | Sign in at m365.cloud.microsoft/chat, then open DevTools → Network → filter 'WS' → click the Chathub WebSocket connection. Copy both the access_token query parameter AND the account-specific Chathub path segment from its request URL (wss://…/Chathub/<path>?…&access_token=…). It is NOT an Authorization: Bearer header on an XHR/Fetch request. The token is short-lived; this is an unofficial integration. Optional: store a refresh_token in providerSpecificData.refreshToken (any Microsoft device-code/refresh flow for the substrate.office.com/sydney scopes) and OmniRoute pre-flight-refreshes the access token itself — otherwise re-capture after every ~75 min expiry. | — |
-| `copilot-web` | `copilot` | Microsoft Copilot Web | Web cookie | [link](https://copilot.microsoft.com) | Paste the access_token from an authenticated copilot.microsoft.com request (DevTools → Network → Authorization), or export a HAR while logged in | — |
-| `deepseek-web` | `ds-web` | DeepSeek Web | Web cookie | [link](https://chat.deepseek.com) | Paste your userToken from chat.deepseek.com — DevTools → Application → Local Storage → userToken | emulated |
-| `doubao-web` | `db` | Dola Web (ByteDance) | Web cookie | [link](https://www.dola.com) | Paste the full Cookie header from www.dola.com. It should include sessionid, ttwid, and s_v_web_id. If s_v_web_id is unavailable, fp=verify_... from a chat/completion request URL can be used as a fallback. | — |
-| `gemini-business` | `gembiz` | Gemini Business (Enterprise) | Web cookie | [link](https://business.gemini.google) | From your enterprise account: open business.gemini.google/home/cid/{your-cid}, then copy __Secure-1PSID and __Secure-1PSIDTS cookies from DevTools → Application → Cookies. Paste as a cookie header below. | — |
-| `gemini-web` | `gweb` | Gemini Web (Free) | Web cookie | [link](https://gemini.google.com) | Paste your __Secure-1PSID cookie value from gemini.google.com. Optionally add __Secure-1PSIDTS separated by semicolon. | emulated |
-| `grok-web` | `gw` | Grok Web (Subscription) | Web cookie | [link](https://grok.com) | Paste the full grok.com cookie line from DevTools → Application → Cookies. Include both `sso` and `sso-rw` (e.g. `sso=...; sso-rw=...`) — Grok's anti-bot rejects `sso` on its own. | — |
-| `hailuo-web` | `hailuo-web` | Hailuo Web (MiniMax) | Web cookie | [link](https://hailuo.ai) | Open hailuo.ai, log in, then open DevTools → Application → Local Storage → copy the "_token" value. device_id/uuid fingerprint fields are derived automatically; if requests fail, re-capture _token (sessions can expire). | — |
-| `huggingchat` | `huggingchat` | HuggingChat (Free) | Web cookie | [link](https://huggingface.co/chat) | Paste the full Cookie header from huggingface.co/chat (DevTools → Network → /chat/conversation → Request Headers → Cookie). It should include hf-chat and may also include token / aws-waf-token. | — |
-| `hyperagent` | `ha` | HyperAgent (Unofficial/Experimental) | Web cookie | [link](https://hyperagent.com) | Paste the full Cookie header from hyperagent.com (DevTools → Network → any request → Request Headers → Cookie). Session cookies power chat + billing usage. | — |
-| `inner-ai` | `in-ai` | Inner.ai (Subscription) | Web cookie | [link](https://app.innerai.com) | Paste your token cookie and email separated by a space: open DevTools → Application → Cookies → .innerai.com, copy the token value, then append a space and your Inner.ai login email. Example: eyJhbG... user@example.com | emulated |
-| `kimi-web` | `kimi-web` | Kimi Web | Web cookie | [link](https://www.kimi.com/code?aff=omniroute) | Paste access_token from www.kimi.com DevTools → Application → Local Storage. A legacy kimi-auth cookie is also accepted. | — |
-| `lmarena` | `lma` | Arena (Free) | Web cookie | [link](https://arena.ai) | Paste the full Cookie header from arena.ai (DevTools → Network → request → Cookie). Include arena-auth-prod-v1.0/.1… and cf_clearance/__cf_bm when present. OmniRoute uses Chrome TLS impersonation; if Arena still 403s, set providerSpecificData.recaptchaV3Token from a live browser session. | — |
-| `microsoft-designer-web` | `msdesigner` | Microsoft Designer (Image Generation) | Web cookie | [link](https://designer.microsoft.com) | Sign in at designer.microsoft.com, then open DevTools → Network, generate an image, and find the request to DallE.ashx?action=GetDallEImagesCogSci. Copy the value of its Authorization: Bearer header (the access_token — no 'Bearer ' prefix). The token is short-lived; this is an unofficial, reverse-engineered integration. | — |
-| `muse-spark-web` | `ms-web` | Muse Spark Web (Meta AI) | Web cookie | [link](https://www.meta.ai) | Paste your ecto_1_sess cookie AND the ecto1:... WS auth token from meta.ai. Capture the ecto1: token in DevTools → Network → WS → the clippy request's Authorization query param. Example: ecto_1_sess=4240a308...NVDg0; ecto1:ABCD... | emulated |
-| `notion-web` | `nw` | Notion AI Web (Unofficial/Experimental) | Web cookie | [link](https://www.notion.so) | Paste only the token_v2 cookie VALUE from app.notion.com (DevTools → Application → Cookies → token_v2). Do not paste token_v2= or the full Cookie header. Workspace is auto-detected; space_id / notion_user_id are optional. | — |
-| `perplexity-web` | `pplx-web` | Perplexity Web (Pro/Max) | Web cookie | [link](https://www.perplexity.ai) | Paste your __Secure-next-auth.session-token cookie value from perplexity.ai | emulated |
-| `poe-web` | `poe` | Poe Web (Subscription) | Web cookie | [link](https://poe.com) | Paste your p-b cookie value from poe.com (DevTools → Application → Cookies → p-b) | — |
-| `promptql` | `pql` | PromptQL (Unofficial/Experimental) | Web cookie | [link](https://prompt.ql.app) | Paste the Bearer JWT from prompt.ql.app DevTools → Network → graphql → Authorization (token only). Optional projectId + session Cookie for refresh. | — |
-| `qwen-web` | `qwen-web` | Qwen Web (Free) | Web cookie | [link](https://chat.qwen.ai) | Open chat.qwen.ai, log in, then open DevTools → Application → Local Storage → copy the "token" value (or use tongyi_sso_ticket cookie as Bearer token). | emulated |
-| `t3-web` | `t3chat` | t3.chat (Pro/Free) | Web cookie | [link](https://t3.chat) | Open t3.chat in your browser, log in, then open DevTools → Application → Local Storage → https://t3.chat. Copy the value of 'convex-session-id'. Also open DevTools → Network, copy the Cookie header from any request. Paste both values here. See provider setup docs for a step-by-step guide. | emulated |
-| `tencent-aistudio-web` | `tasw` | Tencent AI Studio (Free) | Web cookie | [link](https://aistudio.tencent.ai) | Log in to aistudio.tencent.ai, open DevTools -> Network, copy any request Cookie header containing session tokens. | — |
-| `tinycms-web` | `tcw` | TinyCMS Web (Free/Sub) | Web cookie | [link](https://site.tinycms.xyz) | Go to site.tinycms.xyz, open DevTools → Application → Local Storage, copy the value of 'app-config-uuid' (starts with 'R'), and paste it here. | — |
-| `v0-vercel-web` | `v0-vercel-web` | v0 Vercel Web (Code Gen) | Web cookie | [link](https://v0.dev) | Paste your session cookie from v0.dev (DevTools → Application → Cookies) | — |
-| `venice-web` | `ven` | Venice Web (Privacy) | Web cookie | [link](https://venice.ai) | Paste your session cookie from venice.ai (DevTools → Application → Cookies) | — |
-| `yuanbao-web` | `ybw` | Tencent Yuanbao (Free) | Web cookie | [link](https://yuanbao.tencent.com) | Log in to yuanbao.tencent.com, then paste the full Cookie header (DevTools → Network → any /api request → Request Headers → Cookie). It must contain hy_user and hy_token. | — |
-| `zai-web` | `zw` | Z.ai Web | Web cookie | [link](https://chat.z.ai) | Copy the "token" value from chat.z.ai → DevTools → Application → Local Storage. Do not copy cookies; OmniRoute handles the per-request CAPTCHA through its browser transport. | — |
-| `zenmux-free` | `zmf` | ZenMux Free (Web) | Web cookie | [link](https://zenmux.ai) | Login at zenmux.ai, then export all cookies using EditThisCookie or Cookie-Editor and paste the full Cookie header string here. Refresh every ~30 days. | — |
-
-## API Key Providers (paid / paid-with-free-credits) (233)
-
-| ID | Alias | Name | Tags | Website | Notes |
-|----|-------|------|------|---------|-------|
-| `360ai` | `360ai` | 360 AI | API key | [link](https://ai.360.cn) | Get API key at ai.360.cn |
-| `agentrouter` | `agentrouter` | AgentRouter | API key, aggregator | [link](https://agentrouter.org) | $200 free credits on signup - multi-model routing gateway |
-| `agnes` | `agnes` | Agnes AI | API key, video | [link](https://agnes-ai.com) | Get API key at agnes-ai.com |
-| `ai21` | `ai21` | AI21 Labs | API key | [link](https://www.ai21.com) | $10 trial credits on signup (valid 3 months), no credit card required |
-| `aimlapi` | `aiml` | AI/ML API | API key, aggregator | [link](https://aimlapi.com) | Free tier paused (2026) — AI/ML API is now pay-as-you-go only (min $20 top-up); no recurring free credits. |
-| `ainative` | `ainative` | AINative Studio | API key | [link](https://ainative.studio) | Create a free API key at ainative.studio (no card), then paste it here as a Bearer token. |
-| `aion` | `aion` | Aion Labs | API key | [link](https://www.aionlabs.ai) | Create a free API key at aionlabs.ai (no card), then paste it here as a Bearer token. |
-| `alibaba` | `ali` | Alibaba Cloud Model Studio | API key | [link](https://bailian.console.alibabacloud.com/) | — |
-| `alibaba-cn` | `ali-cn` | Alibaba (China) | API key | [link](https://dashscope.console.aliyun.com/) | — |
-| `ant-ling` | `ling` | Ant Ling / Ring (inclusionAI) | API key | [link](https://developer.ant-ling.com/en/docs/) | Register and create an API key at the Ant Ling API console (https://chat.ant-ling.com/open), then paste it here. OmniRoute routes chat traffic to https://api.ant-ling.com/v1/chat/completions; the provider is OpenAI-compatible and also exposes an Anthropic-compatible surface. |
-| `anthropic` | `anthropic` | Anthropic | API key | [link](https://platform.claude.com) | — |
-| `anyapi` | `anyapi` | AnyAPI AI | API key, aggregator | [link](https://anyapi.ai) | Free plan: 100,000 ANY Tokens/day and 100 RPM for eligible Free/Basic models; no credit card required. |
-| `api-airforce` | `af` | Api.airforce | API key | [link](https://api.airforce) | 55 free tier models including Grok-3, Claude 3.7, Qwen3, Kimi-K2, Gemini 2.5 Flash, DeepSeek-V3 |
-| `arcee-ai` | `arcee` | Arcee AI | API key | [link](https://arcee.ai) | Get API key at arcee.ai |
-| `auriko` | `auriko` | Auriko | API key, aggregator | [link](https://www.auriko.ai) | Free plan publishes 1,000 Platform RPM and 10,000 BYOK RPM. Platform inference still passes through provider cost; this is not a free-token pool or unlimited free inference. |
-| `azure-ai` | `azure-ai` | Azure AI Foundry | API key, enterprise | [link](https://learn.microsoft.com/azure/ai-foundry) | Use your Azure AI Foundry key. Base URL can be https://<resource>.services.ai.azure.com/openai/v1/ or https://<resource>.openai.azure.com/openai/v1/. |
-| `azure-openai` | `azure` | Azure OpenAI | API key, enterprise | [link](https://azure.microsoft.com/products/ai-services/openai-service) | Use your Azure OpenAI API key. Base URL should be your resource endpoint, for example https://my-resource.openai.azure.com. |
-| `bai` | `bai` | b.ai | API key | [link](https://b.ai) | Bearer API key for the b.ai OpenAI-compatible LLM gateway (distinct from TheB.AI). Create a key at https://docs.b.ai, then use https://api.b.ai/v1 as the OpenAI-compatible base URL. |
-| `baichuan` | `baichuan` | Baichuan | API key | [link](https://www.baichuan-ai.com/) | Get API key at platform.baichuan-ai.com |
-| `baidu` | `baidu` | Baidu (ERNIE) | API key | [link](https://ernie.baidu.com/) | Get API key at console.bce.baidu.com |
-| `bailian-coding-plan` | `bcp` | Alibaba Token Plan | API key | [link](https://www.alibabacloud.com/help/en/model-studio/token-plan-overview) | — |
-| `baseten` | `baseten` | Baseten | API key | [link](https://baseten.co) | $30 free trial credits for GPU inference |
-| `bazaarlink` | `bzl` | BazaarLink | API key | [link](https://bazaarlink.ai) | Use your BazaarLink API key (starts with sk-bl-) in Authorization: Bearer <key>. OpenAI SDK works with base URL https://bazaarlink.ai/api/v1. Models use provider/model-name format. |
-| `bedrock` | `bedrock` | Amazon Bedrock | API key, enterprise | [link](https://aws.amazon.com/bedrock) | Use your Amazon Bedrock API key and configure the AWS region where your models are enabled (for example eu-west-2). OmniRoute calls Bedrock's native Converse API directly. |
-| `black-forest-labs` | `bfl` | Black Forest Labs | API key, image | [link](https://blackforestlabs.ai) | — |
-| `blackbox` | `bb` | Blackbox AI | API key | [link](https://blackbox.ai) | Limited free access is available through Blackbox; model availability and account limits apply |
-| `bluesminds` | `bm` | BluesMinds | API key | [link](https://www.bluesminds.com) | Free daily pi credits — supports 200+ models including GPT-4o, GPT-4.1, Claude Sonnet 4.5, Gemini 2.0 Flash, DeepSeek V4, Qwen, Kimi K2 |
-| `byteplus` | `bpm` | BytePlus ModelArk | API key | [link](https://console.byteplus.com/ark) | — |
-| `bytez` | `bytez` | Bytez | API key | [link](https://bytez.com) | $1 free credits, refreshes every 4 weeks |
-| `cerebras` | `cerebras` | Cerebras | API key | [link](https://inference.cerebras.ai) | Free Trial: 1M tokens/day, 30K TPM, 5 RPM — no credit card. |
-| `charm-hyper` | `charm-hyper` | Charm Hyper | API key | [link](https://hyper.charm.land) | 100 free monthly Hypercredits on signup |
-| `chat-oripe` | `chat-oripe` | Chat Oripe | API key, aggregator | [link](https://api.oriper.com) | Official metadata advertises 2M tokens/month, but the public site and documentation were blocked during audit; treat the quota and brand mapping as unconfirmed. |
-| `chatanywhere` | `chatanywhere` | ChatAnywhere | API key, aggregator | [link](https://chatanywhere.tech) | Personal, educational or research use only: public documentation cites 10,000 points/day and 200 requests/day per IP/key; do not use for commercial traffic. |
-| `cheaperinference` | `cinf` | Cheaper Inference | API key | [link](https://cheaperinference.com/?utm_source=omniroute) | — |
-| `chenzk` | `chenzk` | Chenzk API | API key | [link](https://chenzk.top) | — |
-| `chutes` | `chutes` | Chutes.ai | API key, aggregator | [link](https://chutes.ai) | Bearer API key for the Chutes OpenAI-compatible gateway. |
-| `clarifai` | `clarifai` | Clarifai | API key, enterprise | [link](https://docs.clarifai.com) | Use your Clarifai PAT or app-specific API key. OmniRoute targets the OpenAI-compatible endpoint at https://api.clarifai.com/v2/ext/openai/v1 and authenticates with Authorization: Key <token>. |
-| `cloudcode-one` | `cloudcode-one` | CloudCode.ONE | API key, aggregator | [link](https://cloudcode.one) | Published free models include glm-4.7-flash and glm-4.6v-flash; no numeric quota is published, and key creation may require credit or a coupon. |
-| `cloudflare-ai` | `cf` | Cloudflare Workers AI | API key | [link](https://developers.cloudflare.com/workers-ai) | Requires API Token AND Account ID (found at dash.cloudflare.com) |
-| `clova-studio` | `clova` | Naver CLOVA Studio | API key | [link](https://api.ncloud-docs.com/docs/en/ai-naver-clovastudio-summary) | — |
-| `codestral` | `codestral` | Codestral | API key | [link](https://mistral.ai) | — |
-| `cohere` | `cohere` | Cohere | API key | [link](https://cohere.com) | Free Trial: 1,000 API calls/month for testing, no credit card required |
-| `command-code` | `cmd` | Command Code | API key | [link](https://commandcode.ai/) | Use a Command Code API key. Requests are sent to Command Code's /alpha/generate endpoint. |
-| `coze` | `coze` | Coze | API key | [link](https://coze.com) | Get API key at coze.com/open/api |
-| `crof` | `crof` | CrofAI | API key | [link](https://crof.ai) | — |
-| `cursor-api` | `cua` | Cursor API | API key | [link](https://cursor.com/dashboard/api) | Paste a Cursor user API key (crsr_...) from cursor.com/dashboard/api. OmniRoute exchanges it for a session token on demand; no IDE or cursor-agent install is needed. Usage bills to the Cursor plan that owns the key. |
-| `dahl` | `dahl` | Dahl | API key | [link](https://inference.dahl.global) | Click 'Add Account' to auto-generate a token, or add a manual API key. |
-| `databricks` | `databricks` | Databricks | API key, enterprise | [link](https://www.databricks.com) | — |
-| `datarobot` | `datarobot` | DataRobot | API key, enterprise | [link](https://docs.datarobot.com) | Use your DataRobot API token. Optional Base URL can be the account root (for LLM Gateway) or a deployment URL under /api/v2/deployments/<id>. |
-| `deepai` | `deepai` | DeepAI | API key, image | [link](https://deepai.org) | Use your DeepAI API key. Get one at deepai.org — requires a Pro subscription ($9.99/mo). |
-| `deepinfra` | `deepinfra` | DeepInfra | API key | [link](https://deepinfra.com) | Free signup credits for API testing and model exploration |
-| `deepseek` | `ds` | DeepSeek | API key | [link](https://platform.deepseek.com) | 5M free tokens on signup - no credit card required |
-| `dgrid` | `dgrid` | DGrid | API key | [link](https://dgrid.ai) | DGrid Free Models Router: 10 requests/minute and 100 requests/day. A $5 lifetime top-up unlocks up to 20 requests/minute and 1,000 requests/day. |
-| `dify` | `dify` | Dify | API key | [link](https://dify.ai) | Get API key from your Dify instance. |
-| `digitalocean` | `digitalocean` | DigitalOcean | API key | [link](https://docs.digitalocean.com/products/ai-platform/) | — |
-| `dit` | `dai` | DIT.ai | API key | [link](https://dit.ai) | Use your dit.ai API key in Authorization: Bearer <key>. Fully OpenAI-compatible — a drop-in replacement, just change the base URL to https://api.dit.ai/v1. |
-| `doubao` | `doubao` | Doubao | API key | [link](https://doubao.com) | Get API key at console.volcengine.com |
-| `dxnt` | `dxnt` | DXNT / DX Token | API key, aggregator | [link](https://www.dxnt.com) | Free accounts are documented at 100 calls/day; the quota may increase through invitations and can vary by account. |
-| `electronhub` | `electronhub` | Electron Hub | API key, aggregator | [link](https://www.electronhub.ai) | Free plan: 5 RPM, $0.25 weekly credits and 10 Neutrinos/day for :free models; family budgets also apply. |
-| `empower` | `empower` | Empower | API key, aggregator | [link](https://docs.empower.dev) | Bearer API key for the Empower OpenAI-compatible endpoint. |
-| `factory` | `factory` | Factory | API key | [link](https://factory.ai) | Bearer API key for the Factory OpenAI-compatible gateway. |
-| `fal-ai` | `fal` | Fal.ai | API key, image | [link](https://fal.ai) | — |
-| `fastrouter` | `fastrouter` | FastRouter | API key, aggregator | [link](https://fastrouter.ai) | Models with the :free suffix allow 10 requests/day per organization and model; availability may change. |
-| `featherless-ai` | `featherless` | Featherless AI | API key | [link](https://featherless.ai) | Free tier available — no credit card required |
-| `fenayai` | `fenayai` | FenayAI | API key, aggregator | [link](https://fenayai.com) | Bearer API key for the FenayAI OpenAI-compatible gateway. |
-| `fireworks` | `fireworks` | Fireworks AI | API key | [link](https://fireworks.ai) | $1 free starter credits on signup for API testing |
-| `free-ai` | `free-ai` | Free.ai | API key, aggregator | [link](https://free.ai) | 30,000 tokens/day cover self-hosted models after email verification. Usage beyond the pool can bill at raw cost, and premium external models are paid. |
-| `freeaiapikey` | `faik` | FreeAIAPIKey | API key | [link](https://freeaiapikey.com) | — |
-| `freebuff` | `freebuff` | Freebuff | API key | [link](https://freebuff.com) | Enter Freebuff / Codebuff Auth Token (obtained via CLI login or automated harvester). |
-| `freeinference` | `freeinference` | FreeInference | API key, aggregator | [link](https://freeinference.org) | Free research access without a card; non-Harvard applicants require manual approval and no numeric quota is publicly guaranteed. |
-| `freemodel-dev` | `fmd` | FreeModel.dev | API key | [link](https://freemodel.dev) | $300 free credits on signup — no credit card required. Access GPT-5.4 and GPT-5.5 (OpenAI's latest flagship models) through an OpenAI-compatible API. |
-| `freetheai` | `fta` | FreeTheAi | API key, aggregator | [link](https://freetheai.xyz) | Join the FreeTheAi Discord to get your free API key. |
-| `friendliai` | `friendli` | FriendliAI | API key | [link](https://friendli.ai) | Free tier for serverless inference — no credit card required |
-| `g4f-gemini` | `g4fgem` | g4f.space — Gemini | API key, aggregator | [link](https://g4f.space) | No auth required. Free tier is limited to 5 requests/minute — sign up at g4f.dev/members.html for higher limits. |
-| `g4f-groq` | `g4fgroq` | g4f.space — Groq | API key, aggregator | [link](https://g4f.space) | No auth required. Free tier is limited to 5 requests/minute — sign up at g4f.dev/members.html for higher limits. |
-| `g4f-nvidia` | `g4fnv` | g4f.space — NVIDIA | API key, aggregator | [link](https://g4f.space) | No auth required. Free tier is limited to 5 requests/minute — sign up at g4f.dev/members.html for higher limits. |
-| `g4f-ollama` | `g4foll` | g4f.space — Ollama | API key, aggregator | [link](https://g4f.space) | No auth required. Free tier is limited to 5 requests/minute — sign up at g4f.dev/members.html for higher limits. |
-| `g4f-pollinations` | `g4fpol` | g4f.space — Pollinations | API key, aggregator | [link](https://g4f.space) | No auth required. Free tier is limited to 5 requests/minute — sign up at g4f.dev/members.html for higher limits. |
-| `galadriel` | `galadriel` | Galadriel | API key | [link](https://galadriel.com) | ⚠️ **DEPRECATED.** api.galadriel.ai no longer resolves (sweep 2026-06-19); the inference API appears discontinued. |
-| `gemini` | `gemini` | Gemini (Google AI Studio) | API key | [link](https://aistudio.google.com) | Free tier available through Google AI Studio; current per-model quotas and regional limits apply |
-| `getgoapi` | `ggo` | GoAPI | API key, aggregator | [link](https://api.getgoapi.com) | — |
-| `gigachat` | `gigachat` | GigaChat (Sber) | API key | [link](https://developers.sber.ru) | — |
-| `gitlab` | `gitlab` | GitLab Duo PAT | API key | [link](https://docs.gitlab.com/user/duo_agent_platform/code_suggestions/) | GitLab personal access token for the public Code Suggestions API. Configure a self-hosted base URL when not using gitlab.com. |
-| `gitlawb` | `glb` | Gitlawb Opengateway (MiMo) | API key | [link](https://opengateway.gitlawb.com) | Free MiMo (xiaomi/mimo-v2.5) revoked 2026-05 — Opengateway is now a pay-as-you-go credit gateway; no recurring free model. |
-| `gitlawb-gmi` | `glb-gmi` | Gitlawb Opengateway (GMI Cloud) | API key | [link](https://opengateway.gitlawb.com) | Free Nemotron promo ended 2026-06 — the GMI Cloud route is now pay-as-you-go credit only. |
-| `glm` | `glm` | GLM Coding | API key | [link](https://z.ai/subscribe) | — |
-| `glm-cn` | `glmcn` | GLM Coding (China) | API key | [link](https://open.bigmodel.cn) | — |
-| `glmt` | `glmt` | GLM Thinking | API key | [link](https://open.bigmodel.cn) | — |
-| `groq` | `groq` | Groq | API key | [link](https://groq.com) | Free tier: 30 RPM / 14.4K RPD — no credit card |
-| `hackclub` | `hc` | Hackclub AI | API key, aggregator | [link](https://ai.hackclub.com) | Sign in with your Hack Club account at ai.hackclub.com. |
-| `haiper` | `hp` | Haiper | API key, video | [link](https://haiper.ai) | Get API key at haiper.ai/haiper-api |
-| `hcnsec` | `hcnsec` | Huancheng Public API | API key | [link](https://api.hcnsec.cn) | Get API key at api.hcnsec.cn |
-| `helixmind` | `helixmind` | HelixMind | API key, aggregator | [link](https://helixmind.online) | Previously circulated 3 RPM/50 RPD and no-card claims were not confirmed during the 2026-08-02 audit; current quota and billing require account verification. |
-| `helyxai` | `helyxai` | Helyx AI | API key, aggregator | [link](https://helyxai.space) | Operational Free plan documents 100,000 tokens/day; the site's separate 2M+ marketing claim conflicts and is not treated as a quota guarantee. |
-| `heroku` | `heroku` | Heroku AI | API key, enterprise | [link](https://www.heroku.com) | — |
-| `huggingface` | `hf` | HuggingFace | API key | [link](https://huggingface.co) | Free Inference API for thousands of models (Whisper, VITS, SDXL…) |
-| `hyperbolic` | `hyp` | Hyperbolic | API key | [link](https://hyperbolic.xyz) | $1-5 trial credits on signup for serverless inference |
-| `ideogram` | `ideo` | Ideogram | API key | [link](https://ideogram.ai) | Get API key at ideogram.ai/docs/api |
-| `iflytek` | `iflytek` | iFlytek Spark | API key | [link](https://xinghuo.xfyun.cn) | Get API key at console.xfyun.cn |
-| `inception` | `inception` | Inception | API key | [link](https://docs.inceptionlabs.ai) | 10M free tokens on signup, no credit card required. |
-| `inference-net` | `inet` | Inference.net | API key | [link](https://inference.net) | $25 free credits on signup plus research grants available |
-| `internlm` | `internlm` | InternLM (Intern-S1) | API key | [link](https://internlm.intern-ai.org.cn/) | Free monthly quota ~1M input / 3M output tokens (~10 RPM) |
-| `jina-ai` | `jina` | Jina AI (Foundation API) | API key, embed/rerank | [link](https://jina.ai) | Bearer API key for api.jina.ai — embeddings, rerank, classify, segment, and search. Dashboard keys take precedence over JINA_AI_API_KEY. This is not the Reader / r.jina.ai card and does not fetch URLs. |
-| `jina-reader` | `jr` | Jina Reader (r.jina.ai) | API key | [link](https://jina.ai/reader) | Bearer API key for r.jina.ai URL-to-markdown (/v1/web/fetch only). Does not serve /v1/embeddings or /v1/rerank. The same Jina token as Foundation API works; OmniRoute reuses a jina-ai dashboard key or JINA_AI_API_KEY when this card is empty. |
-| `kenari` | `kenari` | Kenari | API key | [link](https://kenari.id) | Use your Kenari API key (kn-...) in Authorization: Bearer <key>. Fully OpenAI-compatible. API base URL: https://kenari.id/v1. |
-| `kie` | `kie` | KIE.AI | API key | [link](https://kie.ai) | — |
-| `kilo-gateway` | `kg` | Kilo Gateway | API key, aggregator | [link](https://kilo.ai) | — |
-| `kimi` | `kimi` | Kimi (Legacy Moonshot API) | API key | [link](https://platform.kimi.ai?aff=omniroute) | — |
-| `kimi-coding-apikey` | `kmca` | Kimi Code API Key | API key | [link](https://www.kimi.com/code?aff=omniroute) | — |
-| `lambda-ai` | `lambda` | Lambda AI | API key | [link](https://lambda.ai) | — |
-| `laozhang` | `lz` | LaoZhang AI | API key, aggregator | [link](https://api.laozhang.ai) | — |
-| `leonardo` | `leo` | Leonardo AI | API key, video | [link](https://leonardo.ai) | Get API key at leonardo.ai/developer |
-| `liquid` | `liquid` | Liquid AI | API key | [link](https://liquid.ai) | Get API key at liquid.ai |
-| `literouter` | `literouter` | LiteRouter | API key, aggregator | [link](https://literouter.com) | Free model variants use the :free suffix; daily credit limits vary by model and free input is capped at 5,000 tokens. |
-| `llamagate` | `llamagate` | LlamaGate | API key | [link](https://llamagate.ai) | — |
-| `llm-kiwi` | `llmkiwi` | LLM.Kiwi | API key, aggregator | [link](https://llm.kiwi) | Free plan exposes auto and hrLLM; the published 40 requests/hour limit applies to hrLLM. |
-| `llm7` | `llm7` | LLM7.io | API key | [link](https://llm7.io) | Use any non-empty key (for example 'unused'). If older built-in models return model_unavailable, use Available Models → Import from /models or Auto-Sync; verified live model: gemini-3.1-flash-lite. |
-| `llmgateway` | `llmgateway` | LLM Gateway | API key, aggregator | [link](https://llmgateway.io) | Hosted Free plan: free-priced models are limited to 5 requests per 10 minutes when the account has no credits. |
-| `logfare` | `logfare` | Logfare | API key, aggregator | [link](https://logfare.ai) | Create a free account at https://logfare.ai/register (username/password, no email verification) to get an instant API key, then paste it here as a Bearer token. |
-| `longcat` | `lc` | LongCat AI | API key | [link](https://longcat.chat/platform/docs) | Free: one-time 10M-token grant after account signup + KYC verification (LongCat-2.0). One-time only — not a recurring daily/monthly allowance. |
-| `magnific` | `freepik` | Magnific | API key, image | [link](https://www.magnific.com) | Get an API key at magnific.com/user/api-keys (header x-magnific-api-key). Legacy Freepik developer keys still work. |
-| `maritalk` | `maritalk` | Maritalk | API key | [link](https://www.maritaca.ai) | — |
-| `meganova-ai` | `meganova-ai` | MegaNova AI | API key, aggregator | [link](https://meganova.ai) | Free signup without a card. Published Tier 1 per-model quotas total 550 requests/day; they are not a shared global pool, and paid overage can apply if enabled. |
-| `meta-llama` | `meta` | Meta Llama API | API key | [link](https://llama.developer.meta.com) | — |
-| `minimax` | `minimax` | Minimax Coding | API key, video | [link](https://www.minimax.io) | — |
-| `minimax-cn` | `minimax-cn` | Minimax (China) | API key | [link](https://www.minimaxi.com) | — |
-| `mistral` | `mistral` | Mistral | API key | [link](https://mistral.ai) | Free Experiment tier: rate-limited access to all models, no credit card required |
-| `mixedbread` | `mxbai` | Mixedbread AI | API key | [link](https://www.mixedbread.com) | Bearer API key for the Mixedbread embeddings API. |
-| `mixlayer` | `mixlayer` | Mixlayer | API key, aggregator | [link](https://www.mixlayer.com) | The qwen/qwen3.5-4b-free model is free for prototyping and rate-limited; no fixed public RPM or daily quota is confirmed. |
-| `mnn-ai` | `mnn-ai` | MNN AI | API key, aggregator | [link](https://mnnai.ru) | Free plan: $1 monthly credits, 10 RPM and access only to models marked Free. |
-| `modal` | `mdl` | Modal | API key, enterprise | [link](https://modal.com/docs) | Use the bearer token that protects your Modal deployment, if enabled. Base URL should point to your OpenAI-compatible Modal app, for example https://<workspace>--<app>.modal.run/v1. |
-| `modelscope` | `ms` | ModelScope | API key | [link](https://modelscope.cn) | Free tier via ModelScope API-Inference — Alibaba account required. |
-| `monsterapi` | `monster` | MonsterAPI | API key | [link](https://monsterapi.ai) | ⚠️ **DEPRECATED.** Monster API shuttered operations on 2026-06-30. Use alternative OpenAI-compatible providers. |
-| `moonshot` | `moonshot` | Kimi | API key | [link](https://platform.kimi.ai?aff=omniroute) | — |
-| `morph` | `morph` | Morph | API key | [link](https://morphllm.com) | Free tier: 250K credits/month, $0 |
-| `muse-code` | `mc` | Muse Code (Meta) | API key | [link](https://github.com/meta-llama/llama-stack) | Use your META_API_KEY env var as a Bearer token. Muse Code CLI uses the OpenAI Responses API wire format (POST /responses). |
-| `naga-ac` | `naga` | Naga.ac | API key, aggregator | [link](https://naga.ac) | Get API key at naga.ac — Google/GitHub/Discord signup available. |
-| `naga-ai` | `naga-ai` | Naga AI | API key, aggregator | [link](https://naga.ac) | Models marked :free are publicly listed, but no numeric quota is confirmed. Naga's policy warns that free-tier prompts and outputs may be collected or used for training. |
-| `nanogpt` | `nanogpt` | NanoGPT | API key | [link](https://nano-gpt.com) | — |
-| `nara` | `nara` | NaraRouter | API key | [link](https://bynara.id) | Get a free API key via NaraRouter's Telegram channel, then paste it here as a Bearer token. |
-| `navy` | `navy` | NavyAI | API key | [link](https://api.navy) | Create a free API key from the NavyAI dashboard, then paste it here as a Bearer token. |
-| `nebius` | `nebius` | Nebius AI | API key | [link](https://nebius.com) | ~$1 trial credits on signup for API testing |
-| `nlpcloud` | `nlpc` | NLP Cloud | API key | [link](https://docs.nlpcloud.com) | Use your NLP Cloud API key in Authorization: Token <key>. OmniRoute targets the chatbot endpoint on https://api.nlpcloud.io/v1/gpu/<model>/chatbot by default. |
-| `nomic` | `nomic` | Nomic | API key | [link](https://nomic.ai) | Get API key at atlas.nomic.ai |
-| `nous-research` | `nous` | Nous Research | API key | [link](https://portal.nousresearch.com/help) | Use your Nous Portal API key. OmniRoute targets the official OpenAI-compatible inference endpoint at https://inference-api.nousresearch.com/v1. |
-| `novita` | `novita` | Novita AI | API key, video, aggregator | [link](https://novita.ai) | $0.50 trial credits on signup (valid about 1 year) |
-| `nscale` | `nscale` | nScale | API key | [link](https://nscale.com) | $5 free credits on signup for inference testing |
-| `nube` | `nube` | Nube.sh | API key | [link](https://nube.sh) | — |
-| `nvidia` | `nvidia` | NVIDIA NIM | API key | [link](https://build.nvidia.com) | Free dev access: ~40 RPM, 70+ models (Kimi K2.5, GLM 4.7, DeepSeek V3.2...) |
-| `oci` | `oci` | OCI Generative AI | API key, enterprise | [link](https://www.oracle.com/artificial-intelligence/generative-ai) | Use your OCI Generative AI API key or IAM bearer token. Base URL can be https://inference.generativeai.<region>.oci.oraclecloud.com/openai/v1/. |
-| `ofoxai` | `ofoxai` | OfoxAI | API key, aggregator | [link](https://ofox.ai) | The current catalog advertises 10+ free models without a public numeric quota; review upstream provenance, retention and training terms before production use. |
-| `ollama-cloud` | `ollamacloud` | Ollama Cloud | API key | [link](https://ollama.com/settings/keys) | — |
-| `openadapter` | `oad` | OpenAdapter | API key | [link](https://openadapter.dev) | Use your OpenAdapter API key in Authorization: Bearer sk-cv-<key>. Fully OpenAI-compatible. API base URL: https://api.openadapter.in/v1. |
-| `openai` | `openai` | OpenAI | API key | [link](https://platform.openai.com) | — |
-| `opencode-go` | `opencode-go` | OpenCode Go | API key | [link](https://opencode.ai/go) | — |
-| `opencode-zen` | `opencode-zen` | OpenCode Zen | API key | [link](https://opencode.ai/zen) | — |
-| `openference-api` | `ofa` | Openference API | API key | [link](https://openference.com) | Free plan: 3-day trial with open-source models — no credit card required |
-| `openrouter` | `openrouter` | OpenRouter | API key, aggregator | [link](https://openrouter.ai) | Free models at $0/token with :free suffix - 20 RPM / 200 RPD |
-| `openvecta` | `openvecta` | OpenVecta | API key | [link](https://openvecta.com) | Free credits on signup for OpenAI-compatible inference across LLMs, embeddings, and reasoning models |
-| `orcarouter` | `orcarouter` | OrcaRouter | API key | [link](https://www.orcarouter.ai) | — |
-| `ovhcloud` | `ovh` | OVHcloud AI | API key | [link](https://www.ovhcloud.com) | — |
-| `perplexity` | `pplx` | Perplexity | API key | [link](https://www.perplexity.ai) | — |
-| `piapi` | `pi` | PiAPI | API key, aggregator | [link](https://piapi.ai) | — |
-| `pioneer` | `pn` | Pioneer AI | API key | [link](https://pioneer.ai) | $75 free usage credits — no credit card required |
-| `plamo` | `plamo` | PLaMo | API key | [link](https://plamo.preferredai.jp/api) | — |
-| `poe` | `poe` | Poe | API key, aggregator | [link](https://creator.poe.com/api-reference) | Bearer API key for the Poe OpenAI-compatible API. |
-| `poixe-ai` | `poixe-ai` | Poixe AI | API key, aggregator | [link](https://poixe.com) | Current public free limits are small and model-group specific: 2 RPM/5 RPD for large-cup models and 20 RPM/50 RPD for small-cup models. |
-| `pollinations` | `pol` | Pollinations AI | API key, video | [link](https://pollinations.ai) | Anonymous/keyless access to the documented free models is best-effort. Local v3.8.50 verification (2026-07-31) returned 401 via OmniRoute and Cloudflare 1010 on direct upstream probes from the same network. Premium models still require a Pollinations API key from enter.pollinations.ai. |
-| `poolside` | `poolside` | Poolside | API key | [link](https://poolside.ai) | Laguna S 2.1 and XS 2.1 are free during Preview; no public numeric quota is published. |
-| `predibase` | `predibase` | Predibase | API key | [link](https://predibase.com) | ⚠️ **DEPRECATED.** serving.app.predibase.com no longer resolves (sweep 2026-06-19); the managed serving API appears discontinued. |
-| `publicai` | `publicai` | PublicAI | API key | [link](https://publicai.co) | Requires an API key — one-time signup credit, then paid |
-| `qianfan` | `qianfan` | Baidu Qianfan | API key | [link](https://cloud.baidu.com/product-s/qianfan_home) | — |
-| `qiniu` | `qiniu` | Qiniu | API key | [link](https://www.qiniu.com) | — |
-| `qwen-cloud` | `qwc` | Qwen Cloud | API key | [link](https://www.qwencloud.com/) | — |
-| `qwen-cloud-token-plan` | `qct` | Qwen Cloud Token Plan | API key | [link](https://www.qwencloud.com/pricing/token-plan) | — |
-| `recraft` | `recraft` | Recraft | API key, image | [link](https://recraft.ai) | — |
-| `regolo` | `regolo` | Regolo AI | API key | [link](https://regolo.ai) | Get your Regolo API key from regolo.ai, then paste it here as a Bearer token. |
-| `reka` | `reka` | Reka | API key | [link](https://docs.reka.ai/chat/overview) | Use your Reka API key. OmniRoute supports the OpenAI-compatible base URL https://api.reka.ai/v1 and sends both Authorization and X-Api-Key headers for compatibility. |
-| `requesty` | `requesty` | Requesty | API key | [link](https://requesty.ai) | Free tier ~200 requests/day - multi-model routing gateway (300+ models) |
-| `routeway` | `routeway` | Routeway | API key | [link](https://routeway.ai) | Create a free API key at routeway.ai, then paste it here as a Bearer token. |
-| `runwayml` | `runway` | Runway | API key, video | [link](https://docs.dev.runwayml.com) | Use your Runway API key in Authorization: Bearer <key>. OmniRoute targets the current Runway API at https://api.dev.runwayml.com/v1 and sends the required X-Runway-Version header automatically. |
-| `sambanova` | `samba` | SambaNova | API key | [link](https://sambanova.ai) | $5 free credits on signup (30-day validity), no credit card required |
-| `sap` | `sap` | SAP Generative AI Hub | API key, enterprise | [link](https://help.sap.com/docs/sap-ai-core/sap-ai-core-service-guide/generative-ai-hub-in-sap-ai-core) | Use your SAP AI Core bearer token. Base URL can be your AI_API_URL root or a deploymentUrl from Generative AI Hub. |
-| `sarvam` | `sarvam` | Sarvam AI | API key | [link](https://docs.sarvam.ai) | ₹1,000 in free signup credits — never expire |
-| `scaleway` | `scw` | Scaleway AI | API key | [link](https://www.scaleway.com/en/docs/ai-data/generative-apis/) | 1M free tokens for new accounts — EU/GDPR compliant (Paris), Qwen3 235B & Llama 70B |
-| `sealion` | `sealion` | SEA-LION | API key | [link](https://sea-lion.ai) | Sign in at sea-lion.ai with Google (no card, no region wall), create an API key, then paste it here. |
-| `segmind` | `segmind` | Segmind | API key, image, video | [link](https://segmind.com) | Use your Segmind API key in the x-api-key header. OmniRoute targets https://api.segmind.com/v1/<model> and returns the generated image/video bytes directly. |
-| `sensenova` | `sensenova` | SenseNova | API key | [link](https://platform.sensenova.cn) | Get API key at platform.sensenova.cn |
-| `siliconflow` | `siliconflow` | SiliconFlow | API key | [link](https://cloud.siliconflow.com) | $1 free credits plus currently listed $0 models after identity verification; availability and limits may change |
-| `snowflake` | `snowflake` | Snowflake Cortex | API key, enterprise | [link](https://www.snowflake.com) | — |
-| `sparkdesk` | `sparkdesk` | SparkDesk | API key | [link](https://xinghuo.xfyun.cn) | Get API key at console.xfyun.cn |
-| `speka` | `speka` | Speka AI | API key, aggregator | [link](https://speka.me) | Free plan: $1 monthly usage, 10 RPM, one API key and access to open models and the playground; no card required. |
-| `stability-ai` | `stability` | Stability AI | API key, image | [link](https://stability.ai) | — |
-| `stepfun` | `stepfun` | StepFun | API key | [link](https://stepfun.com) | Get API key at platform.stepfun.com |
-| `sumopod` | `sumopod` | SumoPod | API key | [link](https://ai.sumopod.com) | Use your SumoPod API key (sk-...) in Authorization: Bearer <key>. Fully OpenAI-compatible. API base URL: https://ai.sumopod.com/v1. |
-| `suno` | `suno` | Suno | API key | [link](https://suno.ai) | Paste session cookie from suno.ai (Clerk auth) |
-| `synthetic` | `synthetic` | Synthetic | API key, aggregator | [link](https://synthetic.new) | — |
-| `tabitoken` | `tabitoken` | TabiToken | API key, aggregator | [link](https://tabitoken.com) | — |
-| `tencent` | `tencent` | Tencent Hunyuan | API key | [link](https://hunyuan.tencent.com) | Get API key at console.cloud.tencent.com |
-| `thebai` | `thebai` | TheB.AI | API key, aggregator | [link](https://theb.ai) | Bearer API key for the TheB.AI OpenAI-compatible gateway. |
-| `tinyfish` | `tf` | TinyFish Fetch | API key | [link](https://docs.tinyfish.ai/fetch-api) | X-API-Key from agent.tinyfish.ai/api-keys |
-| `together` | `together` | Together AI | API key, video | [link](https://www.together.ai) | — |
-| `token-kiosk` | `tk` | Token Kiosk | API key | [link](https://agent-router.gaib.ai) | Use your Token Kiosk API key in Authorization: Bearer <key>. Fully OpenAI-compatible gateway. API base URL: https://agent-router.gaib.ai/v1. |
-| `tokenreply` | `tokenreply` | TokenReply | API key, aggregator | [link](https://www.tokenreply.com) | Free-tagged models have model- and campaign-specific daily limits; no fixed global free quota is published. |
-| `tokenrouter` | `trk` | TokenRouter | API key | [link](https://tokenrouter.com) | Use your TokenRouter API key in Authorization: Bearer <key>. Fully OpenAI-compatible. API base URL: https://api.tokenrouter.com/v1. |
-| `topaz` | `topaz` | Topaz | API key, image | [link](https://topazlabs.com) | — |
-| `typhoon` | `typhoon` | Typhoon | API key | [link](https://docs.opentyphoon.ai) | Free API key with a 5 req/s and 200 req/m rate limit. |
-| `udio` | `udio` | Udio | API key | [link](https://udio.com) | Paste session cookie from udio.com (Supabase auth) |
-| `uncloseai` | `unc` | UncloseAI | API key | [link](https://uncloseai.com) | No auth required. API accepts any non-empty string as key for identification. If older built-in models return 404, use Available Models → Import from /models or Auto-Sync; verified live model: solidrust/Hermes-3-Llama-3.1-8B-AWQ. |
-| `unorouter` | `unorouter` | UnoRouter | API key, aggregator | [link](https://unorouter.ai) | Models with the :free suffix do not debit balance; limit is 1 request/minute per free model per user. |
-| `upstage` | `upstage` | Upstage | API key | [link](https://www.upstage.ai) | — |
-| `v0-vercel` | `v0` | v0 (Vercel) | API key | [link](https://v0.dev) | — |
-| `venice` | `venice` | Venice.ai | API key | [link](https://venice.ai) | — |
-| `vercel-ai-gateway` | `vag` | Vercel AI Gateway | API key, aggregator | [link](https://vercel.com/docs/ai-gateway) | — |
-| `vertex` | `vertex` | Vertex AI | API key, enterprise | [link](https://cloud.google.com/vertex-ai) | Provide Service Account JSON or OAuth access_token |
-| `vertex-partner` | `vp` | Vertex AI Partners | API key, enterprise | [link](https://cloud.google.com/vertex-ai) | Provide the same Service Account JSON used for Vertex AI partner models. |
-| `void-ai` | `void-ai` | Void AI | API key, aggregator | [link](https://voidai.app) | The public model catalog marks some models with a free plan requirement, but access is conditional and no numeric quota is confirmed. |
-| `volcengine` | `volcengine` | Volcengine | API key | [link](https://www.volcengine.com) | — |
-| `voyage-ai` | `voyage` | Voyage AI | API key, embed/rerank | [link](https://www.voyageai.com) | Bearer API key for Voyage AI embeddings and rerank APIs. |
-| `wafer` | `wafer` | Wafer AI | API key | [link](https://wafer.ai) | — |
-| `wandb` | `wandb` | Weights & Biases Inference | API key | [link](https://wandb.ai) | — |
-| `watsonx` | `watsonx` | IBM watsonx.ai Gateway | API key, enterprise | [link](https://www.ibm.com/products/watsonx-ai) | Use your watsonx bearer token. Base URL can be https://<region>.ml.cloud.ibm.com/ml/gateway/v1/ or a self-managed /ml/gateway/v1 endpoint. |
-| `writer` | `writer` | Writer | API key | [link](https://dev.writer.com) | — |
-| `x5lab` | `x5lab` | X5Lab | API key | [link](https://x5lab.dev) | Use your X5Lab API key (x5-...) in Authorization: Bearer <key>. Fully OpenAI-compatible. API base URL: https://api.x5lab.dev/v1. |
-| `xai` | `xai` | xAI (Grok) | API key | [link](https://x.ai) | Use an official xAI API key, or sign in with xAI OAuth. Grok Build JWT sessions remain a separate provider. |
-| `xiaomi-mimo` | `mimo` | Xiaomi MiMo | API key | [link](https://mimo.mi.com) | — |
-| `xiaomi-mimo-token-plan` | `mimotp` | Xiaomi MiMo Token Plan | API key | [link](https://mimo.mi.com) | — |
-| `yi` | `yi` | Yi (01.AI) | API key | [link](https://01.ai) | Get API key at platform.lingyiwanwu.com |
-| `yolo-auto` | `yolo-auto` | Yolo-Auto | API key, aggregator | [link](https://yolo-auto.com) | Free API access is request-limited and intended for testing; no numeric daily quota is published and free access is not promised indefinitely. |
-| `zai` | `zai` | Z.AI | API key | [link](https://open.bigmodel.cn) | — |
-| `zenmux` | `zm` | ZenMux | API key | [link](https://zenmux.ai) | Use your ZenMux API key in Authorization: Bearer <key>. ZenMux is fully OpenAI-compatible. Base URL: https://zenmux.ai/api/v1. |
-| `zerolimitai` | `zerolimitai` | ZeroLimitAI | API key, aggregator | [link](https://www.zerolimitai.com) | Temporary free trial is advertised, but official pages conflict between 3 and 7 days; a 100-calls/day claim is not treated as permanent. |
-| `zylo-api` | `zylo` | Zylo API | API key, aggregator | [link](https://zyloai.net) | Basic plan: 10 RPM, 7,200 requests/day and 200,000 tokens/day; limited to Basic text models. |
-
-## Local Providers (14)
-
-| ID | Alias | Name | Tags | Website | Notes |
-|----|-------|------|------|---------|-------|
-| `comfyui` | `comfyui` | ComfyUI | Local | [link](https://github.com/comfyanonymous/ComfyUI) | No API key required. Configure the local ComfyUI base URL (default: http://localhost:8188). |
-| `docker-model-runner` | `dmr` | Docker Model Runner | Local, self-hosted | [link](https://docs.docker.com/ai/model-runner/) | API key optional. Configure the local Docker Model Runner OpenAI-compatible base URL (default: http://localhost:12434/v1). |
-| `lemonade` | `lemonade` | Lemonade Server | Local, self-hosted | [link](https://lemonade-server.ai) | API key optional. Configure the local Lemonade OpenAI-compatible base URL (default: http://localhost:13305/api/v1). |
-| `llama-cpp` | `llamacpp` | llama.cpp | Local, self-hosted | [link](https://github.com/ggml-org/llama.cpp) | API key optional (use any value, e.g. sk-no-key-required). Configure the llama-server OpenAI-compatible base URL (default: http://127.0.0.1:8080/v1). Note: if Llamafile is also installed, both default to port 8080 — run only one at a time or override the port. |
-| `llamafile` | `llamafile` | Llamafile | Local, self-hosted | [link](https://github.com/Mozilla-Ocho/llamafile) | API key optional. Configure the local Llamafile OpenAI-compatible base URL (default: http://127.0.0.1:8080/v1). |
-| `lm-studio` | `lmstudio` | LM Studio | Local, self-hosted | [link](https://lmstudio.ai) | API key optional. Configure the local LM Studio OpenAI-compatible base URL (default: http://localhost:1234/v1). |
-| `mlx-gemma` | `mlx-gemma` | MLX Gemma 26B | Local, self-hosted | [link](https://github.com/ml-explore/mlx) | No API key required. Runs mlx-lm server locally on port 11435. Requires uv and mlx-lm installed. Model: mlx-community/gemma-4-26B-A4B-it-qat-q4_0-mlx-aligned (~15.9GB peak memory). |
-| `mlx-qwen` | `mlx-qwen` | MLX Qwen 3.8 27B | Local, self-hosted | [link](https://github.com/ml-explore/mlx) | No API key required. Runs mlx-lm server locally on port 11436. Requires uv and mlx-lm installed. Model: maglun/Qwen3.8-27B-MLX-Mixed-3.80bpw (~13.1GB peak memory). |
-| `ollama-local` | `ollama` | Ollama | Local, self-hosted | [link](https://ollama.com) | No API key required. Ollama runs locally — configure its OpenAI-compatible base URL (default: http://localhost:11434/v1) and make sure Ollama is running before connecting. |
-| `oobabooga` | `ooba` | oobabooga | Local, self-hosted | [link](https://github.com/oobabooga/text-generation-webui) | API key optional. Configure the local oobabooga OpenAI-compatible base URL (default: http://localhost:5000/v1). |
-| `sdwebui` | `sdwebui` | SD WebUI | Local | [link](https://github.com/AUTOMATIC1111/stable-diffusion-webui) | No API key required. Configure the local WebUI base URL (default: http://localhost:7860). |
-| `triton` | `triton` | NVIDIA Triton | Local, self-hosted | [link](https://developer.nvidia.com/triton-inference-server) | API key optional. Configure the Triton OpenAI-compatible base URL (default: http://localhost:8000/v1). |
-| `vllm` | `vllm` | vLLM | Local, self-hosted | [link](https://github.com/vllm-project/vllm) | API key optional. Configure the local vLLM OpenAI-compatible base URL (default: http://localhost:8000/v1). |
-| `xinference` | `xinference` | XInference | Local, self-hosted | [link](https://inference.readthedocs.io) | API key optional. Configure the local XInference OpenAI-compatible base URL (default: http://localhost:9997/v1). |
-
-## Search Providers (13)
-
-| ID | Alias | Name | Tags | Website | Notes |
-|----|-------|------|------|---------|-------|
-| `brave-search` | `brave-search` | Brave Search | Search | [link](https://brave.com/search/api) | Subscription token from Brave Search API dashboard |
-| `exa-search` | `exa-search` | Exa Search | Search | [link](https://exa.ai) | API key from dashboard.exa.ai |
-| `firecrawl` | `fc` | Firecrawl | Search | [link](https://firecrawl.dev) | API key from firecrawl.dev/app/api-keys (or set your self-hosted Firecrawl base URL) |
-| `google-pse-search` | `google-pse` | Google Programmable Search | Search | [link](https://developers.google.com/custom-search/v1/overview) | Requires a Google API key and your Programmable Search Engine ID (cx) |
-| `linkup-search` | `linkup` | Linkup Search | Search | [link](https://docs.linkup.so) | Bearer API key from the Linkup dashboard |
-| `ollama-search` | `ollama-search` | Ollama Search | Search | [link](https://ollama.com/settings/keys) | Same API key as Ollama Cloud (from ollama.com/settings/keys) |
-| `perplexity-search` | `pplx-search` | Perplexity Search | Search | [link](https://docs.perplexity.ai/guides/search-quickstart) | Same API key as Perplexity (pplx-...) |
-| `searchapi-search` | `searchapi` | SearchAPI | Search | [link](https://www.searchapi.io/docs/google) | API key from SearchAPI (query param or Bearer auth) |
-| `searxng-search` | `searxng` | SearXNG Search | Search | [link](https://docs.searxng.org) | API key is optional. Set your SearXNG base URL. Some instances may require a bearer token for access. |
-| `serper-search` | `serper-search` | Serper Search | Search | [link](https://serper.dev) | API key from serper.dev dashboard |
-| `tavily-search` | `tavily-search` | Tavily Search | Search | [link](https://tavily.com) | API key from app.tavily.com (format: tvly-...) |
-| `x-search` | `x_search` | X Search (Grok) | Search | [link](https://docs.x.ai/developers/tools/x-search) | SuperGrok OAuth (xai-oauth) or xAI API key. This is Grok X Search, not the X Developer MCP. |
-| `youcom-search` | `youcom-search` | You.com Search | Search | [link](https://you.com/business/api/) | X-API-Key from the You.com platform dashboard |
-
-## Audio-only Providers (12)
-
-| ID | Alias | Name | Tags | Website | Notes |
-|----|-------|------|------|---------|-------|
-| `assemblyai` | `aai` | AssemblyAI | Audio | [link](https://assemblyai.com) | — |
-| `aws-polly` | `polly` | AWS Polly | Audio | [link](https://aws.amazon.com/polly/) | Use AWS Secret Access Key as API key; set providerSpecificData.accessKeyId and optional region. |
-| `cartesia` | `cartesia` | Cartesia | Audio | [link](https://cartesia.ai) | — |
-| `deepgram` | `dg` | Deepgram | Audio | [link](https://deepgram.com) | — |
-| `elevenlabs` | `el` | ElevenLabs | Audio | [link](https://elevenlabs.io) | — |
-| `fishaudio` | `fishaudio` | Fish Audio | Audio | [link](https://fish.audio) | — |
-| `gladia` | `gladia` | Gladia | Audio | [link](https://gladia.io) | — |
-| `inworld` | `inworld` | Inworld | Audio | [link](https://inworld.ai) | — |
-| `playht` | `playht` | PlayHT | Audio | [link](https://play.ht) | — |
-| `rev-ai` | `revai` | Rev AI | Audio | [link](https://www.rev.ai) | — |
-| `soniox` | `sx` | Soniox | Audio | [link](https://soniox.com) | — |
-| `speechmatics` | `sm` | Speechmatics | Audio | [link](https://www.speechmatics.com) | Free tier — 8 hours/month, no credit card required. Batch (async) mode only. |
-
-## Upstream Proxy Providers (2)
-
-| ID | Alias | Name | Tags | Website | Notes |
-|----|-------|------|------|---------|-------|
-| `9router` | `nr` | 9router | Upstream proxy | [link](https://www.npmjs.com/package/9router) | — |
-| `cliproxyapi` | `cpa` | CLIProxyAPI | Upstream proxy | [link](https://github.com/router-for-me/CLIProxyAPI) | — |
-
-## Cloud Agent Providers (3)
-
-| ID | Alias | Name | Tags | Website | Notes |
-|----|-------|------|------|---------|-------|
-| `codex-cloud` | `codex-cloud` | Codex Cloud | Cloud agent | [link](https://openai.com/codex) | OpenAI API key with Codex Cloud task access. |
-| `devin` | `devin` | Devin | Cloud agent | [link](https://devin.ai) | Devin API key for cloud agent sessions. |
-| `jules` | `jules` | Google Jules | Cloud agent | [link](https://jules.google) | Jules API key for creating and managing cloud coding tasks. |
-
-## System Providers (1)
-
-| ID | Alias | Name | Tags | Website | Notes |
-|----|-------|------|------|---------|-------|
-| `auto` | `auto` | Auto (Zero-Config) | System | — | — |
-
-## Sources of truth
-
-- Catalog: [`src/shared/constants/providers.ts`](../../src/shared/constants/providers.ts)
-- Registry (per-model details): [`open-sse/config/providerRegistry.ts`](../../open-sse/config/providerRegistry.ts)
-- Executors: [`open-sse/executors/`](../../open-sse/executors/) (106 implementations)
-- Translators: [`open-sse/translator/`](../../open-sse/translator/)
-
-## See Also
-
-- [FREE_TIERS.md](./FREE_TIERS.md) — curated free-tier guide
-- [USER_GUIDE.md](../guides/USER_GUIDE.md) — provider setup walkthrough
-- [ARCHITECTURE.md](../architecture/ARCHITECTURE.md) — overall architecture

README.md

@@ -7,7 +7,7 @@
 
 # 🚀 OmniRoute — The Free AI Gateway
 
-<img src="./docs/diagrams/readme-hero.svg" width="100%" alt="OmniRoute — Never stop coding. Every AI tool → 350 providers — 90+ free — through one endpoint. Claude Code, Codex, Cursor, Cline, Copilot & Antigravity into FREE Claude / GPT / Gemini with auto-fallback. RTK + Caveman stacked compression saves 15–95% tokens (~89% avg) — never hit limits. 350 AI providers · 90+ free tiers · ~1.51B free tokens/mo · 19 routing strategies · $0 to start."/>
+<img src="./docs/diagrams/readme-hero.svg" width="100%" alt="OmniRoute — Never stop coding. Every AI tool → 340 providers — 90+ free — through one endpoint. Claude Code, Codex, Cursor, Cline, Copilot & Antigravity into FREE Claude / GPT / Gemini with auto-fallback. RTK + Caveman stacked compression saves 15–95% tokens (~89% avg) — never hit limits. 340 AI providers · 90+ free tiers · ~1.51B free tokens/mo · 19 routing strategies · $0 to start."/>
 
 </div>
 
@@ -63,7 +63,7 @@
 
 |                           | v3.8.49 | **v3.8.50** | `v3.8.51+`  |
 | ------------------------- | :-----: | :---------: | :---------: |
-| 🌐 Providers              |   290   |   **342**   | more queued |
+| 🌐 Providers              |   290   |   **340**   | more queued |
 | 🧠 Documented models      |  1185   |  **1202**   |      —      |
 | 🖼️ Modality Bridge        |    —    |  🆕 vision  |    video    |
 | 📡 Radar free catalog     |    —    |  🆕 opt-in  |      —      |
@@ -101,7 +101,7 @@
   <tr>
     <td align="right"><b>⚙️ Features</b></td>
     <td align="center"><a href="#-combos--the-flagship">🎯 Combos</a></td>
-    <td align="center"><a href="#-349-ai-providers--90-free">🌐 Providers</a></td>
+    <td align="center"><a href="#-340-ai-providers--90-free">🌐 Providers</a></td>
     <td align="center"><a href="#-full-cli--a2a--mcp">🔌 CLI &amp; MCP</a></td>
   </tr>
   <tr>
@@ -210,7 +210,7 @@ curl http://localhost:20128/v1/chat/completions \
 
 </div>
 
-<img src="./docs/diagrams/promise-pillars.svg" width="100%" alt="The Promise — One endpoint. 350 providers. Never stop building — OmniRoute picks the cheapest one that works. Six pillars: Never hit limits (auto-fallback across 350 providers in milliseconds, zero downtime) · Save up to 95% tokens (RTK + Caveman stacked compression cuts 15–95%, ~89% avg on tool-heavy sessions) · $0 to start (90+ free tiers, 56 free forever — no card needed) · Every tool works (33 coding agents through one config) · One endpoint (OpenAI ↔ Claude ↔ Gemini ↔ Responses API at /v1) · Production-grade (circuit breakers, TLS stealth, MCP 110 tools, A2A, memory, guardrails, evals — 25,000+ tests)."/>
+<img src="./docs/diagrams/promise-pillars.svg" width="100%" alt="The Promise — One endpoint. 340 providers. Never stop building — OmniRoute picks the cheapest one that works. Six pillars: Never hit limits (auto-fallback across 340 providers in milliseconds, zero downtime) · Save up to 95% tokens (RTK + Caveman stacked compression cuts 15–95%, ~89% avg on tool-heavy sessions) · $0 to start (90+ free tiers, 56 free forever — no card needed) · Every tool works (33 coding agents through one config) · One endpoint (OpenAI ↔ Claude ↔ Gemini ↔ Responses API at /v1) · Production-grade (circuit breakers, TLS stealth, MCP 109 tools, A2A, memory, guardrails, evals — 25,000+ tests)."/>
 
 <br/>
 <br/>
@@ -461,7 +461,7 @@ All **19** strategies — mix & match per combo step:
 
 </div>
 
-<img src="./docs/diagrams/comparison-table.svg" width="100%" alt="What sets OmniRoute apart — comparison table vs 9router, OpenRouter, CLIProxyAPI and LiteLLM across 13 capabilities. OmniRoute: 350 providers, 90+ free providers built-in, 19 routing strategies, 12-engine token compression, built-in MCP server with 110 tools, A2A agent protocol, persistent memory, guardrails, cloud agents, TLS fingerprint stealth, Desktop/Termux/PWA, 43 i18n UI locales, 100% MIT self-hosted. OmniRoute is the only one with the full set; competitors show a mix of checks, partials and crosses. Verified from each project&apos;s docs."/>
+<img src="./docs/diagrams/comparison-table.svg" width="100%" alt="What sets OmniRoute apart — comparison table vs 9router, OpenRouter, CLIProxyAPI and LiteLLM across 13 capabilities. OmniRoute: 340 providers, 90+ free providers built-in, 19 routing strategies, 12-engine token compression, built-in MCP server with 109 tools, A2A agent protocol, persistent memory, guardrails, cloud agents, TLS fingerprint stealth, Desktop/Termux/PWA, 43 i18n UI locales, 100% MIT self-hosted. OmniRoute is the only one with the full set; competitors show a mix of checks, partials and crosses. Verified from each project&apos;s docs."/>
 
 <sub>📊 Full methodology &amp; per-feature detail vs 9router, OpenRouter, CLIProxyAPI &amp; LiteLLM → [`docs/comparison/OMNIROUTE_VS_ALTERNATIVES.md`](docs/comparison/OMNIROUTE_VS_ALTERNATIVES.md)</sub>
 
@@ -557,9 +557,9 @@ the current catalog at **[radar.omniroute.online/planos](https://radar.omniroute
 - **🧠 Memory you control** — off by default, opt-in int8 vector quantization + typed decay, per-request `x-omniroute-no-memory`. → [Memory](docs/frameworks/MEMORY.md)
 - **🛡️ Security** — prompt-injection guard on every LLM route (red-team suite), opt-in credential-masking guardrail (redacts leaked API keys/secrets in both directions), free DuckDuckGo last-resort web search, and an optional OIDC login gate for the dashboard (password login always stays available). → [Guardrails](docs/security/GUARDRAILS.md)
 - **🖼️ New endpoints** — `/v1/ocr` (Mistral OCR) and `/v1/audio/translations` (Whisper-style) round out the media surface. → [API Reference](docs/reference/API_REFERENCE.md)
-- **🎨 Image / video / audio generation** — one API for media: xAI Grok Imagine & Novita AI video, ComfyUI, Freepik, Adobe Firefly, Microsoft Designer, Segmind, EdgeTTS. → [API Reference](docs/reference/API_REFERENCE.md)
+- **🎨 Image / video / audio generation** — one API for media: xAI Grok Imagine & Novita AI video, ComfyUI, Freepik, Adobe Firefly, Microsoft Designer, Google Imagen, Segmind, EdgeTTS. → [API Reference](docs/reference/API_REFERENCE.md)
 - **🌍 Deployment & ops** — reverse-proxy `basePath`, browser-language auto-detect, per-key device tracking, root-less MITM trust, zh-TW localization. → [Environment](docs/reference/ENVIRONMENT.md)
-- **🤝 More providers & agents** — Cursor Cloud Agent, Grok Build (xAI) with browser + OAuth login, Ollama first-class card, Claude Opus 5 & Sonnet 5, Kimi official partnership (Code/Web/Moonshot), Zed, Requesty, SenseNova, Yuanbao, Agnes AI… and a refreshed **350-provider catalog**. → [Providers](docs/reference/PROVIDER_REFERENCE.md)
+- **🤝 More providers & agents** — Cursor Cloud Agent, Grok Build (xAI) with browser + OAuth login, Ollama first-class card, Claude Opus 5 & Sonnet 5, Kimi official partnership (Code/Web/Moonshot), Zed, Requesty, SenseNova, Yuanbao, Agnes AI… and a refreshed **340-provider catalog**. → [Providers](docs/reference/PROVIDER_REFERENCE.md)
 - **📡 Routing transparency** — every response carries an `X-OmniRoute-Decision` header naming the strategy/provider/latency that served it, a new `cache-optimized` combo strategy + Auto-Combo `cacheAffinity` factor route repeat requests back to the connection holding the cached prefix, and a read-only `/v1/auto-combo/{channel}/candidates` endpoint exposes an `auto/*` channel's live candidate pool. → [Auto-Combo](docs/routing/AUTO-COMBO.md)
 - **⚡ Local performance & infra** — one-click local Redis, Cloudflare Workers / Deno Deploy relay deployers, Bifrost & Mux as supervised embedded services. → [Embedded Services](docs/frameworks/EMBEDDED-SERVICES.md)
 
@@ -612,7 +612,7 @@ the current catalog at **[radar.omniroute.online/planos](https://radar.omniroute
 <b>＋ also works with</b> · Kiro · Command Code · Antigravity · Windsurf · AMP · <b>any OpenAI-compatible tool</b>
 </div>
 
-<sub>📖 Per-tool setup for all 35 tools (26 CLI Code's + 9 CLI Agents) → [`docs/reference/CLI-TOOLS.md`](docs/reference/CLI-TOOLS.md) · 🧩 OpenCode plugin → [`@omniroute/opencode-provider`](https://www.npmjs.com/package/@omniroute/opencode-provider)</sub>
+<sub>📖 Per-tool setup for all 34 tools (26 CLI Code's + 8 CLI Agents) → [`docs/reference/CLI-TOOLS.md`](docs/reference/CLI-TOOLS.md) · 🧩 OpenCode plugin → [`@omniroute/opencode-provider`](https://www.npmjs.com/package/@omniroute/opencode-provider)</sub>
 
 </div>
 
@@ -642,11 +642,11 @@ of your shell history. → [CLI Integrations](docs/guides/CLI-INTEGRATIONS.md)
 
 <div align="center">
 
-## 🌐 349 AI Providers — 90+ Free
+## 🌐 340 AI Providers — 90+ Free
 
 </div>
 
-> The most complete catalog of any open-source router: **350 providers**, **90+ with a free tier**, **56 free forever**.
+> The most complete catalog of any open-source router: **340 providers**, **90+ with a free tier**, **56 free forever**.
 
 <div align="center">
 
@@ -821,7 +821,7 @@ Expose OmniRoute over **MCP**, **A2A**, a **REST API**, **webhooks** or a **remo
 <table>
   <tr><th align="left">Interface</th><th align="left">Endpoint / command</th><th align="left">Use it for</th></tr>
   <tr><td align="left" nowrap>🧰 <b>MCP (stdio)</b></td><td align="left" nowrap><code>omniroute --mcp</code></td><td align="left">Plug into Claude Desktop, Cursor, any MCP client</td></tr>
-  <tr><td align="left" nowrap>🌊 <b>MCP (HTTP)</b></td><td align="left" nowrap><code>/api/mcp/stream</code></td><td align="left">Remote MCP — <b>110 tools</b>, 33 scopes, full audit trail</td></tr>
+  <tr><td align="left" nowrap>🌊 <b>MCP (HTTP)</b></td><td align="left" nowrap><code>/api/mcp/stream</code></td><td align="left">Remote MCP — <b>109 tools</b>, 33 scopes, full audit trail</td></tr>
   <tr><td align="left" nowrap>📡 <b>MCP (SSE)</b></td><td align="left" nowrap><code>/api/mcp/sse</code></td><td align="left">Streaming MCP transport</td></tr>
   <tr><td align="left" nowrap>🤝 <b>A2A</b></td><td align="left" nowrap><code>/.well-known/agent.json</code></td><td align="left">Agent-to-agent, <b>JSON-RPC 2.0</b> + SSE, 6 skills</td></tr>
   <tr><td align="left" nowrap>🌐 <b>REST API</b></td><td align="left" nowrap><code>/v1/*</code></td><td align="left">OpenAI-compatible — chat, embeddings, images, audio, OCR</td></tr>
@@ -877,7 +877,7 @@ Engines run in pipeline order; each is independently toggleable and configurable
   <tr><td align="center" nowrap>9</td><td align="left" nowrap><b>Aggressive</b></td><td align="left">Summarization + progressive aging of old turns</td></tr>
   <tr><td align="center" nowrap>10</td><td align="left" nowrap><b>LLMLingua-2</b></td><td align="left">ML semantic pruning via MobileBERT ONNX — code-safe, async</td></tr>
   <tr><td align="center" nowrap>11</td><td align="left" nowrap><b>Ultra</b></td><td align="left">Heuristic token pruning with an optional small-model (SLM) tier</td></tr>
-  <tr><td align="center" nowrap>12</td><td align="left" nowrap><b>OmniGlyph</b></td><td align="left">Experimental context-as-image encoding for measured Claude Fable 5 on the direct Anthropic wire; GPT 5.6 transformers remain fail-closed pending provider receipts. Four compression profiles (aggressive default, balanced, coding-safe, passthrough) (most aggressive; opt-in)</td></tr>
+  <tr><td align="center" nowrap>12</td><td align="left" nowrap><b>OmniGlyph</b></td><td align="left">Experimental context-as-image encoding routed to Claude Fable 5 (most aggressive; opt-in)</td></tr>
 </table>
 
 Code blocks, URLs and structured data are **always preserved** byte-perfect. **One-click presets** combine the engines:
@@ -988,41 +988,12 @@ docker run -d --name omniroute --restart unless-stopped --stop-timeout 40 \
   -p 127.0.0.1:20128:20128 -v omniroute-data:/app/data diegosouzapw/omniroute:latest
 ```
 
-`:latest` follows the highest **published** stable SemVer. It does not track git `main`. Pin `:X.Y.Z` for GitOps. See [Docker Release Channels](docs/guides/DOCKER_GUIDE.md#release-channels).The image pins **`OMNIROUTE_MEMORY_MB=1024`**. That is enough for the dashboard and a light chat. **Coding agents** (`POST /v1/responses` from Claude Code, Codex, Grok, …) need a much larger V8 heap or the process `FATAL ERROR`s at ~12 GiB under two overlapping long contexts. Size the container above the heap (native buffers sit outside V8):
-
-| Workload                            | Heap (`-e OMNIROUTE_MEMORY_MB`) | Container (`--memory`) |
-| ----------------------------------- | ------------------------------- | ---------------------- |
-| Dashboard / light chat              | `1024` (image default)          | ≥2 g                   |
-| One coding agent                    | `8192`                          | ≥10 g                  |
-| Two concurrent long `/v1/responses` | `10240`–`12288`                 | ≥12–16 g               |
-
-```bash
-docker run -d --name omniroute --restart unless-stopped --stop-timeout 40 \
-  -e OMNIROUTE_MEMORY_MB=8192 --memory=10g \
-  -p 127.0.0.1:20128:20128 -v omniroute-data:/app/data diegosouzapw/omniroute:latest
-```
-
-Full table: [Docker Guide — runtime RAM](docs/guides/DOCKER_GUIDE.md#runtime-ram-for-coding-agents).
-
 > **Pre-release Docker channel:** `diegosouzapw/omniroute:next` and
 > `diegosouzapw/omniroute:next-web` follow the current default `release/v*`
 > branch. These mutable tags are intended only for testing unreleased fixes and
 > are **not supported for production**. See
 > [Docker Release Channels](docs/guides/DOCKER_GUIDE.md#release-channels).
 
-**🥟 Bun**
-
-Standard `bun install` and global installation (`bun install -g omniroute`) are supported via Bun runtime detection:
-- **Built-in `bun:sqlite`**: OmniRoute uses Bun's built-in `bun:sqlite` driver when running under Bun, falling back to `better-sqlite3` on Node.js or `sql.js`.
-- **Automatic Webpack bundler selection**: Development (`bun run dev`) and production builds (`bun run build`) automatically detect Bun and disable Turbopack in favor of Webpack to prevent native V8 binding incompatibilities.
-- **Dedicated Bun Dockerfile**: Multi-stage `Dockerfile.bun` for native Bun production deployments (`docker build -f Dockerfile.bun -t omniroute:bun .`).
-
-```bash
-# Install and run with Bun
-bun install
-bun run dev
-```
-
 **🛠️ From source**
 
 ```bash
@@ -1201,7 +1172,7 @@ Métricas de validação: 1002 vídeos rastreados · 7,069,190 visualizações c
   <tr><td nowrap><b>Runtime</b></td><td>Node.js 22.x / 24.x LTS — <code>&gt;=22.22.2 &lt;23 || &gt;=24.0.0 &lt;27</code></td></tr>
   <tr><td nowrap><b>Language</b></td><td>TypeScript 6.0 — <b>100% TypeScript</b> across <code>src/</code> and <code>open-sse/</code> (zero <code>any</code> in core since v2.0)</td></tr>
   <tr><td nowrap><b>Framework</b></td><td>Next.js 16 + React 19 + Tailwind CSS 4</td></tr>
-  <tr><td nowrap><b>Database</b></td><td>better-sqlite3 (SQLite, WAL journaling) + LowDB (JSON legacy) — 120 domain modules, 159 migrations</td></tr>
+  <tr><td nowrap><b>Database</b></td><td>better-sqlite3 (SQLite, WAL journaling) + LowDB (JSON legacy) — 120 domain modules, 153 migrations</td></tr>
   <tr><td nowrap><b>Memory</b></td><td>SQLite FTS5 full-text + int8-quantized vector embeddings, typed decay</td></tr>
   <tr><td nowrap><b>Schemas</b></td><td>Zod 4 — MCP tool I/O validation + API contracts</td></tr>
   <tr><td nowrap><b>Protocols</b></td><td>MCP (stdio / HTTP / SSE) + A2A v0.3 (JSON-RPC 2.0 + SSE)</td></tr>
@@ -1524,7 +1495,7 @@ OmniRoute stands on the shoulders of giants. It started as a fork of **[9router]
 <table>
   <tr><th align="left">Project</th><th align="center">⭐</th><th align="left">How it inspired OmniRoute</th></tr>
   <tr><td nowrap><b><a href="https://github.com/toon-format/toon">TOON</a></b></td><td align="center">24.9k</td><td>Token-Oriented Object Notation — its columnar, header-plus-rows model shaped our tabular compaction stage.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/blackwell-systems/gcf">GCF – Graph Compact Format</a></b></td><td align="center">22</td><td>First inspired our tabular compaction stage; now its zero-dependency, lossless generic-profile encoder is <b>vendored directly</b> as the Headroom codec (MIT, SPDX-marked), with later numeric-domain and count-mismatch correctness fixes.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/blackwell-systems/gcf">GCF – Graph Compact Format</a></b></td><td align="center">22</td><td>First inspired our tabular compaction stage; now its zero-dependency, lossless generic-profile encoder is <b>vendored directly</b> as the Headroom codec (MIT, SPDX-marked), current with GCF spec v3.2.</td></tr>
   <tr><td nowrap><b><a href="https://github.com/ooples/token-optimizer-mcp">token-optimizer-mcp</a></b></td><td align="center">444</td><td>Brotli/SQLite cache + per-session context-delta — inspired our <code>session-dedup</code> engine.</td></tr>
   <tr><td nowrap><b><a href="https://github.com/Mibayy/token-savior">token-savior</a></b></td><td align="center">1.1k</td><td>Bash-output compaction + MCP profiles — inspired our compression bail-out discipline and MCP tool-manifest reduction.</td></tr>
   <tr><td nowrap><b><a href="https://github.com/ppgranger/token-saver">token-saver</a></b></td><td align="center">117</td><td>Content-aware, per-file-type output compression with failure-aware bail-out — validated our per-type dispatch and minimum-gain skip.</td></tr>

bin/cli/api-commands/combos.mjs

@@ -30,60 +30,20 @@ export function register_combos(parent) {
       const data = res.ok ? await res.json() : await res.text();
       emit(data, gOpts);
     });
-  tag.command("get-api-combos-id-")
-    .description("Get combo by ID")
-    .requiredOption("--id <id>", "")
-    .action(async (opts, cmd) => {
-      const gOpts = cmd.optsWithGlobals();
-      let url = "/api/combos/{id}";
-      url = url.replace("{id}", encodeURIComponent(opts.id ?? ""));
-      const res = await apiFetch(url, { method: "GET", baseUrl: gOpts.baseUrl, apiKey: gOpts.apiKey });
-      const data = res.ok ? await res.json() : await res.text();
-      emit(data, gOpts);
-    });
-  tag.command("put-api-combos-id-")
-    .description("Update combo")
-    .requiredOption("--id <id>", "")
-    .option("--body <jsonOrPath>", "JSON body or @path/to/file.json")
-    .action(async (opts, cmd) => {
-      const gOpts = cmd.optsWithGlobals();
-      let url = "/api/combos/{id}";
-      url = url.replace("{id}", encodeURIComponent(opts.id ?? ""));
-      let body;
-      if (opts.body) {
-        body = opts.body.startsWith("@")
-          ? JSON.parse(readFileSync(opts.body.slice(1), "utf8"))
-          : JSON.parse(opts.body);
-      }
-      const res = await apiFetch(url, { method: "PUT", body, baseUrl: gOpts.baseUrl, apiKey: gOpts.apiKey });
-      const data = res.ok ? await res.json() : await res.text();
-      emit(data, gOpts);
-    });
   tag.command("patch-api-combos-id-")
     .description("Update combo")
-    .requiredOption("--id <id>", "")
-    .option("--body <jsonOrPath>", "JSON body or @path/to/file.json")
     .action(async (opts, cmd) => {
       const gOpts = cmd.optsWithGlobals();
       let url = "/api/combos/{id}";
-      url = url.replace("{id}", encodeURIComponent(opts.id ?? ""));
-      let body;
-      if (opts.body) {
-        body = opts.body.startsWith("@")
-          ? JSON.parse(readFileSync(opts.body.slice(1), "utf8"))
-          : JSON.parse(opts.body);
-      }
-      const res = await apiFetch(url, { method: "PATCH", body, baseUrl: gOpts.baseUrl, apiKey: gOpts.apiKey });
+      const res = await apiFetch(url, { method: "PATCH", baseUrl: gOpts.baseUrl, apiKey: gOpts.apiKey });
       const data = res.ok ? await res.json() : await res.text();
       emit(data, gOpts);
     });
   tag.command("delete-api-combos-id-")
     .description("Delete combo")
-    .requiredOption("--id <id>", "")
     .action(async (opts, cmd) => {
       const gOpts = cmd.optsWithGlobals();
       let url = "/api/combos/{id}";
-      url = url.replace("{id}", encodeURIComponent(opts.id ?? ""));
       const res = await apiFetch(url, { method: "DELETE", baseUrl: gOpts.baseUrl, apiKey: gOpts.apiKey });
       const data = res.ok ? await res.json() : await res.text();
       emit(data, gOpts);

bin/cli/api.mjs

@@ -52,19 +52,6 @@ function resolveUrl(path, opts) {
   return `${getBaseUrl(opts)}${path.startsWith("/") ? path : `/${path}`}`;
 }
 
-/** The machine-derived token is valid only for the local loopback server. */
-export function isLoopbackUrl(value) {
-  try {
-    const hostname = new URL(value).hostname.replace(/^\[|\]$/g, "").toLowerCase();
-    if (hostname === "localhost" || hostname === "::1") return true;
-    if (/^127(?:\.[0-9]{1,3}){3}$/.test(hostname)) return true;
-    if (/^::ffff:(?:127\.|7f[0-9a-f]{2}:)/i.test(hostname)) return true;
-    return false;
-  } catch {
-    return false;
-  }
-}
-
 export async function buildHeaders(opts) {
   const headers = new Headers(opts.headers || {});
   if (!headers.has("accept")) headers.set("accept", "application/json");
@@ -100,17 +87,10 @@ export async function buildHeaders(opts) {
   if (auth && !headers.has("authorization")) {
     headers.set("authorization", `Bearer ${auth}`);
   }
-  // Inject the machine-derived credential only for an explicit local loopback
-  // destination. Remote contexts and absolute remote URLs use scoped access
-  // tokens and must never receive this machine-bound local credential.
-  const destinationUrl = opts.destinationUrl ?? getBaseUrl(opts);
-  if (!isLoopbackUrl(destinationUrl)) {
-    headers.delete(CLI_TOKEN_HEADER);
-  } else {
-    const cliToken = opts.cliToken ?? process.env.OMNIROUTE_CLI_TOKEN ?? (await getCliToken());
-    if (cliToken && !headers.has(CLI_TOKEN_HEADER)) {
-      headers.set(CLI_TOKEN_HEADER, cliToken);
-    }
+  // Inject machine-id derived CLI token; env var override for testing.
+  const cliToken = opts.cliToken ?? process.env.OMNIROUTE_CLI_TOKEN ?? (await getCliToken());
+  if (cliToken && !headers.has(CLI_TOKEN_HEADER)) {
+    headers.set(CLI_TOKEN_HEADER, cliToken);
   }
   if (opts.idempotencyKey && !headers.has("idempotency-key")) {
     headers.set("idempotency-key", opts.idempotencyKey);
@@ -215,12 +195,8 @@ function fetchOnce(url, init, timeoutMs) {
 export async function apiFetch(path, opts = {}) {
   const method = String(opts.method || "GET").toUpperCase();
   const url = resolveUrl(path, opts);
-  const headers = await buildHeaders({ ...opts, destinationUrl: url });
+  const headers = await buildHeaders(opts);
   const body = serializeBody(opts.body, headers);
-  // Undici preserves custom headers across cross-origin redirects. A local server
-  // redirect must never turn the loopback machine credential into an outbound
-  // secret, so fail redirects whenever this header is present.
-  const redirect = headers.has(CLI_TOKEN_HEADER) ? "error" : opts.redirect;
   const timeout =
     opts.timeout ?? (Number.parseInt(process.env.OMNIROUTE_HTTP_TIMEOUT_MS || "", 10) || 30000);
   const maxAttempts = opts.retry === false ? 1 : (opts.retryMax ?? RETRY_DEFAULTS.maxAttempts);
@@ -229,7 +205,7 @@ export async function apiFetch(path, opts = {}) {
   let lastErr;
   for (let attempt = 1; attempt <= maxAttempts; attempt++) {
     try {
-      const res = await fetchOnce(url, { method, headers, body, redirect }, timeout);
+      const res = await fetchOnce(url, { method, headers, body }, timeout);
       if (res.ok) return enrichResponse(res, opts);
       if (attempt < maxAttempts && shouldRetryStatus(res.status, method, opts)) {
         const delay = computeBackoff(attempt, res.headers.get("retry-after"));

bin/cli/commands/auth-export.mjs

@@ -22,15 +22,8 @@ const VALID_FORMATS = new Set(["json", "env"]);
 const SECURE_FILE_MODE = 0o600;
 
 export function registerAuthExport(program) {
-  // #11226: `.command("auth export")` does NOT register a two-word command — commander
-  // parses the bare word `export` as a required positional argument of `auth`, so the
-  // action received (exportArgValue, options, command) while expecting (options, command)
-  // and crashed with "cmd.optsWithGlobals is not a function". Register `export` as a
-  // proper nested subcommand instead; the CLI surface stays `omniroute auth export`.
   program
-    .command("auth")
-    .description(t("authExport.description"))
-    .command("export")
+    .command("auth export")
     .description(t("authExport.description"))
     .option("--id <id>", t("authExport.idOpt"))
     .option("--format <format>", t("authExport.formatOpt"), "json")

bin/cli/commands/combo.mjs

@@ -3,9 +3,7 @@ import { printHeading } from "../io.mjs";
 import { withRuntime } from "../runtime.mjs";
 import { t } from "../i18n.mjs";
 import { apiFetch } from "../api.mjs";
-import { mcpCallTool } from "../mcpClient.mjs";
 import { emit } from "../output.mjs";
-import { resolveComboModels, collectModel } from "./comboModels.mjs";
 
 const VALID_STRATEGIES = [
   "priority",
@@ -64,7 +62,15 @@ export function extendComboSuggest(combo) {
         weights: opts.weights ? JSON.parse(opts.weights) : undefined,
         top: opts.top,
       };
-      const data = await mcpCallTool("omniroute_best_combo_for_task", body);
+      const res = await apiFetch("/api/mcp/tools/call", {
+        method: "POST",
+        body: { name: "omniroute_best_combo_for_task", arguments: body },
+      });
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.status}\n`);
+        process.exit(1);
+      }
+      const data = await res.json();
       const candidates = data.candidates ?? data;
       const rows = (Array.isArray(candidates) ? candidates : []).map((c, i) => ({
         rank: i + 1,
@@ -119,31 +125,10 @@ export function registerCombo(program) {
         .choices(VALID_STRATEGIES)
         .default("priority")
     )
-    .option(
-      "--models <spec>",
-      "Models for the combo: comma-separated provider/model entries, or a JSON array " +
-        '(e.g. --models "openai/gpt-4o,anthropic/claude-3-opus" or ' +
-        '--models \'[{"model":"gpt-4o","providerId":"openai"}]\')'
-    )
-    .option(
-      "--model <spec>",
-      "Add one model to the combo (provider/model or bare model id) — repeatable",
-      collectModel,
-      []
-    )
     .action(async (name, opts, cmd) => {
       const globalOpts = cmd.parent.optsWithGlobals();
-      let models;
-      try {
-        models = resolveComboModels(opts);
-      } catch (err) {
-        console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
-        process.exit(1);
-        return;
-      }
       const exitCode = await runComboCreateCommand(name, opts.strategy, {
         ...opts,
-        models,
         output: globalOpts.output,
       });
       if (exitCode !== 0) process.exit(exitCode);
@@ -299,20 +284,12 @@ export async function runComboCreateCommand(name, strategy = "priority", opts =
     return 1;
   }
 
-  const models = Array.isArray(opts.models) ? opts.models : [];
-  if (!models.length) {
-    console.error(
-      "combo create requires at least one target. Pass --models <provider/model,...> and/or repeat --model <provider/model>."
-    );
-    return 1;
-  }
-
   try {
     return await withRuntime(async ({ kind, api, db }) => {
       if (kind === "http") {
         const res = await api("/api/combos", {
           method: "POST",
-          body: { name, strategy, enabled: true, models, config: {} },
+          body: { name, strategy, enabled: true, models: [], config: {} },
           retry: false,
           acceptNotOk: true,
         });
@@ -328,7 +305,7 @@ export async function runComboCreateCommand(name, strategy = "priority", opts =
           console.error(`Combo '${name}' already exists. Delete it first.`);
           return 1;
         }
-        await db.combos.createCombo({ name, strategy, enabled: true, models, config: {} });
+        await db.combos.createCombo({ name, strategy, enabled: true, models: [], config: {} });
       }
 
       console.log(t("combo.created", { name }));

bin/cli/commands/comboModels.mjs

@@ -1,142 +0,0 @@
-// Parses the `--models` / `--model` options for `omniroute combo create` (#10954).
-//
-// Root cause of #10954: `combo create` only ever registered `--strategy`; the
-// HTTP body (POST /api/combos) and the local-db fallback (db.combos.createCombo)
-// both hardcoded `models: []`, so every combo created via the CLI came out
-// empty regardless of what the operator intended to route to.
-//
-// Accepted shapes mirror the server-side Zod union in
-// `src/shared/validation/schemas/combo.ts` (`comboModelEntry` /
-// `createComboSchema.models`) so a CLI-built payload never gets rejected by
-// the API that ultimately validates it:
-//   - a plain string ("provider/model" or a bare model id) — the server's
-//     `normalizeComboModels` (src/lib/combos/steps.ts) already splits the
-//     leading "provider/" segment off a plain string, so passing the raw
-//     token through is sufficient for the common case;
-//   - a structured `{ kind?: "model", model, providerId?, provider?, ... }`
-//     object;
-//   - a structured `{ kind: "combo-ref", comboName, ... }` object (nested
-//     combo reference).
-//
-// The CLI (bin/cli/**) ships as plain `.mjs` with relative-only imports — no
-// `@/` path aliases and no TS transpilation at runtime — so importing the
-// real Zod schema from `src/shared/validation/schemas/combo.ts` is not
-// viable here. This module instead validates the same minimal shape by hand
-// and stays a thin, independently testable unit.
-
-/**
- * Validates one already-parsed combo model entry against the shape accepted
- * by `comboModelEntry` (string | model-step | combo-ref). Throws with a
- * 1-based, human-readable position when the entry does not match.
- *
- * @param {unknown} entry
- * @param {number} index
- * @returns {string | Record<string, unknown>}
- */
-export function validateComboModelEntryShape(entry, index) {
-  const position = index + 1;
-
-  if (typeof entry === "string") {
-    const trimmed = entry.trim();
-    if (trimmed.length === 0) {
-      throw new Error(`--models entry #${position}: empty model string`);
-    }
-    if (trimmed.length > 300) {
-      throw new Error(`--models entry #${position}: model string exceeds 300 characters`);
-    }
-    return trimmed;
-  }
-
-  if (entry === null || typeof entry !== "object" || Array.isArray(entry)) {
-    throw new Error(`--models entry #${position}: must be a string or a JSON object`);
-  }
-
-  const kind = entry.kind;
-
-  if (kind === "combo-ref") {
-    if (typeof entry.comboName !== "string" || entry.comboName.trim().length === 0) {
-      throw new Error(
-        `--models entry #${position}: kind "combo-ref" requires a non-empty "comboName"`
-      );
-    }
-    return entry;
-  }
-
-  if (kind !== undefined && kind !== "model") {
-    throw new Error(`--models entry #${position}: unknown "kind" value ${JSON.stringify(kind)}`);
-  }
-
-  if (typeof entry.model !== "string" || entry.model.trim().length === 0) {
-    throw new Error(`--models entry #${position}: requires a non-empty "model"`);
-  }
-  if (entry.providerId !== undefined && typeof entry.providerId !== "string") {
-    throw new Error(`--models entry #${position}: "providerId" must be a string`);
-  }
-  if (entry.provider !== undefined && typeof entry.provider !== "string") {
-    throw new Error(`--models entry #${position}: "provider" must be a string`);
-  }
-
-  return entry;
-}
-
-/**
- * Parses one `--models` spec — either a JSON array (`--models '[{"model":"gpt-4o"}]'`)
- * or a comma-separated list of provider/model tokens
- * (`--models 'openai/gpt-4o,anthropic/claude-3-opus'`) — into an array of
- * combo model entries.
- *
- * @param {string} spec
- * @returns {Array<string | Record<string, unknown>>}
- */
-export function parseModelsSpec(spec) {
-  const trimmed = String(spec ?? "").trim();
-  if (trimmed.length === 0) return [];
-
-  if (trimmed.startsWith("[")) {
-    let parsed;
-    try {
-      parsed = JSON.parse(trimmed);
-    } catch (err) {
-      throw new Error(`--models: invalid JSON array (${err.message})`);
-    }
-    if (!Array.isArray(parsed)) {
-      throw new Error("--models: JSON value must be an array");
-    }
-    return parsed.map((entry, i) => validateComboModelEntryShape(entry, i));
-  }
-
-  return trimmed
-    .split(",")
-    .map((token) => token.trim())
-    .filter((token) => token.length > 0)
-    .map((token, i) => validateComboModelEntryShape(token, i));
-}
-
-/**
- * Resolves the final `models` array for `combo create` from Commander opts:
- * `--models <csv-or-json>` and/or repeatable `--model <spec>`.
- *
- * @param {{ models?: string, model?: string[] }} opts
- * @returns {Array<string | Record<string, unknown>>}
- */
-export function resolveComboModels(opts = {}) {
-  const result = [];
-
-  if (typeof opts.models === "string" && opts.models.trim().length > 0) {
-    result.push(...parseModelsSpec(opts.models));
-  }
-
-  if (Array.isArray(opts.model)) {
-    opts.model.forEach((token, i) => {
-      result.push(validateComboModelEntryShape(String(token).trim(), i));
-    });
-  }
-
-  return result;
-}
-
-/** Commander `collect`-style reducer for the repeatable `--model` option. */
-export function collectModel(value, previous) {
-  previous.push(value);
-  return previous;
-}

bin/cli/commands/compression.mjs

@@ -1,6 +1,5 @@
 import { readFileSync } from "node:fs";
 import { apiFetch } from "../api.mjs";
-import { mcpCallTool } from "../mcpClient.mjs";
 import { emit } from "../output.mjs";
 import { t } from "../i18n.mjs";
 
@@ -79,17 +78,18 @@ async function restComboStats(period) {
 }
 
 async function mcpCall(name, args, restFallback) {
-  try {
-    return await mcpCallTool(name, args);
-  } catch (err) {
-    // Keep the REST fallback behavior for builds where the MCP surface
-    // is unreachable / not mounted. Anything else rethrows as an error.
-    const status = err?.status || err?.cause?.status;
-    if ((status === 404 || status === 501) && typeof restFallback === "function") {
-      return restFallback();
-    }
-    throw err;
+  const res = await apiFetch("/api/mcp/tools/call", {
+    method: "POST",
+    body: { name, arguments: args },
+  });
+  if (res.ok) return res.json();
+  // 404 = MCP tool surface not mounted on this build; 501 = not implemented.
+  // Anything else is a genuine error and we surface it.
+  if ((res.status === 404 || res.status === 501) && typeof restFallback === "function") {
+    return restFallback();
   }
+  process.stderr.write(`Error: ${res.status}\n`);
+  process.exit(1);
 }
 
 async function confirm(q) {

bin/cli/commands/doctor.mjs

@@ -4,9 +4,7 @@ import os from "node:os";
 import path from "node:path";
 import { createDecipheriv, scryptSync } from "node:crypto";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { isLoopbackUrl } from "../api.mjs";
 import { resolveDataDir, resolveStoragePath } from "../data-dir.mjs";
-import { getCliToken, CLI_TOKEN_HEADER } from "../utils/cliToken.mjs";
 import { printHeading } from "../io.mjs";
 import { t } from "../i18n.mjs";
 import { readDatabaseHealth, readEncryptedCredentialSamples } from "../sqlite.mjs";
@@ -380,11 +378,11 @@ function checkMemory() {
   });
 }
 
-async function fetchWithTimeout(url, options = {}) {
+async function fetchWithTimeout(url) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), CHECK_TIMEOUT_MS);
   try {
-    return await fetch(url, { ...options, signal: controller.signal });
+    return await fetch(url, { signal: controller.signal });
   } finally {
     clearTimeout(timeout);
   }
@@ -473,98 +471,6 @@ async function checkServerLiveness(options = {}) {
   );
 }
 
-export async function checkMachineTokenAuth(options = {}) {
-  if (process.env.OMNIROUTE_DISABLE_CLI_TOKEN === "true") {
-    return warn("CLI machine token", "CLI machine-token authentication is disabled", {
-      derived: false,
-      accepted: false,
-      disabled: true,
-      tokenExposed: false,
-    });
-  }
-
-  let url;
-  try {
-    const parsed = new URL(resolveLivenessUrl(options));
-    if (
-      !["http:", "https:"].includes(parsed.protocol) ||
-      parsed.username ||
-      parsed.password ||
-      !isLoopbackUrl(parsed.toString())
-    ) {
-      return warn(
-        "CLI machine token",
-        "Machine-token probes are limited to HTTP(S) loopback endpoints",
-        { derived: false, accepted: false, tokenExposed: false }
-      );
-    }
-    parsed.pathname = "/api/cli/whoami";
-    parsed.search = "";
-    parsed.hash = "";
-    url = parsed.toString();
-  } catch {
-    return warn("CLI machine token", "Could not resolve the management endpoint", {
-      derived: false,
-      accepted: false,
-      tokenExposed: false,
-    });
-  }
-
-  const token = await getCliToken();
-  if (!token) {
-    return fail(
-      "CLI machine token",
-      "Could not derive a machine token; verify the node-machine-id runtime is installed",
-      { derived: false, accepted: false, tokenExposed: false }
-    );
-  }
-
-  try {
-    const response = await fetchWithTimeout(url, {
-      headers: { [CLI_TOKEN_HEADER]: token },
-      redirect: "error",
-    });
-    if (response.ok) {
-      return ok("CLI machine token", "Server accepted the local machine token", {
-        url,
-        status: response.status,
-        derived: true,
-        accepted: true,
-        tokenExposed: false,
-      });
-    }
-    if (response.status === 401 || response.status === 403) {
-      return warn(
-        "CLI machine token",
-        "Server rejected the local machine token; if the CLI and server are on different hosts or container boundaries, run `omniroute connect <host> --key <oma_live_...>`",
-        {
-          url,
-          status: response.status,
-          derived: true,
-          accepted: false,
-          containerBoundaryLikely: true,
-          tokenExposed: false,
-        }
-      );
-    }
-    return warn("CLI machine token", `Machine-token probe returned HTTP ${response.status}`, {
-      url,
-      status: response.status,
-      derived: true,
-      accepted: false,
-      tokenExposed: false,
-    });
-  } catch {
-    return warn("CLI machine token", "Machine-token endpoint could not be reached", {
-      url,
-      status: 0,
-      derived: true,
-      accepted: false,
-      tokenExposed: false,
-    });
-  }
-}
-
 export async function collectDoctorChecks(context = {}, options = {}) {
   const rootDir =
     context.rootDir || path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
@@ -582,7 +488,6 @@ export async function collectDoctorChecks(context = {}, options = {}) {
 
   if (!options.skipLiveness) {
     checks.push(await checkServerLiveness(options));
-    checks.push(await checkMachineTokenAuth(options));
   }
 
   // CLI tool health checks

bin/cli/commands/mcp.mjs

@@ -61,12 +61,27 @@ export function registerMcp(program) {
             ? JSON.parse(argsPositional)
             : {};
 
-      const exitCode = await runMcpCallCommand(tool, args, {
-        ...opts,
-        stream: opts.stream,
-      }, globalOpts);
+      if (opts.stream) {
+        await runMcpStream(tool, args, globalOpts);
+        return;
+      }
 
-      if (exitCode !== 0) process.exit(exitCode);
+      const extraHeaders = opts.scope?.length ? { "X-MCP-Scopes": opts.scope.join(",") } : {};
+      const res = await apiFetch("/api/mcp/tools/call", {
+        method: "POST",
+        body: { name: tool, arguments: args },
+        headers: extraHeaders,
+      });
+      if (res.status === 403) {
+        process.stderr.write("Scope denied\n");
+        process.exit(4);
+      }
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.status}\n`);
+        process.exit(1);
+      }
+      const data = await res.json();
+      emit(data, globalOpts);
     });
 
   mcp
@@ -84,132 +99,112 @@ export function registerMcp(program) {
       const data = await res.json();
       emit(data.scopes ?? data, cmd.optsWithGlobals());
     });
+
+  // 5.2 — mcp tools + mcp audit
+  const tools = mcp.command("tools").description(t("mcp.tools.description"));
+
+  tools
+    .command("list")
+    .description(t("mcp.tools.list.description"))
+    .option("--scope <s>", t("mcp.tools.list.scope"))
+    .action(async (opts, cmd) => {
+      const params = new URLSearchParams();
+      if (opts.scope) params.set("scope", opts.scope);
+      const res = await apiFetch(`/api/mcp/tools?${params}`);
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.status}\n`);
+        process.exit(1);
+      }
+      const data = await res.json();
+      emit(data.tools ?? data, cmd.optsWithGlobals(), mcpToolSchema);
+    });
+
+  tools
+    .command("info <name>")
+    .description(t("mcp.tools.info.description"))
+    .action(async (name, opts, cmd) => {
+      const res = await apiFetch(`/api/mcp/tools?name=${encodeURIComponent(name)}`);
+      if (!res.ok) {
+        process.stderr.write(`Not found: ${name}\n`);
+        process.exit(1);
+      }
+      emit(await res.json(), cmd.optsWithGlobals());
+    });
+
+  tools
+    .command("schema <name>")
+    .description(t("mcp.tools.schema.description"))
+    .option("--io <kind>", t("mcp.tools.schema.io"), "input")
+    .action(async (name, opts, cmd) => {
+      const res = await apiFetch(`/api/mcp/tools?name=${encodeURIComponent(name)}&io=${opts.io}`);
+      if (!res.ok) {
+        process.stderr.write(`Not found: ${name}\n`);
+        process.exit(1);
+      }
+      const data = await res.json();
+      const globalOpts = cmd.optsWithGlobals();
+      if (globalOpts.output === "json") {
+        process.stdout.write(JSON.stringify(data.schema ?? data, null, 2) + "\n");
+      } else {
+        emit(data.schema ?? data, globalOpts);
+      }
+    });
+
+  const audit = mcp.command("audit").description(t("mcp.audit.description"));
+
+  audit
+    .command("tail")
+    .option("--follow", t("audit.tail.follow"))
+    .option("--limit <n>", t("audit.tail.limit"), parseInt, 100)
+    .action(async (opts, cmd) => {
+      const { runAuditTail } = await import("./audit.mjs");
+      await runAuditTail({ ...opts, source: "mcp" }, cmd);
+    });
+
+  audit
+    .command("stats")
+    .option("--period <p>", t("audit.stats.period"), "7d")
+    .action(async (opts, cmd) => {
+      const res = await apiFetch(`/api/mcp/audit/stats?period=${opts.period}`);
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.status}\n`);
+        process.exit(1);
+      }
+      emit(await res.json(), cmd.optsWithGlobals());
+    });
 }
 
-/**
- * Shared JSON-RPC 2.0 MCP client used by both stream and non-stream `mcp call`.
- *
- * Protocol:
- *   1. POST /api/mcp/stream with initialize → get Mcp-Session-Id header
- *   2. POST /api/mcp/stream with tools/call + Mcp-Session-Id header
- *
- * When `stream` is true, writes SSE data chunks to stdout as they arrive.
- * When `stream` is false, returns the parsed JSON-RPC result.
- *
- * Returns the exit code (0 = success, non-zero = failure).
- */
-async function mcpJsonRpcCall(tool, args, { stream = false, globalOpts = {} } = {}) {
+async function runMcpStream(tool, args, globalOpts) {
   const baseUrl = globalOpts.baseUrl ?? "http://localhost:20128";
   const apiKey = globalOpts.apiKey ?? "";
-  const streamUrl = `${baseUrl}/api/mcp/stream`;
-
-  const hdrs = {
-    "Content-Type": "application/json",
-    Accept: stream ? "text/event-stream" : "application/json",
-    ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
-  };
-
-  // Step 1 — initialize
-  const initRes = await fetch(streamUrl, {
+  const res = await fetch(`${baseUrl}/api/mcp/stream`, {
     method: "POST",
-    headers: hdrs,
-    body: JSON.stringify({
-      jsonrpc: "2.0",
-      id: 1,
-      method: "initialize",
-      params: {
-        protocolVersion: "2024-11-05",
-        capabilities: {},
-        clientInfo: { name: "omniroute-cli", version: "1.0" },
-      },
-    }),
+    headers: {
+      "Content-Type": "application/json",
+      ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
+    },
+    body: JSON.stringify({ name: tool, arguments: args }),
   });
-
-  if (!initRes.ok) {
-    const text = await initRes.text().catch(() => "");
-    process.stderr.write(`MCP initialize failed: HTTP ${initRes.status}${text ? ` — ${text}` : ""}\n`);
-    return 1;
+  if (!res.ok) {
+    process.stderr.write(`HTTP ${res.status}\n`);
+    process.exit(1);
   }
-
-  const sessionId = initRes.headers.get("mcp-session-id");
-  if (!sessionId) {
-    process.stderr.write("MCP initialize failed: no Mcp-Session-Id in response\n");
-    return 1;
-  }
-
-  // Step 2 — tools/call
-  const callHeaders = {
-    ...hdrs,
-    "mcp-session-id": sessionId,
-  };
-
-  const callRes = await fetch(streamUrl, {
-    method: "POST",
-    headers: callHeaders,
-    body: JSON.stringify({
-      jsonrpc: "2.0",
-      id: 2,
-      method: "tools/call",
-      params: { name: tool, arguments: args },
-    }),
-  });
-
-  if (!callRes.ok) {
-    const text = await callRes.text().catch(() => "");
-    process.stderr.write(`MCP call failed: HTTP ${callRes.status}${text ? ` — ${text}` : ""}\n`);
-    return 1;
-  }
-
-  if (stream) {
-    return readMcpSseStream(callRes.body);
-  }
-
-  // Non-stream: parse JSON-RPC response
-  const data = await callRes.json();
-  if (data.error) {
-    process.stderr.write(`MCP error: ${data.error.message || JSON.stringify(data.error)}\n`);
-    return 1;
-  }
-  // Print the result content
-  const content = data.result?.content;
-  if (content) {
-    for (const item of content) {
-      if (item.type === "text") {
-        process.stdout.write(item.text + "\n");
-      } else if (item.type === "resource") {
-        process.stdout.write(JSON.stringify(item.resource) + "\n");
-      } else {
-        process.stdout.write(JSON.stringify(item) + "\n");
-      }
-    }
-  } else {
-    process.stdout.write(JSON.stringify(data.result, null, 2) + "\n");
-  }
-  return 0;
-}
-
-async function readMcpSseStream(body) {
-  if (!body) return 1;
-  const reader = body.getReader();
+  const reader = res.body.getReader();
   const dec = new TextDecoder();
   let buf = "";
   while (true) {
     const { done, value } = await reader.read();
     if (done) break;
     buf += dec.decode(value, { stream: true });
-  }
-  const lines = buf.split("\n");
-  for (const line of lines) {
-    if (line.startsWith("data: ")) {
-      const raw = line.slice(6).trim();
-      if (raw && raw !== "[DONE]") process.stdout.write(raw + "\n");
+    const lines = buf.split("\n");
+    buf = lines.pop() ?? "";
+    for (const line of lines) {
+      if (line.startsWith("data: ")) {
+        const raw = line.slice(6).trim();
+        if (raw && raw !== "[DONE]") process.stdout.write(raw + "\n");
+      }
     }
   }
-  return 0;
-}
-
-export async function runMcpCallCommand(tool, args, opts = {}, globalOpts = {}) {
-  return mcpJsonRpcCall(tool, args, { stream: opts.stream, globalOpts });
 }
 
 export async function runMcpStatusCommand(opts = {}) {
@@ -238,8 +233,7 @@ export async function runMcpStatusCommand(opts = {}) {
     }
 
     const transport = status.transport || "stdio";
-    const online = status.online ?? status.running;
-    console.log(online ? t("mcp.running", { transport }) : t("mcp.stopped"));
+    console.log(status.running ? t("mcp.running", { transport }) : t("mcp.stopped"));
     if (status.toolsCount !== undefined) console.log(`  Tools: ${status.toolsCount}`);
     if (status.scopes?.length) {
       console.log("  Scopes:");

bin/cli/commands/oauth.mjs

@@ -228,37 +228,20 @@ async function runSocialFlow(def, opts) {
 
 async function runDeviceFlow(def, opts) {
   const providerKey = resolveBackendKey(def.id);
-  let startRes = await apiFetch(`/api/oauth/${providerKey}/device-code`, targetApiOptions(opts));
-  if (!startRes.ok) {
-    startRes = await apiFetch(`/api/providers/${providerKey}/auth/start`, {
-      ...targetApiOptions(opts),
-      method: "POST",
-    });
-  }
+  const startRes = await apiFetch(`/api/providers/${providerKey}/auth/start`, {
+    ...targetApiOptions(opts),
+    method: "POST",
+  });
   if (!startRes.ok) {
     process.stderr.write(`Failed to start device flow: ${startRes.status}\n`);
     process.exit(1);
   }
   const start = await startRes.json();
-  const userCode = start.userCode ?? start.user_code ?? "";
-  const verificationUri =
-    start.verificationUriComplete ??
-    start.verification_uri_complete ??
-    start.verificationUri ??
-    start.verification_uri ??
-    start.authUrl ??
-    start.url ??
-    "";
-
-  if (userCode) {
-    process.stdout.write(`\nDevice code: ${userCode}\nVisit: ${verificationUri}\n\n`);
-  } else if (verificationUri) {
-    process.stdout.write(`\nVisit: ${verificationUri}\n\n`);
-  } else {
-    process.stdout.write(`\nAuthorization URL not available\n\n`);
-  }
-
-  if (opts.browser !== false && verificationUri) await openBrowser(verificationUri);
+  process.stdout.write(
+    `\nDevice code: ${start.userCode ?? start.user_code ?? ""}\nVisit: ${start.verificationUri ?? start.verification_uri}\n\n`
+  );
+  if (opts.browser !== false)
+    await openBrowser(start.verificationUri ?? start.verification_uri ?? "");
   process.stderr.write("Waiting for device authorization...\n");
   const deadline = Date.now() + (opts.timeout ?? 300000);
   const intervalMs = (start.intervalMs ?? start.interval ?? 5) * 1000;
@@ -319,18 +302,7 @@ export async function runOAuthStatus(opts, cmd) {
     process.exit(1);
   }
   const data = await res.json();
-  const payload = data?.connections ?? data?.providers ?? data?.items ?? data;
-  // #11236 (bug 5 residual): a 200 whose body is out of contract (no
-  // connections/providers/items array — e.g. `{"status":"ok"}`) used to fall
-  // through to `.filter` on a non-array and crash with a bare TypeError plus a
-  // libuv teardown assertion on Windows. Coerce to an empty list with a
-  // sanitized one-line warning instead of dumping a stack trace.
-  if (!Array.isArray(payload)) {
-    process.stderr.write(
-      "Warning: unexpected response shape from /api/providers; showing no connections.\n"
-    );
-  }
-  const connections = (Array.isArray(payload) ? payload : []).filter(
+  const connections = (data.connections ?? data.providers ?? data.items ?? data).filter(
     (c) => c.authType === "oauth" || c.authType === "oauth2"
   );
   emit(connections, globalOpts, connectionSchema);

bin/cli/commands/oneproxy.mjs

@@ -1,5 +1,4 @@
 import { apiFetch } from "../api.mjs";
-import { mcpCallTool } from "../mcpClient.mjs";
 import { emit } from "../output.mjs";
 import { t } from "../i18n.mjs";
 
@@ -9,7 +8,15 @@ function fmtTs(v) {
 }
 
 async function mcpCall(name, args) {
-  return mcpCallTool(name, args);
+  const res = await apiFetch("/api/mcp/tools/call", {
+    method: "POST",
+    body: { name, arguments: args },
+  });
+  if (!res.ok) {
+    process.stderr.write(`MCP error: ${res.status}\n`);
+    process.exit(1);
+  }
+  return res.json();
 }
 
 const proxySchema = [

bin/cli/commands/plugin.mjs

@@ -9,13 +9,10 @@ import { discoverPlugins } from "../plugins.mjs";
 // (instead of string-interpolating into `execSync`) prevents a malicious plugin
 // name like `foo; rm -rf ~` or `` foo`id` `` from being interpreted by the shell.
 function runNpm(args) {
-  const isBun = Boolean(process.versions.bun);
-  const pm = isBun ? "bun" : "npm";
-  const cmdArgs = isBun && args[0] === "install" ? ["add", ...args.slice(1)] : args;
-  const res = spawnSync(pm, cmdArgs, { stdio: "inherit", shell: false });
+  const res = spawnSync("npm", args, { stdio: "inherit", shell: false });
   if (res.error) throw res.error;
   if (typeof res.status === "number" && res.status !== 0) {
-    throw new Error(`${pm} exited with code ${res.status}`);
+    throw new Error(`npm exited with code ${res.status}`);
   }
 }
 

bin/cli/commands/providers.mjs

@@ -129,34 +129,7 @@ function buildTestInput(connection, apiKey) {
   };
 }
 
-async function testProviderConnectionThroughServer(connection) {
-  try {
-    const res = await apiFetch(`/api/providers/${encodeURIComponent(connection.id)}/test`, {
-      method: "POST",
-      body: {},
-      retry: false,
-      timeout: 30000,
-      acceptNotOk: true,
-    });
-    const data = res.ok ? await res.json() : { valid: false, error: `HTTP ${res.status}` };
-    return {
-      connection: publicConnection(connection),
-      ...data,
-      valid: data.valid === true,
-      skipped: false,
-    };
-  } catch (error) {
-    return {
-      connection: publicConnection(connection),
-      valid: false,
-      skipped: false,
-      error: error instanceof Error ? error.message : String(error),
-      statusCode: null,
-    };
-  }
-}
-
-async function runProviderTest(db, connection, { serverUp = false } = {}) {
+async function runProviderTest(db, connection) {
   // Only API-key connections can be probed with a stored credential. OAuth /
   // no-auth connections have nothing for testProviderApiKey() to send, and
   // getProviderApiKey() throws for them by design — reporting that as a FAILED
@@ -178,9 +151,6 @@ async function runProviderTest(db, connection, { serverUp = false } = {}) {
     // means the CLI has no probe recipe, not that the provider is unhealthy.
     // Persisting it would overwrite a good test_status with a failure.
     if (result.unsupported) {
-      if (serverUp) {
-        return testProviderConnectionThroughServer(connection);
-      }
       return {
         connection: publicConnection(connection),
         ...result,
@@ -296,7 +266,6 @@ export async function runTestCommand(selector, opts = {}) {
 }
 
 export async function runTestAllCommand(opts = {}) {
-  const serverUp = await isServerUp();
   const { db } = await openOmniRouteDb();
   try {
     const connections = listProviderConnections(db);
@@ -311,7 +280,7 @@ export async function runTestAllCommand(opts = {}) {
         });
         continue;
       }
-      results.push(await runProviderTest(db, connection, { serverUp }));
+      results.push(await runProviderTest(db, connection));
     }
 
     if (opts.json) {

bin/cli/commands/resilience.mjs

@@ -1,7 +1,6 @@
 import { createInterface } from "node:readline";
 import { Argument } from "commander";
 import { apiFetch } from "../api.mjs";
-import { mcpCallTool } from "../mcpClient.mjs";
 import { emit } from "../output.mjs";
 import { t } from "../i18n.mjs";
 
@@ -167,7 +166,14 @@ export function registerResilience(program) {
       ])
     )
     .action(async (name, opts, cmd) => {
-      await mcpCallTool("omniroute_set_resilience_profile", { profile: name });
+      const res = await apiFetch("/api/mcp/tools/call", {
+        method: "POST",
+        body: { name: "omniroute_set_resilience_profile", arguments: { profile: name } },
+      });
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.status}\n`);
+        process.exit(1);
+      }
       process.stdout.write(`Profile: ${name}\n`);
     });
 

bin/cli/commands/serve.mjs

@@ -1,7 +1,7 @@
 import { spawn } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
 import { platform, totalmem } from "node:os";
 import { t } from "../i18n.mjs";
 import { writePidFile, cleanupPidFile, waitForServer } from "../utils/pid.mjs";
@@ -12,7 +12,7 @@ import {
   isFatalInstrumentationHookFailure,
   formatAndroidInstrumentationFailureHint,
 } from "../utils/ensureAndroidCacheDir.mjs";
-import { resolveServerHost, resolveExposureWarning } from "../utils/serverHost.mjs";
+import { resolveServerHost } from "../utils/serverHost.mjs";
 import {
   resolveMaxOldSpaceMb,
   calibrateHeapFallbackMb,
@@ -20,7 +20,6 @@ import {
   buildNodeHeapArgs,
 } from "../../../scripts/build/runtime-env.mjs";
 import { resolveTlsOptions } from "../../../scripts/dev/tls-options.mjs";
-import { startDetachedTray, validateTrayOptions } from "../tray/detachedTray.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const _pkg = JSON.parse(readFileSync(join(__dirname, "..", "..", "..", "package.json"), "utf8"));
@@ -43,7 +42,7 @@ function parsePort(value, fallback) {
 }
 
 export function registerServe(program) {
-  const command = program
+  program
     .command("serve", { isDefault: true })
     .description(t("serve.description"))
     .option("--port <port>", t("serve.port"))
@@ -52,7 +51,7 @@ export function registerServe(program) {
     .option("--log", t("serve.log"))
     .option("--no-recovery", t("serve.no_recovery"))
     .option("--max-restarts <n>", t("serve.max_restarts"), parseInt, 2)
-    .option("--tray", t("serve.tray") || "Start in the system tray (desktop only)")
+    .option("--tray", t("serve.tray") || "Show system tray icon (desktop only)")
     .option("--no-tray", t("serve.no_tray") || "Disable system tray icon")
     .option(
       "--tls-cert <path>",
@@ -67,9 +66,6 @@ export function registerServe(program) {
     .action(async (opts) => {
       await runServe(opts);
     });
-  command.addOption(command.createOption("--tray-worker").hideHelp());
-  command.addOption(command.createOption("--tray-ready-port <port>").hideHelp());
-  command.addOption(command.createOption("--tray-ready-token <token>").hideHelp());
 }
 
 /** Once-per-process guard so the Android/Termux cache hint is not spammed. */
@@ -99,32 +95,6 @@ export function resetInstrumentationFailureHintForTests() {
 export async function runServe(opts = {}) {
   const startedAt = performance.now();
 
-  const trayOptionError = validateTrayOptions(opts);
-  if (trayOptionError) throw new Error(trayOptionError);
-
-  if (opts.tray === true && opts.trayWorker !== true) {
-    const port = parsePort(opts.port ?? process.env.PORT ?? "20128", 20128);
-    const tlsCert = opts.tlsCert ?? process.env.OMNIROUTE_TLS_CERT;
-    const tlsKey = opts.tlsKey ?? process.env.OMNIROUTE_TLS_KEY;
-    urlScheme = resolveTlsOptions({
-      ...process.env,
-      ...(tlsCert ? { OMNIROUTE_TLS_CERT: tlsCert } : {}),
-      ...(tlsKey ? { OMNIROUTE_TLS_KEY: tlsKey } : {}),
-    })
-      ? "https"
-      : "http";
-    const result = await startDetachedTray({
-      cliPath: join(ROOT, "bin", "omniroute.mjs"),
-      port,
-      maxRestarts: opts.maxRestarts ?? 2,
-      tlsCert,
-      tlsKey,
-    });
-    console.log(`\x1b[32m✔ OmniRoute tray started in background\x1b[0m`);
-    console.log(`  \x1b[1mDashboard:\x1b[0m  ${urlScheme}://localhost:${port}`);
-    return result;
-  }
-
   // Same prep as bin/omniroute.mjs — keep it here so a direct `runServe()` call
   // (tests / programmatic) still gets a writable Next.js cache dir before spawn.
   ensureAndroidCacheDir({ env: process.env });
@@ -162,15 +132,6 @@ export async function runServe(opts = {}) {
 `);
   }
 
-  // GHSA-wmgv-ph3p-rv57: the default posture (all interfaces + no API key) is a
-  // deliberate local-first choice, but it must be loud at startup — an operator
-  // on an untrusted network learns the two escape hatches here, not after a
-  // surprise quota bill.
-  const exposureWarning = resolveExposureWarning();
-  if (exposureWarning) {
-    console.warn(`\x1b[33m  ⚠  ${exposureWarning}\x1b[0m\n`);
-  }
-
   const serverWsJs = join(APP_DIR, "server-ws.mjs");
   const serverJs = existsSync(serverWsJs) ? serverWsJs : join(APP_DIR, "server.js");
 
@@ -294,8 +255,7 @@ export async function runServe(opts = {}) {
     opts.log === true,
     opts.maxRestarts ?? 2,
     startedAt,
-    useTray,
-    { trayReadyPort: opts.trayReadyPort, trayReadyToken: opts.trayReadyToken }
+    useTray
   );
 }
 
@@ -408,11 +368,9 @@ async function runWithSupervisor(
   showLog,
   maxRestarts,
   startedAt,
-  useTray = false,
-  { trayReadyPort, trayReadyToken } = {}
+  useTray = false
 ) {
   if (showLog) process.env.OMNIROUTE_SHOW_LOG = "1";
-  writePidFile("supervisor", process.pid);
 
   const supervisor = new ServerSupervisor({
     serverPath: serverJs,
@@ -423,7 +381,7 @@ async function runWithSupervisor(
       if (detectMitmCrash(crashLog)) {
         try {
           const PROJECT_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
-          const { updateSettings } = await import(pathToFileURL(join(PROJECT_ROOT, "src/lib/db/settings.ts")).href);
+          const { updateSettings } = await import(`${PROJECT_ROOT}/src/lib/db/settings.ts`);
           updateSettings({ mitmEnabled: false });
         } catch {}
         return "disable-mitm-and-retry";
@@ -436,38 +394,17 @@ async function runWithSupervisor(
 
   process.on("SIGINT", () => {
     killTrayIfActive();
-    cleanupPidFile("supervisor");
     supervisor.stop();
   });
   process.on("SIGTERM", () => {
     killTrayIfActive();
-    cleanupPidFile("supervisor");
     supervisor.stop();
   });
 
   if (!showLog) {
     waitForServer(dashboardPort, 60000).then(async (up) => {
       if (up) {
-        if (useTray) {
-          const trayReady = await maybeStartTray(dashboardPort, apiPort, supervisor);
-          if (!trayReady) {
-            cleanupPidFile("supervisor");
-            supervisor.stop();
-            process.exitCode = 1;
-            return;
-          }
-          if (trayReadyPort && trayReadyToken) {
-            const { notifyTrayReady } = await import("../tray/detachedTray.mjs");
-            try {
-              await notifyTrayReady(parsePort(trayReadyPort, 0), trayReadyToken);
-            } catch {
-              cleanupPidFile("supervisor");
-              supervisor.stop();
-              process.exitCode = 1;
-              return;
-            }
-          }
-        }
+        if (useTray) await maybeStartTray(dashboardPort, apiPort, supervisor);
         onReady(dashboardPort, apiPort, noOpen, startedAt);
       } else {
         reportReadinessTimeout(dashboardPort, supervisor);
@@ -514,30 +451,29 @@ function killTrayIfActive() {
 async function maybeStartTray(port, apiPort, supervisor) {
   try {
     const { initTray, isTraySupported } = await import("../tray/index.mjs");
-    if (!isTraySupported()) return false;
+    if (!isTraySupported()) return;
     const { default: open } = await import("open").catch(() => ({ default: null }));
     const dashboardUrl = `${urlScheme}://localhost:${port}`;
     const tray = await initTray({
       port,
       onQuit: () => {
         killTrayIfActive();
-        cleanupPidFile("supervisor");
         supervisor.stop();
       },
       onOpenDashboard: () => open?.(dashboardUrl),
-      onShowLogs: () => open?.(`${dashboardUrl}/dashboard/logs`),
+      onShowLogs: () => {
+        // In-place: open logs stream (best-effort)
+        process.stdout.write(`[omniroute][tray] Logs at: ${dashboardUrl}/logs\n`);
+      },
     });
     if (tray) {
       const { killTray } = await import("../tray/index.mjs");
       _killTray = killTray;
-      return true;
     }
-    return false;
   } catch (err) {
     // tray is optional — do not fail the server, but surface why it failed so
     // "--tray shows nothing" is diagnosable instead of silent (#4605).
     process.stderr.write(`[omniroute][tray] failed to start: ${err?.message ?? String(err)}\n`);
-    return false;
   }
 }
 

bin/cli/commands/setup.mjs

@@ -1,4 +1,4 @@
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
 import { dirname, resolve } from "node:path";
 import { createPrompt, printHeading, printInfo, printSuccess } from "../io.mjs";
 import { openOmniRouteDb } from "../sqlite.mjs";
@@ -16,7 +16,7 @@ import { t } from "../i18n.mjs";
 const PROJECT_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../../..");
 
 async function getListCliTools() {
-  const { listCliTools } = await import(pathToFileURL(resolve(PROJECT_ROOT, "src/shared/constants/cliTools.ts")).href);
+  const { listCliTools } = await import(`${PROJECT_ROOT}/src/shared/constants/cliTools.ts`);
   return listCliTools;
 }
 

bin/cli/commands/skills.mjs

@@ -1,6 +1,5 @@
 import { readFileSync } from "node:fs";
 import { apiFetch } from "../api.mjs";
-import { mcpCallTool } from "../mcpClient.mjs";
 import { emit } from "../output.mjs";
 import { t } from "../i18n.mjs";
 
@@ -107,7 +106,14 @@ export async function runSkillsInstall(opts, cmd) {
 }
 
 export async function runSkillsEnable(id, opts, cmd) {
-  await mcpCallTool("omniroute_skills_enable", { skillId: id, enabled: true });
+  const res = await apiFetch("/api/mcp/tools/call", {
+    method: "POST",
+    body: { name: "omniroute_skills_enable", arguments: { skillId: id, enabled: true } },
+  });
+  if (!res.ok) {
+    process.stderr.write(`Error: ${res.status}\n`);
+    process.exit(1);
+  }
   process.stdout.write(`Enabled: ${id}\n`);
 }
 
@@ -116,7 +122,14 @@ export async function runSkillsDisable(id, opts, cmd) {
     const ok = await confirm(`Disable ${id}?`);
     if (!ok) return;
   }
-  await mcpCallTool("omniroute_skills_enable", { skillId: id, enabled: false });
+  const res = await apiFetch("/api/mcp/tools/call", {
+    method: "POST",
+    body: { name: "omniroute_skills_enable", arguments: { skillId: id, enabled: false } },
+  });
+  if (!res.ok) {
+    process.stderr.write(`Error: ${res.status}\n`);
+    process.exit(1);
+  }
   process.stdout.write(`Disabled: ${id}\n`);
 }
 
@@ -140,11 +153,16 @@ export async function runSkillsExecute(id, opts, cmd) {
     : opts.inputFile
       ? JSON.parse(readFileSync(opts.inputFile, "utf8"))
       : {};
-  const data = await mcpCallTool(
-    "omniroute_skills_execute",
-    { skillId: id, input },
-    { timeout: opts.timeout ?? 30000 },
-  );
+  const res = await apiFetch("/api/mcp/tools/call", {
+    method: "POST",
+    body: { name: "omniroute_skills_execute", arguments: { skillId: id, input } },
+    timeout: opts.timeout ?? 30000,
+  });
+  if (!res.ok) {
+    process.stderr.write(`Error: ${res.status}\n`);
+    process.exit(1);
+  }
+  const data = await res.json();
   emit(data, globalOpts);
 }
 

bin/cli/commands/test-provider.mjs

@@ -38,19 +38,12 @@ export async function runTestProviderCommand(provider, model, opts = {}) {
   }
 
   const targetProvider = provider || "anthropic";
-  const connections = await _loadConnections();
-  if (!connections) return 1;
-  const connection = _resolveConnection(connections, targetProvider, model);
-  if (!connection) {
-    console.error(`Provider connection not found: ${targetProvider}`);
-    return 1;
-  }
-  const targetModel = model || connection.defaultModel;
+  const targetModel = model || "claude-haiku-4-5-20251001";
   const repeat = opts.repeat && opts.repeat > 0 ? opts.repeat : 1;
 
   const results = [];
   for (let i = 0; i < repeat; i++) {
-    const result = await _runSingleTest(connection, targetModel);
+    const result = await _runSingleTest(targetProvider, targetModel);
     results.push(result);
   }
 
@@ -77,10 +70,18 @@ export async function runTestProviderCommand(provider, model, opts = {}) {
 }
 
 async function _runAllProviders(opts) {
-  const loaded = await _loadConnections();
-  if (!loaded) return 1;
-  const connections = loaded.filter(
-    (c) => c.isActive !== false && (c.authType === "apikey" || c.testStatus !== "unavailable")
+  const res = await apiFetch("/api/providers?limit=200", {
+    retry: false,
+    timeout: 5000,
+    acceptNotOk: true,
+  });
+  if (!res.ok) {
+    console.error(t("test.noServer"));
+    return 1;
+  }
+  const data = await res.json();
+  const connections = (data.connections ?? data.providers ?? data.items ?? data).filter(
+    (c) => c.authType === "apikey" || c.testStatus !== "unavailable"
   );
   if (connections.length === 0) {
     console.log(t("test.noProviders"));
@@ -88,7 +89,6 @@ async function _runAllProviders(opts) {
   }
 
   const providers = connections.map((c) => ({
-    connectionId: c.id,
     provider: c.provider ?? c.id,
     model: c.defaultModel ?? c.model,
   }));
@@ -102,8 +102,8 @@ async function _runAllProviders(opts) {
   }
 
   const results = await Promise.all(
-    providers.map(async ({ connectionId, provider, model }) => {
-      const r = await _runSingleTest({ id: connectionId }, model);
+    providers.map(async ({ provider, model }) => {
+      const r = await _runSingleTest(provider, model);
       return { provider, model, ...r };
     })
   );
@@ -123,13 +123,6 @@ async function _runAllProviders(opts) {
 
 async function _runCompare(provider, opts) {
   const targetProvider = provider || "anthropic";
-  const connections = await _loadConnections();
-  if (!connections) return 1;
-  const connection = _resolveConnection(connections, targetProvider);
-  if (!connection) {
-    console.error(`Provider connection not found: ${targetProvider}`);
-    return 1;
-  }
   const models = opts.compare
     .split(",")
     .map((m) => m.trim())
@@ -145,7 +138,7 @@ async function _runCompare(provider, opts) {
   for (const model of models) {
     const results = [];
     for (let i = 0; i < repeat; i++) {
-      const result = await _runSingleTest(connection, model);
+      const result = await _runSingleTest(targetProvider, model);
       results.push(result);
     }
     rows.push({ model, ..._aggregate(results, true) });
@@ -187,55 +180,19 @@ async function _runCompare(provider, opts) {
   return rows.every((r) => r.success) ? 0 : 1;
 }
 
-async function _loadConnections() {
-  const res = await apiFetch("/api/providers?limit=200", {
-    retry: false,
-    timeout: 5000,
-    acceptNotOk: true,
-  });
-  if (!res.ok) {
-    console.error(t("test.noServer"));
-    return null;
-  }
-  const data = await res.json();
-  const connections = data.connections ?? data.providers ?? data.items ?? data;
-  if (!Array.isArray(connections)) {
-    console.error(t("test.noServer"));
-    return null;
-  }
-  return connections;
-}
-
-function _resolveConnection(connections, selector, model) {
-  const normalized = String(selector || "")
-    .trim()
-    .toLowerCase();
-  const active = connections.filter((connection) => connection.isActive !== false);
-  return (
-    active.find((connection) => String(connection.id || "").toLowerCase() === normalized) ??
-    active.find((connection) => String(connection.name || "").toLowerCase() === normalized) ??
-    active.find(
-      (connection) =>
-        String(connection.provider || "").toLowerCase() === normalized &&
-        (!model || connection.defaultModel === model || connection.model === model)
-    ) ??
-    active.find((connection) => String(connection.provider || "").toLowerCase() === normalized)
-  );
-}
-
-async function _runSingleTest(connection, model) {
+async function _runSingleTest(provider, model) {
   const startMs = Date.now();
   try {
-    const res = await apiFetch(`/api/providers/${encodeURIComponent(connection.id)}/test`, {
+    const res = await apiFetch("/api/v1/providers/test", {
       method: "POST",
-      body: model ? { validationModelId: model } : {},
+      body: { provider, model },
       retry: false,
       timeout: 30000,
       acceptNotOk: true,
     });
     const durationMs = Date.now() - startMs;
-    const data = res.ok ? await res.json() : { valid: false, error: `HTTP ${res.status}` };
-    return { ...data, success: data.valid === true, durationMs };
+    const data = res.ok ? await res.json() : { success: false, error: `HTTP ${res.status}` };
+    return { ...data, durationMs };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     return {

bin/cli/locales/en.json

@@ -254,7 +254,7 @@
     "log": "Show server logs inline",
     "no_recovery": "Disable auto-restart on crash (debugging mode)",
     "max_restarts": "Max crash restarts within 30s before giving up (default: 2)",
-    "tray": "Start in the system tray (desktop only, opt-in)",
+    "tray": "Show system tray icon (desktop only, opt-in)",
     "no_tray": "Disable system tray icon",
     "tls_cert": "Path to a TLS certificate (PEM) to serve HTTPS (also OMNIROUTE_TLS_CERT)",
     "tls_key": "Path to the TLS private key (PEM) to serve HTTPS (also OMNIROUTE_TLS_KEY)"

bin/cli/mcpClient.mjs

@@ -1,127 +0,0 @@
-/**
- * Shared MCP JSON-RPC client for CLI commands.
- *
- * The server exposes MCP through /api/mcp/stream (Streamable HTTP transport).
- * Calling a tool requires:
- *   1. POST initialize → get Mcp-Session-Id response header
- *   2. POST tools/call with that session header
- *
- * Older CLI paths POSTed { name, arguments } to /api/mcp/tools/call, which is
- * not a registered route, so every MCP-backed command was broken.
- *
- * These functions route through apiFetch so CLI auth, remote contexts and
- * timeouts are handled the same way as every other management API call.
- */
-import { apiFetch } from "./api.mjs";
-
-function mcpError(message, status) {
-  const err = new Error(message);
-  if (status) err.status = status;
-  return err;
-}
-
-async function callMcpEndpoint(payload, { timeout, stream }) {
-  const res = await apiFetch("/api/mcp/stream", {
-    method: "POST",
-    body: payload,
-    timeout,
-    acceptNotOk: true,
-    headers: stream ? { Accept: "text/event-stream" } : {},
-  });
-
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw mcpError(
-      `${payload.method} ${payload.id}: HTTP ${res.status}${text ? ` — ${text}` : ""}`,
-      res.status,
-    );
-  }
-  return res;
-}
-
-/**
- * Call an MCP tool over /api/mcp/stream.
- *
- * Non-stream: returns the JSON-RPC result payload.
- * Stream: writes SSE `data:` chunks to stdout and returns null on success.
- */
-export async function mcpCallTool(name, args = {}, options = {}) {
-  const { timeout, scope } = options;
-  const scopeHeader = scope?.length ? { "X-MCP-Scopes": scope.join(",") } : {};
-
-  const initRes = await callMcpEndpoint(
-    {
-      jsonrpc: "2.0",
-      id: 1,
-      method: "initialize",
-      params: {
-        protocolVersion: "2024-11-05",
-        capabilities: {},
-        clientInfo: { name: "omniroute-cli", version: "1.0" },
-      },
-    },
-    { timeout, stream: options.stream },
-  );
-
-  const sessionId = initRes.headers.get("mcp-session-id");
-  if (!sessionId) {
-    throw mcpError("MCP initialize failed: no Mcp-Session-Id in response", 500);
-  }
-
-  const callRes = await callMcpEndpoint(
-    {
-      jsonrpc: "2.0",
-      id: 2,
-      method: "tools/call",
-      params: { name, arguments: args },
-    },
-    { timeout, stream: options.stream },
-  );
-
-  if (options.stream) {
-    return consumeSse(callRes.body, options.onChunk);
-  }
-
-  const data = await callRes.json();
-  if (data.error) {
-    const err = mcpError(`MCP error: ${data.error.message || JSON.stringify(data.error)}`);
-    err.code = data.error.code;
-    throw err;
-  }
-  if (data.result?.isError) {
-    const msg = data.result?.content?.[0]?.text || "unknown tool error";
-    throw mcpError(`MCP error: ${msg}`, 500);
-  }
-  return data.result;
-}
-
-async function consumeSse(body, onChunk) {
-  if (!body) throw mcpError("MCP stream returned no body", 500);
-  const reader = body.getReader();
-  const decoder = new TextDecoder();
-  let buf = "";
-  const flushLines = () => {
-    let idx;
-    while ((idx = buf.indexOf("\n")) >= 0) {
-      const line = buf.slice(0, idx);
-      buf = buf.slice(idx + 1);
-      if (line.startsWith("data: ")) {
-        const raw = line.slice(6).trim();
-        if (raw && raw !== "[DONE]") (onChunk ?? writeStdout)(raw);
-      }
-    }
-  };
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    buf += decoder.decode(value, { stream: true });
-    flushLines();
-  }
-  buf += decoder.decode();
-  flushLines();
-  return null;
-}
-
-function writeStdout(raw) {
-  process.stdout.write(raw + "\n");
-}

bin/cli/provider-test.mjs

@@ -10,10 +10,6 @@ const PROVIDER_TEST_CONFIGS = {
     format: "openai",
     baseUrl: "https://openrouter.ai/api/v1",
     model: "openai/gpt-4o-mini",
-    // #11226: /models is public on OpenRouter (200 with any or no key) — probe the
-    // authenticated key-info endpoint instead so a bad key fails the test here
-    // instead of on the first real chat request.
-    keyCheckPath: "/auth/key",
   },
   groq: {
     format: "openai",
@@ -105,19 +101,13 @@ async function testOpenAILikeProvider(input, config) {
     "Content-Type": "application/json",
   };
 
-  // Providers whose /models endpoint is public (e.g. OpenRouter) declare a
-  // keyCheckPath pointing at an authenticated endpoint so the probe actually
-  // exercises the key instead of the public catalog.
-  const probeRes = await fetchWithTimeout(
-    joinUrl(config.baseUrl, config.keyCheckPath || "/models"),
-    {
-      method: "GET",
-      headers,
-    }
-  );
+  const modelsRes = await fetchWithTimeout(joinUrl(config.baseUrl, "/models"), {
+    method: "GET",
+    headers,
+  });
 
-  if (probeRes.ok || probeRes.status === 401 || probeRes.status === 403) {
-    return classifyResponse(probeRes);
+  if (modelsRes.ok || modelsRes.status === 401 || modelsRes.status === 403) {
+    return classifyResponse(modelsRes);
   }
 
   const chatRes = await fetchWithTimeout(joinUrl(config.baseUrl, "/chat/completions"), {

bin/cli/runtime.mjs

@@ -1,14 +1,9 @@
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
 import { dirname, resolve } from "node:path";
 import { apiFetch, isServerUp } from "./api.mjs";
 
 const PROJECT_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
 
-// Dynamic `import()` resolves its specifier as a URL, not as a filesystem path.
-// On Windows an absolute path starts with a drive letter, which the ESM loader
-// reads as the unsupported URL scheme `e:` and rejects. Pass a file:// URL.
-const projectFileUrl = (relPath) => pathToFileURL(resolve(PROJECT_ROOT, relPath)).href;
-
 export class ServerOfflineError extends Error {
   constructor(message = "Server is offline and operation requires HTTP runtime") {
     super(message);
@@ -27,8 +22,8 @@ function makeHttpContext(opts) {
 
 async function importDbModules() {
   const [combos, recovery] = await Promise.all([
-    import(projectFileUrl("src/lib/db/combos.ts")),
-    import(projectFileUrl("src/lib/db/recovery.ts")),
+    import(`${PROJECT_ROOT}/src/lib/db/combos.ts`),
+    import(`${PROJECT_ROOT}/src/lib/db/recovery.ts`),
   ]);
   return { combos, recovery };
 }

bin/cli/runtime/nativeDeps.mjs

@@ -114,30 +114,24 @@ export function isBetterSqliteBinaryValid() {
 
 export function npmInstallRuntime(pkgs, opts = {}) {
   const cwd = ensureRuntimeDir();
+  // Persist to the runtime package.json (exact version) instead of --no-save so a later
+  // install of a sibling runtime dep (e.g. systray2 from trayRuntime.ts, which writes to the
+  // same runtime dir) does not prune this package as "extraneous" — that pruning otherwise
+  // reproduces "No SQLite driver available" after a tray install removes better-sqlite3.
+  const npmArgs = [
+    "install",
+    ...pkgs,
+    "--no-audit",
+    "--no-fund",
+    "--prefer-online",
+    "--save-exact",
+  ];
+  // On Windows .cmd files cannot be executed without a shell; use cmd.exe /c explicitly
+  // so we never set shell:true (which would propagate env and enable injection).
   const isWin = platform() === "win32";
-  const isBun = Boolean(process.versions.bun);
-
-  let exe, args, displayCmd;
-  if (isBun) {
-    const bunArgs = ["add", ...pkgs, "--trust"];
-    [exe, args] = isWin ? ["cmd.exe", ["/c", "bun", ...bunArgs]] : ["bun", bunArgs];
-    displayCmd = `bun ${bunArgs.join(" ")}`;
-  } else {
-    const npmArgs = [
-      "install",
-      ...pkgs,
-      "--no-audit",
-      "--no-fund",
-      "--prefer-online",
-      "--save-exact",
-      ...pkgs.map((pkg) => `--allow-scripts=${pkg}`),
-    ];
-    [exe, args] = isWin ? ["cmd.exe", ["/c", "npm", ...npmArgs]] : ["npm", npmArgs];
-    displayCmd = `npm ${npmArgs.join(" ")}`;
-  }
-
+  const [exe, args] = isWin ? ["cmd.exe", ["/c", "npm", ...npmArgs]] : ["npm", npmArgs];
   if (!opts.silent) {
-    process.stdout.write(`[omniroute][runtime] ${displayCmd}\n`);
+    process.stdout.write(`[omniroute][runtime] npm ${npmArgs.join(" ")}\n`);
   }
   const res = spawnSync(exe, args, {
     cwd,

bin/cli/runtime/sqliteRuntime.mjs

@@ -6,9 +6,7 @@ import { pathToFileURL } from "node:url";
 import { validateBinaryMagic, platformBinaryLabel } from "./magicBytes.mjs";
 
 const RUNTIME_DIR = join(homedir(), ".omniroute", "runtime");
-// Exported so the packaging coherence guard (tests/unit/pack-boot-runtime-paths.test.ts)
-// can assert this stays on the same major as optionalDependencies.better-sqlite3 (#11242).
-export const BETTER_SQLITE3_VERSION = "better-sqlite3@^13.0.2";
+const BETTER_SQLITE3_VERSION = "better-sqlite3@^12.10.1";
 
 let resolvedCached = null;
 

bin/cli/sqlite.mjs

@@ -5,14 +5,10 @@ import { ensureSettingsSchema, hashManagementPassword, updateSettings } from "./
 
 async function loadSqlite() {
   if (process.versions.bun) {
-    try {
-      return { Database: (await import("bun:sqlite")).Database, driver: "bun:sqlite" };
-    } catch (bunError) {
-      // fall through to better-sqlite3 if bun:sqlite fails
-    }
+    return { Database: (await import("bun:sqlite")).Database };
   }
   try {
-    return { Database: (await import("better-sqlite3")).default, driver: "better-sqlite3" };
+    return { Database: (await import("better-sqlite3")).default };
   } catch (error) {
     return { error };
   }
@@ -90,14 +86,12 @@ export function normalizeBunSqliteParams(params) {
 
 export function createSqliteNativeError(error) {
   const message = error instanceof Error ? error.message : String(error);
-  const isBun = Boolean(process.versions.bun);
-  const rebuildCmd = isBun ? "bun add better-sqlite3 --trust" : "npm rebuild better-sqlite3";
   if (message.includes("NODE_MODULE_VERSION") || message.includes("ERR_DLOPEN_FAILED")) {
     return new Error(
-      `better-sqlite3 native binding is incompatible with this runtime. ` +
-        `Run \`${rebuildCmd}\` in the OmniRoute project and try again. ` +
-        `Or run: omniroute runtime repair  ` +
-        `(rebuilds into a user-writable runtime; works without a C++ toolchain).`
+      "better-sqlite3 native binding is incompatible with this Node.js runtime. " +
+        "Run `npm rebuild better-sqlite3` in the OmniRoute project and try again. " +
+        "Or run: omniroute runtime repair  " +
+        "(rebuilds into a user-writable runtime; works without a C++ toolchain)."
     );
   }
   if (
@@ -106,9 +100,10 @@ export function createSqliteNativeError(error) {
     message.includes("Cannot find module 'better-sqlite3'")
   ) {
     return new Error(
-      `better-sqlite3 native binding could not be found (no prebuilt addon for this platform). ` +
-        `Run: omniroute runtime repair  ` +
-        `(rebuilds into a user-writable runtime; works without a C++ toolchain).`
+      "better-sqlite3 native binding could not be found (no prebuilt addon for this platform). " +
+        "This is common under `npx`, which runs a fresh, ephemeral install that never built the addon. " +
+        "Run: omniroute runtime repair  " +
+        "(rebuilds into a user-writable runtime; works without a C++ toolchain)."
     );
   }
   return error;
@@ -116,7 +111,7 @@ export function createSqliteNativeError(error) {
 
 async function openSqliteDatabase(dbPath, options = {}) {
   const loaded = await loadSqlite();
-  if (loaded.driver === "bun:sqlite" || (process.versions.bun && !loaded.Database)) {
+  if (process.versions.bun) {
     if (options.fileMustExist && !fs.existsSync(dbPath)) {
       throw new Error(`SQLite file does not exist: ${dbPath}`);
     }

bin/cli/tray/autostart.mjs

@@ -121,16 +121,7 @@ function writeLinuxSystemdUnit(cliPath) {
     "Wants=network-online.target",
     "",
     "[Service]",
-    // Type=notify + WatchdogSec: the server sends READY=1 once listening and
-    // WATCHDOG=1 every 60s; if its event loop ever blocks (frozen process),
-    // the pings stop and systemd kills+restarts the service. NotifyAccess=all
-    // because the pings come from the server child, not the serve supervisor.
-    // Foreground serve only: `--daemon` escapes the cgroup and would break
-    // the notify handshake.
-    "Type=notify",
-    "NotifyAccess=all",
-    "WatchdogSec=180",
-    "TimeoutStartSec=300",
+    "Type=simple",
     `ExecStart=${buildServeExecLine(cliPath, { tray: false })}`,
     "Restart=on-failure",
     "RestartSec=5",
@@ -276,10 +267,6 @@ function isAgentSelfMac() {
   }
 }
 
-function isDetachedTrayWorker() {
-  return process.argv.includes("--tray-worker");
-}
-
 function enableMac() {
   const plistDir = join(homedir(), "Library", "LaunchAgents");
   mkdirSync(plistDir, { recursive: true });
@@ -304,7 +291,7 @@ function enableMac() {
   // If we're already the running agent, launchctl load/unload would SIGTERM us.
   // The plist is updated on disk and launchd already has us loaded under our own
   // PID — nothing more to do for the current session.
-  if (isAgentSelfMac() || isDetachedTrayWorker()) return existsSync(plistPath);
+  if (isAgentSelfMac()) return existsSync(plistPath);
   try {
     execSync("launchctl load -w " + JSON.stringify(plistPath), { stdio: "ignore" });
   } catch {}
@@ -317,7 +304,7 @@ function disableMac() {
   // `launchctl unload` sends SIGTERM and a user clicking "Disable Autostart"
   // from the tray would lose the tray icon instead of just flipping the label.
   // Removing the plist file is enough to stop the agent at the next login.
-  if (!isAgentSelfMac() && !isDetachedTrayWorker()) {
+  if (!isAgentSelfMac()) {
     try {
       execSync("launchctl unload -w " + JSON.stringify(plistPath), { stdio: "ignore" });
     } catch {}

bin/cli/tray/detachedTray.mjs

@@ -1,176 +0,0 @@
-import { execFileSync, spawn } from "node:child_process";
-import { randomBytes, timingSafeEqual } from "node:crypto";
-import { createServer, connect } from "node:net";
-
-/** Builds arguments for the hidden process that owns the server and tray. */
-export function buildTrayWorkerArgs({ port, maxRestarts, readyPort, readyToken, tlsCert, tlsKey }) {
-  const args = [
-    "serve",
-    "--tray",
-    "--tray-worker",
-    "--no-open",
-    "--port",
-    String(port),
-    "--max-restarts",
-    String(maxRestarts),
-    "--tray-ready-port",
-    String(readyPort),
-    "--tray-ready-token",
-    readyToken,
-  ];
-  if (tlsCert) args.push("--tls-cert", tlsCert);
-  if (tlsKey) args.push("--tls-key", tlsKey);
-  return args;
-}
-
-/** Builds the platform command that starts the hidden tray worker. */
-export function buildTrayLaunch({ platform, execPath, cliPath, workerArgs, label }) {
-  if (platform === "darwin") {
-    return {
-      command: "launchctl",
-      args: ["submit", "-l", label, "--", execPath, cliPath, ...workerArgs],
-      options: { stdio: "ignore" },
-    };
-  }
-  return {
-    command: execPath,
-    args: [cliPath, ...workerArgs],
-    options: { detached: true, stdio: "ignore", windowsHide: true },
-  };
-}
-
-/** Returns an error for command modes that conflict with detached tray mode. */
-export function validateTrayOptions(opts) {
-  if (opts.trayWorker && (!opts.trayReadyPort || !opts.trayReadyToken)) {
-    return "tray worker requires readiness credentials";
-  }
-  if (!opts.tray || opts.trayWorker) return null;
-  if (opts.daemon) return "--tray cannot use --daemon";
-  if (opts.log) return "--tray cannot use --log";
-  if (opts.noRecovery || opts.recovery === false) return "--tray cannot use --no-recovery";
-  return null;
-}
-
-/** Creates a token-protected loopback server for tray worker readiness. */
-export async function createTrayReadinessServer(token) {
-  let markReady;
-  const ready = new Promise((resolve) => {
-    markReady = resolve;
-  });
-  const expected = Buffer.from(token);
-  const server = createServer((socket) => {
-    let data = "";
-    socket.setEncoding("utf8");
-    socket.on("data", (chunk) => {
-      data += chunk;
-      if (data.length > 256) socket.destroy();
-    });
-    socket.on("end", () => {
-      const received = Buffer.from(data);
-      if (received.length !== expected.length || !timingSafeEqual(received, expected)) {
-        socket.end("ERROR");
-        return;
-      }
-      socket.end("READY");
-      markReady();
-    });
-  });
-  await new Promise((resolve, reject) => {
-    server.once("error", reject);
-    server.listen(0, "127.0.0.1", resolve);
-  });
-  const address = server.address();
-  return {
-    port: address.port,
-    wait(timeoutMs) {
-      return new Promise((resolve, reject) => {
-        const timer = setTimeout(
-          () => reject(new Error("Tray worker did not become ready")),
-          timeoutMs
-        );
-        ready.then(() => {
-          clearTimeout(timer);
-          resolve();
-        });
-      });
-    },
-    close() {
-      server.close();
-    },
-  };
-}
-
-/** Notifies the parent process that the server and tray are ready. */
-export async function notifyTrayReady(port, token) {
-  await new Promise((resolve, reject) => {
-    const socket = connect({ host: "127.0.0.1", port }, () => socket.end(token));
-    let reply = "";
-    socket.setEncoding("utf8");
-    socket.on("data", (chunk) => {
-      reply += chunk;
-    });
-    socket.on("end", () => {
-      if (reply === "READY") resolve();
-      else reject(new Error("Tray readiness token was rejected"));
-    });
-    socket.on("error", reject);
-  });
-}
-
-/** Starts a detached tray worker and waits until its server and tray are ready. */
-export async function startDetachedTray(
-  { cliPath, port, maxRestarts, tlsCert, tlsKey, timeoutMs = 60000 },
-  { platform = process.platform, spawnProcess = spawn } = {}
-) {
-  const token = randomBytes(32).toString("hex");
-  const readiness = await createTrayReadinessServer(token);
-  const label = `com.omniroute.tray.${process.pid}.${Date.now()}`;
-  const workerArgs = buildTrayWorkerArgs({
-    port,
-    maxRestarts,
-    readyPort: readiness.port,
-    readyToken: token,
-    tlsCert,
-    tlsKey,
-  });
-  const launch = buildTrayLaunch({
-    platform,
-    execPath: process.execPath,
-    cliPath,
-    workerArgs,
-    label,
-  });
-  const child = spawnProcess(launch.command, launch.args, launch.options);
-  const spawnFailure = new Promise((_, reject) => {
-    child.once("error", reject);
-    child.once("exit", (code) => {
-      if (platform !== "darwin" || code !== 0) {
-        reject(new Error(`Tray worker exited before readiness with code ${code ?? "unknown"}`));
-      }
-    });
-  });
-  if (platform !== "darwin") child.unref?.();
-  try {
-    await Promise.race([readiness.wait(timeoutMs), spawnFailure]);
-    return { platform, pid: child.pid, label: platform === "darwin" ? label : null };
-  } catch (err) {
-    if (platform === "darwin") {
-      try {
-        execFileSync("launchctl", ["bootout", `gui/${process.getuid()}/${label}`], {
-          stdio: "ignore",
-        });
-      } catch {}
-    } else if (platform === "win32" && child.pid) {
-      try {
-        execFileSync("taskkill", ["/PID", String(child.pid), "/T", "/F"], { stdio: "ignore" });
-      } catch {}
-    } else if (child.pid) {
-      try {
-        process.kill(child.pid, "SIGTERM");
-      } catch {}
-    }
-    throw err;
-  } finally {
-    readiness.close();
-  }
-}

bin/cli/tray/traySystray.mjs

@@ -97,7 +97,9 @@ export async function initSystrayUnix(
     }
   });
 
-  await tray.ready();
+  tray.ready().catch((err) => {
+    process.stderr.write(`[omniroute][tray] systray2 failed: ${err?.message ?? String(err)}\n`);
+  });
 
   return tray;
 }

bin/cli/tui/ProvidersTestAll.jsx

@@ -1,7 +1,6 @@
 import React, { useState, useEffect, useCallback } from "react";
 import { render, Box, Text, useInput } from "ink";
 import Spinner from "ink-spinner";
-import { apiFetch } from "../api.mjs";
 import { DataTable } from "../tui-components/DataTable.jsx";
 import { ProgressBar } from "../tui-components/ProgressBar.jsx";
 
@@ -32,20 +31,22 @@ const TABLE_SCHEMA = [
   { key: "error", header: "Error", width: 28, formatter: (v) => (v ? v.slice(0, 26) : "") },
 ];
 
-async function testOne(connectionId, model, baseUrl, apiKey) {
+async function testOne(provider, model, baseUrl, apiKey) {
+  const headers = {
+    "Content-Type": "application/json",
+    ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
+  };
   const start = Date.now();
   try {
-    const res = await apiFetch(`/api/providers/${encodeURIComponent(connectionId)}/test`, {
+    const res = await fetch(`${baseUrl}/api/v1/providers/test`, {
       method: "POST",
-      body: model ? { validationModelId: model } : {},
-      baseUrl,
-      token: apiKey,
-      timeout: 30000,
-      acceptNotOk: true,
+      headers,
+      body: JSON.stringify({ provider, model }),
+      signal: AbortSignal.timeout(30000),
     });
     const latencyMs = Date.now() - start;
-    const data = res.ok ? await res.json() : { valid: false, error: `HTTP ${res.status}` };
-    return { status: data.valid ? STATUS.PASS : STATUS.FAIL, latencyMs, error: data.error };
+    const data = res.ok ? await res.json() : { success: false, error: `HTTP ${res.status}` };
+    return { status: data.success ? STATUS.PASS : STATUS.FAIL, latencyMs, error: data.error };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     return {
@@ -62,7 +63,6 @@ function ProvidersTestAllApp({ providers, baseUrl, apiKey, concurrency = 4, onEx
   const [rows, setRows] = useState(() =>
     providers.map((p, i) => ({
       id: i,
-      connectionId: p.connectionId ?? p.id,
       provider: p.provider ?? p.id ?? String(p),
       model: p.model ?? p.defaultModel ?? "",
       status: STATUS.PENDING,
@@ -91,7 +91,7 @@ function ProvidersTestAllApp({ providers, baseUrl, apiKey, concurrency = 4, onEx
           const row = queue[cursor++];
           running++;
           update(row.id, { status: STATUS.RUNNING });
-          testOne(row.connectionId, row.model, resolved, apiKey).then((result) => {
+          testOne(row.provider, row.model, resolved, apiKey).then((result) => {
             update(row.id, result);
             running--;
             nextSlot();

bin/cli/utils/cliToken.mjs

@@ -12,39 +12,25 @@ function getActiveSalt() {
   return process.env.OMNIROUTE_CLI_SALT || BUILTIN_DEFAULT_SALT;
 }
 
-export function deriveCliToken(machineIdModule, salt) {
+export async function getCliToken() {
+  const salt = getActiveSalt();
+  if (_cached !== null && _cachedSalt === salt) return _cached;
   try {
     // node-machine-id is CommonJS: under `await import()` its exports land on
     // `.default`, so destructuring `machineIdSync` off the namespace yields
     // undefined and calling it throws — which the catch below turned into an
     // empty token, silently disabling CLI auth for every management request.
     // Same resolution order as src/lib/machineToken.ts.
-    const machineIdSync =
-      machineIdModule?.machineIdSync || machineIdModule?.default?.machineIdSync;
-    if (typeof machineIdSync !== "function") return "";
+    const mod = await import("node-machine-id");
+    const machineIdSync = mod.machineIdSync ?? mod.default?.machineIdSync;
+    if (typeof machineIdSync !== "function") throw new Error("machine-id API unavailable");
     // machineIdSync(true) returns the original unhashed hardware ID — mirrors
     // getMachineTokenSync() in src/lib/machineToken.ts (#10148 cliToken hardening).
-    const rawId = machineIdSync(true);
-    if (!rawId) return "";
-    return crypto.createHmac("sha256", rawId).update(salt).digest("hex");
-  } catch {
-    return "";
-  }
-}
-
-export async function getCliToken() {
-  const salt = getActiveSalt();
-  if (_cached !== null && _cachedSalt === salt) return _cached;
-  try {
-    const imported = await import("node-machine-id");
-    const token = deriveCliToken(imported, salt);
-    if (!token) {
-      // Swallowing here changes control flow (every management call goes out
-      // unauthenticated and 401s), so leave a breadcrumb rather than failing mute.
-      console.debug("[CLI_TOKEN] machine-id resolution failed, CLI auth disabled");
-    }
-    _cached = token;
+    const mid = machineIdSync(true);
+    _cached = crypto.createHmac("sha256", mid).update(salt).digest("hex");
   } catch (e) {
+    // Swallowing here changes control flow (every management call goes out
+    // unauthenticated and 401s), so leave a breadcrumb rather than failing mute.
     console.debug("[CLI_TOKEN] machine-id resolution failed, CLI auth disabled:", e);
     _cached = "";
   }

bin/cli/utils/ensureAndroidCacheDir.mjs

@@ -94,15 +94,10 @@ export function ensureAndroidCacheDir(options = {}) {
  */
 export function isFatalInstrumentationHookFailure(text) {
   if (!text) return false;
-  // Next.js wraps ANY throw inside instrumentation.register() with the generic
-  // "An error occurred while loading instrumentation hook:" prefix, on every
-  // platform (node_modules/next/dist/server/web/globals.js). That prefix alone
-  // therefore cannot identify the Android/Termux cache-probe failure — a bare
-  // generic instrumentation error on win32/desktop would be misreported as the
-  // Android bug and hide the real cause. Only match when the text actually
-  // carries the Android platform marker that Next's getCacheDirectory() emits.
-  // #10028
-  return /Unsupported platform:\s*android/i.test(text);
+  return (
+    /Unsupported platform:\s*android/i.test(text) ||
+    /error occurred while loading instrumentation hook/i.test(text)
+  );
 }
 
 /**

bin/cli/utils/pid.mjs

@@ -102,7 +102,7 @@ export async function waitForServer(port, timeout = 60000) {
 // - "not-listening": nothing is accepting connections on the port at all.
 async function pollHealthOnce(port) {
   try {
-    const res = await fetch(`http://127.0.0.1:${port}/api/monitoring/health`, {
+    const res = await fetch(`http://localhost:${port}/api/monitoring/health`, {
       signal: AbortSignal.timeout(2000),
     });
     return res.ok ? "ready" : "fast-reject";

bin/cli/utils/serverHost.mjs

@@ -24,34 +24,3 @@ export function resolveServerHost(
   }
   return "0.0.0.0";
 }
-
-const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
-
-/**
- * Boot-time exposure warning (GHSA-wmgv-ph3p-rv57): the shipped default binds
- * all interfaces while the inference plane requires no credentials, so any
- * LAN peer can spend the operator's quota. That local-first posture is a
- * deliberate, documented default — but it must be LOUD at startup so an
- * operator who never read the docs still learns the two escape hatches.
- *
- * Returns the warning text when the server will listen on a non-loopback
- * interface with no API-key requirement, or null when the exposure is closed.
- *
- * @param {NodeJS.ProcessEnv} [env]
- * @param {string} [host]
- * @returns {string | null}
- */
-export function resolveExposureWarning(env = process.env, host = resolveServerHost(env)) {
-  if (LOOPBACK_HOSTS.has(host)) return null;
-  const requireKey = String(env.REQUIRE_API_KEY || "")
-    .trim()
-    .toLowerCase();
-  if (requireKey === "true" || requireKey === "1" || requireKey === "yes") return null;
-  return (
-    `SECURITY: listening on ${host} with NO API-key requirement — the inference ` +
-    `plane (/v1/*) is reachable by ANY device that can route to this host, and ` +
-    `requests are billed to your configured providers. This local-first default ` +
-    `is intentional, but on an untrusted network either set REQUIRE_API_KEY=true ` +
-    `or bind loopback with OMNIROUTE_SERVER_HOST=127.0.0.1.`
-  );
-}

bin/nodeRuntimeSupport.mjs

@@ -44,18 +44,6 @@ export function getSecureFloorForMajor(major) {
 }
 
 export function getNodeRuntimeSupport(version = process.versions.node) {
-  if (process.versions.bun) {
-    return {
-      nodeVersion: `bun-${process.versions.bun} (Node.js API ${version})`,
-      nodeCompatible: true,
-      reason: "supported-bun",
-      supportedRange: SUPPORTED_NODE_RANGE + " || Bun >=1.1.0",
-      supportedDisplay: SUPPORTED_NODE_DISPLAY + ", or Bun 1.1+",
-      recommendedVersion: `v${RECOMMENDED_NODE_VERSION}`,
-      minimumSecureVersion: null,
-    };
-  }
-
   const parsed = parseNodeVersion(version);
   const secureFloor = getSecureFloorForMajor(parsed.major);
   const nodeCompatible = secureFloor ? compareNodeVersions(parsed, secureFloor) >= 0 : false;

bin/omniroute.mjs

@@ -17,12 +17,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-let updateNotifier = null;
-try {
-  updateNotifier = (await import("update-notifier")).default;
-} catch {
-  // update-notifier is optional in pruned standalone environments
-}
+import updateNotifier from "update-notifier";
 import { isNativeBinaryCompatible } from "../scripts/build/native-binary-compat.mjs";
 import { getNodeRuntimeSupport, getNodeRuntimeWarning } from "./nodeRuntimeSupport.mjs";
 import { getDefaultDataDir } from "./cli/data-dir.mjs";
@@ -124,9 +119,6 @@ function loadEnvFile() {
     addEnvPath(join(ROOT, ".env"));
   }
 
-  const keyOrigin = new Map();
-  const shadowed = new Map();
-
   for (const envPath of envPaths) {
     try {
       if (existsSync(envPath)) {
@@ -139,31 +131,19 @@ function loadEnvFile() {
             const key = trimmed.slice(0, eqIdx).trim();
             if (process.env[key] === undefined) {
               process.env[key] = parseEnvValue(trimmed.slice(eqIdx + 1));
-              keyOrigin.set(key, envPath);
-            } else if (!shadowed.has(key)) {
-              // The line is inert: something set this key first. Report it once
-              // per key, whether the winner was an earlier file or the process
-              // environment (#6194: a shell's own HOSTNAME beat the .env and the
-              // server bound to the wrong address in silence).
-              shadowed.set(key, { winner: keyOrigin.get(key) ?? null, loser: envPath });
             }
           }
         }
         loadedEnvPaths.push(envPath);
       }
-    } catch (err) {
-      console.warn(`  \x1b[33m⚠ Could not read ${envPath}: ${err?.message ?? err}\x1b[0m`);
+    } catch {
+      // Ignore errors reading env files.
     }
   }
 
   for (const envPath of loadedEnvPaths) {
     console.log(`  \x1b[2m📋 Loaded env from ${envPath}\x1b[0m`);
   }
-
-  for (const [key, { winner, loser }] of shadowed) {
-    const setter = winner ? winner : "the environment";
-    console.warn(`  \x1b[33m⚠ ${key} in ${loser} is ignored, ${setter} set it first\x1b[0m`);
-  }
 }
 
 loadEnvFile();
@@ -256,9 +236,8 @@ if (shouldProvisionStorageKey(process.argv)) {
 
 // Register update notifier — checks npm once per 24h, notifies on exit via stderr.
 const _pkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8"));
-const _notifier = updateNotifier ? updateNotifier({ pkg: _pkg, updateCheckInterval: 1000 * 60 * 60 * 24 }) : null;
+const _notifier = updateNotifier({ pkg: _pkg, updateCheckInterval: 1000 * 60 * 60 * 24 });
 process.on("exit", () => {
-  if (!_notifier || !_notifier.update) return;
   if (process.env.OMNIROUTE_NO_UPDATE_NOTIFIER) return;
   if (process.env.CI) return;
   if (process.argv.includes("--quiet") || process.argv.includes("-q")) return;

changelog.d/features/10303-healthz-event-loop-lag.md

@@ -1 +0,0 @@
-- **feat(resilience):** warn when `/healthz` is served under event-loop lag ≥200ms so a slow 200 is visible as sick, not healthy ([#10303](https://github.com/diegosouzapw/OmniRoute/issues/10303))

changelog.d/features/10316-livez-endpoint.md

@@ -1 +0,0 @@
-- **feat(docker):** add `GET`/`HEAD` `/livez` as a process-alive probe, distinct from `/healthz` readiness ([#10316](https://github.com/diegosouzapw/OmniRoute/issues/10316))

changelog.d/features/10587-ogg-speech-alias.md

@@ -1 +0,0 @@
-- **feat(providers):** accept `response_format=ogg` on `/v1/audio/speech` as an alias for the existing Opus/Ogg encoder ([#10587](https://github.com/diegosouzapw/OmniRoute/issues/10587))

changelog.d/features/10662-systemd-notify.md

@@ -1 +0,0 @@
-- feat(server): emit systemd sd_notify READY/WATCHDOG/STOPPING (generated unit becomes Type=notify with WatchdogSec=180) so a frozen server process is killed and restarted by systemd instead of lingering undetected

changelog.d/features/10668-newapi-gateway-protocols.md

@@ -1,2 +0,0 @@
-- **feat(providers):** add the TabiToken NewAPI gateway (`tabitoken`) and teach the existing HCNSec entry (`hcnsec`) the three further protocols it actually serves. TabiToken leaves the NewAPI pricing endpoint public, so its catalog is read from the host rather than guessed: four Claude models, each reporting the Anthropic and OpenAI protocols. HCNSec shipped OpenAI-only; probing the host showed `/v1/messages`, `/v1/responses` and the Gemini `/v1beta` path all reach its token layer, so each is now declared as an alternate format — with its default format, base URL, auth scheme and regional catalog classification untouched. ([#10668](https://github.com/diegosouzapw/OmniRoute/pull/10668)) — thanks @yawar-aquil
-- **feat(sse):** allow an alternate protocol to build its own upstream URL. `AlternateFormat` gained an optional `urlBuilder`, because the Gemini protocol carries the model inside the path (`{base}/{model}:generateContent`) and the existing `chatPath`/`urlSuffix` fields are constants that cannot express it. The route builder is extracted as `buildGeminiGenerateContentUrl` and shared with the native `gemini` provider so the two consumers cannot drift on the `?alt=sse` streaming suffix. ([#10668](https://github.com/diegosouzapw/OmniRoute/pull/10668)) — thanks @yawar-aquil

changelog.d/features/10670-call-logs-error-type.md

@@ -1 +0,0 @@
-- **feat(call_logs):** persist the per-call error family in `call_logs.error_type` and expose a failure breakdown (`errorBreakdown`) in the usage analytics endpoint, reusing the existing production classifier ([#10670](https://github.com/diegosouzapw/OmniRoute/issues/10670))

changelog.d/features/10677-egress-sharing-summary.md

@@ -1 +0,0 @@
-- **feat(proxy):** the proxy-health sweep and `GET /api/settings/proxies/egress` now report an anonymous summary of egress-IP sharing — how many rotation groups share an egress IP and the largest number of accounts behind one IP — computed from persisted `proxy_logs` over a 24h window. No IPs and no account identities by default; `PROXY_LOG_INCLUDE_IPS=true` restores raw details. ([#10677](https://github.com/diegosouzapw/OmniRoute/issues/10677))

changelog.d/features/10697-vscode-copilot-guide.md

@@ -1 +0,0 @@
-- **docs(guides):** OmniRoute now serves VS Code's **native Copilot Chat model picker** through the [OmniCopilot](https://github.com/diegosouzapw/OmniCopilot) extension ([Marketplace](https://marketplace.visualstudio.com/items?itemName=diegosouzapw.omnicopilot) · [Open VSX](https://open-vsx.org/extension/diegosouzapw/omnicopilot) — Cursor, Windsurf, VSCodium, Theia…) — no Copilot subscription needed since VS Code 1.122. New [`docs/guides/VSCODE-COPILOT.md`](docs/guides/VSCODE-COPILOT.md) covers setup, how the picker collapses the `dual`-prefix catalog via `GET /v1/models?prefix=alias`, and the **build-time** `DASHBOARD_ALLOW_EMBED=vscode` flag that renders the dashboard in an editor tab ([#10697](https://github.com/diegosouzapw/OmniRoute/pull/10697))

changelog.d/features/10701-dockerfile-dashboard-embed-arg.md

@@ -1 +0,0 @@
-- **feat(docker):** `DASHBOARD_ALLOW_EMBED` is now a Docker build argument — `docker build --build-arg DASHBOARD_ALLOW_EMBED=vscode` produces an image whose dashboard renders inside the VS Code Simple Browser (OmniCopilot's `dashboardOpen: "editor"`). Previously the flag was only reachable from a source build: Docker silently drops a `--build-arg` with no matching `ARG`, so the operator got the default image and no error. Builder-stage only and empty by default — the runtime stages deliberately do not carry it, and the unframable default posture is unchanged ([#10701](https://github.com/diegosouzapw/OmniRoute/pull/10701))

changelog.d/features/10729-cursor-api-key-and-cli-passthrough.md

@@ -1 +0,0 @@
-- **feat(providers):** new `cursor-api` provider (card "Cursor API", alias `cua`): connect a Cursor user API key (`crsr_…`) and route `cursor-api/<model>` through the existing Cursor agent executor (the key is exchanged for a 1h session token and cached), plus a `/api/cursor-cli/*` passthrough so the Cursor CLI itself runs through OmniRoute (`CURSOR_API_ENDPOINT=http://<omniroute>/api/cursor-cli`, `CURSOR_API_KEY=<OmniRoute key>`) with every RPC attributed and logged. The IDE `cursor` provider is unchanged. (#10729)

changelog.d/features/10771-health-root-endpoint.md

@@ -1 +0,0 @@
-- **feat(api):** `GET /api/health` now answers `{ status, timestamp }` without a key. Until now the path had no route, so the management-auth boundary answered first with a 401 — indistinguishable from a wrong key or an unknown route, which left Docker HEALTHCHECKs and Kubernetes probes unable to tell "down" from "misconfigured". Kept deliberately minimal: version, uptime and memory stay behind the authenticated `/api/monitoring/health` ([#PRNUM](https://github.com/diegosouzapw/OmniRoute/pull/10771)).

changelog.d/features/10783-task-routing-configurable-patterns.md

@@ -1 +0,0 @@
-- feat(routing): make Task-Aware Smart Routing's detection patterns operator-configurable via `settings.taskRouting.patternOverrides` (`PUT /api/settings/task-routing`) — the built-in patterns are English-only, so a non-English dashboard had no recourse short of turning detection off entirely; an override now replaces the pattern list for one task type without touching the rest (#10783)

changelog.d/features/10869-combo-patch-verb.md

@@ -1 +0,0 @@
-- feat(api): accept PATCH on /api/combos/[id], the verb the OpenAPI spec already documents (#10869)

changelog.d/features/10896-glm-5.3.md

@@ -1 +0,0 @@
-- **feat(sse):** add GLM-5.3 support (`glm-5.3`, `glm-5.3-high`, `glm-5.3-low`) across the z.ai first-party providers, mapping the upstream `reasoning_effort` request parameter to the existing 5.2 tier UX ([#10896](https://github.com/diegosouzapw/OmniRoute/pull/10896)) — thanks @phuongddx

changelog.d/features/10897-home-recent-requests.md

@@ -1 +0,0 @@
-- **feat(home):** add a live **Recent Requests** panel beside the home Provider Topology (polls `GET /api/usage/call-logs?excludeTests=1` every ~3s, gated by the topology appearance toggle + page visibility). `excludeTests` is now an allowlist of real provider inference (`/v1/%` or `/api/v1/%`), applied before `LIMIT`, so connection-test/model-sync/management rows can never leak into the feed ([#10897](https://github.com/diegosouzapw/OmniRoute/pull/10897), extracted from [#8450](https://github.com/diegosouzapw/OmniRoute/pull/8450)) — thanks @nguyenha935

changelog.d/features/10909-free-provider-rankings-reliability.md

@@ -1 +0,0 @@
-- **feat(rankings):** free provider rankings now expose a `reliability` field (raw `testStatus`/`rateLimitedUntil` per connection plus a `healthy`/`degraded`/`down` state, reusing the `ProviderHealthState` vocabulary of the provider health matrix) when the configured/available filters are active — derived from already-loaded data, without touching the ranking order ([#10909](https://github.com/diegosouzapw/OmniRoute/pull/10909))

changelog.d/features/10920-egress-ip-lock.md

@@ -1,8 +0,0 @@
-- `feat(resilience)`: when an allowlisted provider (opencode family) answers
-  429 classified `quota_exhausted` or `rate_limit_exceeded` and its free-tier
-  quota is bucketed by egress IP (#9611), every connection of that family
-  sharing the IP is cooled down together before the rotation tries them — one
-  guaranteed-failed upstream call per episode instead of N, on the combo path
-  as well. For the allowlisted family a 429 now cools the connection instead
-  of locking a single model. Exclusive allowlist, never terminal, best-effort
-  when the egress IP is unknown (#10920).

changelog.d/features/10926-rankings-usage-reliability.md

@@ -1 +0,0 @@
-- **feat(rankings):** free provider rankings can now report what each provider actually served — `reliability.usage` (requests, successes, success rate over a window) behind the opt-in `withUsage`/`usageRange` query parameters, so a provider that answers every call with an error is no longer described as healthy ([#10926](https://github.com/diegosouzapw/OmniRoute/pull/10926))

changelog.d/features/10987-logfare-free-provider.md

@@ -1 +0,0 @@
-- **feat(providers):** add Logfare as a free OpenAI-compatible provider — dashboard card with a Free badge and request-logging disclosure (every prompt/completion is logged for research; opt out at logfare.ai/consent), live model discovery from `https://logfare.ai/v1/models` (20 models, 11 chat-capable: kimi-k3, deepseek-v4-pro, glm-5.2, gpt-5.6-luna, minimax-m3…), full chat/streaming through the existing OpenAI-compatible path, the real Logfare logo on the card, and a listing in the free-tiers guide. ([#10987](https://github.com/diegosouzapw/OmniRoute/pull/10987))

changelog.d/features/11104-operator-error-rules.md

@@ -1 +0,0 @@
-- **feat(providers):** let operators declare per-provider error rules through `settings.providerErrorRules` instead of patching the catalog — an operator-supplied rule for a provider is consulted before the built-in `providerRuleRegistry`, receives the raw error text, and has its declared scope/cooldown/reason actually honored end to end, for any provider (declaring the rule is the opt-in — no extra allowlist entry needed). Matches are plain case-insensitive substrings (never RegExp) and bounded to 50 rules to keep the hot path safe ([#11104](https://github.com/diegosouzapw/OmniRoute/pull/11104))

changelog.d/features/11134-configurable-max-global-attempts.md

@@ -1 +0,0 @@
-- **feat(combo):** the shared per-request combo attempt budget is now operator-configurable via `maxGlobalAttempts` (combo config / `comboDefaults` cascade), instead of the hardcoded 30. Lower it to fail fast on a dead target pool, raise it for large combos; clamped to `[1, 200]` so an unbounded budget can never cause runaway background requests ([#11134](https://github.com/diegosouzapw/OmniRoute/issues/11134))

changelog.d/features/11190-usage-command-json.md

@@ -1 +0,0 @@
-- **feat(api):** `/api/usage/om-usage` gains a structured form — `?format=json` returns the key's own usage as `ApiKeyUsageLimitStatus` + `UsageSnapshot` instead of `text/plain`. This is the surface a UI (the OmniCopilot panel) consumes to show a key holder their daily/weekly spend and quota reset. The route is self-service (the caller's own key, gated by `allowUsageCommand`), not the management surface; refusals come back as a discriminated `{ "allowed": false, "error": … }` so a UI can tell "not allowed" apart from "allowed but nothing cached yet". The endpoint was previously undocumented in `API_REFERENCE.md`; it now has a section ([#11190](https://github.com/diegosouzapw/OmniRoute/pull/11190))

changelog.d/features/11192-usage-command-providers-array.md

@@ -1 +0,0 @@
-- **feat(api):** `/api/usage/om-usage?format=json` now returns `providers[]` — every connection's quota snapshot, not just the single selected one — so a panel can render Codex / Claude / OpenCode side by side. The collector already gathered all of them; the single-pick `provider` field (kept) is a terminal presentation choice. Closes the per-connection gap from OmniCopilot #8 ([#11192](https://github.com/diegosouzapw/OmniRoute/pull/11192))

changelog.d/features/11251-connection-max-wait-ms-override.md

@@ -1 +0,0 @@
-- **feat(providers):** allow overriding the rate-limit queue wait timeout (`maxWaitMs`) per connection, alongside the existing `rpm`/`tpm`/`tpd`/`minTime`/`maxConcurrent` overrides — a single slow provider no longer has to lower the global wait budget for every other provider (#11251)

changelog.d/features/11282-first-run-readiness-card.md

@@ -1 +0,0 @@
-- **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282))

changelog.d/features/11283-traffic-inspector-purpose-header.md

@@ -1 +0,0 @@
-- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283))

changelog.d/features/11286-essentials-sidebar-preset.md

@@ -1 +0,0 @@
-- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286))

changelog.d/features/8443-credential-health-per-connection-interval.md

@@ -1,2 +0,0 @@
-- **feat(credential-health):** pace the credential health sweep per connection via `provider_connections.healthCheckInterval` (minutes, 0 = never), with `CREDENTIAL_HEALTH_CHECK_INTERVAL` as the global default ([#8443](https://github.com/diegosouzapw/OmniRoute/issues/8443))
-- **behavior change:** `healthCheckInterval` is a shared column — it paces both the OAuth token refresh and the credential health sweep, and `0` disables both. The connection editor defaults it to 60, so configured OAuth connections are now credential-checked at 60min instead of the previous ~10min (aligned with the probe-volume goal of #8443)

changelog.d/features/command-code-reasoning-efforts.md

@@ -1 +0,0 @@
-- feat(command-code): advertise low/medium/high/xhigh/max reasoning-effort suffixes for reasoning-capable models in the catalog and Combo Builder, with request-time resolution to reasoning_effort

changelog.d/features/cursor-agent-image-provider.md

@@ -1 +0,0 @@
-- feat(sse): add Cursor plan image generation via Agent CLI (`IMAGE_PROVIDERS.cursor`, format `cursor-agent-image`), reusing the chat Cursor OAuth connection

changelog.d/features/disable-context-window-checks.md

@@ -1 +0,0 @@
-- feat(routing): add the default-off `DISABLE_CONTEXT_WINDOW_CHECKS` feature flag to let operators bypass OmniRoute's local context-window and max-input-token check for direct single-model requests, leaving upstream limits, prompt compression, and output-token caps intact.

changelog.d/features/effort-tiers-loop-learned-sets.md

@@ -1 +0,0 @@
-- **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path (related to #7694, builds on #11232)

changelog.d/features/kimi-coding-extra-usage.md

@@ -1 +0,0 @@
-- **feat(usage):** show Kimi Coding's fixed-order Code 5-hour/7-day quota windows plus Extra Usage status, balance, monthly spend/limit, and the official Additional Credits link on Dashboard → Quota cards.

changelog.d/features/m365-copilot-tool-calls.md

@@ -1 +0,0 @@
-- **feat(providers):** copilot-m365-web now supports OpenAI tool calling — a router planning turn asks the substrate model (as a tool-selection assistant emitting `CALL_TOOL: name({...})` / `NO_TOOL_NEEDED` text, which bypasses its plugin-registry refusal) and validated decisions surface as `tool_calls` with `finish_reason: "tool_calls"` in both stream and non-stream modes; also flattens the full message history (assistant `tool_calls` + compacted tool results) so multi-turn agent loops keep context, replies to SignalR `type:6` keepalives, surfaces `type:3` error frames instead of a silent empty `stop`, and suppresses `writeAtCursor` text from tool-progress frames

changelog.d/features/opencode-go-muse-spark-efforts.md

@@ -1 +0,0 @@
-- feat(opencode-go): expose Muse Spark 1.2 Contributor reasoning-effort aliases (minimal/low/medium/high/xhigh) in the Combo Builder

changelog.d/features/per-connection-upstream-timeout.md

@@ -1 +0,0 @@
-- **feat(providers):** restore the operator-owned upstream timeout tier per connection via `providerSpecificData.timeoutMs` (preempts the maintainer-only model/provider registry tiers and the global `FETCH_TIMEOUT_MS`), and make the combo per-target timeout ceiling follow the selected connection

changelog.d/features/unreleased-detached-cli-tray.md

@@ -1 +0,0 @@
-- **feat(cli):** run `omniroute serve --tray` as a detached desktop process after server and tray readiness, with graphical login auto-start support.

changelog.d/fixes/10028-windows-instrumentation-hook.md

@@ -1 +0,0 @@
-- fix(cli): stop diagnosing every Next.js instrumentation-hook failure as the Android/Termux cache bug — only the Android "Unsupported platform: android" signal now triggers the Android hint, so a win32/desktop instrumentation error surfaces its real cause instead of a useless `mkdir -p ~/.cache` (#10028)

changelog.d/fixes/10060-build-sqlite-native-addon-guard.md

@@ -1 +0,0 @@
-- **fix(build):** stop the native `better-sqlite3` addon from loading during the Next.js production build (#10060). Its `Statement` destructor aborts with `SIGABRT` when a build worker thread exits (assertion in `node::RemoveEnvironmentCleanupHook`, `env == nullptr`), which can leave the build with no standalone bundle. Every DB entry point now keys off a reliable `OMNIROUTE_BUILDING=1` signal (set by `build-next-isolated.mjs` and inherited by every spawned build worker, because Next.js workers sometimes drop `NEXT_PHASE`): `getDbInstance()` returns a no-op SQLite stub during build, `driverFactory` skips the native driver and falls through to `node:sqlite`, and the `codegraph`/`kiro-import` lazy loaders fail closed. A build-time `better-sqlite3` alias to a stub (`next.config.mjs`, turbopack) backs this up without changing runtime behaviour (the real package is still `require()`d natively via `serverExternalPackages`). Also raises the default build heap 4096→6144 MB and caps Next build worker pools (`CIRCLE_NODE_TOTAL=8`) to avoid the many-core page-data-collection SIGSEGV, and adds `.gitattributes` (`*.sh text eol=lf`) so kernel-exec'd shell scripts never ship with CRLF shebangs. Deliberately does NOT downgrade the Node base image: per the maintainer's review on #10060, `release/v3.8.50` moved to `node:26-trixie-slim` through several considered commits, so the `OMNIROUTE_BUILDING` guard is re-derived against the current base rather than reverting the FROM line; the npm pin and binary-hide dance from the original PR are dropped because our build already rebuilds `better-sqlite3` deterministically via `node-gyp` and floats `npm@latest` for the CVE overlay.

changelog.d/fixes/10071-g4f-space-anonymous-tier-proof-of-work.md

@@ -1 +0,0 @@
-- **fix(providers):** the five g4f.space sub-providers (Groq, Gemini, Pollinations, Ollama, NVIDIA) no longer advertise a free tier — a keyless `POST /v1/chat/completions` now returns `402 insufficient_credits` behind a proof-of-work "cake" wall (re-verified live 2026-08-22), so `hasFree` is `false` and the notes point at `g4f.dev/members.html`. The gateway still works with a member key, so its registry wiring and `authType: "optional"` are unchanged ([#10071](https://github.com/diegosouzapw/OmniRoute/issues/10071)) — thanks @chirag127

changelog.d/fixes/10095-antigravity-multiaccount-quota-false-exhaustion.md

@@ -1 +0,0 @@
-- fix(domain): stop treating an unreported Antigravity quota fraction (`fractionReported:false`) as 0% remaining in `quotaCache.ts`, which was falsely marking every fresh/newly-connected account as exhausted and blocking multi-account rotation (#10095)

changelog.d/fixes/10156-responses-commentary-completed-snapshot.md

@@ -1 +0,0 @@
-- **fix(sse):** Responses-passthrough `response.completed` snapshots now drop `phase:"commentary"` items the same way live SSE frames already do, so the terminal `response.output` array no longer echoes internal commentary text that was already suppressed from the stream (#10156).