docs(auth): dashboard session = verified JWT + authenticated claim

Refs #13298

.env.example

@@ -3070,6 +3070,11 @@ QUOTA_STORE_DRIVER=sqlite
 # Telegram Mini App bridge. The update endpoint remains disabled while the bot
 # token is unset. Used by: src/lib/telegram/* and src/app/api/telegram/update/route.ts.
 # TELEGRAM_BOT_TOKEN=
+# Shared secret registered with setWebhook and echoed back by Telegram as the
+# X-Telegram-Bot-Api-Secret-Token header. REQUIRED for the webhook path: without
+# it the webhook is rejected with 503, because an unauthenticated update lets any
+# caller mint API keys and spend upstream quota. The Mini App path does not use it.
+# TELEGRAM_WEBHOOK_SECRET=
 # TELEGRAM_DEFAULT_MODEL=auto/chat
 # TELEGRAM_BOT_API_BASE=https://api.telegram.org
 # TELEGRAM_WEBHOOK_TIMEOUT_MS=60000

@omniroute/opencode-plugin-v2/src/cache.ts

@@ -10,6 +10,7 @@ import type {
   OmniRouteRawCombo,
   OmniRouteRawModelEntry,
 } from "./shared/index.js";
+import { isHttpUrl } from "./shared/index.js";
 
 export const DEFAULT_MODEL_CACHE_TTL_MS = 300_000 as const;
 
@@ -34,8 +35,9 @@ export const SNAPSHOT_FORMAT_VERSION = 2 as const;
 
 /**
  * A raw snapshot entry is stale when it cannot be mapped to a publishable
- * model: no string `id` (unroutable) or a pre-mapped `api` block without a
- * valid `npm` package (the runner would reject it as `Unsupported package`).
+ * model: no string `id` (unroutable), or a pre-mapped `api` block missing a
+ * valid `npm` package (the runner would reject it as `Unsupported package`)
+ * or a usable `url` (the host would reach the AI SDK with no baseURL).
  * Plain `/v1/models` entries carry no `api` block -- it is synthesized at
  * publish time -- so only a present-but-invalid block drops the entry.
  */
@@ -47,7 +49,11 @@ export function isStaleSnapshotModel(entry: unknown): boolean {
   if (api === undefined) return false;
   if (!api || typeof api !== "object") return true;
   const npm = (api as { npm?: unknown }).npm;
-  return typeof npm !== "string" || npm.length === 0;
+  if (typeof npm !== "string" || npm.length === 0) return true;
+  // Same requirement as `npm`, and the same predicate the options schema
+  // applies to `baseURL`: a pre-mapped block without a callable `url` publishes
+  // a model the host cannot route -- see `legacyApiToInfoApi`.
+  return !isHttpUrl((api as { url?: unknown }).url);
 }
 
 interface DiskSnapshotV2 {
@@ -145,7 +151,7 @@ export async function readDiskSnapshot(
       (entry) => !isStaleSnapshotModel(entry)
     );
     if (stale > 0) {
-      logger?.warn(`[omniroute-v2] dropping ${stale} stale snapshot entries without api block`);
+      logger?.warn(`[omniroute-v2] dropping ${stale} stale snapshot entries with an unusable api block`);
     }
     if (models.length === 0) return undefined;
     return {

@omniroute/opencode-plugin-v2/src/catalog.ts

@@ -3,6 +3,7 @@ import { type HostContract, detectHostContract, emitsLegacyFields } from "./comp
 import type { Model as LegacyModelV2 } from "@opencode-ai/sdk/v2";
 import type { ModelV2Info, ProviderV2Info } from "@opencode-ai/sdk/v2/types";
 import {
+  isHttpUrl,
   type ApiFormatV2,
   type LogLevel,
   type Logger,
@@ -142,6 +143,15 @@ export function legacyApiToInfoApi(api: LegacyModelV2["api"]): ModelV2Info["api"
       "[omniroute-v2] refusing to publish a model without an api block (missing api.npm)"
     );
   }
+  // The host reads `api.url` in `prepareOptions` and never falls back to the
+  // provider's own, so a model published without one reaches the AI SDK with no
+  // baseURL and fails at call time with a bare `Invalid URL` — no request on the
+  // wire, nothing in the gateway logs, no model named.
+  if (!isHttpUrl(api.url)) {
+    throw new Error(
+      "[omniroute-v2] refusing to publish a model whose api block carries no http(s) url"
+    );
+  }
   return { id: api.id, type: "aisdk", package: api.npm, url: api.url };
 }
 

@omniroute/opencode-plugin-v2/src/options.ts

@@ -1,5 +1,7 @@
 import { z } from "zod";
 
+import { isHttpUrl } from "./shared/models-map.js";
+
 const apiFormatSchema = z
   .object({
     allowAnthropic: z.boolean().optional(),
@@ -28,7 +30,10 @@ const pluginOptionsSchema = z
       .regex(/^[A-Za-z0-9._-]+$/, "providerId may only contain letters, digits, '.', '_' and '-'")
       .refine((v) => v !== "." && v !== "..", "providerId cannot be a path segment")
       .default("omniroute"),
-    baseURL: z.string().url(),
+    baseURL: z
+      .string()
+      .trim()
+      .refine(isHttpUrl, "baseURL must be an http(s) URL, for example http://localhost:20128"),
     apiKey: z.string().optional(),
     displayName: z.string().optional(),
     managementReadToken: z.string().optional(),

@omniroute/opencode-plugin-v2/src/shared/models-map.ts

@@ -111,6 +111,22 @@ function trimTrailingSlashes(value: string): string {
  * (it appends `/v1/messages` automatically), so callers should branch on
  * format first.
  */
+/**
+ * A url the AI SDK can actually call. `new URL()` alone is not enough: it
+ * parses `localhost:20128` as the scheme `localhost:` and `ftp://host` as ftp,
+ * both of which reach `fetch` and fail there. Mirrors the `isHttpUrl` guard the
+ * settings schema applies to `headroomUrl`.
+ */
+export function isHttpUrl(value: unknown): boolean {
+  if (typeof value !== "string") return false;
+  try {
+    const { protocol } = new URL(value);
+    return protocol === "http:" || protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+
 export function ensureV1Suffix(url: string): string {
   const trimmed = trimTrailingSlashes(url);
   return trimmed.endsWith("/v1") ? trimmed : `${trimmed}/v1`;

@omniroute/opencode-plugin-v2/tests/options.test.ts

@@ -29,6 +29,38 @@ describe("parsePluginOptions", () => {
   it("requires baseURL", () => {
     assert.throws(() => parsePluginOptions({}), /baseURL/);
   });
+  it("rejects a baseURL that is not an http(s) URL", () => {
+    // `new URL()` reads "localhost:20128" as the scheme "localhost:" followed
+    // by a path, so a gateway address typed without "http://" parses. Every
+    // model would then be published with "localhost:20128/v1" as its api url
+    // and every call would fail in the client on an unknown scheme, with no
+    // request on the wire and nothing in the gateway logs.
+    for (const baseURL of [
+      "localhost:20128",
+      "localhost:20128/v1",
+      "ftp://gw.example.com/v1",
+      "gw.example.com/v1",
+    ]) {
+      assert.throws(
+        () => parsePluginOptions({ baseURL }),
+        /baseURL must be an http\(s\) URL/,
+        `expected ${baseURL} to be rejected`
+      );
+    }
+  });
+  it("accepts http and https baseURLs, with or without a port or path", () => {
+    for (const baseURL of [
+      "http://localhost:20128/v1",
+      "http://localhost:20128",
+      "https://gw.example.com/v1",
+      "https://gw.example.com/omniroute/v1",
+    ]) {
+      assert.equal(parsePluginOptions({ baseURL }).baseURL, baseURL);
+      // Padding a copied address is trimmed rather than rejected, matching the
+      // treatment `headroomUrl` already gets in the settings schema.
+      assert.equal(parsePluginOptions({ baseURL: `  ${baseURL}  ` }).baseURL, baseURL);
+    }
+  });
   it("rejects unknown top-level keys (strict)", () => {
     assert.throws(() => parsePluginOptions({ baseURL: "https://gw.example.com", bogus: 1 }));
   });

@omniroute/opencode-plugin-v2/tests/snapshot-stale-entries.test.ts

@@ -5,7 +5,11 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { createHash } from "node:crypto";
 import plugin from "../src/index.js";
-import { diskSnapshotPath, snapshotIdentityFingerprint } from "../src/cache.js";
+import {
+  diskSnapshotPath,
+  isStaleSnapshotModel,
+  snapshotIdentityFingerprint,
+} from "../src/cache.js";
 import { legacyApiToInfoApi } from "../src/catalog.js";
 
 function isolateDisk(): { dir: string; restore: () => void } {
@@ -97,7 +101,7 @@ function downFetch(): typeof fetch {
 const fingerprint = snapshotIdentityFingerprint("https://gw.example.com", "k-snapfix", "k-snapfix");
 
 describe("plugin-v2 snapshot stale-entry filter", () => {
-  it("snapshot with 2 entries without api block + 1 valid: only the valid one is published + warn emitted", async () => {
+  it("snapshot with 3 unusable pre-mapped entries + 1 valid: only the valid one is published + warn emitted", async () => {
     const disk = isolateDisk();
     const providerId = "snapfix-mixed";
     mkdirSync(join(disk.dir, "plugins"), { recursive: true });
@@ -106,11 +110,15 @@ describe("plugin-v2 snapshot stale-entry filter", () => {
       JSON.stringify({
         v: 2,
         identityFingerprint: fingerprint,
-        // Two pre-mapped entries with a broken api block (missing npm) plus
-        // one plain raw entry (no api block: synthesized at publish time).
+        // Three pre-mapped entries with an unusable api block — missing npm,
+        // empty npm, and a well-formed npm with no url (the shape a snapshot
+        // written by an older build carries, and the one that reaches the host
+        // as a bare `Invalid URL`) — plus one plain raw entry, which has no api
+        // block at all and gets one synthesized at publish time.
         models: [
           { id: "stale-a", api: {} },
           { id: "stale-b", api: { npm: "" } },
+          { id: "stale-c", api: { id: "openai-compatible", npm: "@ai-sdk/openai-compatible" } },
           { id: "good-1", context_length: 128000 },
         ],
         combos: [],
@@ -137,7 +145,7 @@ describe("plugin-v2 snapshot stale-entry filter", () => {
         );
       });
       assert.ok(
-        warns.some((w) => w.includes("dropping 2 stale snapshot entries without api block")),
+        warns.some((w) => w.includes("dropping 3 stale snapshot entries with an unusable api block")),
         `expected stale-drop warn, got: ${JSON.stringify(warns)}`
       );
     } finally {
@@ -216,4 +224,56 @@ describe("plugin-v2 snapshot stale-entry filter", () => {
     // Sanity: sha256 helper used above matches the plugin identity scheme.
     assert.equal(createHash("sha256").update("x").digest("hex").length, 64);
   });
+
+  it("legacyApiToInfoApi throws unless api.url is an http(s) url", () => {
+    const npm = "@ai-sdk/openai-compatible";
+    for (const api of [
+      { id: "openai-compatible", npm },
+      { id: "openai-compatible", npm, url: "" },
+      { id: "openai-compatible", npm, url: "   " },
+      // Non-empty but uncallable: the AI SDK reaches `fetch` and fails there.
+      { id: "openai-compatible", npm, url: "/v1" },
+      { id: "openai-compatible", npm, url: "gw.example.com/v1" },
+      { id: "openai-compatible", npm, url: "ftp://gw.example.com/v1" },
+    ]) {
+      assert.throws(
+        () => legacyApiToInfoApi(api as unknown as { id: string; npm: string; url: string }),
+        /api block carries no http\(s\) url/,
+        `expected a publish-time refusal for ${JSON.stringify(api)}`
+      );
+    }
+    // A complete block still publishes unchanged.
+    assert.deepEqual(
+      legacyApiToInfoApi({
+        id: "openai-compatible",
+        npm: "@ai-sdk/openai-compatible",
+        url: "https://gw.example.com/v1",
+      }),
+      {
+        id: "openai-compatible",
+        type: "aisdk",
+        package: "@ai-sdk/openai-compatible",
+        url: "https://gw.example.com/v1",
+      }
+    );
+  });
+
+  it("isStaleSnapshotModel drops a pre-mapped entry whose api.url is unusable", () => {
+    const npm = "@ai-sdk/openai-compatible";
+    // Present-but-unusable url: stale, for the same reason a missing npm is.
+    for (const url of [undefined, "", "   ", "/v1", "gw.example.com/v1", "ftp://gw/v1"]) {
+      assert.equal(
+        isStaleSnapshotModel({ id: "a/b", api: { id: "x", npm, ...(url === undefined ? {} : { url }) } }),
+        true,
+        `expected ${JSON.stringify(url)} to be treated as stale`
+      );
+    }
+    // Complete block: publishable.
+    assert.equal(
+      isStaleSnapshotModel({ id: "a/b", api: { id: "x", npm, url: "https://gw/v1" } }),
+      false
+    );
+    // No api block at all stays publishable: it is synthesized at publish time.
+    assert.equal(isStaleSnapshotModel({ id: "a/b" }), false);
+  });
 });

@omniroute/opencode-plugin/src/index.ts

@@ -220,7 +220,11 @@ const optionsSchema = z
      * to 60000. Default when unset: 300000.
      */
     autoSyncIntervalMs: z.number().int().nonnegative().optional(),
-    baseURL: z.string().url().optional(),
+    baseURL: z
+      .string()
+      .trim()
+      .refine(isHttpUrl, "baseURL must be an http(s) URL, for example http://localhost:20128")
+      .optional(),
     managementReadToken: z.string().min(1).optional(),
     features: featuresSchema.optional(),
   })
@@ -482,6 +486,22 @@ export const DEFAULT_ANTHROPIC_PREFIXES = ["cc", "claude", "anthropic", "kiro",
  * (it appends `/v1/messages` automatically), so callers should branch on
  * format first.
  */
+/**
+ * A url the AI SDK can actually call. `new URL()` alone is not enough: it
+ * parses `localhost:20128` as the scheme `localhost:` and `ftp://host` as ftp,
+ * both of which reach `fetch` and fail there. Mirrors the `isHttpUrl` guard the
+ * settings schema applies to `headroomUrl`.
+ */
+export function isHttpUrl(value: unknown): boolean {
+  if (typeof value !== "string") return false;
+  try {
+    const { protocol } = new URL(value);
+    return protocol === "http:" || protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+
 export function ensureV1Suffix(url: string): string {
   const trimmed = trimTrailingSlashes(url);
   return trimmed.endsWith("/v1") ? trimmed : `${trimmed}/v1`;

@omniroute/opencode-plugin/tests/options-schema.test.ts

@@ -59,6 +59,26 @@ test("parseOmniRoutePluginOptions: invalid baseURL (not a URL) → throws", () =
   assert.throws(() => parseOmniRoutePluginOptions({ baseURL: "not-a-url" }), /baseURL/i);
 });
 
+test("parseOmniRoutePluginOptions: baseURL without an http(s) scheme → throws", () => {
+  // `new URL()` reads "localhost:20128" as the scheme "localhost:" followed by
+  // a path, so the address parses and the models are published with an api url
+  // no client can call.
+  for (const baseURL of ["localhost:20128", "localhost:20128/v1", "ftp://or.example.com", "or.example.com"]) {
+    assert.throws(
+      () => parseOmniRoutePluginOptions({ baseURL }),
+      /baseURL must be an http\(s\) URL/,
+      `expected ${baseURL} to be rejected`
+    );
+  }
+});
+
+test("parseOmniRoutePluginOptions: http and https baseURLs are accepted, padding trimmed", () => {
+  for (const baseURL of ["http://localhost:20128", "https://or.example.com/v1"]) {
+    assert.equal(parseOmniRoutePluginOptions({ baseURL }).baseURL, baseURL);
+    assert.equal(parseOmniRoutePluginOptions({ baseURL: `  ${baseURL}  ` }).baseURL, baseURL);
+  }
+});
+
 test("parseOmniRoutePluginOptions: unknown key → throws (strict mode catches typos)", () => {
   assert.throws(
     () =>

changelog.d/features/12985-eurouter-provider.md

@@ -0,0 +1 @@
+- **feat(providers):** Added EURouter as an OpenAI-compatible API-key gateway (`https://api.eurouter.ai/v1`), with live model discovery via `passthroughModels`. Its copy states that models are served by third-party upstreams listed per model, so an EU-based router is not read as EU data residency for inference.

changelog.d/features/12986-greenpt-provider.md

@@ -0,0 +1 @@
+- **feat(providers):** Added GreenPT as an OpenAI-compatible API-key provider (`https://api.greenpt.ai/v1`), with live model discovery via `passthroughModels`. No free-inference badge: the published docs describe a free API subscription billed per token, not a free tier.

changelog.d/fixes/0000-responses-node-model-test.md

@@ -0,0 +1 @@
+- **fix(dashboard):** model health tests for a provider node set to the Responses API now call `/v1/responses` with a Responses-shaped body instead of `/v1/chat/completions` — those models were reported as `Provider returned HTTP 200 but no text content` even though the same model answered normally through `/v1/responses` ([#13070](https://github.com/diegosouzapw/OmniRoute/issues/13070))

changelog.d/fixes/12633-opencode-zen-responses-auth-header.md

@@ -1 +0,0 @@
-- fix(providers): send `x-api-key` instead of `Authorization: Bearer` for OpenCode Zen's `/v1/responses` endpoint (Muse Spark Contributor models), fixing a 401 on OmniRoute's auth header (#12633)

changelog.d/fixes/12681-opencode-muse-spark-context-length.md

@@ -1 +0,0 @@
-- fix(models): declare the real ~1M contextLength for OpenCode Zen's Muse Spark 1.2 models instead of falling back to the 200000 provider default (#12681)

changelog.d/fixes/12896-call-logs-filter-parity.md

@@ -0,0 +1 @@
+- **fix(logs):** the Logs grid's in-memory filter pass no longer discards rows the SQL query already matched — selecting an API key from the dropdown (which sends the key's id) returns its calls again, the Combo tab shows every combo instead of only those whose name contains a "1", and the model filter and search cover the same columns as the query ([#12896](https://github.com/diegosouzapw/OmniRoute/pull/12896)) — fixes [#12873](https://github.com/diegosouzapw/OmniRoute/issues/12873)

changelog.d/fixes/12918-a2a-status-agent-card-base-url.md

@@ -0,0 +1 @@
+- **fix(a2a):** `/api/a2a/status` now builds the agent card from the request that asked for it, so a gateway reached at a non-localhost host no longer advertises `http://localhost:20128` as its A2A URL ([#12918](https://github.com/diegosouzapw/OmniRoute/pull/12918)).

changelog.d/fixes/12920-aging-tool-result-block-order.md

@@ -0,0 +1 @@
+- **fix(compression):** progressive aging now appends its `[COMPRESSED:aging:…]` annotation after a turn's `tool_result` blocks instead of in front of them, so Anthropic no longer rejects aged conversations with "`tool_use` ids were found without `tool_result` blocks immediately after" ([#12920](https://github.com/diegosouzapw/OmniRoute/pull/12920)).

changelog.d/fixes/12921-bedrock-vendor-context-limits.md

@@ -0,0 +1 @@
+- **fix(bedrock):** model import now resolves context limits for every vendor prefix instead of only `anthropic.*`, so `global.openai.gpt-5.6-*` no longer imports with a null `inputTokenLimit` and gets rejected pre-flight at the 200k default ([#12921](https://github.com/diegosouzapw/OmniRoute/pull/12921)).

changelog.d/fixes/12925-glm-stream-buffer-arity.md

@@ -0,0 +1 @@
+- **fix(stream):** the 64 KB stream buffer GLM asks for is honoured instead of dropped, and the type error it caused no longer fails the API Route Typecheck gate on every open PR ([#12925](https://github.com/diegosouzapw/OmniRoute/pull/12925))

changelog.d/fixes/12930-pii-nested-tool-result.md

@@ -0,0 +1 @@
+- **fix(guardrails):** mask PII inside a `tool_result`'s nested content array, which the masker walked past while redacting its sibling block ([#12930](https://github.com/diegosouzapw/OmniRoute/pull/12930))

changelog.d/fixes/12975-opencode-transient-5xx-rotation.md

@@ -0,0 +1 @@
+- **fix(sse):** transient opencode upstream failures rotate to the next account proxy instead of failing, so one flapping egress no longer aborts the whole chain ([#12975](https://github.com/diegosouzapw/OmniRoute/pull/12975)) — thanks @maxmad64bis

changelog.d/fixes/12981-azure-generation-range.md

@@ -0,0 +1 @@
+- **fix(azure):** Deployments from GPT-6 onward now send `max_completion_tokens` instead of `max_tokens`, which Azure rejects with HTTP 400. The rule matched a literal `gpt-5`, so each new generation arrived broken; it now matches the generation range, while `gpt-35-turbo` still keeps `max_tokens`.

changelog.d/fixes/13095-acp-buffer-cap.md

@@ -0,0 +1 @@
+- **fix(acp):** bound the ACP session output buffers — `stdoutBuffer` and `stderrBuffer` now cap at 1 MiB keeping the most recent output behind a visible `[...output truncated...]` marker, and `stderrBuffer` is reset per prompt instead of accumulating for the lifetime of the session.

changelog.d/fixes/13095-acp-sendprompt-listener-leak.md

@@ -0,0 +1 @@
+- **fix(acp):** release the `stdout`/`exit` listeners and the idle timer that a `sendPrompt` timeout used to leave attached to the `acpManager` singleton, and drop sessions that exited on their own from the session map instead of keeping them forever.

changelog.d/fixes/13101-sanitizer-tool-result-carrier.md

@@ -0,0 +1 @@
+- **fix(security):** the prompt-injection and PII scanners now read the text a `tool_result` block carries on `content` (string or nested block list), in messages and in system blocks, so tool output is judged by the same rules as user text ([#13101](https://github.com/diegosouzapw/OmniRoute/pull/13101))

changelog.d/fixes/13103-badge-sse-aborted-signal.md

@@ -0,0 +1 @@
+- **fix(gamification):** close the badge notification SSE stream when the request signal is already aborted before the stream starts — a client that disconnects while the route is still awaiting auth used to leave both the 2s unlock poll and the 15s heartbeat running for the lifetime of the process.

changelog.d/fixes/13104-injection-scan-window.md

@@ -0,0 +1 @@
+- **fix(security):** the prompt-injection scan now spends its 16 KB budget on both ends of the request instead of the first 16 KB only, so `system`, `instructions`, `query`, `documents` and the newest turns are no longer hidden behind one long message ([#13104](https://github.com/diegosouzapw/OmniRoute/pull/13104))

changelog.d/fixes/13108-nodesqlite-process-listener-leak.md

@@ -0,0 +1 @@
+- **fix(db):** release the `beforeExit`/`SIGINT`/`SIGTERM` handlers when a `node:sqlite` adapter closes, so a closed adapter and its database handle are no longer pinned to `process` for the lifetime of the run — the same treatment #7494 gave the sql.js adapter.

changelog.d/fixes/13110-schema-slot-keys.md

@@ -0,0 +1 @@
+- **fix(translator):** `contentSchema` and `unevaluatedItems` are now treated as subschema positions by the tool-schema sanitizer, so a truncation placeholder in either is replaced with a permissive schema instead of being forwarded as a string ([#13110](https://github.com/diegosouzapw/OmniRoute/pull/13110))

changelog.d/fixes/13113-logstream-timer-leak.md

@@ -0,0 +1 @@
+- **fix(cli-helper):** clear the `createLogStream` timeout on the abort path — `stop()` aborts the in-flight fetch and returned through the `signal.aborted` branch, which skipped `clearTimeout` and left an armed timer per stopped stream. The stream reader is now also cancelled when the read loop exits early.

changelog.d/fixes/13141-breaker-epoch-cooldown.md

@@ -0,0 +1 @@
+- **fix(combo):** parse numeric-epoch `rate_limited_until` in the combo cooldown read path ([#13141](https://github.com/diegosouzapw/OmniRoute/pull/13141)) — thanks @maxmad64bis

changelog.d/fixes/13142-plugin-v2-model-api-url.md

@@ -0,0 +1 @@
+- **fix(opencode):** both OpenCode plugins now reject a gateway address typed without `http://` at configuration time, instead of publishing every model with an api url no client can call, and the v2 plugin no longer publishes a model card whose api url is blank or relative ([#13142](https://github.com/diegosouzapw/OmniRoute/pull/13142)) — thanks @maxmad64bis

changelog.d/fixes/13146-opencode-400-model-lock.md

@@ -0,0 +1 @@
+- **fix(providers):** lock opencode model on upstream 400 model-unavailable ([#13146](https://github.com/diegosouzapw/OmniRoute/pull/13146)) — thanks @maxmad64bis

changelog.d/fixes/13147-bodies-first-artifact.md

@@ -0,0 +1 @@
+- **fix(logging):** keep the provider exchange rather than the raw client bodies when a call log exceeds its size budget, and show that recovered payload in the request-detail panel instead of replacing it with the stored response body ([#13147](https://github.com/diegosouzapw/OmniRoute/pull/13147)) — thanks @maxmad64bis

changelog.d/fixes/13152-traffic-inspector-ws-subscriber-leak.md

@@ -0,0 +1 @@
+- **fix(traffic-inspector):** the WebSocket route no longer leaks a traffic-buffer subscriber and a 30s ping timer when the client socket is already closed at handler time — listeners are attached before any resource is acquired, a destroyed socket bails out early, and the ping interval stops on a dead socket where `write()` never throws ([#13155](https://github.com/diegosouzapw/OmniRoute/pull/13155))

changelog.d/fixes/13165-telegram-keycache-unbounded.md

@@ -0,0 +1 @@
+- **fix(telegram):** bound the per-user API key cache in the Telegram chat proxy so a burst of distinct chat ids can no longer grow the process heap without limit ([#13165](https://github.com/diegosouzapw/OmniRoute/issues/13165))

changelog.d/fixes/13169-jsonbody-sniff-reader-leak.md

@@ -0,0 +1 @@
+- **fix(stream):** cancel the upstream response body when the JSON-to-SSE sniff unwinds on a body timeout, so a stalled upstream no longer pins the connection ([#13169](https://github.com/diegosouzapw/OmniRoute/issues/13169))

changelog.d/fixes/13172-telegram-webhook-secret.md

@@ -0,0 +1 @@
+- **fix(telegram):** authenticate webhook deliveries with Telegram's `secret_token` so an unauthenticated caller can no longer mint API keys or spend upstream quota ([#13172](https://github.com/diegosouzapw/OmniRoute/issues/13172))

changelog.d/fixes/13298-dashboard-session-authenticated-claim.md

@@ -0,0 +1 @@
+- **fix(auth):** a dashboard session now requires the `authenticated: true` claim that login, OIDC and the session refresh already emit — a JWT merely signed with `JWT_SECRET` (for example the Cursor CLI passthrough token, which any API-key holder can obtain) no longer verifies as the `auth_token` cookie on any route, the WebSocket handshake or the live server; existing sessions keep working ([#13298](https://github.com/diegosouzapw/OmniRoute/issues/13298))

changelog.d/fixes/cli-skill-parser-addargument.md

@@ -0,0 +1 @@
+- **fix(skills):** The CLI registry parser now reads positionals declared with `.addArgument()`, not only those written inline in `.command()`. `tunnel create [type]` was being published as `tunnel create`, so the agent-skills sync gate reported drift on every branch and regenerating would have deleted the argument.

changelog.d/fixes/compression-pool-idle-terminate.md

@@ -0,0 +1 @@
+- fix(compression): terminate idle worker threads on eviction so long-running instances stop leaking OS threads and MessagePorts

changelog.d/fixes/llmlingua-worker-spawn.md

@@ -0,0 +1 @@
+- fix(compression): spawn the LLMLingua worker with a file URL object so compression actually runs instead of silently failing open on Node

changelog.d/fixes/local-test-concurrency.md

@@ -0,0 +1 @@
+- **fix(test):** run the local `test` and `test:unit` scripts at concurrency 4 so a full-suite run no longer exhausts the machine's commit charge and kills unrelated processes

changelog.d/fixes/plugin-sigkill-listener-leak.md

@@ -0,0 +1 @@
+- fix(plugins): stop leaking an exit listener per plugin hook timeout, which triggered MaxListenersExceededWarning on plugins that ignore SIGTERM

changelog.d/fixes/provider-node-null-quota-reset.md

@@ -0,0 +1 @@
+- **fix(validation):** Provider node edits no longer fail with a generic "Invalid request" when the optional daily-quota reset fields are left blank. The dashboard sends `dailyQuotaResetTimezone` and `dailyQuotaResetHour` as `null`, and only the hour accepted it. ([#13066](https://github.com/diegosouzapw/OmniRoute/issues/13066))

changelog.d/fixes/webdav-test-windows-path.md

@@ -0,0 +1 @@
+- **fix(test):** resolve the WebDAV handler path with `fileURLToPath` so the suite's 37 WebDAV tests run on Windows instead of failing with a doubled `C:\C:\` drive prefix

config/quality/file-size-baseline.json

@@ -1,4 +1,7 @@
 {
+  "_rebaseline_2026_09_10_12975_rotation_correlation_id": "PR #12975 own growth: open-sse/executors/base.ts 1751->1753 (+2) and open-sse/handlers/chatCore.ts 6021->6024 (+3). The opencode rotation lines carry the request correlationId: one optional ExecuteInput field and one correlationId argument at each of the three executor.execute call sites in handleChatCore. Irreducible plumbing at existing call sites; the rotation logic itself lives in open-sse/executors/opencode.ts and the new leaf predicates (under cap). Covered by tests/unit/opencode-transient-rotation.test.ts and tests/unit/chat-correlation-id-exhaustion.test.ts.",
+  "_rebaseline_2026_09_11_mergebatch_v3851_maxmad_opencode": "/merge-batch 2026-09-11 (v3.8.51), PRs #13141, #13146 and #12975 by maxmad64bis. src/sse/services/auth.ts 3450->3488 (+38): #13146 adds the narrow ruleScope===model branch to markAccountUnavailable (gated on status 400; every other status keeps its path) plus the HONORS_RULE_LOCK_SCOPE_PROVIDERS opencode entry, taking it to 3464; #12975 then adds buildExhaustionOptions so the exhaustion log lines carry the request correlationId (+24). open-sse/services/accountFallback.ts 2467->2468 (+1): #13141 routes hasFutureRateLimitUntil through the tolerant epoch normalizer; #13146 is net zero there (+16/-16). open-sse/executors/base.ts 1751->1753 (+2): #12975 adds the optional ExecuteInput.correlationId field with its doc comment. src/sse/handlers/chat.ts is NOT rebaselined: #12975 threads correlationId through the three executor call sites (+2) but the file lands at 2452, still under its existing 2458 freeze. open-sse/utils/stream.ts is deliberately NOT rebaselined either: it is already 3115 > 3098 on the pure tip with zero contribution from this batch (base-red #12732, owned by /sweep-reds). No new branching beyond the two guarded branches named above. Covered by tests/unit/combo-predicates-epoch-cooldown.test.ts, opencode-400-model-unavailable.test.ts, agentrouter-error-rules.test.ts, opencode-transient-rotation.test.ts and chat-correlation-id-exhaustion.test.ts.",
+  "_rebaseline_2026_09_10_mergebatch_v3851_greenpt_eurouter": "/merge-batch 2026-09-10 (v3.8.51), PRs #13024 (GreenPT, closes #12986) and #13025 (EURouter, closes #12985) by ntdatt812: src/shared/constants/providers/apikey/gateways.ts 1462->1502 (+40 = two APIKEY_PROVIDERS_GATEWAYS catalog entries, declarative data only: id/alias/name/icon/color/website plus the hasFree=false rationale comments and the apiHint copy each PR verified). No logic and no new branching. Same god-file no-split rationale as every prior gateways.ts rebaseline (#11786 seekai, #10987 logfare, #10668 tabitoken, #10531 freebuff, #11631 1min.ai): the file header says it is pure data merged by apikey/index.ts via spread, and it is already split into 6 family files under apikey/, so splitting a catalog for two entries would violate the semantic-families rule rather than help. Both entries are deliberately conservative (models: [] with passthroughModels, no tool/vision capability declared, hasFree false), so the growth is the entry itself, not claims. EURouter is in AGGREGATOR_PROVIDER_IDS because it routes to third-party upstreams; GreenPT is not because it serves its own inference. Covered by tests/unit/greenpt-provider.test.ts and tests/unit/eurouter-provider.test.ts.",
   "_rebaseline_2026_09_10_12828_translate_usage_chunk": "PR #12828 own growth: open-sse/utils/stream.ts 3072->3080 (+8). Translate-mode streams now send the estimated usage as the canonical trailing usage-only chunk before [DONE] when the upstream stays silent (parity with the #12151 passthrough flush), with a latch so a finish chunk that already carried the estimate is not doubled. The chunk builder is shared with the passthrough flush in open-sse/utils/usageOnlyChunk.ts (under cap); what remains is the flush-site wiring. Covered by tests/unit/stream-translate-usage-trailing.test.ts.",
   "_rebaseline_2026_09_10_12715_queue_budget": "PR #12715 own growth: open-sse/handlers/chatCore.ts 6021->6036 (+15). Hierarchical admission now resolves the per-connection queue budget before the gates and hands withRateLimit the remaining budget, the correlation id and the executor timeout context, so gate wait, provider slot and Bottleneck queue share one bound instead of stacking. Error shaping lives in open-sse/handlers/chatCore/queueBudget.ts (under cap); what remains is irreducible call-site wiring. Covered by tests/unit/rate-limit-remaining-budget.test.ts, rate-limit-manager-queue-bound.test.ts and chatcore-hierarchical-admission.test.ts.",
   "_rebaseline_2026_09_06_runtime_quotagroup_nodemap": "Own growth: src/app/(dashboard)/dashboard/runtime/RuntimePageClient.tsx 1201->1222 (+21, check-file-size split-newline). QuotaGroup is a module-level sibling and was reading nodeMap from RuntimePageClient's closure; that identifier is not in scope, so a quota monitor with status error/exhausted/alerting throws ReferenceError. Fix threads nodeMap as a prop (3 call sites + parameter + ProviderNodeEntry import). Prettier wraps the long import and the three QuotaGroup JSX tags. Covered by tests/unit/ui/runtime-page-client.test.tsx (empty monitors stay green; error+exhausted fixtures mount QuotaGroup).",
@@ -421,7 +424,7 @@
     "_rebaseline_pr1043_minimax_tts": "Upstream port decolua/9router#1043 (toanalien) own growth: audioSpeech.ts 965->1061 (+96). Adds MiniMax T2A v2 TTS dispatch (handleMinimaxSpeech + hexToBytes helper) — provider entry was already in audioRegistry (format: minimax-tts) but no handler existed, falling through to the OpenAI-compatible default that fails (T2A has custom shape + hex-encoded audio + base_resp envelope). New branch sits next to the other inline provider branches (xiaomi-mimo, coqui, tortoise, aws-polly) — extracting would just create indirection. Covered by tests/unit/minimax-tts-1043.test.ts (3 tests, GREEN: success, base_resp error, invalid-hex).",
     "_rebaseline_pr4592_exclude_exhausted_auto": "Reconcile #4592 already-merged growth: combo.ts 2991->3036 (+45, terminal-status quota-cutoff exclusion in buildAutoCandidates + opt-in gate). Fast-gate PR->release does not run check:file-size.",
     "open-sse/executors/antigravity.ts": 1665,
-    "open-sse/executors/base.ts": 1751,
+    "open-sse/executors/base.ts": 1753,
     "open-sse/executors/chatgpt-web.ts": 5056,
     "open-sse/executors/codex.ts": 1505,
     "open-sse/executors/cursor.ts": 1759,
@@ -432,7 +435,7 @@
     "open-sse/handlers/search.ts": 1789,
     "open-sse/mcp-server/schemas/tools.ts": 1621,
     "open-sse/mcp-server/server.ts": 1572,
-    "open-sse/services/accountFallback.ts": 2467,
+    "open-sse/services/accountFallback.ts": 2468,
     "open-sse/services/adobeFireflyBrowserLogin.ts": 1401,
     "open-sse/services/combo.ts": 4080,
     "open-sse/services/combo/executeTargetAttempt.ts": 1205,
@@ -465,10 +468,10 @@
     "src/lib/tailscaleTunnel.ts": 1208,
     "src/lib/tokenHealthCheck.ts": 1218,
     "src/shared/components/RequestLoggerV2.tsx": 1718,
-    "src/shared/constants/providers/apikey/gateways.ts": 1462,
+    "src/shared/constants/providers/apikey/gateways.ts": 1502,
     "src/shared/services/cliRuntime.ts": 1296,
     "src/sse/handlers/chat.ts": 2458,
-    "src/sse/services/auth.ts": 3450,
+    "src/sse/services/auth.ts": 3488,
     "tests/unit/account-fallback-service.test.ts": 2453,
     "tests/unit/provider-validation-specialty.test.ts": 4656,
     "open-sse/services/autoCombo/virtualFactory.ts": 1219,

docs/architecture/AUTHZ_GUIDE.md

@@ -35,6 +35,14 @@ For dashboard pages and admin operations.
 Cookie: auth_token=<JWT signed with JWT_SECRET>
 ```
 
+A cookie is a session only when the JWT verifies **and** carries `authenticated: true`
+(`src/shared/utils/dashboardSessionToken.ts` → `verifyDashboardSessionToken`). Every
+consumer of the cookie (route guard, authz pipeline refresh, WebSocket handshake, live
+server, `/api/settings/require-login`, `/api/auth/status`) goes through that helper.
+Other JWTs signed with `JWT_SECRET` exist — the Cursor CLI passthrough mints
+`iss "omniroute" / aud "cursor-cli"` tokens for key holders — and are never sessions
+(#13298).
+
 Verified by `isDashboardSessionAuthenticated()` in `src/shared/utils/apiAuth.ts`. The pipeline auto-refreshes the JWT when it has fewer than 7 days left in its 30-day lifetime.
 
 Some management routes accept **either** mode: cookie OR `Bearer <key>` when the API key has the `manage` (or `admin`) scope. This is what enables the "configurable via API calls" workflow added in v3.8.

docs/guides/OPENCODE-V2-PLUGIN.md

@@ -77,7 +77,7 @@ naming the endpoint and what was lost — so a degraded picker is never a myster
 | Key                              | Default                                        | Notes                                                                                                  |
 | -------------------------------- | ---------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
 | `providerId`                     | `"omniroute"`                                  | Provider id, integration id, and the prefix models appear under                                        |
-| `baseURL`                        | required                                       | Gateway root; the `/v1` suffix is added where needed                                                   |
+| `baseURL`                        | required                                       | Gateway root, `http(s)` only; the `/v1` suffix is added where needed                                   |
 | `apiKey`                         | connected credential, then `OMNIROUTE_API_KEY` | Chat key for `/v1/*`                                                                                   |
 | `managementReadToken`            | falls back to `apiKey`                         | Key for `/api/*` — usually **not** the same one                                                        |
 | `displayName`                    | `"OmniRoute"`                                  | Provider name in the picker                                                                            |

docs/reference/ENVIRONMENT.md

@@ -1623,6 +1623,7 @@ These settings were introduced after the previous environment-contract snapshot.
 | `ADOBE_FIREFLY_CHROME_HEADLESS` | `0` | `open-sse/services/adobeFireflyBrowserLogin.ts` | Debug-only true-headless mode; Adobe colligo normally rejects the resulting risk session. |
 | `CHROME_PATH` | auto-detect | `open-sse/executors/cloudflare-playground.ts`, `open-sse/executors/chatgpt-web-codex.ts` | Optional absolute Chrome executable used by the browser-driven executors when platform auto-detection is insufficient. |
 | `TELEGRAM_BOT_TOKEN` | _(unset)_ | `src/lib/telegram/config.ts` | BotFather token that enables the inbound webhook and signs Mini App `initData`. |
+| `TELEGRAM_WEBHOOK_SECRET` | _(unset)_ | `src/lib/telegram/config.ts` | Shared secret registered via `setWebhook` and verified against the `X-Telegram-Bot-Api-Secret-Token` header on every webhook delivery. Required for the webhook path; unset means webhook deliveries are refused with 503. |
 | `TELEGRAM_DEFAULT_MODEL` | `auto/chat` | `src/lib/telegram/chatProxy.ts` | Model used for Telegram chat replies. |
 | `TELEGRAM_BOT_API_BASE` | `https://api.telegram.org` | `src/lib/telegram/config.ts` | Bot API base URL override for proxies or self-hosted Bot API servers. |
 | `TELEGRAM_WEBHOOK_TIMEOUT_MS` | `60000` | `src/lib/telegram/config.ts` | Timeout in milliseconds for outbound Bot API calls. |

open-sse/config/bedrock.ts

@@ -90,13 +90,19 @@ export function getBedrockKnownModelLimits(modelId: string): {
   if (!trimmed) return null;
 
   const unqualified = trimmed.includes("/") ? trimmed.slice(trimmed.indexOf("/") + 1) : trimmed;
-  const withoutProfilePrefix = unqualified.replace(/^(?:eu|us|global)\./i, "");
-  const withoutProviderPrefix = withoutProfilePrefix.replace(/^anthropic\./i, "");
-  const spec =
-    getModelSpec(trimmed) ||
-    getModelSpec(unqualified) ||
-    getModelSpec(withoutProfilePrefix) ||
-    getModelSpec(withoutProviderPrefix);
+  // A Bedrock id is "<vendor>.<model>" optionally behind a cross-region profile
+  // prefix: "global.openai.gpt-5.6-sol", "us.anthropic.claude-...". The model
+  // name itself contains dots ("gpt-5.6-sol"), so peel at most those two leading
+  // qualifiers and keep the first candidate a spec knows. Peeling only
+  // "anthropic." left every other vendor (openai, meta, amazon, ...) without a
+  // context window, and the caller then fell back to a 200k default (#12915).
+  const segments = unqualified.split(".");
+  const spec = [trimmed, unqualified, segments.slice(1).join("."), segments.slice(2).join(".")]
+    .filter((candidate) => candidate.length > 0)
+    .reduce<ReturnType<typeof getModelSpec>>(
+      (found, candidate) => found || getModelSpec(candidate),
+      undefined
+    );
 
   if (!spec?.contextWindow && !spec?.maxOutputTokens) return null;
   return {

open-sse/config/providerErrorRules.ts

@@ -32,7 +32,7 @@ export type ProviderErrorRuleMatch = {
   /**
    * Intended lock scope. #10334: for a BUILT-IN catalog rule, this field is
    * CONSUMED end-to-end only for providers in `HONORS_RULE_LOCK_SCOPE_PROVIDERS`
-   * (agentrouter-exclusive today, gated by `honorsRuleLockScope()`) — for those,
+   * (agentrouter + the opencode family, gated by `honorsRuleLockScope()`) — for
    * `checkFallbackError` surfaces it as `ruleScope` on its return value for the
    * persistence layer to honor instead of re-deriving scope from
    * `hasPerModelQuota()`. For every other built-in-rule provider it remains
@@ -155,6 +155,19 @@ function buildOpencodeRules(): ProviderErrorRule[] {
         return null;
       },
     },
+    {
+      id: "opencode-400-model-unavailable",
+      match: ({ status, body }) => {
+        if (status !== 400) return null;
+        const text = JSON.stringify(body ?? "").toLowerCase();
+        if (!text.includes("upstream request failed: model is unavailable.")) return null;
+        return {
+          reason: "model_capacity",
+          scope: "model",
+          cooldownMs: 3_600_000,
+        };
+      },
+    },
   ];
 }
 
@@ -290,15 +303,16 @@ function buildAgentrouterRules(): ProviderErrorRule[] {
   ];
 }
 
+/** Providers sharing the opencode upstream envelope, hence the opencode catalog rules. */
+const OPENCODE_RULE_FAMILY = ["opencode", "opencode-zen", "opencode-go", "opencode-cli"];
+
 /**
  * Global registry. Provider name → ordered list of rules (first match wins).
  * Add new providers here; the matcher in classifyError will pick them up
  * automatically.
  */
 export const providerRuleRegistry = new Map<string, ProviderErrorRule[]>([
-  ["opencode", buildOpencodeRules()],
-  ["opencode-go", buildOpencodeRules()],
-  ["opencode-cli", buildOpencodeRules()],
+  ...OPENCODE_RULE_FAMILY.map((id): [string, ProviderErrorRule[]] => [id, buildOpencodeRules()]),
   ["minimax", buildMinimaxRules()],
   ["minimax-passthrough", buildMinimaxRules()],
   ["cloudflare-ai", buildCloudflareAiRules()],
@@ -323,7 +337,7 @@ export const providerRuleRegistry = new Map<string, ProviderErrorRule[]>([
  * mechanism (#11104) silently inert for every provider except the ones listed
  * below. See `hasOperatorRuleForProvider`.
  */
-const HONORS_RULE_LOCK_SCOPE_PROVIDERS = new Set(["agentrouter"]);
+const HONORS_RULE_LOCK_SCOPE_PROVIDERS = new Set(["agentrouter", ...OPENCODE_RULE_FAMILY]);
 
 export function honorsRuleLockScope(provider: string | null | undefined): boolean {
   if (!provider) return false;
@@ -509,3 +523,21 @@ export function parseResetCountdownMs(text: string): number | null {
       return null;
   }
 }
+
+/**
+ * Opencode-family "Upstream request failed: Model is unavailable." 400: the rule's
+ * model-scope match, or null for any other provider, status or rule. Takes the raw
+ * error text so it stays independent of FULL_TEXT_RULE_PROVIDERS (#10880).
+ */
+export function getOpencodeModelUnavailableMatch(
+  provider: string | null | undefined,
+  status: number,
+  headers: Headers | Record<string, string> | null | undefined,
+  errorText: unknown
+): ProviderErrorRuleMatch | null {
+  if (status !== 400 || !provider || !OPENCODE_RULE_FAMILY.includes(provider.toLowerCase())) {
+    return null;
+  }
+  const match = getProviderErrorRuleMatch(provider, status, headers, errorText);
+  return match?.scope === "model" && match.reason === "model_capacity" ? match : null;
+}

open-sse/config/providers/index.ts

@@ -249,6 +249,8 @@ import { electronhubProvider } from "./registry/electronhub/index.ts";
 import { llmgatewayProvider } from "./registry/llmgateway/index.ts";
 import { llmKiwiProvider } from "./registry/llm-kiwi/index.ts";
 import { literouterProvider } from "./registry/literouter/index.ts";
+import { greenptProvider } from "./registry/greenpt/index.ts";
+import { eurouterProvider } from "./registry/eurouter/index.ts";
 import { mnnAiProvider } from "./registry/mnn-ai/index.ts";
 import { meganovaAiProvider } from "./registry/meganova-ai/index.ts";
 import { mixlayerProvider } from "./registry/mixlayer/index.ts";
@@ -524,6 +526,8 @@ export const REGISTRY: Record<string, RegistryEntry> = {
   llmgateway: llmgatewayProvider,
   "llm-kiwi": llmKiwiProvider,
   literouter: literouterProvider,
+  greenpt: greenptProvider,
+  eurouter: eurouterProvider,
   "mnn-ai": mnnAiProvider,
   "meganova-ai": meganovaAiProvider,
   mixlayer: mixlayerProvider,

open-sse/config/providers/registry/eurouter/index.ts

@@ -0,0 +1,11 @@
+import type { RegistryEntry } from "../../shared.ts";
+import { buildOpenAiCompatibleRegistryEntry } from "../../shared.ts";
+
+export const eurouterProvider: RegistryEntry = buildOpenAiCompatibleRegistryEntry({
+  id: "eurouter",
+  alias: "eurouter",
+  baseUrl: "https://api.eurouter.ai/v1/chat/completions",
+  modelsUrl: "https://api.eurouter.ai/v1/models",
+  models: [],
+  passthroughModels: true,
+});

open-sse/config/providers/registry/greenpt/index.ts

@@ -0,0 +1,11 @@
+import type { RegistryEntry } from "../../shared.ts";
+import { buildOpenAiCompatibleRegistryEntry } from "../../shared.ts";
+
+export const greenptProvider: RegistryEntry = buildOpenAiCompatibleRegistryEntry({
+  id: "greenpt",
+  alias: "greenpt",
+  baseUrl: "https://api.greenpt.ai/v1/chat/completions",
+  modelsUrl: "https://api.greenpt.ai/v1/models",
+  models: [],
+  passthroughModels: true,
+});

open-sse/config/providers/registry/opencode/index.ts

@@ -30,25 +30,17 @@ export const opencodeProvider: RegistryEntry = {
     // content (see issue #10867). The opencode provider is passthrough, so
     // declaring them here only sets the wire format / capability flags — the
     // live upstream model list already advertises both ids.
-    // #12681: real window confirmed against the opencode-go registry's own
-    // muse-spark-1.2-contributor entries (contextLength: 1048576, maxOutputTokens:
-    // 131072) — without an explicit value here resolution fell back to the
-    // provider-wide defaultContextLength (200000), understating the real window.
     {
       id: "muse-spark-1.2",
       name: "Muse Spark 1.2",
       supportsReasoning: true,
       targetFormat: "openai-responses",
-      contextLength: 1048576,
-      maxOutputTokens: 131072,
     },
     {
       id: "muse-spark-1.2-contributor-free",
       name: "Muse Spark 1.2 Contributor Free",
       supportsReasoning: true,
       targetFormat: "openai-responses",
-      contextLength: 1048576,
-      maxOutputTokens: 131072,
     },
     { id: "deepseek-v4-flash-free", name: "DeepSeek V4 Flash Free", supportsReasoning: true },
     // #6998: 2026-07-14 refresh — the upstream free tier rotated its lineup;

open-sse/config/providers/registry/opencode/zen/index.ts

@@ -63,17 +63,11 @@ export const opencode_zenProvider: RegistryEntry = {
     // targetFormat declaration, so requests routed here still hit
     // /chat/completions with a mismatched or unanswerable body and the
     // upstream returns an empty message.
-    // #12681: real window confirmed against the opencode-go registry's own
-    // muse-spark-1.2-contributor entries (contextLength: 1048576, maxOutputTokens:
-    // 131072) — without an explicit value here resolution fell back to the
-    // provider-wide defaultContextLength (200000), understating the real window.
     {
       id: "muse-spark-1.2",
       name: "Muse Spark 1.2",
       supportsReasoning: true,
       targetFormat: "openai-responses",
-      contextLength: 1048576,
-      maxOutputTokens: 131072,
     },
     // Explicit wire-format overlay of the base opencode provider's muse-spark entry
     // (targetFormat: openai-responses). Keep in sync with base on catalog syncs.
@@ -82,8 +76,6 @@ export const opencode_zenProvider: RegistryEntry = {
       name: "Muse Spark 1.2 Contributor Free",
       supportsReasoning: true,
       targetFormat: "openai-responses",
-      contextLength: 1048576,
-      maxOutputTokens: 131072,
     },
 
     // ── DeepSeek ────────────────────────────────────────────────

open-sse/executors/azureParamRules.ts

@@ -20,15 +20,24 @@
 /**
  * Deployments that require `max_completion_tokens` instead of `max_tokens`.
  *
- * Matches the GPT-5 family and the o1/o3/o4 reasoning series at a token
+ * Matches GPT-5 and later, and the o1/o3/o4 reasoning series, at a token
  * boundary, so a deployment named `my-gpt-5-prod` matches while an unrelated
  * `piston-o4-legacy`-style name does not match by accident. `gpt-chat-latest`
  * is listed explicitly: it is a moving alias that currently resolves to a
  * GPT-5-era model and rejects `max_tokens`, but carries no version number for
  * the boundary pattern to key on.
+ *
+ * The generation is a range rather than a literal `gpt-5`, because the rule is
+ * a property of the generation and not of one release: `gpt-6-astra` rejects
+ * `max_tokens` for exactly the reason `gpt-5` does, and pinning the literal
+ * meant every new family arrived broken (#12981).
+ *
+ * It is a range and not `\d+` on purpose. Azure's own name for GPT-3.5 is
+ * `gpt-35-turbo`, which takes `max_tokens` and would be caught by a digit-run.
+ * `1\d` keeps a future `gpt-10` working without letting `gpt-35` in.
  */
 export const AZURE_COMPLETION_TOKEN_DEPLOYMENT =
-  /(?:^|[/_-])(?:gpt-5|o(?:1|3|4))(?:[._-]|$)|^gpt-chat-latest$/i;
+  /(?:^|[/_-])(?:gpt-(?:[5-9]|1\d)|o(?:1|3|4))(?:[._-]|$)|^gpt-chat-latest$/i;
 
 /**
  * Apply the Azure param rules to an already-translated Chat Completions body.

open-sse/executors/base.ts

@@ -211,6 +211,8 @@ export type ExecuteInput = {
   ) => Promise<void> | void;
   /** When true, skip the intra-URL 429 retry in execute() so the caller handles fallback. */
   skipUpstreamRetry?: boolean;
+  /** Request-scoped id for log attribution; absent off the chat path, never fabricated. */
+  correlationId?: string | null;
   /** Delegated Context Editing (Claude only): when enabled, attach the
    * `context_management.clear_tool_uses` strategy so the provider clears stale
    * tool-use blocks server-side. Honored only on the genuine `claude` path. */

open-sse/executors/glm.ts

@@ -216,6 +216,9 @@ function translateAnthropicJsonError(parsed: unknown): JsonRecord {
   };
 }
 
+/** 64 KB queue budget for GLM streaming (#12179, wired through in #12925). */
+const GLM_STREAM_BUFFER_BYTES = 65536;
+
 export function translateSseResponse(
   response: Response,
   provider: string,
@@ -223,8 +226,11 @@ export function translateSseResponse(
   suppressThinkClose: boolean = false
 ): Response {
   if (!response.body) return response;
-  // Helper has 15 parameters; a 16th positional (65536) was a TS2554 and
-  // never reached TransformStream. highWaterMark stays at the helper default.
+  // GLM is a high-throughput provider: a 64 KB queue budget keeps provider ->
+  // client pacing ahead of the model's emission rate. #12179 asked for this by
+  // passing a 16th positional the helper did not take (a TS2554 that never
+  // reached the TransformStream); the helper now accepts it as its last
+  // parameter, so the request finally takes effect (#12925).
   const transform = createSSETransformStreamWithLogger(
     FORMATS.CLAUDE,
     FORMATS.OPENAI,
@@ -238,7 +244,10 @@ export function translateSseResponse(
     null,
     null,
     false,
-    suppressThinkClose
+    suppressThinkClose,
+    undefined,
+    undefined,
+    GLM_STREAM_BUFFER_BYTES
   );
   const headers = cloneHeaders(response.headers);
   headers.set("content-type", "text/event-stream");

open-sse/executors/opencode.ts

@@ -29,15 +29,9 @@ import {
   extractChatcmplId,
 } from "./accountRotation.ts";
 import { isOpencodeGeoBlocked, proxyKeyOf } from "./opencodeGeoBlock.ts";
+import { isRetriableUpstreamFailure } from "./opencodeTransientFailure.ts";
 import { isNetworkRotationSharedEgressGuardEnabled } from "@/shared/utils/featureFlags";
 
-/**
- * The main OpenCode Zen host, shared by the `opencode` and `opencode-zen`
- * registry entries. Used to scope the `x-api-key` auth override (#12633) away
- * from `opencode-go`, which serves a different upstream (`.../zen/go/v1`).
- */
-const ZEN_BASE_URL = "https://opencode.ai/zen/v1";
-
 /**
  * Per-account proxy configuration, persisted by NoAuthAccountCard under
  * `providerSpecificData.accountProxies` (keyed by the account id, which the UI
@@ -511,6 +505,10 @@ export class OpencodeExecutor extends BaseExecutor {
 
       this.syncAccountsFromCredentials(input.credentials);
       const { log } = input;
+      // Request-scoped attribution prefix for rotation logs: message head,
+      // empty when absent (never n/a/none/fabricated). The existing motif
+      // stays byte-identical after the prefix.
+      const cid = input.correlationId ? `correlationId=${input.correlationId} ` : "";
 
       const hasProxies = this.accounts.some((a) => a.proxy !== null);
       // Fast path: no multi-account proxy wiring configured → original behavior,
@@ -540,7 +538,7 @@ export class OpencodeExecutor extends BaseExecutor {
               const chatcmplId = extractChatcmplId(bodyText);
               log?.warn?.(
                 "OPENCODE",
-                `upstream empty rejection on direct account (${chatcmplId}), retrying once…`
+                `${cid}upstream empty rejection on direct account (${chatcmplId}), retrying once…`
               );
               return this.normalizeMuseSparkResponse(input, await super.execute(input));
             }
@@ -574,8 +572,9 @@ export class OpencodeExecutor extends BaseExecutor {
       // through the accounts is the retry). Avoids an unbounded loop on a
       // persistently malformed upstream.
       const emptyRejectionBudget = this.accounts.length === 1 ? 1 : 0;
-      // 403-geo tried set: proxy keys already proven geo-blocked for this
-      // request's model. Request-local only — nothing persists past execute().
+      // Tried set: proxy keys already proven unusable for this request's
+      // model (geo-blocked, or transient 5xx). Request-local only — nothing
+      // persists past execute().
       const geoTriedProxyKeys = new Set<string>();
       let directTried = false;
 
@@ -601,15 +600,19 @@ export class OpencodeExecutor extends BaseExecutor {
         }
         const lastStatus = lastResult !== null ? lastResult.response.status : null;
         const lastWasGeo = lastStatus === 403 || lastStatus === 451;
+        const lastWasTransient = lastStatus !== null && lastStatus >= 500 && lastStatus < 600;
+        const isMonoRetryOwed = this.accounts.length === 1 && lastWasTransient;
         if (
+          !isMonoRetryOwed &&
           lastResult !== null &&
           geoTriedProxyKeys.size > 0 &&
           !isProxiedCandidate(account) &&
           !(account.proxy === null && !directTried)
         ) {
           // Geo exhaustion (last was 403/451) → surface as-is, no success mark.
+          // Transient exhaustion (last was 5xx) → same: surface last as-is.
           // Any other last status (e.g. 429 after 403s) → skip without a call.
-          if (lastWasGeo) break;
+          if (lastWasGeo || lastWasTransient) break;
           continue;
         }
         // Commit the last-resort direct attempt so a later exclusion breaks
@@ -621,7 +624,7 @@ export class OpencodeExecutor extends BaseExecutor {
         if (sharedEgressGuardEnabled && sharedEgressDown && !account.proxy) {
           log?.warn?.(
             "OPENCODE",
-            `skipping account ${masked} (no dedicated proxy, shared egress already down this request)`
+            `${cid}skipping account ${masked} (no dedicated proxy, shared egress already down this request)`
           );
           continue;
         }
@@ -632,7 +635,7 @@ export class OpencodeExecutor extends BaseExecutor {
         // Token stays masked — never log the full account id.
         log?.info?.(
           "OPENCODE",
-          `dispatch via account ${masked} (idx ${attempt + 1}/${this.accounts.length})` +
+          `${cid}dispatch via account ${masked} (idx ${attempt + 1}/${this.accounts.length})` +
             (account.proxy
               ? ` through proxy ${account.proxy.host}:${account.proxy.port}`
               : " direct")
@@ -664,20 +667,20 @@ export class OpencodeExecutor extends BaseExecutor {
               lastSharedEgressError = err;
               log?.warn?.(
                 "OPENCODE",
-                `network error on account ${masked} (no dedicated proxy, shared egress), cooldown applied — trying next available account… (${reason})`
+                `${cid}network error on account ${masked} (no dedicated proxy, shared egress), cooldown applied — trying next available account… (${reason})`
               );
               continue;
             }
             log?.warn?.(
               "OPENCODE",
-              `network error on account ${masked} (no dedicated proxy, shared egress) — not rotating (${reason})`
+              `${cid}network error on account ${masked} (no dedicated proxy, shared egress) — not rotating (${reason})`
             );
             throw err;
           }
           this.markCooldown(account);
           log?.warn?.(
             "OPENCODE",
-            `network error on account ${masked}, rotating to next… (${reason})`
+            `${cid}network error on account ${masked}, rotating to next… (${reason})`
           );
           continue;
         }
@@ -686,7 +689,28 @@ export class OpencodeExecutor extends BaseExecutor {
         const status = result.response.status;
         if (status === 429) {
           this.markCooldown(account);
-          log?.warn?.("OPENCODE", `Rate limited (429) on account ${masked}, rotating to next…`);
+          log?.warn?.(
+            "OPENCODE",
+            `${cid}Rate limited (429) on account ${masked}, rotating to next…`
+          );
+          continue;
+        }
+
+        if (isRetriableUpstreamFailure(status)) {
+          const key = proxyKeyOf(account.proxy);
+          if (key !== null) geoTriedProxyKeys.add(key);
+          else directTried = true;
+          log?.warn?.(
+            "OPENCODE",
+            `${cid}transient upstream ${status} on account ${masked} (proxy ${key ?? "direct"}), rotating to next…`
+          );
+          // Deliberately a separate branch from the 400-empty arm below,
+          // not one merged `if`: this arm never touches the body, the 400
+          // arm must clone-read it. Both share the predicate + tried-set.
+          // Single proxied account: one retry via the existing budget (a
+          // proxy-less single account takes the fast path, never the loop).
+          // Transient is not deterministic like geo: upstream may recover.
+          // No 0-retry guard here (it stays geo-only).
           continue;
         }
 
@@ -703,7 +727,7 @@ export class OpencodeExecutor extends BaseExecutor {
             else directTried = true;
             log?.warn?.(
               "OPENCODE",
-              `geo-blocked on account ${masked} (proxy ${key ?? "direct"}), rotating to next…`
+              `${cid}geo-blocked on account ${masked} (proxy ${key ?? "direct"}), rotating to next…`
             );
             // Single account with a proxy: 0 retries (same egress = dead latency).
             // (The fast path above already covers single-without-proxy; here length===1 WITH proxy.)
@@ -726,11 +750,11 @@ export class OpencodeExecutor extends BaseExecutor {
           } catch {
             log?.debug?.("OPENCODE", "body read failed on empty rejection check");
           }
-          if (bodyText !== null && isEmptyUpstreamRejection(400, bodyText)) {
+          if (bodyText !== null && isRetriableUpstreamFailure(400, bodyText)) {
             const chatcmplId = extractChatcmplId(bodyText);
             log?.warn?.(
               "OPENCODE",
-              `upstream empty rejection on account ${masked} (${chatcmplId}), rotating to next…`
+              `${cid}upstream empty rejection on account ${masked} (${chatcmplId}), rotating to next…`
             );
             continue;
           }
@@ -783,20 +807,6 @@ export class OpencodeExecutor extends BaseExecutor {
     }
   }
 
-  /**
-   * #12633: OpenCode Zen's `/v1/responses` endpoint (reached when
-   * `_requestFormat === "openai-responses"`, e.g. Muse Spark Contributor
-   * models) requires `x-api-key`, not `Authorization: Bearer` — unlike the
-   * default `/chat/completions` endpoint on the same host, which accepts
-   * Bearer. Scoped by baseUrl (not provider id/alias) so this only applies to
-   * the main Zen host (`opencode` / `opencode-zen`, both `https://opencode.ai/zen/v1`)
-   * and never to opencode-go, which serves Responses-format models from a
-   * different upstream (`https://opencode.ai/zen/go/v1`) that expects Bearer.
-   */
-  private usesZenApiKeyAuth(): boolean {
-    return this._requestFormat === "openai-responses" && this.config?.baseUrl === ZEN_BASE_URL;
-  }
-
   buildHeaders(
     credentials: ProviderCredentials | null,
     stream = true,
@@ -813,7 +823,7 @@ export class OpencodeExecutor extends BaseExecutor {
       : undefined;
 
     if (key) {
-      if (this._requestFormat === "claude" || this.usesZenApiKeyAuth()) {
+      if (this._requestFormat === "claude") {
         headers["x-api-key"] = key;
       } else {
         headers["Authorization"] = `Bearer ${key}`;

open-sse/executors/opencodeTransientFailure.ts

@@ -0,0 +1,17 @@
+/**
+ * opencodeTransientFailure.ts — retriable-upstream predicate for the opencode
+ * executor loop.
+ *
+ * Leaf module: one internal import only (isEmptyUpstreamRejection, same
+ * executors layer — no registry, no DB). 5xx short-circuits on status alone;
+ * the 400 arm delegates to the existing empty-rejection classifier.
+ */
+
+import { isEmptyUpstreamRejection } from "./accountRotation.ts";
+
+export function isRetriableUpstreamFailure(status: number, bodyText?: string): boolean {
+  if (status >= 500 && status < 600) return true;
+  if (status !== 400) return false;
+  if (typeof bodyText !== "string" || bodyText === "") return false;
+  return isEmptyUpstreamRejection(status, bodyText);
+}

open-sse/handlers/chatCore.ts

@@ -3167,6 +3167,7 @@ export async function handleChatCore({
                           onCredentialsRefreshed,
                           skipUpstreamRetry,
                           contextEditing: { enabled: contextEditingEnabled },
+                          correlationId,
                         })
                       ),
                   });
@@ -3353,6 +3354,7 @@ export async function handleChatCore({
                               onCredentialsRefreshed,
                               skipUpstreamRetry,
                               contextEditing: { enabled: contextEditingEnabled },
+                              correlationId,
                             })
                           ),
                       });
@@ -4009,6 +4011,7 @@ export async function handleChatCore({
                 onCredentialsRefreshed,
                 skipUpstreamRetry: isCombo,
                 contextEditing: { enabled: contextEditingEnabled },
+                correlationId,
               })
             )
           );

open-sse/handlers/chatCore/jsonBodyToSse.ts

@@ -88,33 +88,46 @@ async function sniffJsonBodyForSse(
   let sniffed = "";
   let sniffedBytes = 0;
   const maxSniffBytes = 4096;
-  while (sniffedBytes < maxSniffBytes) {
-    const chunk = await deps.withBodyTimeout<ReadableStreamReadResult<Uint8Array>>(reader.read());
-    if (chunk.done || !chunk.value) break;
-    bufferedChunks.push(chunk.value);
-    sniffedBytes += chunk.value.byteLength;
-    sniffed += decoder.decode(chunk.value, { stream: true });
+  // The two success paths below hand this still-open reader to
+  // prependBufferedChunks(), so the reader must NOT be cancelled on the happy
+  // path. Any other unwind (notably a withBodyTimeout rejection on a stalled
+  // upstream) would otherwise abandon the body with no cancellation, pinning
+  // the connection for the lifetime of the socket.
+  let handedOff = false;
+  try {
+    while (sniffedBytes < maxSniffBytes) {
+      const chunk = await deps.withBodyTimeout<ReadableStreamReadResult<Uint8Array>>(reader.read());
+      if (chunk.done || !chunk.value) break;
+      bufferedChunks.push(chunk.value);
+      sniffedBytes += chunk.value.byteLength;
+      sniffed += decoder.decode(chunk.value, { stream: true });
 
-    if (classifyBodyPrefix(sniffed) === "sse") {
-      const rebuiltHeaders = new Headers(providerResponse.headers);
-      rebuiltHeaders.delete("content-length");
-      rebuiltHeaders.set("content-type", "text/event-stream");
-      ctx.log?.debug?.(
-        "STREAM",
-        `Upstream returned SSE bytes with application/json content-type — preserving streaming body (${ctx.provider}/${ctx.model})`
-      );
-      return {
-        sseResponse: new Response(prependBufferedChunks(bufferedChunks, reader), {
-          status: providerResponse.status,
-          statusText: providerResponse.statusText,
-          headers: rebuiltHeaders,
-        }),
-        jsonBody: new Response(null),
-      };
+      if (classifyBodyPrefix(sniffed) === "sse") {
+        const rebuiltHeaders = new Headers(providerResponse.headers);
+        rebuiltHeaders.delete("content-length");
+        rebuiltHeaders.set("content-type", "text/event-stream");
+        ctx.log?.debug?.(
+          "STREAM",
+          `Upstream returned SSE bytes with application/json content-type — preserving streaming body (${ctx.provider}/${ctx.model})`
+        );
+        handedOff = true;
+        return {
+          sseResponse: new Response(prependBufferedChunks(bufferedChunks, reader), {
+            status: providerResponse.status,
+            statusText: providerResponse.statusText,
+            headers: rebuiltHeaders,
+          }),
+          jsonBody: new Response(null),
+        };
+      }
     }
-  }
 
-  return { jsonBody: new Response(prependBufferedChunks(bufferedChunks, reader)) };
+    handedOff = true;
+    return { jsonBody: new Response(prependBufferedChunks(bufferedChunks, reader)) };
+  } finally {
+    // Cancellation is best-effort: the body may already be errored or closed.
+    if (!handedOff) void reader.cancel().catch(() => {});
+  }
 }
 
 export async function maybeConvertJsonBodyToSse(

open-sse/services/accountFallback.ts

@@ -16,6 +16,7 @@ import {
   isNimFunctionDegraded,
 } from "../config/errorConfig.ts";
 import {
+  getOpencodeModelUnavailableMatch,
   getProviderErrorRuleMatch,
   resolveRuleMatchBody,
   honorsRuleLockScope,
@@ -1792,6 +1793,18 @@ export function checkFallbackError(
     return profile?.useUpstreamRetryHints ? detectRetryHint() : null;
   }
 
+  function ruleScopedResult(match: NonNullable<ReturnType<typeof getProviderErrorRuleMatch>>) {
+    const scaled = getScaledBaseCooldown(match.reason as RateLimitReasonValue, backoffLevel);
+    return {
+      shouldFallback: true,
+      cooldownMs: match.cooldownMs ?? scaled.cooldownMs,
+      baseCooldownMs: match.cooldownMs ?? scaled.baseCooldownMs,
+      configuredCooldownMs: match.cooldownMs,
+      newBackoffLevel: match.cooldownMs !== undefined ? 0 : scaled.newBackoffLevel,
+      reason: match.reason,
+      ruleScope: match.scope,
+    };
+  }
   function getScaledBaseCooldown(reason: RateLimitReasonValue, level = backoffLevel) {
     void reason;
     const baseCooldownMs =
@@ -2065,22 +2078,7 @@ export function checkFallbackError(
         headers,
         resolveRuleMatchBody(provider, structuredError ?? null, errorStr)
       );
-      if (forbiddenMatch) {
-        const scaled = getScaledBaseCooldown(
-          forbiddenMatch.reason as RateLimitReasonValue,
-          backoffLevel
-        );
-        const ruleCooldownMs = forbiddenMatch.cooldownMs;
-        return {
-          shouldFallback: true,
-          cooldownMs: ruleCooldownMs ?? scaled.cooldownMs,
-          baseCooldownMs: ruleCooldownMs ?? scaled.baseCooldownMs,
-          configuredCooldownMs: ruleCooldownMs,
-          newBackoffLevel: ruleCooldownMs !== undefined ? 0 : scaled.newBackoffLevel,
-          reason: forbiddenMatch.reason,
-          ruleScope: forbiddenMatch.scope,
-        };
-      }
+      if (forbiddenMatch) return ruleScopedResult(forbiddenMatch);
     }
 
     if (
@@ -2199,6 +2197,8 @@ export function checkFallbackError(
 
   // 400 — context overflow / malformed request / model access denied
   if (status === HTTP_STATUS.BAD_REQUEST) {
+    const modelUnavailable = getOpencodeModelUnavailableMatch(provider, status, headers, errorStr);
+    if (modelUnavailable) return ruleScopedResult(modelUnavailable);
     // Check structured error codes first (more reliable, no false positives)
     // OpenAI:  error.code === "model_not_found"
     // Anthropic: error.type === "not_found_error" / "permission_error"
@@ -2321,7 +2321,8 @@ export function formatRetryAfter(
   rateLimitedUntil: string | number | Date | null | undefined
 ): string {
   if (!rateLimitedUntil) return "";
-  const diffMs = new Date(rateLimitedUntil).getTime() - Date.now();
+  const diffMs = cooldownUntilMs(rateLimitedUntil) - Date.now();
+  if (!Number.isFinite(diffMs)) return "";
   if (diffMs <= 0) return "reset after 0s";
   const totalSec = Math.ceil(diffMs / 1000);
   const h = Math.floor(totalSec / 3600);

open-sse/services/combo/comboPredicates.ts

@@ -16,7 +16,11 @@ import {
   isLocalExecutionError,
   isModelCapacityOverloadError,
 } from "@/shared/utils/circuitBreaker";
-import { CONTEXT_OVERFLOW_PATTERNS, MODEL_ACCESS_DENIED_PATTERNS } from "../accountFallback.ts";
+import {
+  CONTEXT_OVERFLOW_PATTERNS,
+  MODEL_ACCESS_DENIED_PATTERNS,
+  cooldownUntilMs,
+} from "../accountFallback.ts";
 import { isResourceNotFoundResponse } from "../errorClassifier.ts";
 import { getTrustedLocalRateLimitResponse } from "../rateLimitManager/errors.ts";
 import type { ResolvedComboTarget } from "./types.ts";
@@ -476,7 +480,9 @@ export function normalizeConnectionStatus(value: unknown): string {
 
 export function hasFutureRateLimitUntil(value: unknown): boolean {
   if (value == null || value === "") return false;
-  const time = new Date(String(value)).getTime();
+  if (typeof value !== "string" && typeof value !== "number" && !(value instanceof Date))
+    return false;
+  const time = cooldownUntilMs(value);
   return Number.isFinite(time) && time > Date.now();
 }
 

open-sse/services/combo/targetExhaustion.ts

@@ -27,9 +27,11 @@ import {
 import { RateLimitReason } from "../../config/constants.ts";
 import { isProviderCircuitOpenResult, isRequestScopedUpstreamFailure } from "./comboPredicates.ts";
 import { isCloudflareFingerprintRejection } from "../errorClassifier.ts";
-// #10334 — agentrouter-exclusive predicate shared with the persistence layer
+// #10334 — connection-scope predicate shared with the persistence layer
 // (markAccountUnavailable) so the same-request combo skip and the persisted
 // connection cooldown agree on exactly which fallbackResult shapes qualify.
+// Exclusive in practice to agentrouter's "额度不足" rule: no opencode-family
+// rule matches 403 today, so only agentrouter reaches this predicate via 403.
 import { isAgentrouterConnectionQuotaScope } from "@/sse/services/auth";
 import type { ComboLogger, ResolvedComboTarget } from "./types.ts";
 
@@ -84,9 +86,9 @@ export type ComboExhaustionSets = {
 export type ApplyComboTargetExhaustionOptions = {
   result: { status: number; headers?: Headers | null };
   fallbackResult: Parameters<typeof isProviderExhaustedReason>[0] & {
-    /** #10334 — agentrouter-exclusive; see isAgentrouterConnectionQuotaScope
+    /** #10334 — agentrouter + opencode family; see isAgentrouterConnectionQuotaScope
      * (src/sse/services/auth.ts). Populated only for providers in
-     * HONORS_RULE_LOCK_SCOPE_PROVIDERS (today: agentrouter only). */
+     * HONORS_RULE_LOCK_SCOPE_PROVIDERS (agentrouter + opencode family). */
     ruleScope?: "model" | "provider" | "connection";
     permanent?: boolean;
   };
@@ -115,7 +117,8 @@ export function applyComboTargetExhaustion(
   const { result, sets, log, tag, errorText, structuredError } = opts;
   const provider = target.provider;
 
-  // #10334: agentrouter-exclusive account-wide quota exhaustion ("额度不足")
+  // #10334: connection-scope account-wide quota exhaustion (agentrouter "额度不足";
+  // exclusive in practice — no opencode-family rule matches 403 today)
   // must skip remaining SAME-CONNECTION targets within THIS request too, not
   // just via the persisted cooldown markAccountUnavailable applies for
   // whichever leg runs next. agentrouter is a passthroughModels provider
@@ -341,7 +344,8 @@ function markAuthLevelExhaustion(
 }
 
 /**
- * #10334: agentrouter-exclusive connection-scope account quota exhaustion. Mirrors
+ * #10334: connection-scope account quota exhaustion (agentrouter-exclusive in
+ * practice — see above). Mirrors
  * markAuthLevelExhaustion's connectionId-present/absent split — when the target carries a
  * connectionId, only that connection's account is exhausted (sibling agentrouter connections
  * for the same user may still have quota); fall back to whole-provider exhaustion only when no

open-sse/services/compression/compressionWorkerPool.ts

@@ -131,7 +131,7 @@ export class CompressionWorkerPool {
   }
   async close(): Promise<void> {
     for (const job of this.queue.splice(0)) job.resolve(unchanged(job.originalBody));
-    await Promise.all([...this.workers].map((slot) => this.remove(slot, true)));
+    await Promise.all([...this.workers].map((slot) => this.remove(slot)));
   }
   private spawn(): PoolWorker {
     const slot: PoolWorker = {
@@ -185,7 +185,10 @@ export class CompressionWorkerPool {
     slot.timeout = null;
     slot.job = null;
     job.resolve(result);
-    slot.idle = setTimeout(() => void this.remove(slot, false), this.idleMs);
+    // Idle eviction MUST terminate. Dropping the slot from the set only releases our
+    // reference - the thread, its MessagePort and its private heap outlive the pool
+    // for the whole process lifetime, invisible to process.memoryUsage(). (#12812)
+    slot.idle = setTimeout(() => void this.remove(slot), this.idleMs);
     slot.idle.unref();
     this.dispatch();
   }
@@ -193,13 +196,15 @@ export class CompressionWorkerPool {
     const job = slot.job;
     if (job) job.resolve(unchanged(job.originalBody));
     slot.job = null;
-    void this.remove(slot, true).finally(() => this.dispatch());
+    void this.remove(slot).finally(() => this.dispatch());
   }
-  private async remove(slot: PoolWorker, terminate: boolean): Promise<void> {
+  /** Drop a slot and release its OS thread. Removal always terminates: a pooled worker
+   *  has no other owner, so skipping terminate() strands the thread permanently. */
+  private async remove(slot: PoolWorker): Promise<void> {
     if (!this.workers.delete(slot)) return;
     if (slot.timeout) clearTimeout(slot.timeout);
     if (slot.idle) clearTimeout(slot.idle);
-    if (terminate) await slot.worker.terminate().catch(() => undefined);
+    await slot.worker.terminate().catch(() => undefined);
   }
 }
 

open-sse/services/compression/engines/llmlingua/worker.ts

@@ -234,7 +234,12 @@ function ensureWorker(): Worker {
 
   const { workerFile, execArgv } = resolveWorkerFile();
   const absoluteWorkerFile = path.resolve(workerFile);
-  const w = new Worker(pathToFileURL(absoluteWorkerFile).href, { execArgv });
+  // Pass the URL OBJECT, not `.href`. `new Worker()` treats a plain string as a
+  // filesystem path, so a "file://..." string is looked up literally and throws
+  // ERR_WORKER_PATH (a string arg must start with ./ or ../). Only a URL instance
+  // is interpreted as a file: URL. Spawn failures are swallowed by pump()'s catch,
+  // so getting this wrong silently disables compression instead of erroring.
+  const w = new Worker(pathToFileURL(absoluteWorkerFile), { execArgv });
 
   w.on("message", (reply: WorkerReply) => {
     const entry = pending.get(reply.id);

open-sse/services/compression/messageContent.ts

@@ -22,6 +22,12 @@ export function isTextBlock(value: unknown): value is TextBlock {
   );
 }
 
+export function isToolResultBlock(value: unknown): boolean {
+  return (
+    !!value && typeof value === "object" && (value as { type?: unknown }).type === "tool_result"
+  );
+}
+
 export function extractTextContent(content: ChatMessageLike["content"]): string {
   if (typeof content === "string") return content;
   if (!Array.isArray(content)) return "";
@@ -82,7 +88,14 @@ export function replaceTextContent(msg: ChatMessageLike, newText: string): ChatM
   });
 
   if (!replaced) {
-    return { ...msg, content: [{ type: "text", text: newText }, ...msg.content] };
+    // Anthropic requires every `tool_result` block to sit at the start of the
+    // user turn that answers a `tool_use`; a text block in front of them makes
+    // upstream reject the whole request with "tool_use ids were found without
+    // tool_result blocks immediately after" (#12890). Append the annotation in
+    // that case, and keep prepending everywhere else.
+    return msg.content.some(isToolResultBlock)
+      ? { ...msg, content: [...msg.content, { type: "text", text: newText }] }
+      : { ...msg, content: [{ type: "text", text: newText }, ...msg.content] };
   }
 
   return { ...msg, content };

open-sse/translator/helpers/schemaCoercion.ts

@@ -514,6 +514,13 @@ const SCHEMA_SLOT_KEYS = [
   "else",
   "unevaluatedProperties",
   "additionalItems",
+  // draft 2020-12 applicators whose value is a schema too. Without them a
+  // placeholder in either position falls through to the scalar branch at the
+  // bottom of the walker and is forwarded as a string, which is the shape this
+  // sanitizer exists to remove. The opencode plugin's own walker
+  // (@omniroute/opencode-plugin-v2/src/shared/gemini.ts) lists both.
+  "contentSchema",
+  "unevaluatedItems",
 ];
 
 function coerceIndexedObjectToArray(value: unknown): unknown[] | null {

open-sse/utils/stream.ts

@@ -145,6 +145,9 @@ type StreamCompletePayload = {
   interrupted?: boolean;
 };
 
+/** Queue budget every provider used before `streamBufferBytes` existed. */
+const DEFAULT_STREAM_BUFFER_BYTES = 16384;
+
 type StreamOptions = {
   mode?: string;
   targetFormat?: string;
@@ -160,6 +163,14 @@ type StreamOptions = {
    */
   dropResponsesCommentary?: boolean;
   customToolNames?: ReadonlySet<string>;
+  /**
+   * Byte budget for the transform's readable and writable queues.
+   *
+   * Defaults to the 16 KB every provider used before this was configurable. A
+   * high-throughput provider can raise it so provider -> client pacing stays
+   * ahead of the model's emission rate; nothing else should need to.
+   */
+  streamBufferBytes?: number;
   provider?: string | null;
   reqLogger?: StreamLogger | null;
   toolNameMap?: unknown;
@@ -655,6 +666,7 @@ export function createSSEStream(options: StreamOptions = {}) {
     dropResponsesCommentary,
     customToolNames = new Set<string>(),
     requestToolIdentityMap = null,
+    streamBufferBytes = DEFAULT_STREAM_BUFFER_BYTES,
   } = options;
   const signatureNamespace = connectionId;
   // Request-body-size metric (for monitoring payload size distribution & correlation with TTFT).
@@ -1103,7 +1115,8 @@ export function createSSEStream(options: StreamOptions = {}) {
       cacheHit: false,
       latencyMs: Date.now() - streamStartedAt,
       usage: timing.withTps(finalUsage),
-      costUsd, ttftMs: timing.ttftMs(),
+      costUsd,
+      ttftMs: timing.ttftMs(),
     });
     if (!comment) return;
     reqLogger?.appendConvertedChunk?.(comment);
@@ -2069,7 +2082,9 @@ export function createSSEStream(options: StreamOptions = {}) {
                   // estimate is now emitted in flush(), only when the upstream stayed silent.
                   if (isFinishChunk && hasValidUsage(usage) && !passthroughForwardedUsage) {
                     const buffered = addBufferToUsage(usage);
-                    parsed.usage = timing.withTps(filterUsageForFormat(buffered, sourceFormat || FORMATS.OPENAI));
+                    parsed.usage = timing.withTps(
+                      filterUsageForFormat(buffered, sourceFormat || FORMATS.OPENAI)
+                    );
                     output = `data: ${JSON.stringify(parsed)}\n\n`;
                     passthroughForwardedUsage = true;
                     injectedUsage = true;
@@ -3020,8 +3035,8 @@ export function createSSEStream(options: StreamOptions = {}) {
         clearIdleTimer();
       },
     },
-    { highWaterMark: 16384 },
-    { highWaterMark: 16384 }
+    { highWaterMark: streamBufferBytes },
+    { highWaterMark: streamBufferBytes }
   );
 }
 
@@ -3043,7 +3058,8 @@ export function createSSETransformStreamWithLogger(
   copilotCompatibleReasoning = false,
   suppressThinkClose = false,
   customToolNames: ReadonlySet<string> = new Set(),
-  requestToolIdentityMap: Map<string, { namespace: string; name: string }> | null = null
+  requestToolIdentityMap: Map<string, { namespace: string; name: string }> | null = null,
+  streamBufferBytes: number = DEFAULT_STREAM_BUFFER_BYTES
 ) {
   return createSSEStream({
     mode: STREAM_MODE.TRANSLATE,
@@ -3062,6 +3078,7 @@ export function createSSETransformStreamWithLogger(
     suppressThinkClose,
     customToolNames,
     requestToolIdentityMap,
+    streamBufferBytes,
   });
 }
 

package.json

@@ -125,8 +125,8 @@
     "electron:build:mac": "npm run build && cd electron && npm run build:mac",
     "electron:build:linux": "npm run build && cd electron && npm run build:linux",
     "electron:smoke:packaged": "node scripts/dev/smoke-electron-packaged.mjs",
-    "test": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-concurrency=20 tests/unit/*.test.ts \"tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,db,db-adapters,docs,gamification,guardrails,lib,mcp,memory,runtime,security,services,settings,shared,translator,ui,usage}/**/*.test.ts\" \"tests/unit/**/*.test.mjs\" && cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-concurrency=20 \"tests/unit/dashboard/**/*.test.ts\"",
-    "test:unit": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=20 tests/unit/*.test.ts \"tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,db,db-adapters,docs,gamification,guardrails,lib,mcp,memory,runtime,security,services,settings,shared,translator,ui,usage}/**/*.test.ts\" \"tests/unit/**/*.test.mjs\" && cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=20 \"tests/unit/dashboard/**/*.test.ts\" && npm run test:unit:serial",
+    "test": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 tests/unit/*.test.ts \"tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,db,db-adapters,docs,gamification,guardrails,lib,mcp,memory,runtime,security,services,settings,shared,translator,ui,usage}/**/*.test.ts\" \"tests/unit/**/*.test.mjs\" && cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 \"tests/unit/dashboard/**/*.test.ts\"",
+    "test:unit": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 tests/unit/*.test.ts \"tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,db,db-adapters,docs,gamification,guardrails,lib,mcp,memory,runtime,security,services,settings,shared,translator,ui,usage}/**/*.test.ts\" \"tests/unit/**/*.test.mjs\" && cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 \"tests/unit/dashboard/**/*.test.ts\" && npm run test:unit:serial",
     "test:unit:ci": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 tests/unit/*.test.ts \"tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,db,db-adapters,docs,gamification,guardrails,lib,mcp,memory,runtime,security,services,settings,shared,translator,ui,usage}/**/*.test.ts\" \"tests/unit/**/*.test.mjs\" && cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 \"tests/unit/dashboard/**/*.test.ts\" && npm run test:unit:serial",
     "test:unit:ci:shard": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 --test-shard=$TEST_SHARD tests/unit/*.test.ts \"tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,db,db-adapters,docs,gamification,guardrails,lib,mcp,memory,runtime,security,services,settings,shared,translator,ui,usage}/**/*.test.ts\" \"tests/unit/**/*.test.mjs\" && cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 --test-shard=$TEST_SHARD \"tests/unit/dashboard/**/*.test.ts\" && cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=1 --test-shard=$TEST_SHARD \"tests/unit/serial/**/*.test.ts\"",
     "test:unit:fast": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-isolation=none tests/unit/*.test.ts \"tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,db,db-adapters,docs,gamification,guardrails,lib,mcp,memory,runtime,security,services,settings,shared,translator,ui,usage}/**/*.test.ts\" \"tests/unit/**/*.test.mjs\" && cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-isolation=none \"tests/unit/dashboard/**/*.test.ts\" && npm run test:unit:serial",

skills/cli-resilience/SKILL.md

@@ -153,12 +153,12 @@ omniroute resilience profile
 omniroute resilience show
 ```
 
-### `resilience set`
+### `resilience set <name>`
 
 **Example:**
 
 ```bash
-omniroute resilience set
+omniroute resilience set <name>
 ```
 
 ### `resilience config`

src/app/api/a2a/status/route.ts

@@ -1,8 +1,9 @@
 import { NextResponse } from "next/server";
+import type { NextRequest } from "next/server";
 import { getTaskManager } from "@/lib/a2a/taskManager";
 import { getCachedSettings } from "@/lib/db/settings";
 
-export async function GET() {
+export async function GET(request?: NextRequest) {
   try {
     const [settings, stats] = await Promise.all([
       getCachedSettings(),
@@ -14,7 +15,7 @@ export async function GET() {
     if (enabled) {
       try {
         const agentModule = await import("@/app/.well-known/agent.json/route");
-        const cardResponse = await agentModule.GET();
+        const cardResponse = await agentModule.GET(request);
         agentCard = await cardResponse.json();
       } catch {
         agentCard = null;

src/app/api/auth/status/route.ts

@@ -1,25 +1,23 @@
 import { NextResponse } from "next/server";
 export const dynamic = "force-dynamic";
 import { cookies } from "next/headers";
-import { jwtVerify } from "jose";
-
-function getJwtSecret(): Uint8Array | null {
-  const secret = process.env.JWT_SECRET?.trim();
-  return secret ? new TextEncoder().encode(secret) : null;
-}
+import {
+  getDashboardJwtSecret,
+  verifyDashboardSessionToken,
+} from "@/shared/utils/dashboardSessionToken";
 
 export async function GET() {
   try {
     const cookieStore = await cookies();
     const token = cookieStore.get("auth_token")?.value;
-    const secret = getJwtSecret();
+    const secret = getDashboardJwtSecret();
 
     if (!token || !secret) {
       return NextResponse.json({ authenticated: false });
     }
 
-    await jwtVerify(token, secret);
-    return NextResponse.json({ authenticated: true });
+    const payload = await verifyDashboardSessionToken(token, secret);
+    return NextResponse.json({ authenticated: payload !== null });
   } catch {
     return NextResponse.json({ authenticated: false });
   }

src/app/api/settings/require-login/route.ts

@@ -1,6 +1,5 @@
 import { NextResponse } from "next/server";
 import { cookies } from "next/headers";
-import { jwtVerify } from "jose";
 import { isFeatureFlagEnabled } from "@/shared/utils/featureFlags";
 import { getSettings, updateSettings } from "@/lib/db/settings";
 import {
@@ -8,23 +7,19 @@ import {
   hashManagementPassword,
 } from "@/lib/auth/managementPassword";
 import { isAuthenticated } from "@/shared/utils/apiAuth";
+import {
+  getDashboardJwtSecret,
+  verifyDashboardSessionToken,
+} from "@/shared/utils/dashboardSessionToken";
 import { getNodeRuntimeSupport } from "@/shared/utils/nodeRuntimeSupport.ts";
 import { updateRequireLoginSchema } from "@/shared/validation/schemas";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 
-function getJwtSecret(): Uint8Array | null {
-  const secret = process.env.JWT_SECRET?.trim();
-  return secret ? new TextEncoder().encode(secret) : null;
-}
-
 async function checkSessionAuthenticated(): Promise<boolean> {
   try {
     const cookieStore = await cookies();
     const token = cookieStore.get("auth_token")?.value;
-    const secret = getJwtSecret();
-    if (!token || !secret) return false;
-    await jwtVerify(token, secret);
-    return true;
+    return (await verifyDashboardSessionToken(token, getDashboardJwtSecret())) !== null;
   } catch {
     return false;
   }

src/app/api/telegram/update/route.ts

@@ -13,12 +13,18 @@
  *   3. Handles /start (returns the Mini App deep link) and everything else
  *      as a chat prompt proxied through the OmniRoute pipeline.
  */
+import { timingSafeEqual } from "node:crypto";
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { validateBody, isValidationFailure } from "@/shared/validation/helpers";
 import type { TelegramUpdate } from "@/lib/telegram/botApi";
 import { extractChatMessage, sendTelegramMessage } from "@/lib/telegram/botApi";
-import { getTelegramBotToken, isTelegramEnabled } from "@/lib/telegram/config";
+import {
+  getTelegramBotToken,
+  getTelegramWebhookSecret,
+  isTelegramEnabled,
+  isTelegramWebhookSecretConfigured,
+} from "@/lib/telegram/config";
 import { verifyInitData, parseInitData } from "@/lib/telegram/initData";
 import { proxyChat } from "@/lib/telegram/chatProxy";
 import { formatTelegramGatewayError } from "@/lib/telegram/errorMessage";
@@ -33,7 +39,12 @@ import { resolveOmniRouteBaseUrl } from "@/shared/utils/resolveOmniRouteBaseUrl"
 const telegramBodySchema = z
   .object({
     initData: z.string().optional(),
-    message: z.string().optional(),
+    // `message` is a STRING on the Mini App path ({ initData, message }) and an
+    // OBJECT on the webhook path (a Telegram update). Constraining it to a
+    // string rejected every real webhook delivery with 400 before any auth or
+    // routing ran, so accept either shape here and let each branch validate the
+    // shape it actually needs.
+    message: z.union([z.string(), z.record(z.string(), z.unknown())]).optional(),
     update_id: z.number().optional(),
     // allow unknown update fields
   })
@@ -103,6 +114,21 @@ export async function POST(request: Request) {
   }
 
   // ── Bot webhook path: TelegramUpdate ─────────────────────────────────────
+  // Unlike the Mini App branch above (which verifies the initData HMAC), a
+  // webhook body carries no proof of origin: `chat.id` is attacker-chosen and
+  // reaches proxyChat(), which mints a real API key and spends upstream quota.
+  // Telegram's `secret_token` echo is the only authentication available here.
+  if (!isTelegramWebhookSecretConfigured()) {
+    return NextResponse.json(
+      { ok: false, error: "Telegram webhook secret not configured" },
+      { status: 503 }
+    );
+  }
+  const presentedSecret = request.headers.get("x-telegram-bot-api-secret-token") || "";
+  if (!webhookSecretMatches(presentedSecret, getTelegramWebhookSecret())) {
+    return NextResponse.json({ ok: false, error: "Unauthorized" }, { status: 401 });
+  }
+
   const update = body as unknown as TelegramUpdate;
   const chat = extractChatMessage(update);
   if (!chat) {
@@ -117,6 +143,22 @@ export async function POST(request: Request) {
   return NextResponse.json({ ok: true });
 }
 
+/**
+ * Constant-time comparison of the presented webhook secret against the
+ * configured one. A plain `===` short-circuits on the first differing byte and
+ * leaks the shared-prefix length through response timing; `timingSafeEqual`
+ * does not. It requires equal-length buffers, so a length mismatch is rejected
+ * up front (the length itself is not secret).
+ *
+ * Exported as a test seam only — not part of the route contract.
+ */
+export function webhookSecretMatches(presented: string, expected: string): boolean {
+  const a = Buffer.from(presented);
+  const b = Buffer.from(expected);
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+
 async function handleAndReply(chatId: number, text: string, messageId?: number): Promise<void> {
   try {
     const trimmed = text.trim();

src/app/api/tools/traffic-inspector/ws/route.ts

@@ -96,6 +96,14 @@ export async function GET(request: Request): Promise<Response> {
   }
 
   const acceptHeader = acceptKey(clientKey);
+
+  // The client can vanish during the upgrade round trip. `close` has then
+  // ALREADY fired, so the listeners below would never run and every resource
+  // acquired past this point would be held with no path to release it.
+  if (socket.destroyed) {
+    return new Response(null, { status: 101 });
+  }
+
   socket.write(
     [
       "HTTP/1.1 101 Switching Protocols",
@@ -106,21 +114,17 @@ export async function GET(request: Request): Promise<Response> {
     ].join("\r\n")
   );
 
-  const unsubscribe = globalTrafficBuffer.subscribe((ev) => {
-    sendText(socket, ev);
-  });
-
-  const pingTimer = setInterval(() => {
-    try {
-      socket.write(encodeWsFrame(0x09)); // ping
-    } catch {
-      cleanup();
-    }
-  }, PING_INTERVAL_MS);
+  let unsubscribe: (() => void) | null = null;
+  let pingTimer: ReturnType<typeof setInterval> | null = null;
+  let cleanedUp = false;
 
   function cleanup(): void {
-    clearInterval(pingTimer);
-    unsubscribe();
+    if (cleanedUp) return;
+    cleanedUp = true;
+    if (pingTimer) clearInterval(pingTimer);
+    pingTimer = null;
+    unsubscribe?.();
+    unsubscribe = null;
     try {
       socket.destroy();
     } catch {
@@ -128,14 +132,43 @@ export async function GET(request: Request): Promise<Response> {
     }
   }
 
-  socket.once("close", cleanup);
-  socket.once("error", cleanup);
-
-  // Never resolve — the socket is the response channel.
-  await new Promise<void>((resolve) => {
+  // Attached BEFORE any resource is acquired, so there is no window in which a
+  // subscriber or timer exists without a live path to cleanup().
+  const settled = new Promise<void>((resolve) => {
     socket.once("close", resolve);
     socket.once("error", resolve);
   });
+  socket.once("close", cleanup);
+  socket.once("error", cleanup);
+
+  // Re-check: `close` may have fired while we were writing the handshake, in
+  // which case the listeners above already ran and cleanup() is a no-op we
+  // still must not skip.
+  if (socket.destroyed) {
+    cleanup();
+    return new Response(null, { status: 101 });
+  }
+
+  unsubscribe = globalTrafficBuffer.subscribe((ev) => {
+    sendText(socket, ev);
+  });
+
+  pingTimer = setInterval(() => {
+    // `socket.write()` does NOT throw synchronously on a destroyed socket, so
+    // the destroyed check — not the catch — is what stops a dead interval.
+    if (socket.destroyed) {
+      cleanup();
+      return;
+    }
+    try {
+      socket.write(encodeWsFrame(0x09)); // ping
+    } catch {
+      cleanup();
+    }
+  }, PING_INTERVAL_MS);
+
+  // Never resolve — the socket is the response channel.
+  await settled;
 
   cleanup();
   return new Response(null, { status: 101 });

src/app/api/usage/call-logs/route.ts

@@ -36,6 +36,13 @@ function rowPriority(row: any): number {
  * `correlationId`. Running the same predicates over the merged rows closes that
  * gap. It is idempotent for DB rows (they already satisfy the predicate) while
  * correctly excluding in-memory rows that do not match.
+ *
+ * That idempotence is the contract, and it is only worth as much as the two
+ * predicates agree: a row the SQL WHERE accepted must survive this function, so
+ * every clause here has to be at least as wide as its counterpart in
+ * `buildCallLogFilterSql()` (src/lib/usage/callLogs.ts). Where it was narrower,
+ * the query returned the right rows and this pass deleted them again with nothing
+ * logged -- see the apiKey and combo clauses below.
  */
 export function rowMatchesFilter(row: any, filter: Record<string, any>): boolean {
   if (!filter) return true;
@@ -44,11 +51,18 @@ export function rowMatchesFilter(row: any, filter: Record<string, any>): boolean
     if (!(Number(row?.status) >= 400 || Boolean(row?.error))) return false;
   } else if (filter.status === "ok") {
     if (!(Number(row?.status) >= 200 && Number(row?.status) < 300)) return false;
-  } else if (typeof filter.status === "number" || (typeof filter.status === "string" && !isNaN(Number(filter.status)))) {
+  } else if (
+    typeof filter.status === "number" ||
+    (typeof filter.status === "string" && !isNaN(Number(filter.status)))
+  ) {
     if (Number(row?.status) !== Number(filter.status)) return false;
   }
 
-  if (filter.model && !matchesSearch(row?.model || "", String(filter.model))) {
+  if (
+    filter.model &&
+    !matchesSearch(row?.model || "", String(filter.model)) &&
+    !matchesSearch(row?.requestedModel || "", String(filter.model))
+  ) {
     return false;
   }
   if (filter.provider && !matchesSearch(row?.provider || "", String(filter.provider))) {
@@ -57,27 +71,39 @@ export function rowMatchesFilter(row: any, filter: Record<string, any>): boolean
   if (filter.account && !matchesSearch(row?.account || "", String(filter.account))) {
     return false;
   }
-  if (filter.apiKey && !matchesSearch(row?.apiKeyName || "", String(filter.apiKey))) {
+  if (
+    filter.apiKey &&
+    !matchesSearch(row?.apiKeyName || "", String(filter.apiKey)) &&
+    !matchesSearch(row?.apiKeyId || "", String(filter.apiKey))
+  ) {
     return false;
   }
-  if (filter.combo && !matchesSearch(row?.comboName || "", String(filter.combo))) {
+  if (filter.combo && row?.comboName == null) {
     return false;
   }
-  if (filter.correlationId && !matchesSearch(row?.correlationId || "", String(filter.correlationId))) {
+  if (
+    filter.correlationId &&
+    !matchesSearch(row?.correlationId || "", String(filter.correlationId))
+  ) {
     return false;
   }
   if (filter.search) {
     const term = String(filter.search);
     const haystack = [
       row?.model,
+      row?.requestedModel,
       row?.provider,
       row?.providerDisplay,
       row?.account,
       row?.apiKeyName,
+      row?.apiKeyId,
       row?.comboName,
+      row?.comboStepId,
+      row?.comboExecutionKey,
       row?.correlationId,
       row?.error,
       row?.path,
+      row?.status == null ? null : String(row.status),
     ]
       .filter(Boolean)
       .join(" ");

src/lib/acp/manager.ts

@@ -30,6 +30,34 @@ export interface AcpSession {
   createdAt: Date;
 }
 
+/**
+ * Upper bound for each per-session output buffer.
+ *
+ * Both buffers grow on every chunk a CLI agent writes and are only reset when
+ * the next prompt starts, so a chatty or looping agent can grow them without
+ * limit while the session stays alive. 1 MiB is far above a realistic agent
+ * response while keeping a stuck session's footprint bounded.
+ */
+const MAX_BUFFER_CHARS = 1_048_576;
+
+const TRUNCATION_NOTICE = "\n[...output truncated...]\n";
+
+/**
+ * Append to a buffer, keeping the most recent output when the cap is exceeded.
+ *
+ * The tail is what callers care about: `sendPrompt` resolves with the stdout
+ * collected since the prompt was written, and stderr is read for diagnostics
+ * after a failure. Dropping from the front keeps both useful.
+ */
+function appendCapped(buffer: string, chunk: string): string {
+  const combined = buffer + chunk;
+  if (combined.length <= MAX_BUFFER_CHARS) return combined;
+
+  const keep = MAX_BUFFER_CHARS - TRUNCATION_NOTICE.length;
+  if (keep <= 0) return combined.slice(-MAX_BUFFER_CHARS);
+  return TRUNCATION_NOTICE + combined.slice(-keep);
+}
+
 /**
  * ACP Session Manager
  *
@@ -79,17 +107,21 @@ export class AcpManager extends EventEmitter {
     };
 
     child.stdout?.on("data", (chunk: Buffer) => {
-      session.stdoutBuffer += chunk.toString();
+      session.stdoutBuffer = appendCapped(session.stdoutBuffer, chunk.toString());
       this.emit("stdout", { sessionId, data: chunk.toString() });
     });
 
     child.stderr?.on("data", (chunk: Buffer) => {
-      session.stderrBuffer += chunk.toString();
+      session.stderrBuffer = appendCapped(session.stderrBuffer, chunk.toString());
       this.emit("stderr", { sessionId, data: chunk.toString() });
     });
 
     child.on("exit", (code, signal) => {
       session.alive = false;
+      // Only kill() used to remove entries, so any agent that exited on its own
+      // stayed in the map forever. getActiveSessions() filters on `alive`, which
+      // hid the growth from callers.
+      this.sessions.delete(sessionId);
       this.emit("exit", { sessionId, code, signal });
     });
 
@@ -121,39 +153,46 @@ export class AcpManager extends EventEmitter {
     const session = this.sessions.get(sessionId);
     if (!session?.alive) throw new Error(`Session ${sessionId} is not alive`);
 
-    // Clear buffer before sending
+    // Clear buffers before sending. stderr is reset too: it was previously only
+    // ever appended to, so diagnostics for one prompt carried stale output from
+    // every earlier prompt in the session.
     session.stdoutBuffer = "";
+    session.stderrBuffer = "";
 
     // Send prompt
     this.sendInput(sessionId, prompt + "\n");
 
     // Wait for response (collect until process goes idle or timeout)
     return new Promise((resolve, reject) => {
-      const timer = setTimeout(() => {
-        reject(new Error(`ACP timeout after ${timeoutMs}ms`));
-      }, timeoutMs);
+      let idleTimer: ReturnType<typeof setTimeout> | undefined;
 
-      let idleTimer: ReturnType<typeof setTimeout>;
+      // Every outcome -- idle, exit, or timeout -- has to release the same
+      // resources. `acpManager` is a module-level singleton, so a branch that
+      // skips this leaks a listener per call for the lifetime of the process.
+      const settle = (finish: () => void) => {
+        clearTimeout(timer);
+        clearTimeout(idleTimer);
+        this.removeListener("stdout", onData);
+        this.removeListener("exit", onExit);
+        finish();
+      };
+
+      const timer = setTimeout(() => {
+        settle(() => reject(new Error(`ACP timeout after ${timeoutMs}ms`)));
+      }, timeoutMs);
 
       const onData = ({ sessionId: sid }: { sessionId: string }) => {
         if (sid !== sessionId) return;
         // Reset idle timer on new data
         clearTimeout(idleTimer);
         idleTimer = setTimeout(() => {
-          clearTimeout(timer);
-          this.removeListener("stdout", onData);
-          this.removeListener("exit", onExit);
-          resolve(session.stdoutBuffer);
+          settle(() => resolve(session.stdoutBuffer));
         }, 2000); // 2s idle = response complete
       };
 
       const onExit = ({ sessionId: sid }: { sessionId: string }) => {
         if (sid !== sessionId) return;
-        clearTimeout(timer);
-        clearTimeout(idleTimer);
-        this.removeListener("stdout", onData);
-        this.removeListener("exit", onExit);
-        resolve(session.stdoutBuffer);
+        settle(() => resolve(session.stdoutBuffer));
       };
 
       this.on("stdout", onData);

src/lib/agentSkills/cliRegistryParser.ts

@@ -104,6 +104,11 @@ const DESCRIPTION_RE = /\.description\(\s*["']([^"']+)["']/g;
 // Matches: .option("--flag ...", "desc") — capture group 1 = flag string
 const OPTION_RE = /\.option\(\s*["']([^"']+)["']/g;
 
+// Matches: .addArgument(new Argument("<name>")) or ("[name]") — group 1 = the
+// token including its brackets, so it reads the same as an inline positional
+// written straight into .command("stop <type>").
+const ARGUMENT_RE = /new\s+Argument\(\s*["'](<[^"']+>|\[[^"']+\])["']/g;
+
 // ── Parser helpers ───────────────────────────────────────────────────────────
 
 interface RawCommand {
@@ -157,6 +162,16 @@ function extractCommandsFromContent(content: string, topLevelName: string): RawC
       flags.push(optMatch[1]);
     }
 
+    // Positionals declared with .addArgument() rather than inline in the
+    // .command() string. Commander accepts both, and the generated page has
+    // no way to tell them apart, so they are appended to the name here.
+    const args: string[] = [];
+    ARGUMENT_RE.lastIndex = 0;
+    let argMatch: RegExpExecArray | null;
+    while ((argMatch = ARGUMENT_RE.exec(effectiveSlice)) !== null) {
+      args.push(argMatch[1]);
+    }
+
     // Compose full command name:
     // - If rawName equals the top-level name (or is the isDefault pattern), use as-is
     // - Otherwise, qualify as "topLevel subname"
@@ -166,7 +181,8 @@ function extractCommandsFromContent(content: string, topLevelName: string): RawC
       // Some files declare standalone root commands (e.g. serve, health)
       !rawName.includes(" ");
 
-    const fullName = isTopLevel && i === 0 ? rawName : `${topLevelName} ${rawName}`;
+    const base = isTopLevel && i === 0 ? rawName : `${topLevelName} ${rawName}`;
+    const fullName = args.length > 0 ? `${base} ${args.join(" ")}` : base;
 
     commands.push({ name: fullName.trim(), description, flags });
   }

src/lib/api/modelTestRunner.ts

@@ -3,7 +3,9 @@ import { POST as postChatCompletion } from "@/app/api/v1/chat/completions/route"
 import { POST as postAudioTranscription } from "@/app/api/v1/audio/transcriptions/route";
 import { handleValidatedEmbeddingRequestBody } from "@/app/api/v1/embeddings/route";
 import { POST as postRerank } from "@/app/api/v1/rerank/route";
+import { POST as postResponses } from "@/app/api/v1/responses/route";
 import {
+  buildComboTestPrompt,
   buildComboTestRequestBody,
   extractComboTestResponseText,
   extractComboTestStreamResult,
@@ -29,6 +31,10 @@ const ZAI_WEB_PROVIDER_ID = "zai-web";
 const ZAI_WEB_TEST_TIMEOUT_MS = 60_000;
 const SLOW_WEB_TEST_MODELS = new Set(["dola-pro"]);
 const STREAMING_CHAT_TEST_MAX_TOKENS = 64;
+// Responses calls the same budget `max_output_tokens`; `max_tokens` is silently
+// ignored on that endpoint, which would let a reasoning model spend the whole
+// default budget before emitting any visible text.
+const RESPONSES_TEST_MAX_OUTPUT_TOKENS = 256;
 
 function asRecord(value: unknown): Record<string, unknown> {
   return value && typeof value === "object" && !Array.isArray(value)
@@ -175,6 +181,26 @@ export function buildInternalChatRequest(
   });
 }
 
+export function buildInternalResponsesRequest(
+  testBody: Record<string, unknown>,
+  signal: AbortSignal,
+  connectionId?: string
+) {
+  return new Request(`${INTERNAL_ORIGIN}/v1/responses`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "X-Internal-Test": "combo-health-check",
+      "X-OmniRoute-No-Cache": "true",
+      "X-OmniRoute-Compression": "off",
+      "X-Request-Id": `model-test-${randomUUID()}`,
+      ...(connectionId ? { "X-OmniRoute-Connection": connectionId } : {}),
+    },
+    body: JSON.stringify(testBody),
+    signal,
+  });
+}
+
 export function buildInternalRerankRequest(
   testBody: Record<string, unknown>,
   signal: AbortSignal,
@@ -265,7 +291,22 @@ export function detectTestKind(modelStr: string, customModel: any, nodeApiType?:
       lowerModel.includes("text-embed") ||
       lowerModel.includes("jina-clip") ||
       lowerModel.includes("colbert"));
-  return { isRerank, isEmbedding, isAudioTranscription };
+  // A Responses node answers on /v1/responses only. Without this the model fell
+  // through to the chat branch below, which posts a Chat Completions body to
+  // /v1/chat/completions: the route can still answer 200 while carrying nothing a
+  // Chat Completions reader recognises, so the model was marked unhealthy with
+  // "Provider returned HTTP 200 but no text content" (#13070).
+  //
+  // Last in the chain deliberately: a Responses-typed node can still host an
+  // embedding or rerank model, and those endpoints stay right for it.
+  const isResponses =
+    !isAudioTranscription &&
+    !isRerank &&
+    !isEmbedding &&
+    (apiFormat === "responses" ||
+      nodeType === "responses" ||
+      supportedEndpoints.includes("responses"));
+  return { isRerank, isEmbedding, isAudioTranscription, isResponses };
 }
 
 /**
@@ -424,7 +465,7 @@ export async function runSingleModelTest(
     findCustomModelMetadata(providerId, fullModelStr),
     findProviderNodeApiType(providerId),
   ]);
-  const { isRerank, isEmbedding, isAudioTranscription } = detectTestKind(
+  const { isRerank, isEmbedding, isAudioTranscription, isResponses } = detectTestKind(
     fullModelStr,
     customModel,
     nodeApiType
@@ -443,10 +484,22 @@ export async function runSingleModelTest(
       }
     : isAudioTranscription
       ? { model: fullModelStr }
-      : buildComboTestRequestBody(fullModelStr, isEmbedding, {
-          stream: !isEmbedding && streamChat,
-          maxTokens: !isEmbedding && streamChat ? STREAMING_CHAT_TEST_MAX_TOKENS : undefined,
-        });
+      : isResponses
+        ? {
+            model: fullModelStr,
+            // Responses takes `input`, not `messages`.
+            input: buildComboTestPrompt(),
+            max_output_tokens: RESPONSES_TEST_MAX_OUTPUT_TOKENS,
+            // Non-streaming on purpose: the SSE reader below understands Chat
+            // Completions deltas and the `output_text`/`output[]` shapes, but not
+            // Responses stream events (`response.output_text.delta`), so a
+            // streamed answer would read as empty — the very failure being fixed.
+            stream: false,
+          }
+        : buildComboTestRequestBody(fullModelStr, isEmbedding, {
+            stream: !isEmbedding && streamChat,
+            maxTokens: !isEmbedding && streamChat ? STREAMING_CHAT_TEST_MAX_TOKENS : undefined,
+          });
 
   // Per-model AbortController. We track whether the timeout fired so we can
   // distinguish "rate-limit queue aborted" (withRateLimit threw AbortError
@@ -473,6 +526,9 @@ export async function runSingleModelTest(
         buildInternalAudioTranscriptionRequest(fullModelStr, signal, connectionId)
       );
     }
+    if (isResponses) {
+      return postResponses(buildInternalResponsesRequest(testBody, signal, connectionId));
+    }
     return postChatCompletion(buildInternalChatRequest(testBody, signal, connectionId));
   };
 
@@ -577,7 +633,7 @@ export async function runSingleModelTest(
       // deactivated") would run outside runAsProbe and could still reach
       // markAccountUnavailable (#9817).
       const parsedResponse = await runAsProbe(() =>
-        extractModelTestResponseText(res, !isEmbedding && !isRerank && streamChat)
+        extractModelTestResponseText(res, !isEmbedding && !isRerank && !isResponses && streamChat)
       );
       responseText = parsedResponse.text;
       streamError = parsedResponse.error;

src/lib/cli-helper/log-streamer.ts

@@ -38,30 +38,37 @@ export function createLogStream(options: LogStreamOptions = {}): LogStream {
 
         if (!response.ok) {
           controller.error(new Error(`HTTP ${response.status}: ${response.statusText}`));
-          clearTimeout(timeoutId);
           return;
         }
 
         if (!response.body) {
           controller.error(new Error("Response body is null"));
-          clearTimeout(timeoutId);
           return;
         }
 
         const reader = response.body.getReader();
 
-        while (true) {
-          const { done, value } = await reader.read();
-          if (done) break;
-          if (signal.aborted) break;
-          controller.enqueue(value);
+        try {
+          while (true) {
+            const { done, value } = await reader.read();
+            if (done) break;
+            if (signal.aborted) break;
+            controller.enqueue(value);
+          }
+        } finally {
+          // Leaving the loop early (abort/throw) otherwise keeps the body locked
+          // and its socket held until GC.
+          await reader.cancel().catch(() => {});
         }
 
         controller.close();
-        clearTimeout(timeoutId);
       } catch (err) {
         if (signal.aborted) return; // Expected stop
         controller.error(err instanceof Error ? err : new Error(String(err)));
+      } finally {
+        // `stop()` aborts mid-fetch and returns through the `signal.aborted`
+        // branch above, so clearing the timer on the individual exit paths
+        // misses the one path stop() is built to take.
         clearTimeout(timeoutId);
       }
     },

src/lib/combos/testHealth.ts

@@ -112,7 +112,7 @@ function getRandomFiveDigitNumber() {
   return COMBO_TEST_OPERAND_MIN + Math.floor(Math.random() * COMBO_TEST_OPERAND_RANGE);
 }
 
-function buildComboTestPrompt() {
+export function buildComboTestPrompt() {
   const left = getRandomFiveDigitNumber();
   const right = getRandomFiveDigitNumber();
 

src/lib/db/adapters/nodeSqliteAdapter.ts

@@ -35,26 +35,34 @@ export async function createNodeSqliteAdapter(filePath: string): Promise<SqliteA
   }, CHECKPOINT_INTERVAL_MS);
   (checkpointTimer as unknown as NodeJS.Timeout).unref?.();
 
+  // Declared before gracefulClose so the close path can detach them. Without
+  // this, every closed adapter leaves three closures pinned on `process` --
+  // each holding this adapter and its DatabaseSync handle alive -- and short-
+  // lived adapters (POST /api/db-backups/import opens one per request) trip
+  // Node's MaxListenersExceededWarning. #7494 fixed exactly this for sql.js.
+  const onBeforeExit = () => {
+    adapter.close();
+  };
+  const onSignal = () => {
+    adapter.close();
+    process.exit(0);
+  };
+
   function gracefulClose() {
     clearInterval(checkpointTimer as unknown as NodeJS.Timeout);
     try {
       db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
     } catch {}
+    process.removeListener("beforeExit", onBeforeExit);
+    process.removeListener("SIGINT", onSignal);
+    process.removeListener("SIGTERM", onSignal);
   }
 
   const adapter = createNodeSqliteAdapterFromDatabase(db, filePath, gracefulClose);
 
-  process.once("beforeExit", () => {
-    adapter.close();
-  });
-  process.once("SIGINT", () => {
-    adapter.close();
-    process.exit(0);
-  });
-  process.once("SIGTERM", () => {
-    adapter.close();
-    process.exit(0);
-  });
+  process.once("beforeExit", onBeforeExit);
+  process.once("SIGINT", onSignal);
+  process.once("SIGTERM", onSignal);
 
   return adapter;
 }

src/lib/gamification/notifications.ts

@@ -110,6 +110,13 @@ export function createBadgeNotificationStream(
         }
       };
 
+      // A client that disconnects while the route is still awaiting auth
+      // arrives here already aborted, and "abort" will never fire again --
+      // the timers above would then run for the lifetime of the process.
+      if (signal?.aborted) {
+        cleanup();
+        return;
+      }
       if (signal) {
         signal.addEventListener("abort", cleanup);
       }

src/lib/guardrails/piiMasker.ts

@@ -57,11 +57,18 @@ function applyToContentValue(
           modified ||= result.modified;
           record.text = result.text;
         }
-        if (typeof record.content === "string") {
-          const result = sanitizeStringValue(record.content);
-          detections.push(...result.detections);
+        // Recurse rather than only masking a string `content`. A tool_result
+        // block carries its payload as an array of parts, which is what every
+        // agentic client sends back, and the string-only test walked straight
+        // past it: the outer text block was redacted while the tool output next
+        // to it reached the provider intact. This is the same call
+        // sanitizeMessageLikeList already makes one level up, so the two agree
+        // on how deep masking goes. The payload is a JSON round-trip, so it is
+        // acyclic and the recursion is bounded by its nesting.
+        if ("content" in record) {
+          const result = applyToContentValue(record.content, detections);
           modified ||= result.modified;
-          record.content = result.text;
+          record.content = result.value;
         }
         return record;
       }

src/lib/guardrails/promptInjection.ts

@@ -1,6 +1,6 @@
 import { BaseGuardrail, type GuardrailContext, type GuardrailResult } from "./base";
 import {
-  MAX_INJECTION_SCAN_BYTES,
+  buildInjectionScanText,
   extractMessageContents,
   sanitizeRequest,
 } from "@/shared/utils/inputSanitizer";
@@ -191,14 +191,10 @@ export function evaluatePromptInjection(
     warn() {},
   } as Console);
   const contents = extractMessageContents(body);
-  // Bound the custom-pattern scan to the first 16 KB, matching detectInjection's
-  // cap inside sanitizeRequest above (hot-path perf, #3932 / #4041). Injection
-  // directives sit near the top; scanning the full join buys only CPU/GC.
-  const joinedContents = contents.join("\n");
-  const scanText =
-    joinedContents.length > MAX_INJECTION_SCAN_BYTES
-      ? joinedContents.slice(0, MAX_INJECTION_SCAN_BYTES)
-      : joinedContents;
+  // Same 16 KB budget as detectInjection, and now the same bytes: custom
+  // patterns and built-in ones disagreeing about what was scanned would be its
+  // own bug (hot-path perf, #3932 / #4041).
+  const scanText = buildInjectionScanText(contents.join("\n"));
   const customDetections = detectWithPatterns(scanText, patterns);
   const existingDetections = new Set(
     sanitizerResult.detections.map((d: Detection) => `${d.pattern}:${d.match}:${d.severity}`)

src/lib/plugins/loader.ts

@@ -9,6 +9,7 @@
  */
 
 import { spawn } from "child_process";
+import type { ChildProcess } from "child_process";
 import { writeFile, readFile } from "fs/promises";
 import { rmSync } from "fs";
 import { join } from "path";
@@ -105,6 +106,37 @@ function forwardChildOutput(
  * against process exit — under `node --test --test-force-exit` the runner exits
  * before the promise settles, leaking one temp .mjs per plugin load.
  */
+/** Children already escalating to SIGKILL. Prevents re-arming a second timer + listener
+ *  for a child that is already being killed. */
+const escalating = new WeakSet<ChildProcess>();
+
+/**
+ * SIGTERM has already been sent; escalate to SIGKILL if the child ignores it.
+ *
+ * Must be idempotent per child. Every hook timeout hits this path, and a plugin that
+ * traps SIGTERM keeps taking calls, so re-arming would add one exit listener plus one
+ * killTimer closure per timeout — Node starts printing MaxListenersExceededWarning at 11.
+ * One pending kill per child is also all that is useful: SIGKILL cannot be ignored, so a
+ * second timer would only re-signal a corpse. (#12819)
+ */
+function escalateToSigkill(child: ChildProcess): void {
+  if (escalating.has(child)) return;
+  escalating.add(child);
+
+  const onExit = () => {
+    clearTimeout(killTimer);
+    escalating.delete(child);
+  };
+  const killTimer = setTimeout(() => {
+    child.removeListener("exit", onExit);
+    escalating.delete(child);
+    try {
+      child.kill("SIGKILL");
+    } catch {}
+  }, SIGKILL_GRACE_MS);
+  child.once("exit", onExit);
+}
+
 function removeHostScript(path: string): void {
   try {
     rmSync(path, { force: true });
@@ -293,12 +325,7 @@ export async function loadPlugin(
         }
         child.kill("SIGTERM");
         // Escalate to SIGKILL if plugin ignores SIGTERM
-        const killTimer = setTimeout(() => {
-          try {
-            child.kill("SIGKILL");
-          } catch {}
-        }, SIGKILL_GRACE_MS);
-        child.once("exit", () => clearTimeout(killTimer));
+        escalateToSigkill(child);
         reject(new Error(`Plugin hook '${hook}' timed out after ${timeout}ms`));
       }, timeout);
 
@@ -399,12 +426,7 @@ export async function loadPlugin(
   const cleanup = () => {
     child.kill("SIGTERM");
     // Escalate to SIGKILL after grace period
-    const killTimer = setTimeout(() => {
-      try {
-        child.kill("SIGKILL");
-      } catch {}
-    }, SIGKILL_GRACE_MS);
-    child.once("exit", () => clearTimeout(killTimer));
+    escalateToSigkill(child);
     removeHostScript(hostScriptPath);
     log.info("loader.cleanup", { name: manifest.name });
   };

src/lib/telegram/botApi.ts

@@ -5,7 +5,12 @@
  * replies and setWebhook for webhook registration. Streaming is emulated
  * by the caller via progressive edits (sendMessage / editMessageText).
  */
-import { getTelegramBotApiBase, getTelegramBotToken, getTelegramWebhookTimeoutMs } from "./config";
+import {
+  getTelegramBotApiBase,
+  getTelegramBotToken,
+  getTelegramWebhookTimeoutMs,
+  getTelegramWebhookSecret,
+} from "./config";
 
 export interface TelegramSendMessageParams {
   chat_id: number | string;
@@ -92,7 +97,15 @@ export async function setTelegramWebhook(
   opts: { dropPending?: boolean } = {}
 ): Promise<{ url: string; pending_update_count?: number }> {
   if (url) {
-    return botFetch("setWebhook", { url, drop_pending_updates: opts.dropPending ?? true });
+    // Register the shared secret so Telegram echoes it back as
+    // X-Telegram-Bot-Api-Secret-Token on every delivery; the webhook route
+    // rejects deliveries that do not carry it (#13172).
+    const secret = getTelegramWebhookSecret();
+    return botFetch("setWebhook", {
+      url,
+      drop_pending_updates: opts.dropPending ?? true,
+      ...(secret ? { secret_token: secret } : {}),
+    });
   }
   return botFetch("deleteWebhook", { drop_pending_updates: opts.dropPending ?? true });
 }

src/lib/telegram/chatProxy.ts

@@ -21,11 +21,31 @@ const DEFAULT_MODEL = process.env.TELEGRAM_DEFAULT_MODEL || "auto/chat";
  * Resolve (and lazily mint) an OmniRoute API key for a Telegram user.
  * Returns the plaintext key value, cached per user id.
  */
+// Bounded LRU. The webhook path passes a caller-supplied chat id, so the key
+// space is not limited to the real user population and an uncapped Map would
+// grow for the lifetime of the process. Insertion order is the recency order:
+// a hit re-inserts, and the oldest entry is dropped once the cap is reached.
+const KEY_CACHE_MAX_ENTRIES = 1000;
 const keyCache = new Map<number, string>();
 
+function rememberUserApiKey(telegramUserId: number, key: string): void {
+  // Re-insert so this id becomes the most recently used entry.
+  keyCache.delete(telegramUserId);
+  keyCache.set(telegramUserId, key);
+  while (keyCache.size > KEY_CACHE_MAX_ENTRIES) {
+    const oldest = keyCache.keys().next();
+    if (oldest.done) break;
+    keyCache.delete(oldest.value);
+  }
+}
+
 export async function resolveUserApiKey(telegramUserId: number): Promise<string> {
   const cached = keyCache.get(telegramUserId);
-  if (cached) return cached;
+  if (cached) {
+    // Refresh recency so an active user is not evicted by a burst of new ids.
+    rememberUserApiKey(telegramUserId, cached);
+    return cached;
+  }
 
   const machineId = (await getConsistentMachineId().catch(() => null)) || "0000000000000000";
 
@@ -39,12 +59,12 @@ export async function resolveUserApiKey(telegramUserId: number): Promise<string>
   );
   const matchKey = (match as { key?: string } | undefined)?.key;
   if (typeof matchKey === "string" && matchKey.length > 0) {
-    keyCache.set(telegramUserId, matchKey);
+    rememberUserApiKey(telegramUserId, matchKey);
     return matchKey;
   }
 
   const created = await createApiKey(`telegram:${telegramUserId}`, machineId);
-  keyCache.set(telegramUserId, created.key);
+  rememberUserApiKey(telegramUserId, created.key);
   return created.key;
 }
 

src/lib/telegram/config.ts

@@ -25,6 +25,30 @@ export function getTelegramWebhookTimeoutMs(): number {
   return Number.isInteger(parsed) && parsed > 0 ? parsed : DEFAULT_WEBHOOK_TIMEOUT_MS;
 }
 
+/**
+ * Shared secret for authenticating Telegram webhook deliveries.
+ *
+ * Telegram echoes the `secret_token` passed to `setWebhook` back on every
+ * delivery in the `X-Telegram-Bot-Api-Secret-Token` header, which is the only
+ * way to prove a webhook POST actually came from Telegram. Kept in the
+ * environment alongside the bot token so it is never stored in the DB.
+ */
+export function getTelegramWebhookSecret(): string {
+  return process.env.TELEGRAM_WEBHOOK_SECRET || "";
+}
+
+/**
+ * Whether webhook deliveries are authenticated.
+ *
+ * When no secret is configured the webhook path is rejected outright rather
+ * than served unauthenticated: an open path mints API keys and spends upstream
+ * quota for any caller (see #13172). The Mini App path is unaffected — it
+ * authenticates with the initData HMAC and does not use this secret.
+ */
+export function isTelegramWebhookSecretConfigured(): boolean {
+  return getTelegramWebhookSecret().length > 0;
+}
+
 export function getTelegramBotApiBase(): string {
   return process.env.TELEGRAM_BOT_API_BASE || "https://api.telegram.org";
 }

src/lib/usage/callLogArtifacts.ts

@@ -17,6 +17,17 @@ const OMITTED_FOR_SIZE_LIMIT = "[omitted: call log artifact size limit exceeded]
 const STREAM_CHUNKS_OMITTED_FOR_SIZE_LIMIT =
   "[stream chunks omitted: call log artifact size limit exceeded]";
 
+/**
+ * True for a placeholder a size-limit fallback wrote in place of a real
+ * payload. Consumers that fall back from one artifact field to another
+ * (`maybeEnrichCompletedDetail`) must treat a marker as absent: it is a
+ * non-empty string, so a bare truthiness check happily "recovers" it and
+ * overwrites the real value it was meant to stand in for.
+ */
+export function isSizeLimitOmissionMarker(value: unknown): boolean {
+  return value === OMITTED_FOR_SIZE_LIMIT || value === STREAM_CHUNKS_OMITTED_FOR_SIZE_LIMIT;
+}
+
 // The error is the only field that says *why* a request failed, and it is
 // typically ~90 bytes next to the multi-hundred-KB bodies that trip the cap.
 // Dropping it made a size-limited row undiagnosable: a provider outage, a local
@@ -182,33 +193,49 @@ function buildMinimalArtifactForSizeLimit(artifact: CallLogArtifact) {
   };
 }
 
-function serializeFinalSizeLimitFallback(artifact: CallLogArtifact, maxBytes: number): string {
-  const withSummary = JSON.stringify(buildMinimalArtifactForSizeLimit(artifact));
-  if (Buffer.byteLength(withSummary) <= maxBytes) {
-    return withSummary;
-  }
-
-  // The summary alone exceeded the cap (pathological). Keep the error so the
-  // row stays diagnosable, drop everything else including the summary body.
-  const errorOnly = JSON.stringify({
-    schemaVersion: artifact.schemaVersion,
-    _omniroute_truncated: true,
-    reason: SIZE_LIMIT_EXCEEDED_REASON,
+/**
+ * Fallback ladder for an artifact that does not fit its byte budget, ordered
+ * from "keeps the most" to "keeps the least": the first stage that fits wins.
+ *
+ * Ordering rule: drop the payload that most plausibly tripped the cap, and
+ * drop a payload that is *duplicated elsewhere in the artifact* before one
+ * that is unique. `pipeline` carries both sides of the exchange already
+ * translated (`clientRawRequest`/`providerRequest`/`providerResponse`/
+ * `clientResponse`), so evicting it to keep `requestBody` traded the whole
+ * upstream exchange -- including the only record of what the provider
+ * actually answered -- for a raw client prompt the pipeline already holds a
+ * translated copy of. Bodies go first now, and `pipeline` survives one stage
+ * longer; the previous order is still reached when dropping the bodies alone
+ * is not enough.
+ *
+ * Two consumers depend on that ordering, not just human diagnosis:
+ * `resolvePreviousResponseState` (db/responsesContinuationStore.ts) rebuilds
+ * `previous_response_id` history from `pipeline.clientRawRequest` /
+ * `pipeline.clientResponse` and returns null -- forcing the client to resend
+ * full history -- for any artifact whose pipeline was omitted; and
+ * `maybeEnrichCompletedDetail` (usage/completedRequestDetails.ts) reads
+ * `pipeline.providerResponse` in preference to `responseBody`.
+ */
+function buildSizeLimitStages(artifact: CallLogArtifact): Array<() => unknown> {
+  const omitBodies = <T extends object>(value: T) => ({
+    ...value,
+    requestBody: OMITTED_FOR_SIZE_LIMIT,
+    responseBody: OMITTED_FOR_SIZE_LIMIT,
     error: preserveErrorForSizeLimit(artifact.error),
   });
-  if (Buffer.byteLength(errorOnly) <= maxBytes) {
-    return errorOnly;
-  }
 
-  // Last resort: even the error-only payload did not fit. The error still
-  // rides along -- without it this row says only "something was too big",
-  // which is the state this change exists to remove.
-  return JSON.stringify({
-    schemaVersion: artifact.schemaVersion,
-    _omniroute_truncated: true,
-    reason: SIZE_LIMIT_EXCEEDED_REASON,
-    error: preserveErrorForSizeLimit(artifact.error),
-  });
+  return [
+    () => truncateArtifactForStorage(artifact),
+    // Bodies alone: worth a stage only when there is a pipeline to keep in
+    // exchange. Without one it produces the same bytes as the stage two lines
+    // below, so it is left out rather than costing a redundant stringify.
+    ...(artifact.pipeline ? [() => omitBodies(artifact)] : []),
+    () => omitOversizedPipeline(artifact),
+    () => omitBodies(omitOversizedPipeline(artifact)),
+    // The summary alone exceeded the cap (pathological). Keep the error so the
+    // row stays diagnosable, drop everything else including the summary body.
+    () => buildMinimalArtifactForSizeLimit(artifact),
+  ];
 }
 
 function serializeArtifactForStorage(artifact: CallLogArtifact): string {
@@ -227,27 +254,22 @@ function serializeArtifactForStorage(artifact: CallLogArtifact): string {
     return serialized;
   }
 
-  const truncated = JSON.stringify(truncateArtifactForStorage(artifact));
-  if (Buffer.byteLength(truncated) <= maxBytes) {
-    return truncated;
+  for (const buildStage of buildSizeLimitStages(artifact)) {
+    const candidate = JSON.stringify(buildStage());
+    if (Buffer.byteLength(candidate) <= maxBytes) {
+      return candidate;
+    }
   }
 
-  const withoutPipeline = JSON.stringify(omitOversizedPipeline(artifact));
-  if (Buffer.byteLength(withoutPipeline) <= maxBytes) {
-    return withoutPipeline;
-  }
-
-  const minimal = JSON.stringify({
-    ...omitOversizedPipeline(artifact),
-    requestBody: OMITTED_FOR_SIZE_LIMIT,
-    responseBody: OMITTED_FOR_SIZE_LIMIT,
+  // Last resort: not even the summary fit. The error still rides along --
+  // without it this row says only "something was too big", which is the state
+  // the size-limit fallbacks exist to remove.
+  return JSON.stringify({
+    schemaVersion: artifact.schemaVersion,
+    _omniroute_truncated: true,
+    reason: SIZE_LIMIT_EXCEEDED_REASON,
     error: preserveErrorForSizeLimit(artifact.error),
   });
-  if (Buffer.byteLength(minimal) <= maxBytes) {
-    return minimal;
-  }
-
-  return serializeFinalSizeLimitFallback(artifact, maxBytes);
 }
 
 export function writeCallArtifact(

src/lib/usage/completedRequestDetails.ts

@@ -50,13 +50,14 @@ export function clearCompletedDetails() {
   completedDetails.clear();
 }
 
+function isUnset(value: unknown): boolean {
+  return value === undefined || value === null;
+}
+
 export function maybeEnrichCompletedDetail(updated: PendingRequestDetail, connectionId: string) {
   void (async () => {
     try {
-      const missingProvider =
-        updated.providerResponse === undefined || updated.providerResponse === null;
-      const missingClient = updated.clientResponse === undefined || updated.clientResponse === null;
-      if (!missingProvider && !missingClient) return;
+      if (!isUnset(updated.providerResponse) && !isUnset(updated.clientResponse)) return;
 
       const db = getDbInstance();
       const sinceIso = new Date(Date.now() - 30_000).toISOString();
@@ -67,24 +68,32 @@ export function maybeEnrichCompletedDetail(updated: PendingRequestDetail, connec
         .all(connectionId, updated.model, sinceIso) as Array<{ artifact_relpath: string | null }>;
       for (const row of rows) {
         if (!row.artifact_relpath) continue;
-        const { readCallArtifact } = await import("./callLogArtifacts");
+        const { readCallArtifact, isSizeLimitOmissionMarker } = await import("./callLogArtifacts");
         const art = readCallArtifact(row.artifact_relpath);
         if (art.state !== "ready" || !art.artifact) continue;
         const pipeline = art.artifact.pipeline as
           | { providerResponse?: unknown; clientResponse?: unknown }
           | undefined;
-        if (missingProvider && pipeline?.providerResponse) {
+        // pipeline.* first: it is the translated payload of one specific side.
+        // `responseBody` is a single coarse value handed to both sides, so it
+        // may only fill a side still empty AFTER the pipeline had its turn --
+        // testing emptiness once before the loop let it overwrite the payload
+        // just recovered, showing a provider payload as the client response.
+        if (isUnset(updated.providerResponse) && pipeline?.providerResponse) {
           updated.providerResponse = pipeline.providerResponse;
         }
-        if (missingClient && pipeline?.clientResponse) {
+        if (isUnset(updated.clientResponse) && pipeline?.clientResponse) {
           updated.clientResponse = pipeline.clientResponse;
         }
-        if (
-          (missingProvider && art.artifact.responseBody) ||
-          (missingClient && art.artifact.responseBody)
-        ) {
-          if (missingProvider) updated.providerResponse = art.artifact.responseBody;
-          if (missingClient) updated.clientResponse = art.artifact.responseBody;
+        // A size-limited artifact stores an omission marker string in place of
+        // the body. It is truthy, so recovering it here overwrites a real
+        // payload with "[omitted: ...]".
+        const responseBody = isSizeLimitOmissionMarker(art.artifact.responseBody)
+          ? null
+          : art.artifact.responseBody;
+        if (responseBody) {
+          if (isUnset(updated.providerResponse)) updated.providerResponse = responseBody;
+          if (isUnset(updated.clientResponse)) updated.clientResponse = responseBody;
         }
         if (updated.providerResponse || updated.clientResponse) {
           if (completedDetails.has(updated.id)) storeCompletedDetail(updated);

src/lib/ws/handshake.ts

@@ -1,4 +1,4 @@
-import { jwtVerify } from "jose";
+import { verifyDashboardSessionToken } from "@/shared/utils/dashboardSessionToken";
 import { getSettings } from "@/lib/db/settings";
 import { validateApiKey } from "@/lib/db/apiKeys";
 
@@ -44,12 +44,7 @@ async function hasValidSessionCookie(request: Request): Promise<boolean> {
   const token = getCookieValue(request.headers.get("cookie"), "auth_token");
   if (!token) return false;
 
-  try {
-    await jwtVerify(token, new TextEncoder().encode(secretValue));
-    return true;
-  } catch {
-    return false;
-  }
+  return (await verifyDashboardSessionToken(token, new TextEncoder().encode(secretValue))) !== null;
 }
 
 export function extractWsTokenFromUrl(input: string | URL): string | null {

src/server/authz/pipeline.ts

@@ -1,8 +1,9 @@
-import { jwtVerify, SignJWT } from "jose";
+import { SignJWT } from "jose";
 import { NextResponse, type NextRequest } from "next/server";
 import { getCachedSettings } from "../../lib/db/readCache";
 import { isDraining } from "../../lib/gracefulShutdown";
 import { checkBodySize, getBodySizeLimit } from "../../shared/middleware/bodySizeGuard";
+import { verifyDashboardSessionToken } from "@/shared/utils/dashboardSessionToken";
 import { generateRequestId } from "../../shared/utils/requestId";
 import { applyCorsHeaders } from "../cors/origins";
 import { validateBrowserMutationOrigin } from "../origin/publicOrigin";
@@ -153,7 +154,13 @@ async function refreshDashboardSessionIfNeeded(
   if (!token) return;
 
   try {
-    const { payload } = await jwtVerify(token, secret);
+    const payload = await verifyDashboardSessionToken(token, secret);
+    if (!payload) {
+      // Not a dashboard session (foreign/expired/claim-less token): drop it so a
+      // Cursor CLI token can never ride along as the cookie (#13298).
+      response.cookies.delete("auth_token");
+      return;
+    }
     const exp = typeof payload.exp === "number" ? payload.exp : null;
     if (!exp) return;
 

src/server/ws/liveServer.ts

@@ -18,9 +18,9 @@
  */
 
 import { WebSocketServer, WebSocket } from "ws";
-import { jwtVerify } from "jose";
 import { createServer, type IncomingMessage, type ServerResponse } from "http";
 import { randomUUID } from "crypto";
+import { verifyDashboardSessionToken } from "@/shared/utils/dashboardSessionToken";
 
 // ── Types ─────────────────────────────────────────────────────────────────
 
@@ -190,13 +190,7 @@ async function isDashboardCookieAuthenticated(
 ): Promise<boolean> {
   const token = getCookieValueFromHeader(request.headers, "auth_token");
   if (!token || !process.env.JWT_SECRET) return false;
-  try {
-    const secret = new TextEncoder().encode(process.env.JWT_SECRET);
-    await jwtVerify(token, secret);
-    return true;
-  } catch {
-    return false;
-  }
+  return (await verifyDashboardSessionToken(token)) !== null;
 }
 
 function extractBearerToken(request: import("http").IncomingMessage): string | null {

src/shared/constants/config.ts

@@ -17,6 +17,8 @@ export const PROVIDER_ENDPOINTS = {
   llmgateway: "https://api.llmgateway.io/v1/chat/completions",
   "llm-kiwi": "https://api.llm.kiwi/v1/chat/completions",
   literouter: "https://api.literouter.com/v1/chat/completions",
+  greenpt: "https://api.greenpt.ai/v1/chat/completions",
+  eurouter: "https://api.eurouter.ai/v1/chat/completions",
   "mnn-ai": "https://api.mnnai.ru/v1/chat/completions",
   "meganova-ai": "https://api.meganova.ai/v1/chat/completions",
   mixlayer: "https://models.mixlayer.ai/v1/chat/completions",

src/shared/constants/providers.ts

@@ -123,6 +123,7 @@ export const AGGREGATOR_PROVIDER_IDS = new Set([
   "llmgateway",
   "llm-kiwi",
   "literouter",
+  "eurouter",
   "mnn-ai",
   "meganova-ai",
   "mixlayer",