fix(quality): let check-forgotten-sibling-tests read a 1,000-file diff

The gate shells out to `git diff` through execFileSync with Node's default 1 MB
maxBuffer; the 1,292-file codemod in this PR is the first diff large enough to
overflow it, and the gate died with `spawnSync git ENOBUFS` before comparing
anything. 64 MB is far above any real PR and costs nothing when unused.

.env.example

@@ -45,16 +45,6 @@ INITIAL_PASSWORD=CHANGEME
 # executor's on-disk thread-sticky session cache. Leave unset to rely on DATA_DIR.
 # OMNIROUTE_DATA_DIR=/var/lib/omniroute
 
-# Directory the runtime plugin scanner reads, overriding the home-derived default (#11827).
-# Used by: src/lib/plugins/scanner.ts — getDefaultPluginDir(); it is also the root the
-# plugin manager installs into. Set it in Docker/K8s to point straight at the bind-mounted
-# plugin tree, instead of moving HOME (which changes every other HOME-relative behaviour)
-# just to relocate the scan path. Unset = <HOME>/.omniroute/plugins, and
-# /tmp/.omniroute/plugins when the process exports no home at all.
-# Distinct from the CLI-only variable in section 9 that points the omniroute-cmd-* command
-# loader (bin/cli/plugins.mjs) at a package tree — this one drives the server-side scanner.
-# OMNIROUTE_PLUGINS_DIR=/opt/omniroute/plugins
-
 # Escape hatch for the test-context DATA_DIR guard (#10428). A test run that never
 # chose a DATA_DIR is redirected to a throwaway temp dir so it cannot open the
 # operator's real database. Set to 1 only for a deliberate run against the real
@@ -81,11 +71,6 @@ INITIAL_PASSWORD=CHANGEME
 # Never set this for the running server. Used by: src/lib/buildPhase.ts, src/lib/db/core.ts
 # OMNIROUTE_BUILDING=1
 
-# Skip the optional native-dependency prebuild check for exotic vendored trees.
-# This does not make a missing dependency buildable. Used by: scripts/check/check-native-deps.mjs
-# Default: 0  |  Set to 1 only when native dependencies are supplied out of band.
-# OMNIROUTE_SKIP_NATIVE_DEP_CHECK=0
-
 # Encryption key for SQLite database encryption at rest.
 # Used by: src/lib/db/encryption.ts — encrypts the entire SQLite database.
 # Generate: openssl rand -hex 32  |  Leave empty to disable DB encryption.
@@ -673,11 +658,21 @@ NEXT_PUBLIC_CLOUD_URL=
 # open-sse/services/usage.ts.
 #OMNIROUTE_CROF_USAGE_URL=https://crof.ai/usage_api/
 #OMNIROUTE_CODEWHISPERER_BASE_URL=https://codewhisperer.us-east-1.amazonaws.com
-# Official OpenCode Go usage endpoint, authenticated with the connection API key.
-# Override only for relays or test fixtures.
-#OMNIROUTE_OPENCODE_QUOTA_URL=https://opencode.ai/zen/go/v1/usage
+#OMNIROUTE_OPENCODE_QUOTA_URL=https://opencode.ai/zen/go/v1/quota
+# OpenCode Go has no public quota API — this has no default and stays
+# unset unless you explicitly opt in to a self-hosted/mirrored endpoint:
+#OMNIROUTE_OPENCODE_GO_QUOTA_URL=
+#OMNIROUTE_OPENCODE_GO_DASHBOARD_URL=https://opencode.ai/workspace
 #OMNIROUTE_OLLAMA_CLOUD_USAGE_URL=https://ollama.com/settings
 
+# OpenCode Go dashboard quota scraping. Prefer configuring these per connection
+# in Dashboard → Providers → OpenCode Go. Env vars are useful for headless
+# deployments or shared server defaults. The cookie is sensitive.
+#OPENCODE_GO_WORKSPACE_ID=wrk_...
+#OMNIROUTE_OPENCODE_GO_WORKSPACE_ID=wrk_...
+#OPENCODE_GO_AUTH_COOKIE=auth=...
+#OMNIROUTE_OPENCODE_GO_AUTH_COOKIE=auth=...
+
 # OpenCode Go/Zen VPS egress (#5997): on a datacenter VPS, Cloudflare in front of
 # opencode.ai/zen/go 403s chat requests that lack OpenCode CLI identity headers.
 # When your clients don't already send them, set this to synthesize the CLI headers
@@ -812,14 +807,9 @@ NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
 # CLI_CRUSH_BIN=crush
 # CLI_OMP_BIN=omp
 # CLI_LETTA_BIN=letta
-# CLI_PRIME_AGENT_BIN=prime-agent
 # Windsurf has no default binary — set this to enable binary detection for it.
 # CLI_WINDSURF_BIN=windsurf
 # CLI_AUGGIE_BIN=auggie
-# CLI_5DIVE_BIN=5dive
-# 5dive keeps root-owned auth profiles under a system state dir (its own STATE_DIR,
-# default /var/lib/5dive); override here when it lives elsewhere.
-# CLI_5DIVE_STATE_DIR=/var/lib/5dive
 # AUGGIE_BIN=auggie
 
 # ── ZCode (Z.ai GLM coding-plan CLI) local provider ──
@@ -979,11 +969,6 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # Used by: src/lib/jobs/budgetResetJob.ts.  Floor: 10000.
 #OMNIROUTE_BUDGET_RESET_JOB_INTERVAL_MS=600000
 
-# Cron expression for the call-log export job (destinations configured in the
-# dashboard under Integrations > Log export).  Default: hourly, on the hour.
-# Used by: src/lib/jobs/logExportJob.ts.  Timezone: UTC.
-#OMNIROUTE_LOG_EXPORT_CRON=0 * * * *
-
 # Emergency budget-exhaustion fallback (set false or 0 to disable the reroute to
 # nvidia/openai/gpt-oss-120b when a request fails with a 402 budget error).
 # Used by: open-sse/services/emergencyFallback.ts.  Default: enabled.
@@ -1470,25 +1455,17 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # FIRECRAWL_BASE_URL=https://api.firecrawl.dev
 # FIRECRAWL_TIMEOUT_MS=30000            # Per-request timeout (default: 30000 = 30s)
 
-# ── ChatGPT browser transport (Firefox-fingerprinted client) ──
-# Used by: open-sse/services/chatgptTlsClient.ts — native wreq-js request
-# timeout and the JS-side hard-deadline grace layered on top of it.
-# OMNIROUTE_CHATGPT_TLS_TIMEOUT_MS=60000
-# OMNIROUTE_CHATGPT_TLS_GRACE_MS=10000
-# Max wait for the FIRST streamed byte before switching from direct streaming
-# to a buffered response, in milliseconds. Default 30000 (30s). The request's
-# hard deadline continues to apply while the buffered body is read.
-# OMNIROUTE_CHATGPT_STREAM_FIRST_BYTE_TIMEOUT_MS=30000
-
-# ── Claude browser transport (Chromium-fingerprinted client) ──
-# Used by: open-sse/services/claudeTlsClient.ts — native wreq-js request
-# timeout and the JS-side hard-deadline grace layered on top of it.
+# ── Claude TLS sidecar (Chromium-fingerprinted client) ──
+# Used by: open-sse/services/claudeTlsClient.ts — wire-level timeout for
+# the bogdanfinn/tls-client koffi binding and the JS-side grace window
+# layered on top of it when the native library is wedged.
 # OMNIROUTE_CLAUDE_TLS_TIMEOUT_MS=60000
 # OMNIROUTE_CLAUDE_TLS_GRACE_MS=10000
 
-# ── Perplexity browser transport (Firefox-fingerprinted client) ──
-# Used by: open-sse/services/perplexityTlsClient.ts — native wreq-js request
-# timeout and the JS-side hard-deadline grace layered on top of it.
+# ── Perplexity TLS sidecar (Firefox-fingerprinted client) ──
+# Used by: open-sse/services/perplexityTlsClient.ts — wire-level timeout for
+# the bogdanfinn/tls-client koffi binding and the JS-side grace window
+# layered on top of it when the native library is wedged.
 # OMNIROUTE_PPLX_TLS_TIMEOUT_MS=30000
 # OMNIROUTE_PPLX_TLS_GRACE_MS=10000
 
@@ -1500,16 +1477,18 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # meta-commentary. Set to 1/true/yes/on to restore the old behavior.
 # OMNIROUTE_PPLX_SEARCH_HINT=0
 
-# ── Grok web browser transport (Chrome-fingerprinted client) ──
-# Used by: open-sse/services/grokTlsClient.ts — native wreq-js request timeout
-# and the JS-side hard-deadline grace layered on top of it.
+# ── Grok web TLS sidecar (Chrome-fingerprinted client) ──
+# Used by: open-sse/services/grokTlsClient.ts — wire-level timeout for the
+# bogdanfinn/tls-client koffi binding and the JS-side grace window layered on
+# top of it when the native library is wedged.
 # OMNIROUTE_GROK_TLS_TIMEOUT_MS=60000
 # OMNIROUTE_GROK_TLS_GRACE_MS=10000
 
-# ── Notion web browser transport (Chrome-fingerprinted client) ──
-# Used by: open-sse/services/notionTlsClient.ts — native wreq-js request timeout
-# and the JS-side hard-deadline grace layered on top of it. The notion-web
-# executor raises the native timeout per-request to 180000 for long generations.
+# ── Notion web TLS sidecar (Chrome-fingerprinted client) ──
+# Used by: open-sse/services/notionTlsClient.ts — wire-level timeout for the
+# bogdanfinn/tls-client koffi binding and the JS-side grace window layered on
+# top of it when the native library is wedged. The notion-web executor raises
+# the wire timeout per-request to 180000 for long generations.
 # OMNIROUTE_NOTION_TLS_TIMEOUT_MS=30000
 # OMNIROUTE_NOTION_TLS_GRACE_MS=10000
 
@@ -1770,7 +1749,6 @@ APP_LOG_TO_FILE=true
 
 # Custom directory for CLI plugin discovery (omniroute-cmd-* packages).
 # Default: ~/.omniroute/plugins/  Override in dev/CI to point at a local plugin tree.
-# CLI-only: the server-side plugin scanner is pointed by OMNIROUTE_PLUGINS_DIR (section 2).
 # OMNIROUTE_PLUGIN_PATH=
 
 # ── Prompt cache (system prompt deduplication) ──
@@ -2039,8 +2017,6 @@ APP_LOG_TO_FILE=true
 # CLIPROXYAPI_HOST=127.0.0.1
 # CLIPROXYAPI_PORT=5544
 # CLIPROXYAPI_CONFIG_DIR=~/.cli-proxy-api
-# Data-plane key fallback; the cliproxyapi_api_key setting takes precedence.
-# CLIPROXYAPI_API_KEY=
 # Management key for an externally managed instance. Embedded instances use
 # OmniRoute's encrypted service key.
 # CLIPROXYAPI_MANAGEMENT_KEY=
@@ -2144,12 +2120,6 @@ APP_LOG_TO_FILE=true
 # Used by: open-sse/services/rateLimitManager.ts
 # RATE_LIMIT_MAX_WAIT_MS=15000
 
-# Limiter-managed execution backstop (Bottleneck `expiration`): bounds a job's
-# post-dispatch execution, never queue wait. Must stay ABOVE upstream
-# fetch-start timeouts on non-incremental gateways. Default: 600000 (10 min)
-# Used by: open-sse/services/rateLimitManager.ts
-# RATE_LIMIT_EXECUTION_MAX_WAIT_MS=600000
-
 # Rate limit queue admission cap: reject with 429 queue_full once this many requests
 # are already queued (0 = disabled/unbounded, the default). Used by: open-sse/services/rateLimitManager.ts
 # RATE_LIMIT_MAX_QUEUE_DEPTH=0
@@ -2473,6 +2443,14 @@ APP_LOG_TO_FILE=true
 # When enabled, the node authenticates with the API key stored on its connection.
 # AUDIO_REMOTE_PROVIDER_NODES=false
 
+# ── 1Proxy egress pool ──
+# Used by: src/lib/oneproxySync.ts — fetches proxy nodes from the OmniRoute
+# CrofAI 1Proxy service. Disable, override URL, or tune the import quality.
+# ONEPROXY_ENABLED=true
+# ONEPROXY_API_URL=https://1proxy-api.aitradepulse.com
+# ONEPROXY_MAX_PROXIES=500
+# ONEPROXY_MIN_QUALITY_THRESHOLD=50
+
 # ── Free Proxy Pool (auto-sync scheduler) ──
 # Background refresh of the free-proxy pool. Opt-in, OFF by default (parallels
 # Hard Rule #20's default-off posture for data-mutating background features).
@@ -2891,14 +2869,6 @@ QUOTA_STORE_DRIVER=sqlite
 # PROMPTQL_TOKEN_REFRESH_URL=https://auth.pro.ql.app/ddn/project/token
 # PROMPTQL_POLL_TIMEOUT_MS=180000
 
-# ─────────────────────────────────────────────────────────────────────────────
-# Kilo Code usage quotas (src/shared/constants/providers/kilocode.ts)
-# Personal USD balance and Kilo Pass usage lookup. Optional — the default
-# points at the public Kilo API; override only for a relay/test fixture.
-# Authentication uses the connection's existing OAuth access token.
-# Used by: open-sse/services/usage/kilocode.ts
-# ─────────────────────────────────────────────────────────────────────────────
-# KILO_API_URL=https://api.kilo.ai
 # ─────────────────────────────────────────────────────────────────────────────
 # HyperAgent web provider (Unofficial/Experimental — src/shared/constants/providers/web-cookie.ts)
 # Reverse-engineered session bridge for hyperagent.com. Optional — defaults
@@ -2918,12 +2888,7 @@ QUOTA_STORE_DRIVER=sqlite
 # CHATGPT_WEB_CODEX_CDP_URL=http://chatgpt-web-codex-browser:9223
 # CHATGPT_WEB_CODEX_TUNNEL_ID=tunnel_0123456789abcdef0123456789abcdef
 # CHATGPT_WEB_CODEX_RUNTIME_KEY=
-# CHATGPT_WEB_CODEX_CONNECTOR_NAME=OmniRoute Codex v2
-# CODEX_CHATGPT_WEB_HOME=/var/lib/omniroute/chatgpt-web-codex
-# CODEX_CHATGPT_WEB_BROWSER_DIAGNOSTICS=0
-# CODEX_CHATGPT_WEB_LAUNCHER=/absolute/path/to/codex-chatgpt-web
-# CODEX_CHATGPT_WEB_BUN=/absolute/path/to/bun
-# CODEX_WEB_GPT_BUN=/absolute/path/to/bun
+# CHATGPT_WEB_CODEX_CONNECTOR_NAME=OmniRoute Codex
 
 # ─────────────────────────────────────────────────────────────────────────────
 # Browser-login VNC sessions (optional — src/lib/vncSession/manifest.ts)

.github/workflows/api-route-typecheck.yml

@@ -1,36 +0,0 @@
-name: API Route Typecheck
-
-on:
-  pull_request:
-    branches:
-      - main
-      - "release/**"
-    types: [opened, synchronize, reopened, ready_for_review]
-  push:
-    branches: [main]
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  api-typecheck:
-    name: API Route Typecheck
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: "24"
-          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
-      - name: Reject new API-route TypeScript diagnostics
-        run: node scripts/check/check-api-typecheck.mjs
-      - name: API typecheck gate unit tests
-        run: node --import tsx/esm --test tests/unit/build/check-api-typecheck.test.ts

.github/workflows/ci.yml

@@ -109,11 +109,8 @@ jobs:
             .eslintcache
             .eslintcache-complexity
           key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'eslint.complexity-ratchets.config.mjs', 'config/quality/eslint-suppressions.json', 'package-lock.json') }}
-          # No restore-keys fallback on purpose (#11600, P-II.1 of the v3.8.50 postmortem): a
-          # cache built under a different suppressions file / lint config / lockfile reports
-          # stale per-file verdicts, which is exactly how 215 pre-existing errors stayed
-          # invisible for a whole cycle. Exact key or a cold full lint (~13 min) — never a
-          # partial cache from another configuration.
+          restore-keys: |
+            eslint-${{ runner.os }}-
       # Single ESLint inventory (JSON) — quality-gate reuses the artifact instead of
       # a second cold full-tree pass for eslintWarnings ratchet counts.
       - name: ESLint (JSON report)
@@ -212,11 +209,8 @@ jobs:
             .eslintcache
             .eslintcache-complexity
           key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'eslint.complexity-ratchets.config.mjs', 'config/quality/eslint-suppressions.json', 'package-lock.json') }}
-          # No restore-keys fallback on purpose (#11600, P-II.1 of the v3.8.50 postmortem): a
-          # cache built under a different suppressions file / lint config / lockfile reports
-          # stale per-file verdicts, which is exactly how 215 pre-existing errors stayed
-          # invisible for a whole cycle. Exact key or a cold full lint (~13 min) — never a
-          # partial cache from another configuration.
+          restore-keys: |
+            eslint-${{ runner.os }}-
       # Coverage mergeada (coverage-summary.json) p/ o ratchet de cobertura.
       # continue-on-error: o artifact pode não existir se a job test-coverage foi
       # SKIPPED (shard flaky). Nesse caso collect-metrics pula coverage.* (ausente sem
@@ -627,9 +621,9 @@ jobs:
     # 13:50Z the kernel OOM-killed main's build while a PR build ran beside it
     # (five Build jobs had been queued by a burst of PRs). Two lanes: main keeps
     # its own so a release is never queued behind PR traffic; PR builds serialize
-    # among themselves. docker-publish.yml's amd64 leg joins `heavy-build-main`
-    # so a :next image build waits beside this artefact instead of becoming the
-    # third heavy (#11976). GitHub keeps one running + one pending per group.
+    # among themselves. GitHub keeps one running + one pending per group and
+    # CANCELS older pendings — a cancelled PR build is re-runnable; a dead main
+    # build costs the publish its artefact and a 40-minute rebuild that OOMs.
     concurrency:
       group: heavy-build-${{ github.ref == 'refs/heads/main' && 'main' || 'pr' }}
       cancel-in-progress: false
@@ -985,11 +979,7 @@ jobs:
     # 10min was sized before #7114 added the lcov reporter (Codecov/Sonar need it);
     # merging 8 shard JSONs + text+json+lcov now takes ~10-12min — three consecutive
     # release-tip runs died at exactly 10m as job-timeout "cancelled" (2026-07-15/16).
-    # 30, not 20 (2026-08-29): the informational Codecov upload below hung for the rest of
-    # the budget on two consecutive main runs (33207760653, 33215115341); the job ended
-    # `cancelled` and dragged the whole run's conclusion to `cancelled` although every
-    # blocking job was green. The upload step now has its own ceiling; this is headroom.
-    timeout-minutes: 30
+    timeout-minutes: 20
     needs: test-unit
     if: ${{ !cancelled() && needs.test-unit.result == 'success' && !contains(github.event.pull_request.labels.*.name, 'hotfix') }}
     env:
@@ -1068,10 +1058,6 @@ jobs:
       # (if-no-files-found: warn) — Sonar consumes the same file.
       - name: Upload coverage to Codecov (informational)
         if: always()
-        # Informational means informational: its own ceiling and continue-on-error, so a
-        # stalled upload can neither eat the job's budget nor turn a green job cancelled.
-        timeout-minutes: 5
-        continue-on-error: true
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           files: coverage/lcov.info

.github/workflows/codeql.yml

@@ -22,10 +22,10 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+      - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           languages: javascript-typescript
           queries: security-extended
-      - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+      - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           category: "/language:javascript-typescript"

.github/workflows/docker-publish.yml

@@ -26,14 +26,6 @@ on:
         type: boolean
         default: false
 
-# One publish per ref. A merge storm used to fan out 8 concurrent hosted builds,
-# every one OOM-killing `npm run build` inside BuildKit (#11976). The :next
-# channel only needs the newest SHA; cancel-in-progress is the same pattern as
-# quality.yml / nightly-release-green.
-concurrency:
-  group: docker-publish-${{ github.ref }}
-  cancel-in-progress: true
-
 # Least-privilege default: read-only at the top level; the build and merge jobs that
 # push to GHCR grant packages: write themselves (Scorecard TokenPermissions).
 permissions:
@@ -126,23 +118,7 @@ jobs:
     name: Build Docker (${{ matrix.platform }})
     needs: prepare
     if: needs.prepare.outputs.skip != 'true'
-    # amd64: the .113 omni-build pool (31 GB / 32 cores, ONE listener since
-    # #12048). Hosted ubuntu-24.04 is ~7 GB and dies ResourceExhausted (#11976).
-    # Falls back to hosted when USE_VPS_RUNNER is off. arm64: no ARM box — stay
-    # on GitHub's ubuntu-24.04-arm.
-    # Webpack on BOTH arches: Turbopack on omniroute-113-6 hit
-    # TurbopackInternalError "there must be a path to a root" after 26 min
-    # (run 33253576569). The same tree's arm64 webpack build on hosted ARM
-    # succeeded (run 33264823398). Dockerfile already documents webpack as the
-    # Docker escape hatch (OMNIROUTE_USE_TURBOPACK=0).
-    runs-on: ${{ matrix.arch == 'amd64' && (vars.USE_VPS_RUNNER == 'true' && fromJSON('["self-hosted","omni-build"]') || 'ubuntu-24.04') || 'ubuntu-24.04-arm' }}
-    # Share the 1-slot omni-build ceiling (#12048) with ci.yml `Build` /
-    # npm-publish. Same group as main's Build so a :next publish waits beside
-    # the artefact instead of sitting next to it. arm64 is hosted — its own
-    # group, cancelled by the workflow-level concurrency.
-    concurrency:
-      group: ${{ matrix.arch == 'amd64' && 'heavy-build-main' || format('docker-publish-arm-{0}', github.ref) }}
-      cancel-in-progress: ${{ matrix.arch != 'amd64' }}
+    runs-on: ${{ matrix.runner }}
     permissions:
       contents: read
       packages: write
@@ -151,8 +127,10 @@ jobs:
       matrix:
         include:
           - platform: linux/amd64
+            runner: ubuntu-24.04
             arch: amd64
           - platform: linux/arm64
+            runner: ubuntu-24.04-arm
             arch: arm64
     env:
       IMAGE_NAME: diegosouzapw/omniroute
@@ -165,9 +143,6 @@ jobs:
           ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/tags/v{0}', inputs.version) || '' }}
           fetch-depth: 0
 
-      - name: Assert Docker Engine
-        run: docker info
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
@@ -191,8 +166,6 @@ jobs:
           context: .
           target: runner-base
           platforms: ${{ matrix.platform }}
-          build-args: |
-            OMNIROUTE_USE_TURBOPACK=0
           outputs: type=image,push-by-digest=true,name-canonical=true,push=true
           tags: |
             ${{ env.IMAGE_NAME }}
@@ -210,8 +183,6 @@ jobs:
           context: .
           target: runner-web
           platforms: ${{ matrix.platform }}
-          build-args: |
-            OMNIROUTE_USE_TURBOPACK=0
           outputs: type=image,push-by-digest=true,name-canonical=true,push=true
           tags: |
             ${{ env.IMAGE_NAME }}
@@ -237,8 +208,6 @@ jobs:
           file: Dockerfile.bun
           target: runner-base
           platforms: ${{ matrix.platform }}
-          build-args: |
-            OMNIROUTE_USE_TURBOPACK=0
           outputs: type=image,push-by-digest=true,name-canonical=true,push=true
           tags: |
             ${{ env.IMAGE_NAME }}
@@ -264,8 +233,6 @@ jobs:
           file: Dockerfile.bun
           target: runner-web
           platforms: ${{ matrix.platform }}
-          build-args: |
-            OMNIROUTE_USE_TURBOPACK=0
           outputs: type=image,push-by-digest=true,name-canonical=true,push=true
           tags: |
             ${{ env.IMAGE_NAME }}
@@ -528,14 +495,11 @@ jobs:
           severity: CRITICAL
           ignore-unfixed: true
           exit-code: "1"
-          # Explicit: the advisory scan above already points at it, and the blocking
-          # gate must honour the same accepted-risk list (#12084).
-          trivyignores: .trivyignore
 
       - name: Upload Trivy SARIF to Security tab
         if: needs.prepare.outputs.version != 'main'
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@v4.37.8
+        uses: github/codeql-action/upload-sarif@v4.37.7
         with:
           sarif_file: trivy-results.sarif
           category: trivy-image

.github/workflows/electron-release.yml

@@ -4,21 +4,12 @@ on:
   push:
     tags:
       - "v*"
-  # A dispatch builds the ref it is dispatched ON (`gh workflow run … --ref v3.8.50` rebuilds
-  # that tag; `--ref main` builds the repaired line). The ref is deliberately NOT an input:
-  # CodeQL flags an input-controlled checkout next to the npm cache on the default branch as
-  # cache poisoning (actions/cache-poisoning/poisonable-step), and `github.ref` is trusted.
   workflow_dispatch:
     inputs:
       version:
         description: "Release version (e.g., v1.6.8)"
         required: true
         type: string
-      publish_npm:
-        description: "Also run the npm publish leg (turn off when re-attaching desktop assets to a release whose npm package already shipped)"
-        required: false
-        default: true
-        type: boolean
 
 # Least-privilege default: read-only at the top level; each job grants the writes it
 # needs (build/release upload assets, publish-npm forwards npm provenance / packages
@@ -85,9 +76,6 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-          # workflow_dispatch: build the tag being (re)built, not the dispatching branch. On a
-          # tag push this resolves to the same commit.
-          ref: ${{ needs.validate.outputs.version }}
       - name: Setup Node
         uses: actions/setup-node@v7
         with:
@@ -173,9 +161,6 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-          # workflow_dispatch: build the tag being (re)built, not the dispatching branch. On a
-          # tag push this resolves to the same commit.
-          ref: ${{ needs.validate.outputs.version }}
       - name: Setup Node
         uses: actions/setup-node@v7
         with:
@@ -237,7 +222,7 @@ jobs:
         #          optionals (@img/sharp-*, @img/sharp-libvips-*, @ngrok/ngrok-*,
         #          fsevents) carry linux forks. Replace them with the forks this
         #          leg's own `npm ci` resolved, then assert every bundled native
-        #          (better-sqlite3 prebuilds, wreq-js, onnxruntime)
+        #          (koffi triplets, better-sqlite3 prebuilds, wreq-js, onnxruntime)
         #          can service this leg's platform/arch before packaging starts.
         run: |
           node scripts/build/standaloneBundle.mjs restore --archive web-bundle.tar.gz
@@ -362,8 +347,6 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0
-          # Source archives + SBOM come from the tag being released, not the dispatching branch.
-          ref: ${{ needs.validate.outputs.version }}
 
       # `merge-multiple` is deliberately OFF. It resolves same-name collisions by ARRIVAL
       # ORDER, and the two macOS jobs each emit their own `latest-mac.yml` listing only their
@@ -421,14 +404,7 @@ jobs:
           tag_name: ${{ needs.validate.outputs.version }}
           draft: false
           prerelease: false
-          # NEVER. Phase 3 of the release flow creates the GitHub Release with the curated
-          # notes seconds after pushing the tag, so by the time this step runs (1-2 h of
-          # builds later) the body already exists — and `true` APPENDS GitHub's
-          # auto-generated "What's Changed" block to it (v3.8.48 shipped that way; the
-          # v3.8.50 re-attach dispatch added +1,416 chars to a 121 KB body, run
-          # 33238093090). A curated body sits ~3 KB under the 125,000-char cap, so the
-          # append can also turn this step RED and leave the release with no assets.
-          generate_release_notes: false
+          generate_release_notes: true
           fail_on_unmatched_files: false
           files: |
             release-assets/*.dmg
@@ -486,20 +462,11 @@ jobs:
   publish-npm:
     name: Publish to npm
     needs: [validate, release]
-    # A re-dispatch that only re-attaches desktop assets must not publish the npm package again.
-    if: ${{ github.event_name != 'workflow_dispatch' || inputs.publish_npm }}
     permissions:
       # Must be `write`, not `read`: this job calls the reusable npm-publish.yml whose
       # `publish` job needs `contents: write` (gh release upload — attach the SBOM, #3874).
       # A reusable workflow's job cannot request more permission than the caller grants,
       # so a `read` here makes GitHub reject the run at startup (startup_failure).
-      #
-      # `actions: read` for the same reason: the called `publish` job downloads the next-build
-      # artefact and requests it. v3.8.50 (run 33005490476) died at startup with "The nested
-      # job 'publish' is requesting 'actions: read', but is only allowed 'actions: none'" — and
-      # because `release` lives in this same workflow, the tag shipped with ZERO assets. Keep
-      # this block a superset of every job's permissions in npm-publish.yml.
-      actions: read
       contents: write
       id-token: write # npm provenance (forwarded to the reusable workflow)
       packages: write # publish to npm.pkg.github.com

.github/workflows/nightly-llm-security.yml

@@ -10,10 +10,7 @@ permissions:
 jobs:
   promptfoo-guard:
     name: promptfoo — injection guard (block mode, no secret)
-    # #11965: this job runs a backend-only `next build`; the hosted 7 GB runner cannot build
-    # release/v3.8.51 (VM shutdown ~7 min in), so it targets the box's light pool (`omni-light`:
-    # two listeners, jobs ≤ ~6 GB). Falls back to hosted when USE_VPS_RUNNER is off.
-    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && fromJSON('["self-hosted","omni-light"]')) || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
         with:
@@ -49,10 +46,7 @@ jobs:
 
   garak:
     name: garak probes (skip without provider secret)
-    # #11965: this job runs a backend-only `next build`; the hosted 7 GB runner cannot build
-    # release/v3.8.51 (VM shutdown ~7 min in), so it targets the box's light pool (`omni-light`:
-    # two listeners, jobs ≤ ~6 GB). Falls back to hosted when USE_VPS_RUNNER is off.
-    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && fromJSON('["self-hosted","omni-light"]')) || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     # NOTE: the `secrets` context is NOT available in a job-level `if:` — referencing
     # it there makes GitHub reject the file on push (startup_failure on every push).
     # Map the secret into a job-level env and gate each step on a presence check, so

.github/workflows/nightly-release-green.yml

@@ -196,26 +196,6 @@ jobs:
             gh issue create --repo "$GITHUB_REPOSITORY" --title "$TITLE" --label base-red --body-file issue-body.md
           fi
 
-      - name: Close tracking issue when the branch is green again
-        if: steps.validate.outputs.exit == '0'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          TARGET: ${{ steps.branch.outputs.target }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: |
-          set -euo pipefail
-          # The open/update step above is the UPWARD half of the loop; without this
-          # step a stale "not green" issue outlives the fix and every base-green check
-          # (`AGENTS.md` → "Base-green check") keeps stamping new PRs as base-red inherited.
-          TITLE="🔴 Release branch not green: ${TARGET}"
-          EXISTING=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open \
-            --search "in:title $TITLE" --json number --jq '.[0].number' 2>/dev/null || echo "")
-          if [ -n "$EXISTING" ]; then
-            gh issue close "$EXISTING" --repo "$GITHUB_REPOSITORY" --reason completed \
-              --comment "✅ \`${TARGET}\` is release-green again at \`${GITHUB_SHA:0:9}\` — ${RUN_URL}. Auto-closed by Release-Green (continuous)."
-            echo "Closed issue #$EXISTING"
-          fi
-
       - name: Upload report artifact
         if: always()
         uses: actions/upload-artifact@v7
@@ -314,25 +294,6 @@ jobs:
             gh issue create --repo "$GITHUB_REPOSITORY" --title "$TITLE" --label base-red --body-file issue-body.md
           fi
 
-      - name: Close tracking issue when the branch is green again
-        if: steps.validate.outputs.exit == '0'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: |
-          set -euo pipefail
-          # The open/update step above is the UPWARD half of the loop; without this
-          # step a stale "not green" issue outlives the fix and every base-green check
-          # (`AGENTS.md` → "Base-green check") keeps stamping new PRs as base-red inherited.
-          TITLE="🔴 main branch not green"
-          EXISTING=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open \
-            --search "in:title $TITLE" --json number --jq '.[0].number' 2>/dev/null || echo "")
-          if [ -n "$EXISTING" ]; then
-            gh issue close "$EXISTING" --repo "$GITHUB_REPOSITORY" --reason completed \
-              --comment "✅ \`main\` is main-green again at \`${GITHUB_SHA:0:9}\` — ${RUN_URL}. Auto-closed by Release-Green (continuous)."
-            echo "Closed issue #$EXISTING"
-          fi
-
       - name: Upload report artifact
         if: always()
         uses: actions/upload-artifact@v7
@@ -423,13 +384,6 @@ jobs:
           # on `improvements`, complexity-ratchets only when `.improved`), and both exit
           # non-zero while the branch is over baseline — which is exactly when there is
           # nothing to bank. Their exit code is not the signal; the verifier below is.
-          # Velocity phase (quality-baseline.json `_policy`, relax-baselines.mjs): the caps
-          # were raised on purpose, so banking the measured shrink would silently undo the
-          # 20% headroom every night. Pause the downward ratchet until the phase closes.
-          if node -e 'process.exit(require("./config/quality/quality-baseline.json")._policy?.phase === "velocity" ? 0 : 1)'; then
-            echo "Velocity phase active — ratchet banking paused (see docs/architecture/QUALITY_GATES.md → Velocity phase)."
-            exit 0
-          fi
           set +e
           node scripts/check/check-file-size.mjs --update
           node scripts/check/check-complexity-ratchets.mjs --update
@@ -491,72 +445,3 @@ jobs:
             gh pr create --repo "$GITHUB_REPOSITORY" --base "$TARGET" --head "$BANK_BRANCH" \
               --title "chore(quality): bank ratchet shrinks (${TARGET})" --body-file pr-body.md
           fi
-
-  # ── Baseline headroom (velocity phase, 2026-08-30 → v4.0) ──────────────────────
-  # The ratchets only speak when a baseline is crossed. With every baseline loosened by
-  # 20% (scripts/quality/relax-baselines.mjs) the question is how fast the budget is
-  # being consumed — this job measures each gate the way CI does and posts the headroom
-  # table to one living issue, so a budget that fills in a week is visible before the
-  # first red PR. Advisory: never fails the workflow.
-  baseline-headroom:
-    name: Baseline headroom
-    if: ${{ github.event_name != 'push' }}
-    timeout-minutes: 60
-    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && fromJSON('["self-hosted","omni-light"]')) || 'ubuntu-latest' }}
-    permissions:
-      contents: read
-      issues: write
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 1
-          persist-credentials: false
-
-      - uses: actions/setup-node@v7
-        with:
-          node-version: "24"
-          cache: npm
-
-      - uses: ./.github/actions/npm-ci-retry
-
-      - name: Measure headroom on ${{ github.ref_name }}
-        run: |
-          set -euo pipefail
-          node scripts/quality/baseline-headroom.mjs \
-            --json reports/quality/headroom.json --md reports/quality/headroom.md
-          cat reports/quality/headroom.md >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Upload headroom report
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: baseline-headroom-${{ github.run_id }}
-          path: reports/quality/headroom.*
-          retention-days: 90
-
-      - name: Post to the living issue
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: |
-          set -euo pipefail
-          TITLE="📈 Baseline headroom (velocity phase)"
-          BAD=$(node -e 'const r=require("./reports/quality/headroom.json").rows;console.log(r.filter(x=>x.status==="critical"||x.status==="warn").length)')
-          {
-            echo "Branch: \`${GITHUB_REF_NAME}\` · run: ${RUN_URL}"
-            echo ""
-            cat reports/quality/headroom.md
-          } > headroom-comment.md
-          EXISTING=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open \
-            --search "in:title $TITLE" --json number --jq '.[0].number' 2>/dev/null || echo "")
-          if [ -z "$EXISTING" ]; then
-            EXISTING=$(gh issue create --repo "$GITHUB_REPOSITORY" --title "$TITLE" --label quality-gate-finding \
-              --body "Living tracker for the velocity-phase baseline budget (docs/architecture/QUALITY_GATES.md → Velocity phase). One comment per nightly run; the newest comment is the current state." \
-              | grep -oE '[0-9]+$')
-          fi
-          gh issue comment "$EXISTING" --repo "$GITHUB_REPOSITORY" --body-file headroom-comment.md
-          if [ "$BAD" != "0" ]; then
-            gh issue edit "$EXISTING" --repo "$GITHUB_REPOSITORY" --add-label "headroom-alert" 2>/dev/null || true
-          else
-            gh issue edit "$EXISTING" --repo "$GITHUB_REPOSITORY" --remove-label "headroom-alert" 2>/dev/null || true
-          fi

.github/workflows/nightly-resilience.yml

@@ -78,10 +78,7 @@ jobs:
 
   a11y:
     name: A11y axe (nightly, freeze-and-alert)
-    # #11965: this job runs a backend-only `next build`; the hosted 7 GB runner cannot build
-    # release/v3.8.51 (VM shutdown ~7 min in), so it targets the box's light pool (`omni-light`:
-    # two listeners, jobs ≤ ~6 GB). Falls back to hosted when USE_VPS_RUNNER is off.
-    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && fromJSON('["self-hosted","omni-light"]')) || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     # The Playwright webServer (`start` mode) builds Next via build-next-isolated.mjs and
     # boots the standalone server itself (waits on /api/monitoring/health, 15min webServer
     # timeout). Unlike the per-PR test-e2e job, this nightly job has no pre-built artifact,

.github/workflows/nightly-schemathesis.yml

@@ -10,10 +10,7 @@ permissions:
 jobs:
   schemathesis:
     name: Schemathesis — OpenAPI contract fuzz (advisory)
-    # #11965: this job runs a backend-only `next build`; the hosted 7 GB runner cannot build
-    # release/v3.8.51 (VM shutdown ~7 min in), so it targets the box's light pool (`omni-light`:
-    # two listeners, jobs ≤ ~6 GB). Falls back to hosted when USE_VPS_RUNNER is off.
-    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && fromJSON('["self-hosted","omni-light"]')) || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v7

.github/workflows/npm-publish.yml

@@ -273,20 +273,11 @@ jobs:
           if-no-files-found: error
 
       - name: Attach SBOM to GitHub Release
-        # Not only on the `release` event: the v3.8.50 package shipped through a
-        # workflow_dispatch (staged publish, 11 attempts) and this step was skipped, so the
-        # GitHub Release carried no SBOM until it was attached by hand from the run's
-        # `sbom-npm` artifact. Attach whenever a release for the published tag exists.
-        if: steps.resolve.outputs.skip != 'true' && (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
+        if: steps.resolve.outputs.skip != 'true' && github.event_name == 'release'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TAG: ${{ github.event_name == 'release' && github.ref_name || format('v{0}', inputs.version) }}
-        run: |
-          if ! gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
-            echo "::notice::no GitHub Release for $TAG yet — SBOM stays on the sbom-npm workflow artifact"
-            exit 0
-          fi
-          gh release upload "$TAG" sbom-npm.cdx.json --repo "$GITHUB_REPOSITORY" --clobber
+          TAG: ${{ github.ref_name }}
+        run: gh release upload "$TAG" sbom-npm.cdx.json --clobber
 
       # WS1.2/WS1.3 (#7065 class): the artifact that is about to be published must
       # BOOT. build:cli already assembled dist/ above; this packs+installs+boots the

.github/workflows/quality.yml

@@ -70,16 +70,7 @@ jobs:
     # 2026-08-14: 72 of the last 100 PRs into release/** came from forks, so the fork case is
     # the majority of the traffic, not the exception — this job earns its place, it just should
     # not duplicate build.yml for the own-origin 28%.
-    # Disabled 2026-08-29 (#11976 follow-up). `continue-on-error: true` still
-    # reports a GitHub check FAILURE, so every fork PR into release/** was born
-    # with a red "Build (advisory)" even when every required gate was green
-    # (sweep-reds, 41 PRs). Hosted ubuntu-latest cannot finish `npm run build`
-    # on this tree — VM shutdown ~6 min in, same class as build.yml going
-    # workflow_dispatch-only in #11962. Pre-merge build signal for release/**
-    # is nightly-release-green (omni-build); for main it is ci.yml `Build`.
-    # Restore this job when a runner that actually fits the tree is wired here.
-    # Bare `false` (not `${{ false }}`) — zizmor obfuscation flags the expression form.
-    if: false
+    if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true' && github.event.pull_request.head.repo.full_name != github.repository) }}
     # PINNED to hosted — this was the last job in THIS workflow still on the USE_VPS_RUNNER
     # switch (ci.yml's Build, nightly-release-green and npm-publish keep it, so the variable
     # stays meaningful), and with USE_VPS_RUNNER=true it produced NO signal at all here.
@@ -303,12 +294,7 @@ jobs:
             # #8522: file-size is base-relative on PR events (compare against
             # max(frozen, base)) so inherited drift doesn't red an innocent PR;
             # workflow_dispatch (no PR base) falls back to absolute comparison.
-            # New-code mode (Clean-as-You-Code, 2026-08-30): complexity-ratchets and
-            # dead-code compare the PR's files against the merge-base and block only on
-            # what the PR added; the global totals are advisory on PRs and re-frozen at
-            # release. See scripts/check/newCodeMode.mjs.
-            case "$g" in file-size|complexity-ratchets|dead-code) NEW_CODE=1 ;; *) NEW_CODE= ;; esac
-            if [ -n "$NEW_CODE" ] && [ -n "${PR_BASE_SHA:-}" ]; then
+            if [ "$g" = "file-size" ] && [ -n "${PR_BASE_SHA:-}" ]; then
               npm run "check:$g" -- --base-ref "$PR_BASE_SHA" || failed+=("$g")
             else
               npm run "check:$g" || failed+=("$g")
@@ -526,10 +512,7 @@ jobs:
     name: No new ESLint warnings
     needs: changes
     if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true') }}
-    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && fromJSON('["self-hosted","omni-light"]')) || 'ubuntu-latest' }}
-    # 2026-08-30: a cold full lint with the eslint-plugin-react-hooks 7 compiler rules is
-    # killed on the 7 GB hosted runner without a message (status null → exit 1, the
-    # JSON never written); the box lints it in ~12 min with the heap below.
+    runs-on: ubuntu-latest
     continue-on-error: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true }}
     # G0 (trilho .50): security-events:read lets the CodeQL ratchet below read open
     # code-scanning alerts via `gh api .../code-scanning/alerts` (same as ci.yml's
@@ -561,8 +544,6 @@ jobs:
       - name: ESLint (baseline congelado — warning novo = vermelho)
         # lint:json writes the report; --max-warnings 0 keeps no-new-warnings policy.
         run: npm run lint:json -- --max-warnings 0
-        env:
-          NODE_OPTIONS: --max-old-space-size=8192
       # ── G0 (trilho .50): motor de ratchet também no trilho B ─────────────────────
       # This job just wrote .artifacts/eslint-results.json — collect-metrics prefers
       # that file, so the ratchet engine lands here at ZERO extra ESLint cost (one

.github/workflows/scorecard.yml

@@ -4,15 +4,12 @@ on:
   schedule:
     - cron: "27 7 * * 1"
   push:
-    # Scorecard only accepts the DEFAULT branch — here the active release/vX.Y.Z,
-    # not `main`. The job below guards on it so a push to any other branch skips.
-    branches: ["main", "release/**"]
+    branches: ["main"]
 
 permissions: read-all
 
 jobs:
   analysis:
-    if: ${{ github.event_name != 'push' || github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
     name: Scorecard analysis
     runs-on: ubuntu-latest
     permissions:

.trivyignore

@@ -19,12 +19,4 @@
 # Keep this list SHORT and reviewed every release. Prefer fixing (rebuild on a
 # patched base / bump the dep) over suppressing. Stale entries are debt.
 #
-# CVE-2025-68121 — Go stdlib crypto/tls (session-resumption certificate validation)
-#   inside the PREBUILT bogdanfinn/tls-client v1.15.1 .so that tls-client-node's
-#   postinstall downloads (built with go 1.24.1; fixed in 1.24.13). No upstream
-#   rebuild exists (v1.15.1 is still the latest release) and nothing in this repo
-#   can bump it. The binary is only loaded by the browser-TLS web-provider
-#   executors (claude-web / grok-web / lmarena / perplexity-web / notion-web),
-#   whose handshakes go through utls. Tracking issue: #12084. Revisit at the next
-#   tls-client release or base-image bump and BEFORE the v3.8.51 tag (2026-09-15).
-CVE-2025-68121
+# (No accepted-risk suppressions at present — ignore-unfixed covers the noise.)

AGENTS.md

@@ -46,7 +46,7 @@ Repository map and Reference Documentation sections below.
 
 ## Project at a Glance
 
-**OmniRoute** — unified AI proxy/router. One endpoint, 352 LLM providers, auto-fallback.
+**OmniRoute** — unified AI proxy/router. One endpoint, 351 LLM providers, auto-fallback.
 
 | Layer         | Location                | Purpose                                                                                                                                                                   |
 | ------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -56,9 +56,9 @@ Repository map and Reference Documentation sections below.
 | Translators   | `open-sse/translator/`  | Format conversion (OpenAI↔Claude↔Gemini)                                                                                                                                  |
 | Transformer   | `open-sse/transformer/` | Responses API ↔ Chat Completions                                                                                                                                          |
 | Services      | `open-sse/services/`    | Combo routing, rate limits, caching, etc                                                                                                                                  |
-| Database      | `src/lib/db/`           | SQLite domain modules (167 migrations)                                                                                                                                    |
+| Database      | `src/lib/db/`           | SQLite domain modules (166 migrations)                                                                                                                                    |
 | Domain/Policy | `src/domain/`           | Policy engine, cost rules, fallback logic                                                                                                                                 |
-| MCP Server    | `open-sse/mcp-server/`  | 110 tools (45 canonical + memory/skill/GitHub/pool/gamification/plugin/Notion/Obsidian/local-corpus/RTK modules), 3 transports (stdio / SSE / Streamable HTTP), 33 scopes |
+| MCP Server    | `open-sse/mcp-server/`  | 110 tools (44 canonical + memory/skill/GitHub/pool/gamification/plugin/Notion/Obsidian/local-corpus/RTK modules), 3 transports (stdio / SSE / Streamable HTTP), 33 scopes |
 | A2A Server    | `src/lib/a2a/`          | JSON-RPC 2.0 agent protocol                                                                                                                                               |
 | Skills        | `src/lib/skills/`       | Extensible skill framework                                                                                                                                                |
 | Memory        | `src/lib/memory/`       | Persistent conversational memory                                                                                                                                          |
@@ -110,36 +110,26 @@ upstream/service level, so one unhealthy provider does not slow down every reque
 - Shared wrappers: `open-sse/services/accountFallback.ts`
 - Persisted state table: `domain_circuit_breakers`
 
-**States** (4 — `src/shared/utils/circuitBreaker.ts`):
+**States**:
 
 - `CLOSED`: normal traffic is allowed.
-- `DEGRADED`: early-warning band — failures crossed the degradation threshold but not the
-  breaker threshold yet; traffic still flows, dashboards show the warning.
 - `OPEN`: provider is temporarily blocked; callers get a provider-circuit-open response
   or combo routing skips to another target.
 - `HALF_OPEN`: reset timeout has elapsed; allow a probe request. Success closes the
   breaker, failure opens it again.
 
-**Defaults** (`open-sse/config/constants.ts` → `PROVIDER_PROFILES`, consumed via
-`DEFAULT_RESILIENCE_SETTINGS.providerBreaker` in `src/lib/resilience/settings.ts` →
-`getCircuitBreaker(provider, …)` in `src/sse/handlers/chatHelpers.ts`). The whole-provider
-breaker runs on `circuitBreakerThreshold` / `circuitBreakerReset`:
+**Defaults** (`open-sse/config/constants.ts` → `PROVIDER_PROFILES`). Two thresholds live side by
+side — do not confuse them:
 
-| Profile | degrades at | opens at (`circuitBreakerThreshold`) | reset (`circuitBreakerReset`) |
-| ------- | ----------: | -----------------------------------: | ----------------------------: |
-| OAuth   |         `5` |                                  `8` |                         `60s` |
-| API key |         `7` |                                 `12` |                         `30s` |
-| Local   |   (derived) |                                  `2` |                         `15s` |
+| Profile | `providerFailureThreshold` (whole provider) | `providerCooldownMs` | `circuitBreakerThreshold` (one connection) | `circuitBreakerReset` |
+| ------- | ------------------------------------------: | -------------------: | -----------------------------------------: | --------------------: |
+| OAuth   |                                        `10` |               `5min` |                                        `8` |                 `60s` |
+| API key |                                        `15` |              `10min` |                                       `12` |                 `30s` |
+| Local   |                                         `2` |               `1min` |                                        `2` |                 `15s` |
 
-`PROVIDER_PROFILES` also defines `providerFailureThreshold` (10/15/2),
-`providerFailureWindowMs` (15/30/5 min) and `providerCooldownMs` (5/10/1 min): these power the
-**window gate of the opt-in global Provider Cooldown** (`PROVIDER_COOLDOWN_ENABLED`, default
-off) — a provider-level entry in `open-sse/services/providerCooldownTracker.ts` only counts as
-cooling after `providerFailureThreshold` failures inside `providerFailureWindowMs`, and then
-cools for `providerCooldownMs`. They are NOT the live breaker's thresholds — do not tune them
-expecting breaker behavior. Every default is overridable through the
-`OMNIROUTE_PROVIDER_BREAKER_*` and `OMNIROUTE_CIRCUIT_BREAKER_*` env vars; the
-runtime-accurate reference table lives in `docs/architecture/RESILIENCE_GUIDE.md`.
+The provider-level thresholds were scaled up for deployments with 500+ connections (OAuth was
+`3`, API key was `5`); every default is overridable through the `OMNIROUTE_PROVIDER_BREAKER_*`
+and `OMNIROUTE_CIRCUIT_BREAKER_*` env vars.
 
 Only provider-level failure statuses should trip the provider breaker:
 
@@ -252,7 +242,7 @@ Read the nearest `AGENTS.md` and the linked deep-dive before making a non-trivia
 | Streaming request handling         | `open-sse/handlers/`                                    | [`docs/architecture/ARCHITECTURE.md`](docs/architecture/ARCHITECTURE.md)                                                                         |
 | Provider execution and translation | `open-sse/executors/`, `open-sse/translator/`           | [`docs/architecture/CODEBASE_DOCUMENTATION.md`](docs/architecture/CODEBASE_DOCUMENTATION.md)                                                     |
 | Routing and resilience             | `open-sse/services/`                                    | [`open-sse/services/AGENTS.md`](open-sse/services/AGENTS.md), [`docs/routing/AUTO-COMBO.md`](docs/routing/AUTO-COMBO.md)                         |
-| Database and migrations            | `src/lib/db/`, `src/lib/db/migrations/`                 | [`src/lib/db/AGENTS.md`](src/lib/db/AGENTS.md)                                                                                                   |
+| Database and migrations            | `src/lib/db/`, `db/migrations/`                         | [`src/lib/db/AGENTS.md`](src/lib/db/AGENTS.md)                                                                                                   |
 | Domain policy                      | `src/domain/`                                           | [`docs/architecture/ARCHITECTURE.md`](docs/architecture/ARCHITECTURE.md)                                                                         |
 | MCP and A2A                        | `open-sse/mcp-server/`, `src/lib/a2a/`                  | [`docs/frameworks/MCP-SERVER.md`](docs/frameworks/MCP-SERVER.md), [`docs/frameworks/A2A-SERVER.md`](docs/frameworks/A2A-SERVER.md)               |
 | Agent features                     | `src/lib/{acp,memory,skills,cloudAgent}/`               | [`docs/frameworks/AGENT_PROTOCOLS_GUIDE.md`](docs/frameworks/AGENT_PROTOCOLS_GUIDE.md), [`docs/frameworks/SKILLS.md`](docs/frameworks/SKILLS.md) |
@@ -264,13 +254,13 @@ Read the nearest `AGENTS.md` and the linked deep-dive before making a non-trivia
 ## File placement & repo-root hygiene
 
 - **Test files**: ALL unit tests, integration tests, ecosystem tests, or Vitest files MUST strictly be placed within the `tests/` directory (e.g., `tests/unit/`, `tests/integration/`). NEVER create test files in the project root (`/`).
-- **Scripts and utilities**: ALL maintenance, debugging, generation, or experimental scripts (`.cjs`, `.mjs`, `.js`, `.ts`) MUST be placed strictly inside one of the `scripts/` subfolders (`build/`, `dev/`, `check/`, `docs/`, `i18n/`, `ad-hoc/`, `quality/`, `release/`, `ci/`, `ops/`, `perf/`, `research/`, `sre/`, `vps/`, `homolog/`, `packs/`, `skills/`, `test/`, `cli/`, `compression/`, `compression-eval/`, `devin-bridge/`, `docker/`, `features/`, `router-eval/`). One-shot or experimental code goes under `scripts/ad-hoc/`. NEVER dump loose scripts in the project root (`/`) or the top-level `scripts/` folder.
+- **Scripts and utilities**: ALL maintenance, debugging, generation, or experimental scripts (`.cjs`, `.mjs`, `.js`, `.ts`) MUST be placed strictly inside one of the `scripts/` subfolders (`build/`, `dev/`, `check/`, `docs/`, `i18n/`, `ad-hoc/`, `quality/`, `release/`, `ci/`, `ops/`, `perf/`, `research/`, `sre/`, `vps/`, `homolog/`, `raycast/`, `skills/`, `test/`, `cli/`, `compression/`, `compression-eval/`, `devin-bridge/`, `docker/`, `features/`, `router-eval/`). One-shot or experimental code goes under `scripts/ad-hoc/`. NEVER dump loose scripts in the project root (`/`) or the top-level `scripts/` folder.
 
 **The project root MUST ONLY contain:**
 
 - Configuration files (`vitest.config.ts`, `next.config.mjs`, `eslint.config.mjs`, `tsconfig*.json`, `playwright.config.ts`, `prettier.config.mjs`, `postcss.config.mjs`, `sonar-project.properties`, `fly.toml`, `docker-compose*.yml`, `Dockerfile`)
 - Dependency files (`package.json`, `package-lock.json`)
-- Documentation files (`README.md`, `CHANGELOG.md`, `ROADMAP.md`, `LICENSE`, `AGENTS.md`, `CLAUDE.md`, `GEMINI.md`, `CONTRIBUTING.md`, `SECURITY.md`, `CODE_OF_CONDUCT.md`, `llm.txt`)
+- Documentation files (`README.md`, `CHANGELOG.md`, `ROADMAP.md`, `LICENSE`, `AGENTS.md`, `CLAUDE.md`, `GEMINI.md`, `CONTRIBUTING.md`, `SECURITY.md`, `CODE_OF_CONDUCT.md`, `llm.txt`, `Tuto_Qdrant.md`)
 - CI/CD files and ignore definitions (`.gitignore`, `.dockerignore`, `.npmignore`, `.npmrc`, `.node-version`, `.nvmrc`, `.env.example`)
 
 When creating _any_ validation tests or one-off logic scripts, default to `scripts/ad-hoc/` or `tests/unit/` according to your goals. Do not pollute the `/` root context.
@@ -299,7 +289,8 @@ When creating _any_ validation tests or one-off logic scripts, default to `scrip
 ### Database
 
 - **Always** go through `src/lib/db/` domain modules — **never** write raw SQL in routes or handlers
-- **Never** barrel-import from `localDb.ts` — import specific `src/lib/db/*` modules
+- **Never** add logic to `src/lib/localDb.ts` (re-export layer only)
+- **Never** barrel-import from `localDb.ts` — import specific `db/` modules instead
 - DB singleton: `getDbInstance()` from `src/lib/db/core.ts` (WAL journaling)
 - Migrations: `src/lib/db/migrations/` — versioned SQL files, idempotent, run in transactions
 
@@ -364,18 +355,19 @@ Documentation must describe verified behavior, not plausible behavior.
 1. Create `src/lib/db/yourModule.ts` — import `getDbInstance` from `./core.ts`
 2. Export CRUD functions for your domain table(s)
 3. Add migration in `src/lib/db/migrations/` if new tables needed
-4. Write tests
+4. Re-export from `src/lib/localDb.ts` (add to the re-export list only)
+5. Write tests
 
 ### Adding a New MCP Tool
 
 1. Add tool definition in `open-sse/mcp-server/tools/` with Zod input schema + async handler
 2. Register in tool set (wired by `createMcpServer()`)
 3. Assign to appropriate scope(s)
-4. Write tests (tool invocation logged to the `mcp_tool_audit` table)
+4. Write tests (tool invocation logged to `mcp_audit` table)
 
 ### Adding a New A2A Skill
 
-1. Create skill in `src/lib/a2a/skills/` (6 already exist: smart-routing, quota-management, provider-discovery, cost-analysis, health-report, list-capabilities)
+1. Create skill in `src/lib/a2a/skills/` (5 already exist: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 2. Skill receives task context (messages, metadata) → returns structured result
 3. Register in `A2A_SKILL_HANDLERS` in `src/lib/a2a/taskExecution.ts`
 4. Expose in `src/app/.well-known/agent.json/route.ts` (Agent Card)
@@ -384,7 +376,7 @@ Documentation must describe verified behavior, not plausible behavior.
 
 ### Adding a New Cloud Agent
 
-1. Create agent class in `src/lib/cloudAgent/agents/` extending `CloudAgentBase` (4 already exist: codex-cloud, devin, jules, cursor-cloud)
+1. Create agent class in `src/lib/cloudAgent/agents/` extending `CloudAgentBase` (3 already exist: codex-cloud, devin, jules)
 2. Implement `createTask`, `getStatus`, `approvePlan`, `sendMessage`, `listSources`
 3. Register in `src/lib/cloudAgent/registry.ts`
 4. Add OAuth/credentials handling if needed (`src/lib/oauth/providers/`)
@@ -395,7 +387,7 @@ Documentation must describe verified behavior, not plausible behavior.
 1. Create installer in `src/lib/services/installers/{name}.ts` modeled on `ninerouter.ts` (use `runNpm` from `installers/utils.ts` — no shell interpolation, hard rule #13).
 2. Register the service in `src/lib/services/bootstrap.ts` (add to `SERVICES[]` array and extend `buildSpawnArgsFactory()`).
 3. Add a DB seed row for the new service in `src/lib/db/migrations/` (`version_manager` table, `status='not_installed'`, `auto_start=0`).
-4. Create 8 API endpoints under `src/app/api/services/{name}/` (`_lib.ts`, `install`, `start`, `stop`, `restart`, `update`, `status`, `auto-start`, `auto-restart-adopted`). All delegate errors through `createErrorResponse()`. The shared `logs` endpoint is already wired via `[name]/logs/route.ts`.
+4. Create 7 API endpoints under `src/app/api/services/{name}/` (`_lib.ts`, `install`, `start`, `stop`, `restart`, `update`, `status`, `auto-start`). All delegate errors through `createErrorResponse()`. The shared `logs` endpoint is already wired via `[name]/logs/route.ts`.
 5. Verify `/api/services/` is in `LOCAL_ONLY_API_PREFIXES` in `src/server/authz/routeGuard.ts`; add a test asserting `isLocalOnlyPath()` returns `true` for the new prefix if you add one (hard rule #17).
 6. Add a UI tab in `src/app/(dashboard)/dashboard/providers/services/tabs/` reusing `ServiceStatusCard`, `ServiceLifecycleButtons`, `ServiceLogsPanel`.
 7. Document in `docs/frameworks/EMBEDDED-SERVICES.md` (update §1 service table + §4 API reference) and `docs/openapi.yaml`.
@@ -407,9 +399,6 @@ Documentation must describe verified behavior, not plausible behavior.
 - Eval suite: `src/lib/evals/` → docs: `docs/frameworks/EVALS.md`
 - Skill (sandbox): `src/lib/skills/` → docs: `docs/frameworks/SKILLS.md`
 - Webhook event: `src/lib/webhookDispatcher.ts` → docs: `docs/frameworks/WEBHOOKS.md`
-- Log-export destination: add `src/lib/logExport/destinations/<name>.ts` + one line in
-  `src/lib/logExport/registry.ts` → docs: `docs/frameworks/LOG-EXPORT.md`. The runner, REST layer
-  and dashboard form all read the registry, so nothing else changes.
 
 ---
 
@@ -435,7 +424,6 @@ For any non-trivial change, read the matching deep-dive first:
 | Evals                                         | `docs/frameworks/EVALS.md`                              |
 | Compliance / audit                            | `docs/security/COMPLIANCE.md`                           |
 | Webhooks                                      | `docs/frameworks/WEBHOOKS.md`                           |
-| Log export (call logs → BigQuery/…)           | `docs/frameworks/LOG-EXPORT.md`                         |
 | Authorization pipeline                        | `docs/architecture/AUTHZ_GUIDE.md`                      |
 | Stealth (TLS / fingerprint)                   | `docs/security/STEALTH_GUIDE.md`                        |
 | Agent protocols (A2A / ACP / Cloud)           | `docs/frameworks/AGENT_PROTOCOLS_GUIDE.md`              |
@@ -448,7 +436,7 @@ For any non-trivial change, read the matching deep-dive first:
 | VS Code Copilot Chat (OmniCopilot extension)  | `docs/guides/VSCODE-COPILOT.md`                         |
 | Release flow                                  | `docs/ops/RELEASE_CHECKLIST.md`                         |
 | Embedded services                             | `docs/frameworks/EMBEDDED-SERVICES.md`                  |
-| Quality gates (~90 scripts, allowlist policy) | `docs/architecture/QUALITY_GATES.md`                    |
+| Quality gates (~80 scripts, allowlist policy) | `docs/architecture/QUALITY_GATES.md`                    |
 
 ---
 
@@ -494,12 +482,6 @@ Why this matters: fixing bug A while opening bug B is worse than not fixing at a
   pipeline, and A2A skills.
 - Do not close a contributor pull request after using its code; merge it through GitHub so
   the contributor receives credit.
-- **Never merge a PR that touches an agent-instruction surface without explicit operator
-  approval** — `CLAUDE.md`, `AGENTS.md`, `GEMINI.md`, `llm.txt` (+ mirrors) and
-  `skills/**/SKILL.md` are executed as authority by every AI session; a merged instruction
-  compromises every future agent run. Check with `gh pr diff <N> --name-only` before any
-  merge. Incident record: PR #11770 (2026-09-01) told agents to execute a third-party
-  setup script and was swept in by a merge campaign; reverted in #12249.
 
 ---
 
@@ -645,8 +627,8 @@ focused checks, and use a Conventional Commit message (for example, `docs: slim
 
 ## Environment
 
-- **Runtime**: Node.js ≥22.22.2 <23 || ≥24.0.0 <27, ES Modules. This is the **only supported** runtime for the published `omniroute` CLI, the server, and the test suites (`node:test` + vitest) — `engines.node` is authoritative and end users never need Bun. A **best-effort `bun:sqlite` compatibility path** exists so a global Bun install (`bun install -g omniroute`) can start without `better-sqlite3` (driver adapter + Bun-aware process spawning); it is **not** a supported runtime — no support guarantees — and every Bun-specific runtime change MUST preserve the Node driver/fallback chain and ship a Bun test (`test:bun:db`) or an explicit reason why the path is Node-only.
-- **Bun (build/dev script runner + compatibility smoke only)**: Bun `1.4.0` is pinned as an **exact devDependency** (provisioned through the existing `npm ci` via the lockfile's `@oven/bun-*` platform binaries — no `setup-bun`/ad-hoc install). It is used **only** to execute a small, allow-listed set of TypeScript **gate/generator scripts** (replacing `node --import tsx` for startup speed): the CI checks `check:provider-consistency`, `check:compression-budget`, `check:known-symbols`, and the non-CI `gen:provider-reference`, `bench:compression` — plus the focused `test:bun:db` compatibility smoke suite for the best-effort `bun:sqlite` path. **Do NOT** widen Bun to `npm install`, the build (`build:cli*`), `check:pack-artifact`, the supported published runtime, or the main test runners — those stay on Node. Any new Bun-invoking gate/generator script must be validated byte-identical against its `node --import tsx` output first. After pulling the lockfile change, run `npm install` so `bun` resolves locally (a stale `node_modules` will fail those scripts with `bun: not found`).
+- **Runtime**: Node.js ≥22.0.0 <23 || ≥24.0.0 <27, ES Modules. This is the **only supported** runtime for the published `omniroute` CLI, the server, and the test suites (`node:test` + vitest) — `engines.node` is authoritative and end users never need Bun. A **best-effort `bun:sqlite` compatibility path** exists so a global Bun install (`bun install -g omniroute`) can start without `better-sqlite3` (driver adapter + Bun-aware process spawning); it is **not** a supported runtime — no support guarantees — and every Bun-specific runtime change MUST preserve the Node driver/fallback chain and ship a Bun test (`test:bun:db`) or an explicit reason why the path is Node-only.
+- **Bun (build/dev script runner + compatibility smoke only)**: Bun `1.3.14` is pinned as an **exact devDependency** (provisioned through the existing `npm ci` via the lockfile's `@oven/bun-*` platform binaries — no `setup-bun`/ad-hoc install). It is used **only** to execute a small, allow-listed set of TypeScript **gate/generator scripts** (replacing `node --import tsx` for startup speed): the CI checks `check:provider-consistency`, `check:compression-budget`, `check:known-symbols`, and the non-CI `gen:provider-reference`, `bench:compression` — plus the focused `test:bun:db` compatibility smoke suite for the best-effort `bun:sqlite` path. **Do NOT** widen Bun to `npm install`, the build (`build:cli*`), `check:pack-artifact`, the supported published runtime, or the main test runners — those stay on Node. Any new Bun-invoking gate/generator script must be validated byte-identical against its `node --import tsx` output first. After pulling the lockfile change, run `npm install` so `bun` resolves locally (a stale `node_modules` will fail those scripts with `bun: not found`).
 - **TypeScript**: 6.0+, target ES2022, module esnext, resolution bundler
 - **Path aliases**: `@/*` → `src/`, `@omniroute/open-sse` → `open-sse/`, `@omniroute/open-sse/*` → `open-sse/*`
 - **Default port**: 20128 (API + dashboard on same port)
@@ -658,12 +640,12 @@ focused checks, and use a Conventional Commit message (for example, `docs: slim
 
 ## Quality Gates & Ratchets
 
-OmniRoute has **~90 quality-gate scripts** (`scripts/check/` + `scripts/quality/`) wired
+OmniRoute has **~80 quality-gate scripts** (`scripts/check/` + `scripts/quality/`) wired
 across **9 gate-running jobs** in `.github/workflows/ci.yml` (`lint`, `quality-gate`,
 `quality-extended`, `docs-sync-strict`, `i18n-ui-coverage`, `i18n`, `pr-test-policy`,
 `test-vitest`, `sonarqube`), plus the `quality.yml` fast-gates job (PR→`release/**`) and
-5 quality nightly workflows (`nightly-property`, `nightly-resilience`,
-`nightly-llm-security`, `nightly-mutation`, `nightly-schemathesis`). Full inventory, per-job breakdown, and operational
+3 nightly workflows (`nightly-property`, `nightly-resilience`, `nightly-llm-security`;
+`nightly-mutation` once merged). Full inventory, per-job breakdown, and operational
 procedures are in [`docs/architecture/QUALITY_GATES.md`](docs/architecture/QUALITY_GATES.md).
 
 **Quick reference:**
@@ -675,10 +657,6 @@ procedures are in [`docs/architecture/QUALITY_GATES.md`](docs/architecture/QUALI
   `npm run quality:ratchet -- --update` when a metric genuinely improves.
 - Job `test-vitest` runs `npm run test:vitest` (MCP tools, autoCombo, cache) — blocking.
   `test:vitest:ui` has been blocking since PR #7127.
-- **Velocity phase (2026-08-30 → v4.0)**: every numeric baseline is loosened by 20% and
-  `--require-tighten` is advisory (`quality-baseline.json` → `_policy`); the nightly
-  `baseline-headroom` job tracks how much of the budget is left in the issue
-  "📈 Baseline headroom". See `docs/architecture/QUALITY_GATES.md` → "Velocity phase".
 
 **Allowlist policy (short form):** Fix the cause; use the allowlist only for pre-existing
 violations you cannot fix in the same PR. Add a comment with justification + issue number.
@@ -690,7 +668,7 @@ the stale-enforcement added in Fase 6A.3.
 ## Hard Rules
 
 1. Never commit secrets or credentials
-2. Never barrel-import from `localDb.ts` — import specific `src/lib/db/*` modules
+2. Never add logic to `localDb.ts`
 3. Never use `eval()` / `new Function()` / implied eval
 4. Never commit directly to `main`
 5. Never write raw SQL in routes — use `src/lib/db/` modules

CONTRIBUTING.md

@@ -73,9 +73,6 @@ npm run dev
 npm run build    # next build → .build/next/ then assembleStandalone → dist/
 npm run start
 
-# Fast backend/API-only compile for contributor changes
-npm run build:contributor
-
 # Release build (clean rebuild + HEAD sentinel — required for deploy)
 npm run build:release   # rm -rf .build dist && build + writes dist/BUILD_SHA
 
@@ -83,10 +80,6 @@ npm run build:release   # rm -rf .build dist && build + writes dist/BUILD_SHA
 PORT=20128 NEXT_PUBLIC_BASE_URL=http://localhost:20128 npm run dev
 ```
 
-The contributor build performs compile-only validation: it does not assemble the standalone
-distribution or build optional native packaging assets. Use the regular production build when
-you need to validate the shippable bundle.
-
 ### Build Output Layout
 
 | Directory | Contents                                                                  | Tracked |
@@ -107,11 +100,6 @@ npm run build
 `npm run build:release` additionally cleans both directories first and writes
 `dist/BUILD_SHA` (= `git rev-parse --short HEAD`) as a deploy integrity sentinel.
 
-`npm run build:contributor` uses the backend-only build profile. It temporarily stubs
-dashboard UI files while building, keeps API route handlers, and restores the original files
-after the build. Use `npm run build` for changes that affect the dashboard UI or for full
-release validation; the contributor profile is not a replacement for the release build.
-
 > **VPS deploy note:** the remote image directory `/usr/lib/node_modules/omniroute/app/`
 > is unchanged. The deploy skills rsync the contents of `dist/` into it.
 > Only the in-repo build output path moved (`app/` → `dist/`).
@@ -313,7 +301,7 @@ src/                        # TypeScript (.ts / .tsx)
 open-sse/                   # @omniroute/open-sse workspace
 ├── executors/              # 89 executor implementation modules
 ├── handlers/               # 11 request handlers (chat, responses, embeddings, images, etc.)
-├── mcp-server/             # MCP server (110 unique tools, 3 transports, 33 scopes)
+├── mcp-server/             # MCP server (107 unique tools, 3 transports, 32 scopes)
 ├── services/               # 178 top-level services (combo, autoCombo, rateLimitManager, etc.)
 ├── translator/             # Format translators (OpenAI ↔ Claude ↔ Gemini ↔ Responses ↔ Ollama)
 ├── transformer/            # Responses API transformer

Dockerfile

@@ -103,11 +103,25 @@ RUN test -f package-lock.json \
 # node-gyp comes from npm's own bundled copy (deterministic, already in the image)
 # instead of `npx --yes`, which would install an arbitrary registry version
 # on-demand and run its lifecycle scripts (Sonar docker:S6505).
+#
+# tls-client-node (claude-web/grok-web/lmarena/perplexity-web TLS
+# impersonation) hits the same --ignore-scripts wall: its own postinstall.js
+# fetches a platform .so/.dylib/.dll from the bogdanfinn/tls-client GitHub
+# Releases API and is never invoked when npm ci skips lifecycle scripts. Unlike
+# better-sqlite3 above, that script never throws on failure — it only
+# `console.warn`s and exits 0 — so a rate-limited or offline build would
+# otherwise succeed silently with an empty bin/ and only fail at first request
+# in production (TlsClientUnavailableError, #7802). Run it explicitly here so
+# a broken/rate-limited fetch fails the BUILD loudly instead of shipping a
+# broken image.
 RUN --mount=type=cache,id=s/92ca8a61-c1ba-421f-a389-d48ac7258c2d-npm-cache,target=/root/.npm \
   npm ci --include=optional --no-audit --no-fund --legacy-peer-deps --ignore-scripts \
   && (cd node_modules/better-sqlite3 \
       && node /usr/local/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js rebuild) \
-  && node -e "require('better-sqlite3')(':memory:').close()"
+  && node -e "require('better-sqlite3')(':memory:').close()" \
+  && node node_modules/tls-client-node/scripts/postinstall.js \
+  && (test -n "$(find node_modules/tls-client-node/bin -mindepth 1 -print -quit 2>/dev/null)" \
+      || (echo "tls-client-node native binary missing after postinstall — GitHub API fetch likely rate-limited or failed (#7802)" >&2 && exit 1))
 
 # Build with Turbopack (stable in Next 16, the repo default). The v3.8.27-era
 # TurbopackInternalError panic ("entered unreachable code: there must be a path to a

Dockerfile.bun

@@ -1,5 +1,5 @@
 # ── Multi-stage Dockerfile for Native Bun Runtime (web-latest-bun) ───────────
-FROM oven/bun:1.4.0-slim AS base
+FROM oven/bun:1.3.14-slim AS base
 WORKDIR /app
 
 RUN apt-get update \
@@ -31,9 +31,9 @@ COPY scripts/dev/sync-env.mjs ./scripts/dev/sync-env.mjs
 # Fast Bun native package install
 RUN bun install --include=optional --quiet
 
-# Compile native better-sqlite3 Node-API addon under Bun
-RUN if [ -d "node_modules/better-sqlite3" ]; then \
-      (cd node_modules/better-sqlite3 && bunx node-gyp rebuild); \
+# Fetch tls-client-node native binary if script exists
+RUN if [ -f "node_modules/tls-client-node/scripts/postinstall.js" ] && [ ! -d "node_modules/tls-client-node/bin" ]; then \
+      bun node_modules/tls-client-node/scripts/postinstall.js || true; \
     fi
 
 # Smoke check native database driver used by Bun (bun:sqlite)
@@ -58,7 +58,7 @@ ENV NODE_ENV=production
 RUN bun run --quiet build
 
 # ── Runner Base stage (100% Bun Native Production Runtime) ──────────────────
-FROM oven/bun:1.4.0-slim AS runner-base
+FROM oven/bun:1.3.14-slim AS runner-base
 
 LABEL org.opencontainers.image.title="omniroute" \
   org.opencontainers.image.description="Unified AI proxy — route any LLM through one endpoint (Bun Native)" \

README.md

@@ -7,7 +7,7 @@
 
 # 🚀 OmniRoute — The Free AI Gateway
 
-<img src="./docs/diagrams/readme-hero.svg" width="100%" alt="OmniRoute — Never stop coding. Every AI tool → 352 providers — 150+ free — through one endpoint. Claude Code, Codex, Cursor, Cline, Copilot & Antigravity into FREE Claude / GPT / Gemini with auto-fallback. RTK + Caveman stacked compression saves 15–95% tokens (~89% avg) — never hit limits. 352 AI providers · 150+ free tiers · ~1.51B free tokens/mo · 19 routing strategies · $0 to start."/>
+<img src="./docs/diagrams/readme-hero.svg" width="100%" alt="OmniRoute — Never stop coding. Every AI tool → 351 providers — 90+ free — through one endpoint. Claude Code, Codex, Cursor, Cline, Copilot & Antigravity into FREE Claude / GPT / Gemini with auto-fallback. RTK + Caveman stacked compression saves 15–95% tokens (~89% avg) — never hit limits. 351 AI providers · 90+ free tiers · ~1.51B free tokens/mo · 19 routing strategies · $0 to start."/>
 
 </div>
 
@@ -17,9 +17,9 @@
 
 </div>
 
-> Stacking free tiers by hand is painful — dozens of SDKs, dozens of rate limits, and no idea how much you actually have. OmniRoute catalogs **446 free-tier entries across 38 recurring pool keys** and computes the token headline from the **20 pools with a published positive monthly budget**, deduplicated by shared pool. The result stays visible on the dashboard (`/dashboard/free-tiers`).
+> Stacking free tiers by hand is painful — dozens of SDKs, dozens of rate limits, and no idea how much you actually have. OmniRoute catalogs **445 free-tier entries across 39 recurring pool keys** and computes the token headline from the **20 pools with a published positive monthly budget**, deduplicated by shared pool. The result stays visible on the dashboard (`/dashboard/free-tiers`).
 
-<img src="./docs/diagrams/free-tier-budget.svg" width="100%" alt="OmniRoute free-tier budget card: ~1.51B free tokens per month steady, up to ~2.13B in the first month with signup credits, from 38 documented recurring pool keys covering 446 cataloged free-tier entries behind one endpoint. Honest pool-deduped math — each shared pool counted once, including 20 recurring pools with a published positive monthly token budget; 13 providers are marked avoid in the terms-risk catalog so you decide. Budget bar includes Mistral 1B, LLM7 150M, Nara 150M, Gemini 60M and smaller pools, plus first-month signup credits and permanently-free no-token-cap providers surfaced separately so they never inflate the headline. Live used/remaining on /dashboard/free-tiers."/>
+<img src="./docs/diagrams/free-tier-budget.svg" width="100%" alt="OmniRoute free-tier budget card: ~1.51B free tokens per month steady, up to ~2.13B in the first month with signup credits, from 39 documented recurring pool keys covering 445 cataloged free-tier entries behind one endpoint. Honest pool-deduped math — each shared pool counted once, including 20 recurring pools with a published positive monthly token budget; 13 providers are marked avoid in the terms-risk catalog so you decide. Budget bar includes Mistral 1B, LLM7 150M, Nara 150M, Gemini 60M and smaller pools, plus first-month signup credits and permanently-free no-token-cap providers surfaced separately so they never inflate the headline. Live used/remaining on /dashboard/free-tiers."/>
 
 > Animated summary of the live `/dashboard/free-tiers` page. Full methodology (pool dedupe, credit tiers, provider terms): **[docs/reference/FREE_TIERS.md](docs/reference/FREE_TIERS.md)**.
 >
@@ -50,7 +50,7 @@
 [![Discord](https://img.shields.io/badge/Discord-5865F2?style=for-the-badge&logo=discord&logoColor=white)](https://discord.gg/U47eFqAXCn)
 [![Telegram](https://img.shields.io/badge/Telegram-26A5E4?style=for-the-badge&logo=telegram&logoColor=white)](https://t.me/omnirouteOficial)
 [![WhatsApp Global](https://img.shields.io/badge/WhatsApp_Global-25D366?style=for-the-badge&logo=whatsapp&logoColor=white)](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)
-[![WhatsApp Brasil](https://img.shields.io/badge/WhatsApp_Brasil-25D366?style=for-the-badge&logo=whatsapp&logoColor=white)](https://chat.whatsapp.com/KWgatljAjmbELQory59Oti?s=cl&p=a&mlu=4)
+[![WhatsApp Brasil](https://img.shields.io/badge/WhatsApp_Brasil-25D366?style=for-the-badge&logo=whatsapp&logoColor=white)](https://chat.whatsapp.com/LTSpdFhXTxjH4R6CCNiKWz)
 [![Website](https://img.shields.io/badge/Website-omniroute.online-blue?logo=google-chrome&logoColor=white)](https://omniroute.online)
 
 **Questions, provider tips, roadmap & support → [Discord](https://discord.gg/U47eFqAXCn) · [Telegram](https://t.me/omnirouteOficial) · WhatsApp [🌍 Global](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t) / [🇧🇷 Brasil](https://chat.whatsapp.com/LTSpdFhXTxjH4R6CCNiKWz)**
@@ -63,7 +63,7 @@
 
 |                           | v3.8.49 |        **v3.8.50**        | `v3.8.51+`  |
 | ------------------------- | :-----: | :-----------------------: | :---------: |
-| 🌐 Providers              |   290   |          **352**          | more queued |
+| 🌐 Providers              |   290   |          **350**          | more queued |
 | 🧠 Unique chat model IDs  |  1185   |         **1312**          |      —      |
 | 🖼️ Modality Bridge        |    —    | 🆕 vision + audio + video |      —      |
 | 📡 Radar free catalog     |    —    |         🆕 opt-in         |      —      |
@@ -101,7 +101,7 @@
   <tr>
     <td align="right"><b>⚙️ Features</b></td>
     <td align="center"><a href="#-combos--the-flagship">🎯 Combos</a></td>
-    <td align="center"><a href="#-352-ai-providers--154-catalog-marked-free">🌐 Providers</a></td>
+    <td align="center"><a href="#-351-ai-providers--154-catalog-marked-free">🌐 Providers</a></td>
     <td align="center"><a href="#-full-cli--a2a--mcp">🔌 CLI &amp; MCP</a></td>
   </tr>
   <tr>
@@ -210,7 +210,7 @@ curl http://localhost:20128/v1/chat/completions \
 
 </div>
 
-<img src="./docs/diagrams/promise-pillars.svg" width="100%" alt="The Promise — One endpoint and 352 providers. Automatic fallback keeps routing while another healthy target is available. Six pillars: resilient fallback across 352 providers · up to 95% token savings on eligible workloads · $0 to start with 150+ free tiers and 53 recurring/keyless free-forever providers · 36 CLI/agent integrations through one config · OpenAI, Claude, Gemini and Responses API compatibility at /v1 · production controls including circuit breakers, TLS stealth, MCP 110 tools, A2A, memory, guardrails, evals and 39,000+ static test declarations across 5,100+ tracked test files."/>
+<img src="./docs/diagrams/promise-pillars.svg" width="100%" alt="The Promise — One endpoint and 351 providers. Automatic fallback keeps routing while another healthy target is available. Six pillars: resilient fallback across 351 providers · up to 95% token savings on eligible workloads · $0 to start with 90+ free tiers and 56 recurring/keyless free-forever providers · 35 CLI/agent integrations through one config · OpenAI, Claude, Gemini and Responses API compatibility at /v1 · production controls including circuit breakers, TLS stealth, MCP 110 tools, A2A, memory, guardrails, evals and 39,000+ static test declarations across 5,100+ tracked test files."/>
 
 <br/>
 <br/>
@@ -332,8 +332,6 @@ No combo to create. Set your model to `auto` (or a variant) and OmniRoute builds
   <tr><td align="left" nowrap><code>auto/cheap</code></td><td align="left">💰 Cheapest per token first</td></tr>
   <tr><td align="left" nowrap><code>auto/offline</code></td><td align="left">🔋 Most quota / rate-limit headroom first</td></tr>
   <tr><td align="left" nowrap><code>auto/smart</code></td><td align="left">🔭 Quality-first + 10% exploration to discover better models</td></tr>
-  <tr><td align="left" nowrap><code>auto/lkgp</code></td><td align="left">📌 Explicit last-known-good-provider stickiness</td></tr>
-  <tr><td align="left" nowrap><code>auto/chaos</code></td><td align="left">🧪 Fault-injection weights for resilience testing (chaos engineering)</td></tr>
 </table>
 
 ##
@@ -451,7 +449,7 @@ All **19** strategies — mix & match per combo step:
 
 ### 🧱 Resilience is built in (3 independent layers)
 
-<img src="./docs/diagrams/resilience-layers.svg" width="100%" alt="OmniRoute resilience — 3 independent self-healing layers, the right layer for the right failure. Layer 1 provider circuit breaker (whole provider): trips only on 408/5xx, thresholds OAuth 8× / API-key 12× / local 2×, resets 60s/30s/15s into a HALF-OPEN probe, lazy recovery; while OPEN the combo reroutes to the next provider. Layer 2 connection cooldown (one key/account): base 5s OAuth / 3s API-key, exponential ×2 backoff with anti-thundering-herd guard, 429 honors Retry-After, success clears all error state; one cooling key is skipped while sibling keys keep serving. Layer 3 model lockout (one model): per-model 429, local 404 or mode denials lock just that model — never the whole connection. Terminal states (banned, expired, credits exhausted) are for the operator, not cooldowns."/>
+<img src="./docs/diagrams/resilience-layers.svg" width="100%" alt="OmniRoute resilience — 3 independent self-healing layers, the right layer for the right failure. Layer 1 provider circuit breaker (whole provider): trips only on 408/5xx, thresholds OAuth 10× / API-key 15× / local 2×, resets 60s/30s/15s into a HALF-OPEN probe, lazy recovery; while OPEN the combo reroutes to the next provider. Layer 2 connection cooldown (one key/account): base 5s OAuth / 3s API-key, exponential ×2 backoff with anti-thundering-herd guard, 429 honors Retry-After, success clears all error state; one cooling key is skipped while sibling keys keep serving. Layer 3 model lockout (one model): per-model 429, local 404 or mode denials lock just that model — never the whole connection. Terminal states (banned, expired, credits exhausted) are for the operator, not cooldowns."/>
 
 <sub>📖 [Auto-Combo Engine](docs/routing/AUTO-COMBO.md) · [Resilience Guide](docs/architecture/RESILIENCE_GUIDE.md)</sub>
 
@@ -463,7 +461,7 @@ All **19** strategies — mix & match per combo step:
 
 </div>
 
-<img src="./docs/diagrams/comparison-table.svg" width="100%" alt="What sets OmniRoute apart — a dated feature snapshot vs 9router, OpenRouter, CLIProxyAPI and LiteLLM across 13 capabilities. OmniRoute: 352 providers, 150+ free tiers built in, 19 routing strategies, 12-engine token compression, built-in MCP server with 110 tools, A2A agent protocol, persistent memory, guardrails, cloud agents, TLS fingerprint stealth, Desktop/Termux/PWA and 43 i18n UI locales. OmniRoute is MIT-licensed and self-hostable. Competitor capabilities and counts may change; see the linked methodology."/>
+<img src="./docs/diagrams/comparison-table.svg" width="100%" alt="What sets OmniRoute apart — a dated feature snapshot vs 9router, OpenRouter, CLIProxyAPI and LiteLLM across 13 capabilities. OmniRoute: 351 providers, 90+ free tiers built in, 19 routing strategies, 12-engine token compression, built-in MCP server with 110 tools, A2A agent protocol, persistent memory, guardrails, cloud agents, TLS fingerprint stealth, Desktop/Termux/PWA and 43 i18n UI locales. OmniRoute is MIT-licensed and self-hostable. Competitor capabilities and counts may change; see the linked methodology."/>
 
 <sub>📊 Full methodology &amp; per-feature detail vs 9router, OpenRouter, CLIProxyAPI &amp; LiteLLM → [`docs/comparison/OMNIROUTE_VS_ALTERNATIVES.md`](docs/comparison/OMNIROUTE_VS_ALTERNATIVES.md)</sub>
 
@@ -550,7 +548,7 @@ the current catalog at **[radar.omniroute.online/planos](https://radar.omniroute
 - **🗜️ Compression hardening** — default-on inflation guard, Caveman packs for DE / FR / JA + Chinese (wényán), RTK filters for Gradle & .NET. → [Compression](docs/compression/COMPRESSION_ENGINES.md)
 - **💸 Honest flat-rate cost** — subscription / coding-plan providers read **$0** in cost analytics; budget, quota & routing keep estimating. → [API Reference](docs/reference/API_REFERENCE.md)
 - **⚖️ Quota-Share routing** — split a shared account's quota fairly across pooled keys, work-conserving so idle slices are lent out. → [Resilience Guide](docs/architecture/RESILIENCE_GUIDE.md)
-- **🤖 One-command CLI/agent setup** — 13 registered `setup-*` commands; `omniroute run` launches 7 CLIs (Claude Code, Codex, Aider, Goose, OpenCode, Qwen Code, Gemini CLI); `omniroute configure` supports 10 targets with an interactive provider+model picker and per-context favorites. → [CLI Integrations](docs/guides/CLI-INTEGRATIONS.md)
+- **🤖 One-command CLI/agent setup** — 12 registered `setup-*` commands; `omniroute run` launches 7 CLIs (Claude Code, Codex, Aider, Goose, OpenCode, Qwen Code, Gemini CLI); `omniroute configure` supports 9 targets with an interactive provider+model picker and per-context favorites. → [CLI Integrations](docs/guides/CLI-INTEGRATIONS.md)
 - **🛰️ Remote mode** — drive a remote OmniRoute with scoped tokens (`connect` / `contexts` / `tokens`) + an `antigravity` OAuth helper for VPS installs. → [Remote Mode](docs/guides/REMOTE-MODE.md)
 - **🧭 Smarter auto-routing** — `auto/<category>:<tier>` combos, **Fusion** (model panel + judge), task-aware routing, per-request model / mode / USD-budget overrides. → [Auto-Combo](docs/routing/AUTO-COMBO.md)
 - **🗜️ Pluggable compression** — 12 composable engines + Compression Studios: LLMLingua-2, two-tier Ultra, omniglyph, per-step fidelity gate, GCF v3.2, drag-reorder editor. → [Compression](docs/compression/COMPRESSION_ENGINES.md)
@@ -559,12 +557,11 @@ the current catalog at **[radar.omniroute.online/planos](https://radar.omniroute
 - **🧠 Memory you control** — off by default, opt-in int8 vector quantization + typed decay, per-request `x-omniroute-no-memory`. → [Memory](docs/frameworks/MEMORY.md)
 - **🛡️ Security** — prompt-injection guard on every LLM route (red-team suite), opt-in credential-masking guardrail (redacts leaked API keys/secrets in both directions), free DuckDuckGo last-resort web search, and an optional OIDC login gate for the dashboard (password login always stays available). → [Guardrails](docs/security/GUARDRAILS.md)
 - **🖼️ New endpoints** — `/v1/ocr` (Mistral OCR) and `/v1/audio/translations` (Whisper-style) round out the media surface. → [API Reference](docs/reference/API_REFERENCE.md)
-- **🎨 Image / video / audio generation** — one API for media: xAI Grok Imagine & Novita AI video, ComfyUI, Magnific, Adobe Firefly, Segmind, and speech providers such as ElevenLabs. → [API Reference](docs/reference/API_REFERENCE.md)
+- **🎨 Image / video / audio generation** — one API for media: xAI Grok Imagine & Novita AI video, ComfyUI, Freepik, Adobe Firefly, Segmind, and speech providers such as ElevenLabs. → [API Reference](docs/reference/API_REFERENCE.md)
 - **🌍 Deployment & ops** — reverse-proxy `basePath`, browser-language auto-detect, per-key device tracking, root-less MITM trust, zh-TW localization. → [Environment](docs/reference/ENVIRONMENT.md)
-- **🤝 More providers & agents** — cloud agents (Codex Cloud, Cursor, Devin, Jules), Grok Build (xAI) with browser + OAuth login, Ollama first-class card, Claude Opus 5 & Sonnet 5, Kimi official partnership (Code/Web/Moonshot), Zed, Requesty, SenseNova, Yuanbao, Agnes AI… and a refreshed **352-provider catalog**. → [Providers](docs/reference/PROVIDER_REFERENCE.md)
+- **🤝 More providers & agents** — Cursor Cloud Agent, Grok Build (xAI) with browser + OAuth login, Ollama first-class card, Claude Opus 5 & Sonnet 5, Kimi official partnership (Code/Web/Moonshot), Zed, Requesty, SenseNova, Yuanbao, Agnes AI… and a refreshed **351-provider catalog**. → [Providers](docs/reference/PROVIDER_REFERENCE.md)
 - **📡 Routing transparency** — every response carries an `X-OmniRoute-Decision` header naming the strategy/provider/latency that served it, a new `cache-optimized` combo strategy + Auto-Combo `cacheAffinity` factor route repeat requests back to the connection holding the cached prefix, and a read-only `/v1/auto-combo/{channel}/candidates` endpoint exposes an `auto/*` channel's live candidate pool. → [Auto-Combo](docs/routing/AUTO-COMBO.md)
 - **⚡ Local performance & infra** — one-click local Redis, Cloudflare Workers / Deno Deploy relay deployers, Bifrost & Mux as supervised embedded services. → [Embedded Services](docs/frameworks/EMBEDDED-SERVICES.md)
-- **🧩 Also in the box** — plugin framework + marketplace, Omni/Agent/GitHub skills frameworks, Obsidian vault integration (22 MCP tools), OpenAI-compatible Batch & Files APIs, semantic response cache, gamification with leaderboards, ACP agent discovery (15 built-in agents), scheduled log export to BigQuery, `auto/chaos` fault injection, a Telegram bot bridge, an in-app version manager and LMArena-ELO free-provider rankings. → [Docs](docs/README.md)
 
 <br/>
 
@@ -615,7 +612,7 @@ the current catalog at **[radar.omniroute.online/planos](https://radar.omniroute
 <b>＋ also works with</b> · Kiro · Command Code · Antigravity · Windsurf · AMP · <b>any OpenAI-compatible tool</b>
 </div>
 
-<sub>📖 Per-tool setup for all 36 tools (26 CLI Code's + 10 CLI Agents) → [`docs/reference/CLI-TOOLS.md`](docs/reference/CLI-TOOLS.md) · 🧩 OpenCode plugin → [`@omniroute/opencode-provider`](https://www.npmjs.com/package/@omniroute/opencode-provider)</sub>
+<sub>📖 Per-tool setup for all 35 tools (26 CLI Code's + 9 CLI Agents) → [`docs/reference/CLI-TOOLS.md`](docs/reference/CLI-TOOLS.md) · 🧩 OpenCode plugin → [`@omniroute/opencode-provider`](https://www.npmjs.com/package/@omniroute/opencode-provider)</sub>
 
 </div>
 
@@ -634,7 +631,7 @@ omniroute run qwen     --model glm/glm-5.2 -- -p "reply OK"
 omniroute run gemini   --model glm/glm-5.2 -- --skip-trust -p "reply OK"
 
 # Or pick provider+model interactively and write the tool's own config:
-omniroute configure codex          # also: claude opencode qwen aider goose gemini cline continue kilo
+omniroute configure codex          # also: claude opencode qwen aider goose cline continue kilo
 ```
 
 Every command honors the active remote context (`omniroute connect <host>`), `--dry-run`
@@ -645,11 +642,11 @@ of your shell history. → [CLI Integrations](docs/guides/CLI-INTEGRATIONS.md)
 
 <div align="center">
 
-## 🌐 352 AI Providers — 152 Catalog-Marked Free
+## 🌐 351 AI Providers — 154 Catalog-Marked Free
 
 </div>
 
-> **352 registered providers** across the canonical chat, media, search, local, cloud-agent and system collections, including **152 carrying `hasFree: true` discovery metadata**. The chat model registry covers **229 providers / 2,554 distinct provider-model pairs / 1,283 raw model IDs**; the separate free-budget catalog has **446 per-model rows**, **38 recurring pools** and **53 recurring/keyless free-forever providers**. These are different denominators by design; definitions and pool-deduped calculations live in the [Provider Reference](docs/reference/PROVIDER_REFERENCE.md) and [Free Tiers](docs/reference/FREE_TIERS.md).
+> **351 registered providers** across the canonical chat, media, search, local, cloud-agent and system collections, including **154 carrying `hasFree: true` discovery metadata**. The chat model registry covers **268 providers / 2,566 distinct provider-model pairs / 1,312 raw model IDs**; the separate free-budget catalog has **455 per-model rows**, **40 recurring pools** and **56 recurring/keyless free-forever providers**. These are different denominators by design; definitions and pool-deduped calculations live in the [Provider Reference](docs/reference/PROVIDER_REFERENCE.md) and [Free Tiers](docs/reference/FREE_TIERS.md).
 
 <div align="center">
 
@@ -813,7 +810,7 @@ Tokens are scoped `read` / `write` / `admin`; process-spawning routes stay loopb
 
 <div align="left">
 
-<img src="./docs/diagrams/cli-terminal.svg" width="50%" alt="Animated terminal demoing the OmniRoute CLI — omniroute providers list, omniroute combo list and omniroute health — cycling over the 86-command top-level surface: providers · oauth · keys · combo · nodes · models · cache · compression · cost · usage · quota · health · resilience · telemetry · logs · audit · mcp · a2a · cloud · memory · skills · eval · tunnel · backup · sync · webhooks · policy · pricing · translator · simulate …"/>
+<img src="./docs/diagrams/cli-terminal.svg" width="50%" alt="Animated terminal demoing the OmniRoute CLI — omniroute providers list, omniroute combo list and omniroute health — cycling over the 85-command top-level surface: providers · oauth · keys · combo · nodes · models · cache · compression · cost · usage · quota · health · resilience · telemetry · logs · audit · mcp · a2a · cloud · memory · skills · eval · tunnel · backup · sync · webhooks · policy · pricing · translator · simulate …"/>
 
 </div>
 
@@ -824,11 +821,11 @@ Expose OmniRoute over **MCP**, **A2A**, a **REST API**, **webhooks** or a **remo
 <table>
   <tr><th align="left">Interface</th><th align="left">Endpoint / command</th><th align="left">Use it for</th></tr>
   <tr><td align="left" nowrap>🧰 <b>MCP (stdio)</b></td><td align="left" nowrap><code>omniroute --mcp</code></td><td align="left">Plug into Claude Desktop, Cursor, any MCP client</td></tr>
-  <tr><td align="left" nowrap>🌊 <b>MCP (HTTP)</b></td><td align="left" nowrap><code>/api/mcp/stream</code></td><td align="left">Remote MCP — <b>110 tools</b>, 33 scopes (enforcement opt-in), full audit trail</td></tr>
+  <tr><td align="left" nowrap>🌊 <b>MCP (HTTP)</b></td><td align="left" nowrap><code>/api/mcp/stream</code></td><td align="left">Remote MCP — <b>110 tools</b>, 33 scopes, full audit trail</td></tr>
   <tr><td align="left" nowrap>📡 <b>MCP (SSE)</b></td><td align="left" nowrap><code>/api/mcp/sse</code></td><td align="left">Streaming MCP transport</td></tr>
   <tr><td align="left" nowrap>🤝 <b>A2A</b></td><td align="left" nowrap><code>/.well-known/agent.json</code></td><td align="left">Agent-to-agent, <b>JSON-RPC 2.0</b> + SSE, 6 skills</td></tr>
   <tr><td align="left" nowrap>🌐 <b>REST API</b></td><td align="left" nowrap><code>/v1/*</code></td><td align="left">OpenAI-compatible — chat, embeddings, images, audio, OCR</td></tr>
-  <tr><td align="left" nowrap>🔔 <b>Webhooks</b></td><td align="left" nowrap><code>/api/webhooks</code></td><td align="left">Push request / quota events to Slack, Discord, Telegram or any URL</td></tr>
+  <tr><td align="left" nowrap>🔔 <b>Webhooks</b></td><td align="left" nowrap><code>/api/webhooks</code></td><td align="left">Push events (usage, quota, errors, routing) to your URL</td></tr>
   <tr><td align="left" nowrap>🛰️ <b>Remote CLI</b></td><td align="left" nowrap><code>omniroute connect <host></code></td><td align="left">Drive a remote instance with scoped access tokens</td></tr>
 </table>
 
@@ -920,8 +917,6 @@ The 12 engines above shrink what goes **in**. Three more layers shape **how**, *
 - **🪄 Output Styles** _(output-axis steering)_ — inject deterministic, cache-safe response-shaping instructions; combinable, each at `lite` / `full` / `ultra` intensity. Adding a style is a one-line registry entry:
   - **Terse prose** — drop filler / articles / hedging; keep technical substance exact.
   - **Less code** — "lazy senior dev" YAGNI: smallest working change, no unrequested scaffolding.
-  - **Ponytail (lazy senior dev)** — climb the YAGNI ladder, fix the root cause, smallest working diff.
-  - **I have ADHD (action-first)** — next action leads, steps numbered, one concrete next step, no preamble.
   - **Terse CJK (文言)** — classical-Chinese ultra-terse style (locale-gated to `zh`).
 - **🎯 Adaptive context-budget** _(the dial)_ — instead of one on/off token threshold, escalate the cheapest, most-lossless engines only as far as needed to **fit the model's context window**. Policy: `reserve-output` (default, model-aware) · `percentage` · `absolute`. Mode: `floor` (guarantee fit) · `replace-autotrigger` (your explicit choice wins) · `off` (legacy threshold).
 - **🎛️ Where compression is decided** _(precedence, high → low)_ — per-request `x-omniroute-compression` header › routing-combo override › active named profile › adaptive / auto-trigger › panel default › off. The applied plan echoes back in the `X-OmniRoute-Compression: <mode>; source=<source>` response header.
@@ -1183,10 +1178,9 @@ Métricas canônicas em 2026-08-24: **1.029 vídeos únicos** · **11.132.922 vi
 | 🐙 **GitHub** — follow for releases & tips | [@diegosouzapw](https://github.com/diegosouzapw)                                                                          |
 | 💬 **Discord**                             | [discord.gg/U47eFqAXCn](https://discord.gg/U47eFqAXCn)                                                                    |
 | ✈️ **Telegram**                            | [t.me/omnirouteOficial](https://t.me/omnirouteOficial)                                                                    |
-| 🟢 **WhatsApp — 🌍 Global**                | [join the group](https://chat.whatsapp.com/FvuCbrpZmQ6I85n2vW5QIC?s=cl&p=a&mlu=4)                                        |
-| 🟢 **WhatsApp — 🇧🇷 Brasil**                | [entrar no grupo](https://chat.whatsapp.com/KWgatljAjmbELQory59Oti?s=cl&p=a&mlu=4)                                        |
+| 🟢 **WhatsApp — 🌍 Global**                | [join the group](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)                                              |
+| 🟢 **WhatsApp — 🇧🇷 Brasil**                | [entrar no grupo](https://chat.whatsapp.com/LTSpdFhXTxjH4R6CCNiKWz)                                                       |
 | 🌍 **Website**                             | [omniroute.online](https://omniroute.online)                                                                              |
-| 🌍 **🌍StHub OmniRoute Community (free)** | [portal sthub](https://portal.sthub.com.br/communities/groups/st-hub/channels/Omniroute-World-8kRjmK)                     |
 | 📦 **Source code**                         | [github.com/diegosouzapw/OmniRoute](https://github.com/diegosouzapw/OmniRoute)                                            |
 | 🐛 **Report a bug**                        | [open an issue](https://github.com/diegosouzapw/OmniRoute/issues) — attach `npm run system-info` output                   |
 | 🤝 **Contribute**                          | [CONTRIBUTING.md](CONTRIBUTING.md) · [Branching & Release Model](docs/ops/BRANCHING_MODEL.md) · pick a `good first issue` |
@@ -1208,7 +1202,7 @@ Métricas canônicas em 2026-08-24: **1.029 vídeos únicos** · **11.132.922 vi
   <tr><td nowrap><b>Runtime</b></td><td>Node.js 22.x / 24.x LTS — <code>&gt;=22.22.2 &lt;23 || &gt;=24.0.0 &lt;27</code></td></tr>
   <tr><td nowrap><b>Language</b></td><td>TypeScript 6.0 — <b>100% TypeScript</b> across <code>src/</code> and <code>open-sse/</code> (zero <code>any</code> in core since v2.0)</td></tr>
   <tr><td nowrap><b>Framework</b></td><td>Next.js 16 + React 19 + Tailwind CSS 4</td></tr>
-  <tr><td nowrap><b>Database</b></td><td>better-sqlite3 (SQLite, WAL journaling) + LowDB (JSON legacy) — 122 domain modules, 167 migrations</td></tr>
+  <tr><td nowrap><b>Database</b></td><td>better-sqlite3 (SQLite, WAL journaling) + LowDB (JSON legacy) — 120 domain modules, 166 migrations</td></tr>
   <tr><td nowrap><b>Memory</b></td><td>SQLite FTS5 full-text + int8-quantized vector embeddings, typed decay</td></tr>
   <tr><td nowrap><b>Schemas</b></td><td>Zod 4 — MCP tool I/O validation + API contracts</td></tr>
   <tr><td nowrap><b>Protocols</b></td><td>MCP (stdio / HTTP / SSE) + A2A v0.3 (JSON-RPC 2.0 + SSE)</td></tr>
@@ -1271,7 +1265,7 @@ Métricas canônicas em 2026-08-24: **1.029 vídeos únicos** · **11.132.922 vi
   <tr><td nowrap><b><a href="docs/architecture/RESILIENCE_GUIDE.md">Resilience Guide</a></b></td><td>Circuit breakers, cooldowns, queue, anti-thundering herd, TLS spoofing</td></tr>
   <tr><td nowrap><b><a href="docs/routing/AUTO-COMBO.md">Auto-Combo Engine</a></b></td><td>15-factor scoring, mode packs, self-healing</td></tr>
   <tr><td nowrap><b><a href="docs/ops/PROXY_GUIDE.md">Proxy Guide</a></b></td><td>3-level proxy system, 1proxy marketplace, registry CRUD</td></tr>
-  <tr><td nowrap><b><a href="docs/reference/FREE_TIERS.md">Free Tiers</a></b></td><td>Consolidated directory: 38 documented recurring pools / 446 cataloged free-tier entries</td></tr>
+  <tr><td nowrap><b><a href="docs/reference/FREE_TIERS.md">Free Tiers</a></b></td><td>Consolidated directory: 39 documented recurring pools / 445 cataloged free-tier entries</td></tr>
   <tr><td nowrap><b><a href="docs/guides/FEATURES.md">Features Gallery</a></b></td><td>Visual dashboard tour with screenshots</td></tr>
   <tr><td nowrap><b><a href="docs/architecture/CODEBASE_DOCUMENTATION.md">Codebase Documentation</a></b></td><td>Beginner-friendly codebase walkthrough</td></tr>
 </table>
@@ -1672,7 +1666,7 @@ MIT License - see [LICENSE](LICENSE) for details.
 
 **[⬆ Back to top](#-omniroute)** · Built with ❤️ for the open-source AI community.
 
-<sub>OmniRoute v3.8.51 · Node ≥22.22.2 · MIT License · <a href="https://omniroute.online">omniroute.online</a></sub>
+<sub>OmniRoute v3.8.50 · Node ≥22.22.2 · MIT License · <a href="https://omniroute.online">omniroute.online</a></sub>
 
 </div>
 <!-- GitHub Discussions enabled for community Q&A -->

THIRD_PARTY_NOTICES.md

@@ -3,8 +3,8 @@
 ## codex-chatgpt-web
 
 Parts of `open-sse/vendor/codex-chatgpt-web/` are adapted from
-[`miuuyy/codex-chatgpt-web`](https://github.com/miuuyy/codex-chatgpt-web), v4.0.7 commit
-`b59d7dc51b84fb1f465ff1d00f5207f3b2b4a494`.
+[`miuuyy/codex-chatgpt-web`](https://github.com/miuuyy/codex-chatgpt-web), commit
+`55592fca0ba19a27f1b769cec8fff61ff340a785`.
 
 MIT License
 
@@ -25,31 +25,6 @@ NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FO
 DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT
 OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
-## wreq-js 3.0.0
-
-OmniRoute distributes `wreq-js` and its seven platform-specific native addons from
-[`wreq-js@3.0.0`](https://www.npmjs.com/package/wreq-js/v/3.0.0).
-
-MIT License
-
-Copyright (c) 2025 will-work-for-meal
-Copyright (c) 2025 Oleksandr Herasymov
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
-associated documentation files (the "Software"), to deal in the Software without restriction,
-including without limitation the rights to use, copy, modify, merge, publish, distribute,
-sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial
-portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT
-NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT
-OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
 ## blackwell-systems/gcf-typescript
 
 The generic-profile codec in

bin/aliasResolver.mjs

@@ -176,14 +176,13 @@ function isWithinRoot(ancestor, candidate) {
  * Register the ESM resolve hook for the current process. Safe to call multiple
  * times — subsequent calls are no-ops once the hook is installed.
  *
- * Modern runtimes import the hook module in-thread, initialize its root with a
- * plain function call, and register its synchronous resolver through
- * `module.registerHooks()`. Runtimes without that API (notably Bun) retain the
- * `module.register()` worker-thread loader lifecycle path.
+ * Uses Node's stable `module.register()` API (available since Node 20.6,
+ * required Node 22+ here). The hook runs in a worker thread but only reads the
+ * captured `root`, so no shared-state hazards.
  *
  * @param {string} root  Absolute path to the package root.
  * @returns {Promise<boolean>}  Resolves `true` once registered (or if already
- *   registered), `false` when neither registration API is usable.
+ *   registered), `false` on environments where `module.register` is unavailable.
  */
 let _registered = false;
 export async function registerAliasResolver(root) {
@@ -202,7 +201,7 @@ export async function registerAliasResolver(root) {
   }
 
   try {
-    const mod = await import("node:module");
+    const { register } = await import("node:module");
     // #7808: load the hook from a real file on disk via pathToFileURL() instead
     // of building a `data:text/javascript,...` URL dynamically. CodeQL's
     // `js/incomplete-url-substring-sanitization` flagged the interpolated
@@ -212,21 +211,14 @@ export async function registerAliasResolver(root) {
     // package.json "files": ["bin/"].
     const hookPath = join(__dirname, "aliasResolverHook.mjs");
     const hookUrl = pathToFileURL(hookPath);
-    if (typeof mod.registerHooks === "function") {
-      const hook = await import(hookUrl.href);
-      hook.initialize({ root });
-      mod.registerHooks({ resolve: hook.resolve });
-      _registered = true;
-      return true;
-    }
-    mod.register(hookUrl, { data: { root } });
+    register(hookUrl, { data: { root } });
     _registered = true;
     return true;
   } catch {
-    // Runtime or sandboxed env without a usable module hook API — fall back to
-    // the default resolver. The bug will resurface only in the exact
-    // global-install scenario, which is what we explicitly patched; other entry
-    // points still work because they import via relative paths.
+    // Older Node or sandboxed env without module.register — fall back to the
+    // default resolver. The bug will resurface only in the exact global-install
+    // scenario, which is what we explicitly patched; other entry points still
+    // work because they import via relative paths.
     return false;
   }
 }

bin/chatgpt-web-codex-mcp.mjs

@@ -32,20 +32,17 @@ export function resolveChatGptWebCodexMcpEntry(rootDir = root, exists = existsSy
   return candidates.find((candidate) => exists(candidate)) ?? null;
 }
 
-export async function loadChatGptWebCodexMcpModule(entry) {
-  if (entry.endsWith(".ts")) {
-    await import("tsx/esm");
-  }
-  return import(pathToFileURL(entry).href);
-}
-
 export async function startChatGptWebCodexMcp(args = process.argv.slice(2), rootDir = root) {
   const socketIndex = args.indexOf("--broker-socket");
   const brokerSocketPath = socketIndex >= 0 ? args[socketIndex + 1] : undefined;
   if (!brokerSocketPath) throw new Error("--broker-socket is required");
   const entry = resolveChatGptWebCodexMcpEntry(rootDir);
   if (!entry) throw new Error("ChatGPT Web (Codex) MCP entrypoint was not found");
-  const module = await loadChatGptWebCodexMcpModule(entry);
+  if (entry.endsWith(".ts")) {
+    const { register } = await import("node:module");
+    register("tsx/esm", pathToFileURL(`${rootDir}/`));
+  }
+  const module = await import(pathToFileURL(entry).href);
   await module.runChatGptMcpServer({ brokerSocketPath });
 }
 

bin/cli/api-commands/combos.mjs

@@ -16,7 +16,7 @@ export function register_combos(parent) {
     });
   tag.command("post-api-combos")
     .description("Create routing combo")
-    .requiredOption("--body <jsonOrPath>", "JSON body or @path/to/file.json")
+    .option("--body <jsonOrPath>", "JSON body or @path/to/file.json")
     .action(async (opts, cmd) => {
       const gOpts = cmd.optsWithGlobals();
       let url = "/api/combos";
@@ -44,7 +44,7 @@ export function register_combos(parent) {
   tag.command("put-api-combos-id-")
     .description("Update combo")
     .requiredOption("--id <id>", "")
-    .requiredOption("--body <jsonOrPath>", "JSON body or @path/to/file.json")
+    .option("--body <jsonOrPath>", "JSON body or @path/to/file.json")
     .action(async (opts, cmd) => {
       const gOpts = cmd.optsWithGlobals();
       let url = "/api/combos/{id}";
@@ -62,7 +62,7 @@ export function register_combos(parent) {
   tag.command("patch-api-combos-id-")
     .description("Update combo")
     .requiredOption("--id <id>", "")
-    .requiredOption("--body <jsonOrPath>", "JSON body or @path/to/file.json")
+    .option("--body <jsonOrPath>", "JSON body or @path/to/file.json")
     .action(async (opts, cmd) => {
       const gOpts = cmd.optsWithGlobals();
       let url = "/api/combos/{id}";
@@ -99,17 +99,10 @@ export function register_combos(parent) {
     });
   tag.command("post-api-combos-test")
     .description("Test a combo configuration")
-    .requiredOption("--body <jsonOrPath>", "JSON body or @path/to/file.json")
     .action(async (opts, cmd) => {
       const gOpts = cmd.optsWithGlobals();
       let url = "/api/combos/test";
-      let body;
-      if (opts.body) {
-        body = opts.body.startsWith("@")
-          ? JSON.parse(readFileSync(opts.body.slice(1), "utf8"))
-          : JSON.parse(opts.body);
-      }
-      const res = await apiFetch(url, { method: "POST", body, baseUrl: gOpts.baseUrl, apiKey: gOpts.apiKey });
+      const res = await apiFetch(url, { method: "POST", baseUrl: gOpts.baseUrl, apiKey: gOpts.apiKey });
       const data = res.ok ? await res.json() : await res.text();
       emit(data, gOpts);
     });

bin/cli/cli-manifest.mjs

@@ -93,16 +93,6 @@ export const CLI_TARGET_MANIFEST = Object.freeze({
     configure: true,
     runModel: null,
   }),
-  "5dive": Object.freeze({
-    // 5dive is a fleet manager, not a coding CLI: it points its own `claude`
-    // agents at an endpoint. `omniroute run 5dive` would have nothing to
-    // launch, so this is configure-only.
-    description: "5dive (agent fleet)",
-    aliases: Object.freeze(["fivedive", "5dive-cli"]),
-    run: false,
-    configure: true,
-    runModel: null, // travels as the profile's ANTHROPIC_DEFAULT_*_MODEL
-  }),
 });
 
 /**

bin/cli/commands/configure.mjs

@@ -39,7 +39,6 @@ export const SETUP_MODULES = {
   cline: { module: "./setup-cline.mjs", exportName: "runSetupClineCommand" },
   continue: { module: "./setup-continue.mjs", exportName: "runSetupContinueCommand" },
   kilo: { module: "./setup-kilo.mjs", exportName: "runSetupKiloCommand" },
-  "5dive": { module: "./setup-5dive.mjs", exportName: "runSetup5diveCommand" },
 };
 
 /**

bin/cli/commands/nodes.mjs

@@ -24,80 +24,6 @@ function parseHeader(kv) {
   return { name: kv.slice(0, eq), value: kv.slice(eq + 1) };
 }
 
-function getRootCommand(cmd) {
-  let curr = cmd;
-  while (curr.parent) curr = curr.parent;
-  return curr;
-}
-
-function resolveNodeEndpoint(opts, cmd) {
-  if (opts.endpoint) {
-    return { endpoint: opts.endpoint, apiFetchOpts: cmd.optsWithGlobals() };
-  }
-  if (opts.nodeUrl) {
-    return { endpoint: opts.nodeUrl, apiFetchOpts: cmd.optsWithGlobals() };
-  }
-
-  // Check if --base-url, --endpoint, or --node-url was explicitly passed after the subcommand
-  const root = getRootCommand(cmd);
-  const rawArgs = root.rawArgs || process.argv;
-  const cmdName = cmd.name();
-
-  let subArgsStart = -1;
-  for (let i = 0; i < rawArgs.length - 1; i++) {
-    if (rawArgs[i] === "nodes" || rawArgs[i] === "provider-nodes") {
-      if (rawArgs[i + 1] === cmdName) {
-        subArgsStart = i + 2;
-        break;
-      }
-    }
-  }
-
-  let explicitSubcommandBaseUrl = undefined;
-  let serverBaseUrl = undefined;
-
-  if (subArgsStart !== -1) {
-    const preArgs = rawArgs.slice(0, subArgsStart);
-    for (let i = 0; i < preArgs.length; i++) {
-      if (preArgs[i] === "--base-url" && i + 1 < preArgs.length) {
-        serverBaseUrl = preArgs[i + 1];
-      } else if (preArgs[i].startsWith("--base-url=")) {
-        serverBaseUrl = preArgs[i].slice("--base-url=".length);
-      }
-    }
-
-    const subArgs = rawArgs.slice(subArgsStart);
-    for (let i = 0; i < subArgs.length; i++) {
-      const arg = subArgs[i];
-      if (
-        (arg === "--base-url" || arg === "--endpoint" || arg === "--node-url") &&
-        i + 1 < subArgs.length
-      ) {
-        explicitSubcommandBaseUrl = subArgs[i + 1];
-      } else if (
-        arg.startsWith("--base-url=") ||
-        arg.startsWith("--endpoint=") ||
-        arg.startsWith("--node-url=")
-      ) {
-        explicitSubcommandBaseUrl = arg.slice(arg.indexOf("=") + 1);
-      }
-    }
-  }
-
-  if (explicitSubcommandBaseUrl !== undefined) {
-    const globals = cmd.optsWithGlobals?.() ?? {};
-    const apiFetchOpts = { ...globals };
-    if (serverBaseUrl) {
-      apiFetchOpts.baseUrl = serverBaseUrl;
-    } else {
-      delete apiFetchOpts.baseUrl;
-    }
-    return { endpoint: explicitSubcommandBaseUrl, apiFetchOpts };
-  }
-
-  return { endpoint: undefined, apiFetchOpts: cmd.optsWithGlobals() };
-}
-
 const nodeSchema = [
   { key: "id", header: "Node ID", width: 22 },
   { key: "provider", header: "Provider", width: 16 },
@@ -144,8 +70,7 @@ export function registerNodes(program) {
   nodes
     .command("add")
     .requiredOption("--provider <p>", t("nodes.add.provider"))
-    .option("--endpoint <url>", t("nodes.add.baseUrl"))
-    .option("--base-url <url>", t("nodes.add.baseUrl"))
+    .requiredOption("--endpoint <url>", t("nodes.add.baseUrl"))
     .option("--name <n>", t("nodes.add.name"))
     .option("--weight <w>", t("nodes.add.weight"), parseInt, 100)
     .option("--region <r>", t("nodes.add.region"))
@@ -156,14 +81,9 @@ export function registerNodes(program) {
       []
     )
     .action(async (opts, cmd) => {
-      const { endpoint, apiFetchOpts } = resolveNodeEndpoint(opts, cmd);
-      if (!endpoint) {
-        process.stderr.write(`error: required option '--endpoint <url>' or '--base-url <url>' not specified\n`);
-        process.exit(1);
-      }
       const body = {
         provider: opts.provider,
-        baseUrl: endpoint,
+        baseUrl: opts.endpoint,
         name: opts.name,
         weight: opts.weight,
         region: opts.region,
@@ -171,7 +91,7 @@ export function registerNodes(program) {
         headers: opts.authHeader?.length ? opts.authHeader : undefined,
       };
       const res = await apiFetch("/api/provider-nodes", {
-        ...apiFetchOpts,
+        ...cmd.optsWithGlobals(),
         method: "POST",
         body,
       });
@@ -179,26 +99,24 @@ export function registerNodes(program) {
         process.stderr.write(`Error: ${res.status}\n`);
         process.exit(1);
       }
-      emit(await res.json(), apiFetchOpts);
+      emit(await res.json(), cmd.optsWithGlobals());
     });
 
   nodes
     .command("update <nodeId>")
     .option("--endpoint <url>", t("nodes.update.baseUrl"))
-    .option("--base-url <url>", t("nodes.update.baseUrl"))
     .option("--name <n>", t("nodes.update.name"))
     .option("--weight <w>", t("nodes.update.weight"), parseInt)
     .option("--region <r>", t("nodes.update.region"))
     .option("--enabled <b>", t("nodes.update.enabled"), (v) => v === "true")
     .action(async (id, opts, cmd) => {
-      const { endpoint, apiFetchOpts } = resolveNodeEndpoint(opts, cmd);
       const body = {};
-      if (endpoint !== undefined) body.baseUrl = endpoint;
+      if (opts.endpoint !== undefined) body.baseUrl = opts.endpoint;
       for (const k of ["name", "weight", "region", "enabled"]) {
         if (opts[k] !== undefined) body[k] = opts[k];
       }
       const res = await apiFetch(`/api/provider-nodes/${id}`, {
-        ...apiFetchOpts,
+        ...cmd.optsWithGlobals(),
         method: "PUT",
         body,
       });
@@ -206,7 +124,7 @@ export function registerNodes(program) {
         process.stderr.write(`Error: ${res.status}\n`);
         process.exit(1);
       }
-      emit(await res.json(), apiFetchOpts);
+      emit(await res.json(), cmd.optsWithGlobals());
     });
 
   nodes
@@ -227,25 +145,19 @@ export function registerNodes(program) {
 
   nodes
     .command("validate")
-    .option("--endpoint <url>", t("nodes.validate.baseUrl"))
-    .option("--base-url <url>", t("nodes.validate.baseUrl"))
+    .requiredOption("--endpoint <url>", t("nodes.validate.baseUrl"))
     .requiredOption("--provider <p>", t("nodes.validate.provider"))
     .action(async (opts, cmd) => {
-      const { endpoint, apiFetchOpts } = resolveNodeEndpoint(opts, cmd);
-      if (!endpoint) {
-        process.stderr.write(`error: required option '--endpoint <url>' or '--base-url <url>' not specified\n`);
-        process.exit(1);
-      }
       const res = await apiFetch("/api/provider-nodes/validate", {
-        ...apiFetchOpts,
+        ...cmd.optsWithGlobals(),
         method: "POST",
-        body: { baseUrl: endpoint, provider: opts.provider },
+        body: { baseUrl: opts.endpoint, provider: opts.provider },
       });
       if (!res.ok) {
         process.stderr.write(`Error: ${res.status}\n`);
         process.exit(1);
       }
-      emit(await res.json(), apiFetchOpts);
+      emit(await res.json(), cmd.optsWithGlobals());
     });
 
   nodes

bin/cli/commands/registry.mjs

@@ -66,7 +66,6 @@ import { registerSetupClaude } from "./setup-claude.mjs";
 import { registerSetupOpencode } from "./setup-opencode.mjs";
 import { registerSetupCline } from "./setup-cline.mjs";
 import { registerSetupKilo } from "./setup-kilo.mjs";
-import { registerSetup5dive } from "./setup-5dive.mjs";
 import { registerSetupContinue } from "./setup-continue.mjs";
 import { registerSetupCursor } from "./setup-cursor.mjs";
 import { registerSetupRoo } from "./setup-roo.mjs";
@@ -153,7 +152,6 @@ export function registerCommands(program) {
   registerSetupOpencode(program);
   registerSetupCline(program);
   registerSetupKilo(program);
-  registerSetup5dive(program);
   registerSetupContinue(program);
   registerSetupCursor(program);
   registerSetupRoo(program);

bin/cli/commands/setup-5dive.mjs

@@ -1,315 +0,0 @@
-/**
- * omniroute setup-5dive — point a 5dive agent fleet at OmniRoute.
- *
- * 5dive (https://5dive.com) manages a fleet of long-running coding agents, each
- * one a systemd unit under its own Unix user. It is not itself a coding CLI, so
- * there is nothing for `omniroute run` to launch — this is a configure-only
- * target.
- *
- * Unlike the other recipes, 5dive does not read a config file out of $HOME. Its
- * credentials live in AUTH PROFILES under /var/lib/5dive/auth-profiles/<name>/,
- * and the supported way to write one is the CLI itself:
- *
- *   5dive agent auth set claude --provider=<id> --base-url=<url> \
- *     --api-key=- --auth-profile=<name> --model=<slug>
- *
- * Four value flags, all four load-bearing (verified against 5dive-cli main,
- * 2026-08-27):
- *   --provider      `--base-url` is refused without it, rather than accepted
- *                   and silently dropped. `openai` here is 5dive's BYO id for
- *                   "a custom Anthropic-compatible endpoint", not a vendor
- *                   choice — override with --byo-provider.
- *   --base-url      OmniRoute's Anthropic surface, ROOT url with no /v1.
- *   --auth-profile  BYO credentials are profile-scoped; required for claude.
- *   --model         `openai` has no row in 5dive's built-in endpoint catalog,
- *                   so there are no per-tier model ids to inherit.
- *
- * The key is handed over on stdin (`--api-key=-`) so it never reaches argv.
- *
- * Two things this recipe cannot do for you, and says so instead of failing
- * obscurely:
- *   1. Writing an auth profile is root-only on the 5dive host. We re-exec
- *      through sudo when we are not root (disable with --no-sudo).
- *   2. `agent auth set` writes the profile and restarts the agents bound to it,
- *      but each seat also carries its OWN runtime model pin, and that pin wins
- *      over the profile's ANTHROPIC_DEFAULT_*_MODEL. Pass --agent <name> (repeatable)
- *      to pin the seats too; otherwise we print the command for them.
- */
-
-import { spawn } from "node:child_process";
-import { printHeading, printInfo, printSuccess, printError, createPrompt } from "../io.mjs";
-import { resolveActiveContext } from "../contexts.mjs";
-
-const DEFAULT_PROFILE = "omniroute";
-
-/** 5dive's `claude` BYO endpoint is the Anthropic surface ROOT — strip a trailing /v1. */
-function stripToRoot(url) {
-  const s = String(url || "").replace(/\/+$/, "");
-  return s.endsWith("/v1") ? s.slice(0, -3) : s;
-}
-
-/** Resolve baseUrl (ROOT, no /v1) + apiKey from flags -> active context -> localhost. */
-export function resolveFivediveTarget(opts = {}) {
-  let baseUrl;
-  if (opts.remote) baseUrl = stripToRoot(opts.remote);
-  else {
-    try {
-      baseUrl = stripToRoot(
-        resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT)?.baseUrl
-      );
-    } catch {
-      /* no context configured */
-    }
-    if (!baseUrl)
-      baseUrl = `http://localhost:${Number(opts.port ?? process.env.PORT ?? 20128) || 20128}`;
-  }
-  let apiKey = opts.apiKey ?? opts["api-key"];
-  if (!apiKey) {
-    try {
-      const c = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT);
-      apiKey = c?.accessToken || c?.apiKey;
-    } catch {
-      /* no context configured */
-    }
-  }
-  if (!apiKey) apiKey = process.env.OMNIROUTE_API_KEY || "";
-  return { baseUrl, apiKey };
-}
-
-/**
- * 5dive refuses a base URL before storing it, and the rule is not the obvious
- * one: the agent's key rides this URL on every request, so https:// is required
- * unless the host is loopback. Reproduce the check here so the operator gets the
- * reason at the point of choosing, not a validation error three commands later.
- */
-export function validateFivediveBaseUrl(rawUrl) {
-  const url = String(rawUrl || "");
-  if (!url) return { ok: false, reason: "A base URL is required." };
-  if (url.startsWith("https://")) return { ok: true };
-  if (!url.startsWith("http://")) {
-    return { ok: false, reason: `Unsupported scheme in '${url}' (expected http:// or https://).` };
-  }
-  let host = url.slice("http://".length);
-  host = host.split("/")[0].split("?")[0];
-  host = host.startsWith("[") ? `${host.slice(0, host.indexOf("]"))}]` : host.split(":")[0];
-  if (host === "127.0.0.1" || host === "localhost" || host === "[::1]") return { ok: true };
-  return {
-    ok: false,
-    reason:
-      `5dive accepts http:// only for a loopback host; '${host}' is off-box, so the agent's ` +
-      `API key would travel in plaintext. Serve OmniRoute over https:// and pass ` +
-      `--remote https://${host}...`,
-  };
-}
-
-/** Argv for the profile write. The key is NOT here — it goes in on stdin. */
-export function buildFivediveAuthArgs({ baseUrl, profile, model, provider = "openai" }) {
-  return [
-    "agent",
-    "auth",
-    "set",
-    "claude",
-    `--provider=${provider}`,
-    `--base-url=${baseUrl}`,
-    "--api-key=-",
-    `--auth-profile=${profile}`,
-    `--model=${model}`,
-  ];
-}
-
-/** Argv for one seat's runtime model pin, which outranks the profile's env defaults. */
-export function buildFivedivePinArgs(agent, model) {
-  return ["agent", "config", agent, "set", `model=${model}`];
-}
-
-/** Prepend sudo when the profile write needs root and we do not have it. */
-export function withPrivilege(bin, args, { isRoot, useSudo }) {
-  if (isRoot || !useSudo) return [bin, args];
-  return ["sudo", [bin, ...args]];
-}
-
-function quote(arg) {
-  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(arg) ? arg : `'${String(arg).replace(/'/g, "'\\''")}'`;
-}
-
-/** Render argv the way an operator would type it. */
-export function renderCommand(bin, args) {
-  return [bin, ...args].map(quote).join(" ");
-}
-
-function run(bin, args, stdinPayload) {
-  return new Promise((resolve) => {
-    const child = spawn(bin, args, {
-      // sudo reads its password straight from the tty, so stdin stays free for
-      // the API key.
-      stdio: [stdinPayload === undefined ? "inherit" : "pipe", "inherit", "inherit"],
-    });
-    child.on("error", (e) => resolve({ code: 1, error: e }));
-    child.on("close", (code) => resolve({ code: code ?? 1 }));
-    if (stdinPayload !== undefined && child.stdin) {
-      child.stdin.end(stdinPayload);
-    }
-  });
-}
-
-async function fetchModelIds(baseUrl, apiKey) {
-  try {
-    const headers = { "Content-Type": "application/json" };
-    if (apiKey) headers["Authorization"] = `Bearer ${apiKey}`;
-    const res = await fetch(`${baseUrl}/v1/models`, { headers, signal: AbortSignal.timeout(8000) });
-    if (!res.ok) return [];
-    const body = await res.json();
-    const list = Array.isArray(body) ? body : (body.data ?? body.models ?? []);
-    return list.map((m) => (typeof m === "string" ? m : m?.id)).filter(Boolean);
-  } catch {
-    return [];
-  }
-}
-
-function agentList(opts) {
-  const raw = opts.agent ?? opts.agents ?? [];
-  return (Array.isArray(raw) ? raw : [raw]).map((a) => String(a).trim()).filter(Boolean);
-}
-
-export async function runSetup5diveCommand(opts = {}) {
-  const { baseUrl, apiKey } = resolveFivediveTarget(opts);
-  const dryRun = Boolean(opts.dryRun ?? opts["dry-run"]);
-  const bin = opts.fivediveBin ?? opts["fivedive-bin"] ?? process.env.CLI_5DIVE_BIN ?? "5dive";
-  const profile = String(opts.authProfile ?? opts["auth-profile"] ?? opts.name ?? DEFAULT_PROFILE);
-  // NOT `opts.provider`: the `configure` picker uses that flag for the
-  // OmniRoute model provider to filter on, and it reaches setup recipes
-  // verbatim. The 5dive BYO id is its own flag.
-  const provider = String(opts.byoProvider ?? opts["byo-provider"] ?? "openai");
-  const agents = agentList(opts);
-
-  printHeading("OmniRoute -> 5dive (claude BYO endpoint)");
-  printInfo(`Server:  ${baseUrl}`);
-  printInfo(`Profile: ${profile}`);
-
-  const urlCheck = validateFivediveBaseUrl(baseUrl);
-  if (!urlCheck.ok) {
-    printError(urlCheck.reason);
-    return 2;
-  }
-
-  // 5dive needs one explicit model id: `openai` has no catalog row, so there
-  // are no per-tier defaults to fall back to.
-  let model = opts.model;
-  if (!model) {
-    const ids = await fetchModelIds(baseUrl, apiKey);
-    if (ids.length && !opts.yes) {
-      printInfo(`Examples: ${ids.slice(0, 20).join(", ")}${ids.length > 20 ? " …" : ""}`);
-      printInfo("A combo id works here too — that is how you get failover across providers.");
-      const prompt = createPrompt();
-      try {
-        model = await prompt.ask("Model or combo id for the 5dive agents");
-      } finally {
-        prompt.close();
-      }
-    }
-  }
-  if (!model) {
-    printError("A model is required. Pass --model <id> (5dive has no model auto-discovery here).");
-    return 2;
-  }
-  if (!apiKey) {
-    printError("An OmniRoute API key is required. Pass --api-key, or set OMNIROUTE_API_KEY.");
-    return 2;
-  }
-
-  const isRoot = typeof process.getuid === "function" ? process.getuid() === 0 : false;
-  const useSudo = (opts.sudo ?? true) !== false;
-  const authArgs = buildFivediveAuthArgs({ baseUrl, profile, model, provider });
-  const [authBin, authArgv] = withPrivilege(bin, authArgs, { isRoot, useSudo });
-
-  if (dryRun) {
-    printInfo("\n[dry-run] would run:");
-    printInfo(`  ${renderCommand(authBin, authArgv)}`);
-    printInfo("  (the API key is written to that command's stdin, never to argv)");
-    for (const agent of agents) {
-      const [pinBin, pinArgv] = withPrivilege(bin, buildFivedivePinArgs(agent, model), {
-        isRoot,
-        useSudo,
-      });
-      printInfo(`  ${renderCommand(pinBin, pinArgv)}`);
-    }
-    return 0;
-  }
-
-  if (!isRoot && !useSudo) {
-    printError(
-      "Writing a 5dive auth profile needs root on the 5dive host. Re-run as root, drop --no-sudo, " +
-        "or run this by hand:"
-    );
-    printInfo(`  ${renderCommand(bin, authArgs)}`);
-    return 1;
-  }
-
-  const authResult = await run(authBin, authArgv, apiKey);
-  if (authResult.error?.code === "ENOENT") {
-    printError(
-      `Could not find the '${bin}' CLI on this machine. 5dive's verbs run ON the fleet host — ` +
-        "run this there, or point at the binary with --fivedive-bin."
-    );
-    return 1;
-  }
-  if (authResult.code !== 0) {
-    printError(`'${bin} agent auth set' exited ${authResult.code}.`);
-    return authResult.code;
-  }
-  printSuccess(`Auth profile '${profile}' now points at ${baseUrl}`);
-
-  // The profile carries ANTHROPIC_DEFAULT_{OPUS,SONNET,HAIKU}_MODEL, but each
-  // seat's own runtime pin outranks it — a seat still pinned to a stock model id
-  // fails its first turn with "There's an issue with the selected model".
-  for (const agent of agents) {
-    const [pinBin, pinArgv] = withPrivilege(bin, buildFivedivePinArgs(agent, model), {
-      isRoot,
-      useSudo,
-    });
-    const pinResult = await run(pinBin, pinArgv);
-    if (pinResult.code !== 0) {
-      printError(`Could not pin agent '${agent}' to '${model}' (exit ${pinResult.code}).`);
-      return pinResult.code;
-    }
-    printSuccess(`Agent '${agent}' pinned to ${model}`);
-  }
-
-  if (!agents.length) {
-    printInfo("\nEach seat also carries its own runtime model pin, and it beats the profile:");
-    printInfo(`  ${renderCommand(bin, buildFivedivePinArgs("<agent>", model))}`);
-    printInfo("Re-run with --agent <name> to have this command apply it for you.");
-  }
-  printInfo("\nBind a seat to the profile at creation time with:");
-  printInfo(`  ${renderCommand(bin, ["agent", "create", "<name>", `--auth-profile=${profile}`])}`);
-  return 0;
-}
-
-export function registerSetup5dive(program) {
-  program
-    .command("setup-5dive")
-    .description(
-      "Point a 5dive agent fleet's claude seats at OmniRoute (writes a 5dive auth profile)"
-    )
-    .option("--port <port>", "Local OmniRoute port (ignored when --remote is set)", "20128")
-    .option("--remote <url>", "Remote OmniRoute URL, e.g. https://omniroute.example.com")
-    .option("--context <name>", "Named local/remote context")
-    .option("--api-key <key>", "OmniRoute API key (defaults to the active context/env)")
-    .option("--model <id>", "OmniRoute model or combo id the agents should use")
-    .option("--byo-provider <id>", "5dive BYO provider id (default: openai)", "openai")
-    .option("--auth-profile <name>", "5dive auth profile to write", DEFAULT_PROFILE)
-    .option(
-      "--agent <name>",
-      "Also pin this agent's runtime model (repeatable)",
-      (value, previous) => [...(previous || []), value],
-      []
-    )
-    .option("--fivedive-bin <path>", "Path to the 5dive binary (default: 5dive on PATH)")
-    .option("--no-sudo", "Do not re-exec through sudo when not running as root")
-    .option("--yes", "Non-interactive: do not prompt (requires --model)")
-    .option("--dry-run", "Print the commands without running them")
-    .action(async (opts) => {
-      const code = await runSetup5diveCommand(opts);
-      if (code !== 0) process.exit(code);
-    });
-}

bin/cli/commands/update.mjs

@@ -1,4 +1,4 @@
-import { printHeading, printInfo, printSuccess, printError, printWarning } from "../io.mjs";
+import { printHeading, printInfo, printSuccess, printError } from "../io.mjs";
 import { homedir } from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -6,7 +6,6 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { t } from "../i18n.mjs";
 import { npmBin, npmExecOptions } from "../npm-exec.mjs";
-import { readPidFile, isPidRunning } from "../utils/pid.mjs";
 
 const execFileAsync = promisify(execFile);
 
@@ -80,39 +79,6 @@ export async function createBackup() {
   }
 }
 
-// #11885: `--apply` installs the new files (npm install -g) and re-reads
-// package.json from disk to confirm it, but a long-lived server process keeps
-// serving whatever it loaded at its last start — Node caches a `require()`d
-// package.json per resolved path for the life of the process. A later
-// `omniroute update` then correctly reports "already up to date" (the files
-// ARE current) while the running server is still stale, matching the reported
-// symptom. `--apply` never restarted anything and its success message ("Run
-// `omniroute --version` to verify.") implied the update was already live.
-//
-// `restart.mjs`'s `runRestartCommand()` stops then re-spawns the server in the
-// foreground (via `serve.mjs::runServe`), which can block the calling terminal
-// and is a materially bigger behavior change than this fix warrants to invoke
-// unconditionally and unattended from `--apply`. Instead, detect whether a
-// CLI-managed server is currently running (the same PID file `stop.mjs`/
-// `restart.mjs` already trust) and print an explicit, prominent instruction —
-// honest about what did and didn't happen — rather than silently assuming.
-export async function isServerProcessRunning(deps = { readPidFile, isPidRunning }) {
-  const pid = deps.readPidFile("server");
-  return Boolean(pid && deps.isPidRunning(pid));
-}
-
-export async function printPostApplyGuidance(latest, deps = { readPidFile, isPidRunning }) {
-  const running = await isServerProcessRunning(deps);
-  if (running) {
-    printWarning(`Files updated to ${latest}, but the running server is still on the old version.`);
-    printInfo("  Run `omniroute restart` now to apply this update.");
-  } else {
-    printInfo(`No running OmniRoute server was detected via the CLI's PID file.`);
-    printInfo(`  Start it with \`omniroute serve\` (or restart your existing process) to run ${latest}.`);
-  }
-  printInfo("`omniroute --version` will keep reporting the old version until the process restarts.");
-}
-
 export function registerUpdate(program) {
   program
     .command("update")
@@ -244,8 +210,8 @@ export async function runUpdateCommand(opts = {}) {
       console.log("  or reorder PATH so the global bin comes first.");
       return 1;
     }
-    printSuccess(`Installed omniroute@${latest} to disk.`);
-    await printPostApplyGuidance(latest);
+    printSuccess(`Updated to version ${latest}`);
+    printInfo("Run `omniroute --version` to verify.");
     return 0;
   } catch (err) {
     printError(`Update failed: ${err.message}`);

bin/cli/io.mjs

@@ -81,7 +81,3 @@ export function printInfo(message) {
 export function printError(message) {
   console.log(`\x1b[31m✖ ${message}\x1b[0m`);
 }
-
-export function printWarning(message) {
-  console.log(`\x1b[33m⚠ ${message}\x1b[0m`);
-}

bin/cli/utils/pid.mjs

@@ -100,66 +100,31 @@ export async function waitForServer(port, timeout = 60000) {
 // - "hanging": the request timed out waiting for any response — the
 //   process accepted the TCP connection but never answered (#6800).
 // - "not-listening": nothing is accepting connections on the port at all.
-// #11766: probe both IPv4 and IPv6 loopback to handle servers listening on
-// either family (or both).
 async function pollHealthOnce(port) {
-  const hosts = ["127.0.0.1", "::1"];
-  const outcomes = [];
-
-  // Probe both loopback families concurrently
-  const results = await Promise.all(
-    hosts.map(async (host) => {
-      try {
-        const res = await fetch(`http://${host}:${port}/api/monitoring/health`, {
-          signal: AbortSignal.timeout(2000),
-        });
-        return { host, outcome: res.ok ? "ready" : "fast-reject" };
-      } catch (err) {
-        const outcome = err?.name === "TimeoutError" ? "hanging" : "error";
-        return { host, outcome };
-      }
-    })
-  );
-
-  outcomes.push(...results.map((r) => r.outcome));
-
-  // If either family is ready, the server is ready
-  if (outcomes.includes("ready")) return "ready";
-
-  // If either family is fast-reject, treat as fast-reject
-  // (TCP is listening and rejecting, just route not ready yet)
-  if (outcomes.includes("fast-reject")) return "fast-reject";
-
-  // If either family is hanging, server accepted TCP but not answering
-  // (still booting, must not report as ready per #6800)
-  if (outcomes.includes("hanging")) return "hanging";
-
-  // Both families failed — check if either port is actually listening
-  // If listening, then errors above are route-level (fast-reject case)
-  const listening = await isPortListening(port).catch(() => false);
-  return listening ? "fast-reject" : "not-listening";
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}/api/monitoring/health`, {
+      signal: AbortSignal.timeout(2000),
+    });
+    return res.ok ? "ready" : "fast-reject";
+  } catch (err) {
+    if (err?.name === "TimeoutError") return "hanging";
+    const listening = await isPortListening(port).catch(() => false);
+    return listening ? "fast-reject" : "not-listening";
+  }
 }
 
 async function isPortListening(port) {
   const net = await import("node:net");
-  // #11766: check both IPv4 and IPv6 loopback. Return true if either is listening.
-  const hosts = ["127.0.0.1", "::1"];
-  const results = await Promise.all(
-    hosts.map(
-      (host) =>
-        new Promise((resolve) => {
-          const socket = net.connect({ host, port, timeout: 1000 });
-          const finish = (ok) => {
-            try {
-              socket.destroy();
-            } catch {}
-            resolve(ok);
-          };
-          socket.once("connect", () => finish(true));
-          socket.once("error", () => finish(false));
-          socket.once("timeout", () => finish(false));
-        })
-    )
-  );
-  return results.some((ok) => ok);
+  return new Promise((resolve) => {
+    const socket = net.connect({ host: "127.0.0.1", port, timeout: 1000 });
+    const finish = (ok) => {
+      try {
+        socket.destroy();
+      } catch {}
+      resolve(ok);
+    };
+    socket.once("connect", () => finish(true));
+    socket.once("error", () => finish(false));
+    socket.once("timeout", () => finish(false));
+  });
 }

changelog.d/features/11481-model-exposure-allow-deny-list.md

@@ -1 +0,0 @@
-- feat(api): add an opt-in `modelVisibilityAllowlist`/`modelVisibilityDenylist` settings pair to curate exactly which models `/v1/models` advertises, mirrored into every `auto/*` combo candidate pool so a denied model cannot be routed to via combo selection either (#11481)

changelog.d/features/11652-video-transcript-provenance-budgets.md

@@ -1 +0,0 @@
-- **feat(guardrails):** enforce a bounded, deterministic contract for Video Bridge transcripts — 256 cues, 4096 input code units and 4 KiB UTF-8 per cue, 64 KiB total text, malformed-Unicode rejection, focus-window scoping, cross-source reconciliation with contributing-source metadata, and a structural provenance trust boundary so caller JSON can never self-assert `embedded`/`audio-bridge` provenance ([#11652](https://github.com/diegosouzapw/OmniRoute/issues/11652))

changelog.d/features/11654-video-audio-bridge-stt-orchestration.md

@@ -1 +0,0 @@
-- **feat(video):** orchestrate optional Video Bridge audio extraction and Audio Bridge STT behind a dual opt-in (operator setting AND per-request signal) — a new loopback-only broker `mode=audio` operation shares the frame path's exact process queue, deadline, AbortSignal, and byte budgets to extract a bounded mono 16 kHz PCM WAV from the same already-downloaded video, then reuses the existing Audio Bridge transcription boundary; provider segment timing is preserved when available and marked coarse otherwise, and every failure degrades to a visual-only-safe partial instead of throwing (#11654).

changelog.d/features/11655-video-bridge-drilldown-lifecycle.md

@@ -1,6 +0,0 @@
-- Add a tenant-bound Video Bridge drill-down lifecycle on top of the existing secure cache
-  substrate: opaque hashed handles (never raw session/video identifiers), preview/standard/detail
-  multiresolution variants resampled on read, response pagination capped at 8 frames and 32 MiB,
-  and a new authenticated `/api/v1/video-bridge/drilldown` consumer route that stays disabled for
-  remote access by default and denies cross-key access with the same response as a nonexistent
-  handle (no existence oracle).

changelog.d/features/11656-video-bridge-promotion-evidence-harness.md

@@ -1 +0,0 @@
-- **test(video):** Add the Video Bridge FU-07/FU-09 promotion-evidence harness (#11656) — a frozen Zod manifest schema covering the 8 required scenario kinds (static scenes, rapid cuts, late facts, fades, blur, small text, close events, visual prompt injection) with a minimum of 3 repetitions per case, deterministic declarative fixture recipes (`videoBridgePromotionFixtures.ts`), a pure medians/p95 metrics aggregator, a pure FU-07/FU-09 promotion-verdict evaluator applying the ticket's exact thresholds (missing token usage always holds), a digest-only persistence layer that never retains raw media or raw model responses, and a versioned per-model promotion allowlist shipped empty with every model defaulting to `hold`. The FU-07/FU-09 promotion verdicts themselves remain HOLD — they require a real evidence run against real models on VPS 192.168.0.15.

changelog.d/features/11659-video-bridge-embedded-subtitle-provenance.md

@@ -1 +0,0 @@
-- **feat(video bridge):** "embedded" transcript provenance can now be legitimately earned instead of merely asserted — a bounded, allowlisted (`mov_text`/`subrip`/`webvtt`) subtitle probe runs through the loopback-only Video Bridge broker (at most 2 streams, 10s subdeadline bounded by the request deadline, 256 KiB output, 4096-code-unit lines), normalized through a bounded, ReDoS-safe WebVTT parser and Zod-validated end to end. The adapter always resolves to an explicit `success`/`absent`/`transient_failure` outcome — a subtitle failure never breaks the visual description path, and only a fingerprint-verified broker response (never a caller-declared label) can produce embedded cues (#11659).

changelog.d/features/11801-zai-glm-53-flash.md

@@ -1 +0,0 @@
-- **feat(zai):** add GLM-5.3-Flash Coding Plan support (1M context, 128K output, vision, `low|high|max` reasoning) and route `zai` GLM-5.3-family API-key traffic through the OpenAI-compatible Coding Plan endpoint with native thinking defaults ([#11801](https://github.com/diegosouzapw/OmniRoute/pull/11801)) — thanks @Neuron-Mr-White

changelog.d/features/11852-5dive-configure-target.md

@@ -1 +0,0 @@
-- **feat(nodejs):** add `5dive` as a `configure` target — `omniroute configure 5dive` / `omniroute setup-5dive` write a 5dive auth profile that points an agent fleet's `claude` seats at OmniRoute, with the root-only write, the loopback-vs-`https` endpoint rule and the per-seat model pin handled explicitly ([#11852](https://github.com/diegosouzapw/OmniRoute/pull/11852))

changelog.d/features/11903-usage-fetch-capability.md

@@ -1 +0,0 @@
-- **feat(providers):** the provider plugin manifest now advertises a `usage-fetch` capability for the 40 providers that have a wired usage/quota fetcher, so external dashboards can read it from `GET /api/v1/provider-plugin-manifest` instead of parsing `open-sse/services/usage.ts` after every release. Discovery only — no new fetcher, no quota change, and the Dashboard quota widget stays gated by `USAGE_SUPPORTED_PROVIDERS`. `USAGE_FETCHER_PROVIDERS` moved to a zero-dependency leaf (`open-sse/services/usage/fetcherProviders.ts`) and is re-exported from `services/usage.ts`, keeping the manifest module a light leaf instead of pulling the ~490-module usage dispatcher into the manifest route. ([#11903](https://github.com/diegosouzapw/OmniRoute/pull/11903)) — thanks @maxmad64bis

changelog.d/features/11906-omniroute-plugins-dir.md

@@ -1 +0,0 @@
-- **feat(plugins):** `OMNIROUTE_PLUGINS_DIR` sets the directory the runtime plugin scanner reads — and the root the plugin manager installs into — overriding the `HOME`-derived default, so a Docker/K8s deployment can point straight at its bind-mounted plugin tree instead of moving `HOME` just to relocate the scan path. An image that exports no home no longer scans `/tmp/.omniroute/plugins` in silence: the resolved directory is logged once at startup as `scanner.dir_resolved`, naming the input that won. Unset, behaviour is unchanged. Distinct from the CLI-only `OMNIROUTE_PLUGIN_PATH`, which finds `omniroute-cmd-*` command packages and never reached this scanner ([#11906](https://github.com/diegosouzapw/OmniRoute/pull/11906)) — thanks @amaleta

changelog.d/features/11910-owner-authenticated-lease-connection-name.md

@@ -1 +0,0 @@
-- **feat(leases):** add an explicit owner-authenticated status action that returns only the active lease's privacy-safe configured connection and provider labels, with generation fencing and no credential or internal-id disclosure ([#11910](https://github.com/diegosouzapw/OmniRoute/pull/11910)) — thanks @KaspaPulse

changelog.d/features/12155-weighted-score-router-strategy.md

@@ -1 +0,0 @@
-- **feat(routing):** add a `score` Auto router strategy that selects the highest configured weighted score and reuses `explorationRate`.

changelog.d/features/12241-stream-payload-collector-clone-deferral.md

@@ -1 +0,0 @@
-- **perf(sse):** defer `cloneLogPayload()` in the structured SSE collector until after the `maxEvents`/`maxBytes` cap check, eliminating ~9,800 wasted `structuredClone` calls per streaming response (65–71% faster `push()`). Reducer snapshot isolation restored for OpenAI and Responses summaries ([#12241](https://github.com/diegosouzapw/OmniRoute/pull/12241)) — thanks @PauloHSOliveira

changelog.d/features/dashboard-cache-percentage.md

@@ -1 +0,0 @@
-- **feat(dashboard):** display clamped `[0, 100]%` cached input token ratio in request logs table ([#PR_NUMBER](https://github.com/diegosouzapw/OmniRoute/pull/PR_NUMBER))

changelog.d/features/disable-thinking-level-variants.md

@@ -1 +0,0 @@
-- **feat(catalog):** add `OMNIROUTE_DISABLE_THINKING_LEVEL_VARIANTS` feature flag to optionally filter out thinking level variants from model catalog ([#PR_NUMBER](https://github.com/diegosouzapw/OmniRoute/pull/PR_NUMBER))

changelog.d/features/log-export-destinations.md

@@ -1,11 +0,0 @@
-- **feat(dashboard):** continuously export call logs to external analytics stores. A pluggable
-  destination registry ships the full Logs-tab record set on an hourly `JobRegistry` cron, with
-  a persisted per-destination cursor, batched inserts, a config UI rendered from each
-  destination's own field descriptors, and a REST layer (`/api/log-export/*`) for CRUD, a
-  connection test, and an on-demand run. A destination can opt into `includeBodies` to also ship
-  the request and response payloads shown in the Logs detail pane, including the client and
-  provider views of each call; this is off by default, and payloads inherit the dashboard's PII
-  sanitisation, secret redaction and `noLog` handling. Google BigQuery is the first destination,
-  using a service-account key stored encrypted at rest and streaming inserts keyed by call-log id,
-  into a table that is day-partitioned on `timestamp` and clustered on `api_key_name`, `provider`,
-  `model` and `status`.

changelog.d/features/orchestration-canvas.md

@@ -1 +0,0 @@
-- New `/dashboard/orchestration` page: live unified view of everything running — Cloud Agent, A2A and Conductor as a real-time graph (Agents tab), the combo cascade (Routing tab, reusing the Combo Live Studio) and a state kanban (Overview tab), with a detail drawer (trace, cost, approve/cancel). Read-only over existing APIs — no new backend. Canvas concept credit: PR #11815 design

changelog.d/features/perplexity-agent-provider.md

@@ -1 +0,0 @@
-- **feat(providers):** add a Perplexity Agent API provider (`perplexity-agent` / `pplx-agent`) for Perplexity `/v1/responses`, including the documented Anthropic, OpenAI, Google, xAI, DeepSeek, Z.AI, Moonshot/Kimi, NVIDIA, and Perplexity model IDs plus Anthropic-model `max_output_tokens` compatibility.

changelog.d/features/rpd-rate-limit-override.md

@@ -1 +0,0 @@
-- **feat(providers):** add RPD (Requests Per Day) limit to provider rate limit overrides across UI, schemas, DB, and i18n ([#PR_NUMBER](https://github.com/diegosouzapw/OmniRoute/pull/PR_NUMBER))

changelog.d/fixes/0000-provider-icon-zero-size.md

@@ -1 +0,0 @@
-- **fix(dashboard):** Keep local and theme-aware provider SVG icons at a definite layout size so Chromium does not collapse them to 0×0 after the v3.8.50 image-rendering change ([#12054](https://github.com/diegosouzapw/OmniRoute/pull/12054)) — thanks @ponkcore

changelog.d/fixes/11296-kie-flux-kontext-dedicated-endpoint.md

@@ -1 +0,0 @@
-- **fix(kie):** reroute `flux/kontext` off the KIE Market `createTask` flow — it is catalogued with `isMarket: true` but has no Market catalog page, so KIE rejected it with "model name not supported"; it now hits the dedicated `POST /api/v1/flux/kontext/generate` / `GET /api/v1/flux/kontext/record-info` endpoints instead (#11296).

changelog.d/fixes/11500-arena-elo-log-dedup.md

@@ -1 +0,0 @@
-- fix(db): rate-limit repeated Arena ELO leaderboard fetch-failure warnings instead of logging one per sync attempt (#11500)

changelog.d/fixes/11600-eslint-gate-cache-suppressions.md

@@ -1,5 +0,0 @@
-- Dropped the stale-`.eslintcache` `restore-keys` fallback from both "Restore ESLint file
-  cache" steps in `ci.yml`, so the blocking `Lint` job can no longer be served per-file
-  verdicts computed under a different lint config, suppressions file or lockfile. `quality.yml`
-  had already dropped it in #11963; `ci.yml` — the workflow that actually gates PRs — had not
-  (#11600).

changelog.d/fixes/11600-eslint-json-pass-on-unpruned-suppressions.md

@@ -1 +0,0 @@
-- fix(ci): pass `--pass-on-unpruned-suppressions` in `run-eslint-json.mjs` so the CI Lint job no longer fails when a suppression is merely orphaned by a genuine fix, mirroring the identical fix already in `validate-release-green.mjs` (#11600)

changelog.d/fixes/11704-prepublish-npx-cmd-win32.md

@@ -1 +0,0 @@
-- **fix(build):** `prepublish.ts` bundles the ChatGPT Web (Codex) MCP bridge through `runBuildTool()` instead of spawning `npx.cmd` raw, fixing the build crash on Node ≥ 20/Windows where `.cmd` shims cannot be spawned without a shell (EINVAL) ([#11704](https://github.com/diegosouzapw/OmniRoute/issues/11704))

changelog.d/fixes/11707-codex-responses-lite-parallel-tool-calls.md

@@ -1 +0,0 @@
-- fix(codex): keep `parallel_tool_calls:false` on the translated Codex Responses Lite path (#11707)

changelog.d/fixes/11747-browser-pool-lockfile-sync.md

@@ -1 +0,0 @@
-- **fix(packages/browser-pool):** regenerate `package-lock.json` so the `packages/browser-pool` workspace's locked `playwright`/`@types/node` (and transitives) match its `package.json` specs, fixing cache-only/offline installs (`npm ci --offline`, Nix `buildNpmPackage`) that previously failed with `ENOTCACHED` ([#11747](https://github.com/diegosouzapw/OmniRoute/issues/11747)) — thanks @benjaminkitt

changelog.d/fixes/11758-usage-refresh-exclusive-lease.md

@@ -1 +0,0 @@
-- **fix(usage):** quota and usage refresh no longer 409 when an exclusive lease reserves the connection ([#11758](https://github.com/diegosouzapw/OmniRoute/pull/11758)) — thanks @TheDemonTuan

changelog.d/fixes/11761-embedding-registry-width-and-type.md

@@ -1,5 +0,0 @@
-- Keep the embedding registry's vector width and `embedding` type on models when a synced model exists
-  for the same id, so `/v1/models` no longer reports registry-described embedding models widthless or
-  untyped (#11761)
-- Correct `google/gemini-embedding-001` on the OpenRouter route to 3072 dimensions, the width it
-  returns when `dimensions` is not sent (#11761)

changelog.d/fixes/11787-prepublish-opencode-plugin-cjs-check.md

@@ -1 +0,0 @@
-- fix(cli): stop prepublish from re-rebuilding the already-built ESM-only opencode-plugin dist (#11787)

changelog.d/fixes/11810-combo-success-connection-header.md

@@ -1 +0,0 @@
-- fix(sse): set X-OmniRoute-Selected-Connection-Id on successful combo dispatches so downstream consumers stop falling back to an empty connection id (#11810)

changelog.d/fixes/11824-antigravity-mitm-alias-cross-account.md

@@ -1 +0,0 @@
-- **fix(providers):** Antigravity's dynamic mitmAlias table no longer routes `gemini-3.7-flash-{high,medium,low}` to a literal tier-suffixed upstream id just because one connected account's own discovery listed it directly — those display ids always resolve through the safe `gemini-3.7-flash-tiered` static alias, so one account's Google-provisioned access no longer 404s every sibling account of the provider ([#11824](https://github.com/diegosouzapw/OmniRoute/issues/11824), [#11651](https://github.com/diegosouzapw/OmniRoute/issues/11651))

changelog.d/fixes/11861-nous-hermes-405b-label.md

@@ -1 +0,0 @@
-- **fix(config):** Nous Research's `Hermes-4-405B` model now displays as "Hermes 4 405B (Nous Research)" in both the provider registry and the free-model catalog, instead of the mislabelled "Hermes 4 7B" ([#11861](https://github.com/diegosouzapw/OmniRoute/issues/11861)) — thanks @Karan825

changelog.d/fixes/11861-nous-tags-user-injection.md

@@ -1 +0,0 @@
-- **fix(provider/nous):** inject required user= tag into Nous Research inference requests to resolve upstream 400 "missing tags" error ([#11861](https://github.com/diegosouzapw/OmniRoute/issues/11861)) — thanks @Karan825

changelog.d/fixes/11863-native-dep-preflight.md

@@ -1,10 +0,0 @@
-- **fix(build):** `npm run build` now fails in one second with a named package and a
-  copy-pasteable fix when npm silently drops an externalised optional native
-  dependency, instead of dying four minutes in with `Module not found: Can't resolve
-  'better-sqlite3'` ([#11863](https://github.com/diegosouzapw/OmniRoute/pull/11863)) —
-  thanks @ujjawalkaushik1110
-- **fix(install):** `postinstall` no longer throws `ReferenceError: isAndroid is not
-  defined` — failing the whole `npm install` — when the `better-sqlite3` rebuild
-  fallback times out; the manual-fix guidance is reachable again
-  ([#11863](https://github.com/diegosouzapw/OmniRoute/pull/11863)) — thanks
-  @ujjawalkaushik1110

changelog.d/fixes/11885-update-restart-live-process.md

@@ -1 +0,0 @@
-- **fix(cli):** `omniroute update --apply` now tells you explicitly whether a running server was detected and, if so, that you must run `omniroute restart` to apply the update — it never restarted anything and previously implied the update was already live once files were installed. The dashboard's npm-mode Update flow (`/api/system/version`) now tries OmniRoute's own PID-file-managed supervisor before falling back to pm2, and reports an honest "restart required" step instead of a silent pm2-only "skipped" that read like a completed update. The server-side latest-version lookup backing the dashboard's update banner also gained `--prefer-online`, closing the same stale-npm-cache class already fixed in the CLI's own copy for #4376 ([#11885](https://github.com/diegosouzapw/OmniRoute/issues/11885)).

changelog.d/fixes/11911-lkgp-stale-pin-exhaustion.md

@@ -1 +0,0 @@
-- **fix(resilience):** clear persisted LKGP pins when a target suffers connection/provider exhaustion or is skipped before dispatch due to cooldown/exhaustion/unavailability, preventing subsequent requests from repeatedly prioritizing known-dead providers ([#11911](https://github.com/diegosouzapw/OmniRoute/issues/11911)).

changelog.d/fixes/11921-ollama-multibyte-utf8-boundary.md

@@ -1 +0,0 @@
-- fix(ollama): preserve multi-byte UTF-8 content split across stream chunks in the Ollama NDJSON transform, which previously corrupted CJK/emoji into U+FFFD (#11921)

changelog.d/fixes/11923-orcarouter-baseurl.md

@@ -1 +0,0 @@
-- **fix(providers):** OrcaRouter chat requests now target `/v1/chat/completions` instead of the bare `/v1` API root, fixing the upstream `404 Invalid URL (POST /v1)` ([#11923](https://github.com/diegosouzapw/OmniRoute/pull/11923)).

changelog.d/fixes/11934-plugin-onstreamcomplete-delivery.md

@@ -1 +0,0 @@
-- **fix(plugins):** deliver the `onStreamComplete` event to disk-installed plugins. The event shipped in v3.8.50 (#9669) was emitted internally but had no plugin-facing wiring, so no plugin could ever subscribe: the manifest schema silently dropped `hooks.onStreamComplete`, and the loader/manager only knew the seven legacy hooks. `onStreamComplete` is now a declarable manifest hook, wired through the loader and registered by the manager like the other hooks, and its payload carries a `requestId` so consumers can correlate the stream-completion event with the originating request ([#11934](https://github.com/diegosouzapw/OmniRoute/pull/11934)) — thanks @amaleta

changelog.d/fixes/11949-qdrant-local-embedding-providers.md

@@ -1 +0,0 @@
-- **fix(db):** the Qdrant embedding-model dropdown now lists local/self-hosted providers (Ollama, LM Studio, vLLM, etc.) — an active connection is treated as "configured" when the provider allows an optional API key, not only when it has a real key or OAuth, so a running local embedding provider is no longer hidden from the picker ([#11949](https://github.com/diegosouzapw/OmniRoute/issues/11949))

changelog.d/fixes/11991-vertex-anthropic-v1beta1-discovery.md

@@ -1 +0,0 @@
-- **fix(providers):** Vertex AI Anthropic partner-model discovery now calls the Model Garden `v1beta1` publisher list (`/v1beta1/publishers/anthropic/models`, global) and parses its `publisherModels` envelope, so Claude models auto-synced from Vertex populate the active live catalog and route at request time instead of returning `Model '<id>' is not available in the active live catalog` ([#11991](https://github.com/diegosouzapw/OmniRoute/issues/11991)) — thanks @fabioluissilva

changelog.d/fixes/11999-cli-nodes-base-url-shadowing.md

@@ -1 +0,0 @@
-- **fix(cli):** support `--base-url` alongside `--endpoint` in `omniroute nodes add`, `update`, and `validate` subcommands to prevent global `--base-url` shadowing issues ([#11999](https://github.com/diegosouzapw/OmniRoute/issues/11999)).

changelog.d/fixes/12002-cloudflare-ai-model-scoped-content-parts.md

@@ -1 +0,0 @@
-- **fix(providers):** `cloudflare-ai` no longer refuses image content parts for every Workers AI model ([#12002](https://github.com/diegosouzapw/OmniRoute/pull/12002)) — the plain-string `content` requirement behind #2539 is carried by the _model_ schema, not by the `/ai/v1/chat/completions` endpoint (measured: an all-text part array returns 200 on `@cf/mistralai/mistral-small-3.1-24b-instruct`, `@cf/meta/llama-4-scout-17b-16e-instruct` and `@cf/meta/llama-3.3-70b-instruct-fp8-fast`, and 400 on the text-only `@cf/qwen/qwen2.5-coder-32b-instruct`). `transformRequest()` flattened every array and threw on the first non-text part (#6390), so image input was refused for vision-capable Cloudflare models that accept it. All-text arrays are still flattened — the one shape every model accepts — while an array carrying a non-text part is passed through untouched, so the attachment is still never silently dropped. Regression guards: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.

changelog.d/fixes/12025-decouple-execution-expiration-from-queue-wait.md

@@ -1 +0,0 @@
-- **fix(resilience):** decouple the limiter-managed execution backstop from the queue-wait budget — new `requestQueue.executionMaxWaitMs` (env `RATE_LIMIT_EXECUTION_MAX_WAIT_MS`, default 600000 = 10 min) now feeds Bottleneck's post-dispatch `expiration`, while `requestQueue.maxWaitMs` keeps its documented queue-wait semantics. Previously the queue-wait budget doubled as the execution expiration, so legitimate long-running calls on non-incremental gateways (whole generation buffered before the first upstream byte, e.g. Console Go / Command Code tiers serving GLM models) were killed mid-flight at the queue budget with a false 504 `RATE_LIMIT_EXECUTION_TIMEOUT` — the local limiter undercut the provider-aware upstream fetch-start timeouts. The surfaced 504 message now names `requestQueue.executionMaxWaitMs`; the error keeps the #4165 guarantees (disclaims an upstream timeout, preserves the Bottleneck error as `cause`, branded code + trusted provenance, classified request-scoped so combo falls back). A real queue-wait bound (the `Promise.race` around `limiter.schedule()` sketched in #9533) remains future work. (#12025)

changelog.d/fixes/12026-call-log-preserve-error-under-size-limit.md

@@ -1 +0,0 @@
-- **Call logs:** keep the `error` field when an artifact exceeds the storage cap, instead of replacing it with the omission marker. The error is the only field that says *why* a request failed and is typically ~90 bytes next to the multi-hundred-KB bodies that trip the cap, so dropping it left a size-limited row undiagnosable — a provider outage, a local timeout and an upstream 400 all rendered identically. It is now preserved at every fallback stage, truncated to 4KB if it is itself large ([#12026](https://github.com/diegosouzapw/OmniRoute/issues/12026)).

changelog.d/fixes/12026-preserve-error-in-oversized-call-log-artifacts.md

@@ -1 +0,0 @@
-- **fix(diagnostics):** preserve the error field (truncated to 4KB with a `[truncated: …]` suffix) in every call-log artifact size-limit fallback stage. Previously the minimal fallback replaced the error with `[omitted: call log artifact size limit exceeded]`, so an oversized artifact row showed nothing about WHY the request failed — e.g. 91 of 847 opencode-go 504 rows on one production instance were undiagnosable from the dashboard. Oversized request/response bodies are still omitted exactly as before; the error cap is independent of the payload sizes that tripped the fallback. (#12026)

changelog.d/fixes/12031-web-search-call-emission.md

@@ -1 +0,0 @@
-- **fix(sse):** OpenAI Responses clients that declare the native `web_search` tool now receive a spec-shaped `web_search_call` output item with `action.sources` alongside the preserved function-call round-trip, so search results executed through OmniRoute's own search backend are consumable by standard Responses clients (Codex, pi-web-access, …).

changelog.d/fixes/12073-node26-alias-hooks.md

@@ -1 +0,0 @@
-- **fix(cli):** use in-thread alias resolver hooks on modern runtimes to avoid deprecation noise and improve Node.js forward compatibility ([#12073](https://github.com/diegosouzapw/OmniRoute/issues/12073)).

changelog.d/fixes/12090-combo-explicit-context-length.md

@@ -1 +0,0 @@
-- **fix(combo):** an operator-set **Agent Features → Context length** on a combo is now honored at request time. The value was persisted and advertised through `/v1/models`, but `resolveComboContextLimit()` never consulted it — so a multi-target combo whose members carry no per-model window fell through to the provider's generic `defaultContextLength` (openrouter 128000, command-code 200000) and rejected large requests with `Input exceeds context window … limit 128000` despite the combo being explicitly sized much larger. An identical single-target combo worked, because it collapses to its concrete target before the guard runs. Invalid values (0/negative/NaN/Infinity) are ignored, so the existing target → combo-min → fallback order is unchanged. ([#12090](https://github.com/diegosouzapw/OmniRoute/pull/12090)) — thanks @adivekar-utexas

changelog.d/fixes/12206-responses-system-content-parts.md

@@ -1 +0,0 @@
-- **fix(translator):** the leading `system` message now reaches Responses-API upstreams when its `content` is a content-part array — it was read as `typeof content === "string" ? content : ""`, so a prompt-caching client (Anthropic `cache_control`, the shape LiteLLM and the Anthropic SDK emit) had its entire system prompt replaced by an empty `instructions`. The request was still accepted with a normal `prompt_tokens` count, so the model answered with no instructions and nothing in the response said they were missing. Mid-conversation system turns already handled the array shape ([#7056](https://github.com/diegosouzapw/OmniRoute/pull/7056)); only the first one did not ([#12206](https://github.com/diegosouzapw/OmniRoute/issues/12206)). Regression guard: `tests/unit/translator-openai-responses-system-content-parts.test.ts`.

changelog.d/fixes/12222-claude-org-oauth-dedup.md

@@ -1 +0,0 @@
-- **fix(oauth):** Keep a Claude personal workspace and a Team organization as separate connections — they share the same email and `accountUUID`, so the email-only OAuth dedup let the second login overwrite the first account's tokens; `organizationUUID` now disambiguates them, the way `workspaceId` does for Codex ([#12222](https://github.com/diegosouzapw/OmniRoute/pull/12222))

changelog.d/fixes/12262-reasoning-truncation-quality-guard.md

@@ -1 +0,0 @@
-- **fix(sse):** trust `finish_reason: "length"`/`"max_tokens"` over the reasoning-consumed-token ratio in response quality validation, so a reasoning model truncated below the old 90% threshold correctly fails and retries instead of returning empty content as a silent "success" ([#12262](https://github.com/diegosouzapw/OmniRoute/pull/12262))

changelog.d/fixes/9133-auto-combo-candidates-unfiltered.md

@@ -1 +0,0 @@
-- fix(sse): stop the auto-combo candidates inspector from silently dropping model-locked/cooled-down rows (#9133)

changelog.d/fixes/abort-guard-absorb-request-signal-aborted.md

@@ -1 +0,0 @@
-- Absorb `Error [AbortError]: request_signal_aborted` and DOMException AbortError shapes in the process-level client-abort crash guard so routine client disconnects no longer kill the server (exit code 7).

changelog.d/fixes/duckduckgo-err-bn-limit-and-proxy-pool.md

@@ -1 +0,0 @@
-- **fix(executors):** handle DuckDuckGo ERR_BN_LIMIT (418) without retrying — when the upstream returns `418 ERR_BN_LIMIT` (rate-limit/ban), the executor now returns the error immediately instead of burning another VQD acquisition that would only count against the IP limit. The retry logic for `418 ERR_CHALLENGE` (unsolved challenge) remains unchanged. ([#11598](https://github.com/diegosouzapw/OmniRoute/pull/11598))

changelog.d/fixes/native-codex-turn-pin-model-scoped-fallback.md

@@ -1 +0,0 @@
-- **fix(combo):** return non-retryable HTTP 400 when all candidates for a pinned native Codex turn are unavailable due to model-scoped lockout, terminating the turn cleanly while preserving turn continuity and enabling standard Combo routing on subsequent turns

changelog.d/fixes/pending-combo-test-contract-legacy-key-access.md

@@ -1 +0,0 @@
-- **fix(api):** Generated API CLI commands now enforce required OpenAPI request bodies; Combo test commands forward the required `comboName` body, while API keys created by older writers after migration 149 preserve legacy allow-all Combo access without widening explicit empty allowlists — thanks @marcelokarval

changelog.d/fixes/v3850-electron-release-assets.md

@@ -1 +0,0 @@
-- Electron release workflow: the `publish-npm` job now grants `actions: read` to the reusable `npm-publish.yml` it calls (its `publish` job requests it), which is what made GitHub refuse the whole v3.8.50 run at startup and ship the release with zero desktop assets; a `workflow_dispatch` now builds the requested tag instead of the dispatching branch and can skip the npm leg (`publish_npm=false`) when only re-attaching assets

changelog.d/fixes/v3851-electron-lockfile-build-ref-sbom.md

@@ -1 +0,0 @@
-- Electron release: `electron/package-lock.json` regained the optional `electron-builder-squirrel-windows` subtree (13 entries) that `npm ci` had been refusing as out of sync, `electron-release.yml` gained a `build_ref` dispatch input and stops regenerating release notes on a re-attach dispatch, and the npm publish workflow attaches the SBOM to the GitHub Release on dispatch publishes too — so the v3.8.51 tag ships every desktop asset and the SBOM like v3.8.49 did

changelog.d/maintenance/11657-video-bridge-pipeline-ports.md

@@ -1 +0,0 @@
-- **refactor(video bridge):** extract per-video acquisition, whole-result caching, description, and metrics/abort/cleanup out of `VideoBridgeGuardrail.preCall` into a `processVideoPart` seam in a new `videoBridgePipeline.ts`, behind explicit `VideoMediaBrokerPort`, `VideoAudioTranscriptionPort`, and `VideoDrilldownPort` boundaries; `preCall` now only handles request traversal, policy, and response aggregation. The Video tab's FFmpeg/ffprobe runtime status is now an explicit `unknown` / `restricted` / `unavailable` / `available` state instead of a nullable boolean pair, fixing a case where an in-flight or failed probe was mislabeled as "install FFmpeg" ([#11657](https://github.com/diegosouzapw/OmniRoute/issues/11657)).

changelog.d/maintenance/11661-video-bridge-transcript-provenance-doc.md

@@ -1,5 +0,0 @@
-- **docs(video):** clarify that the Video Bridge transcript `source` field (`client`,
-  `embedded`, `audio-bridge`) is presently caller-declared and not yet server-verified —
-  OmniRoute enforces the enum shape but does not cryptographically confirm that an
-  `embedded`/`audio-bridge` label came from a server-owned extraction
-  ([#11661](https://github.com/diegosouzapw/OmniRoute/issues/11661)).

changelog.d/maintenance/11753-wreq-js-transport.md

@@ -1 +0,0 @@
-- **chore(stealth):** replace the `tls-client-node` sidecar/temp-file transport used by the six web-cookie providers with the exactly pinned `wreq-js` 3.0.0 native transport, preserving streaming, proxy isolation, deadlines, EOF policies, binary responses, and cancellation while removing the obsolete downloader and native repair path ([#11753](https://github.com/diegosouzapw/OmniRoute/pull/11753)).

changelog.d/maintenance/11924-type-the-frozen-any.md

@@ -1 +0,0 @@
-- Type the 55 `no-explicit-any` sites that had been frozen under #11924 — four redundant casts in `socksConnectorWithFamily.ts` (undici/socks types already accept them) and the mocks/fixtures of the socks-timeout and isFree suites — and drop their suppression entries; the ESLint ratchet shrinks from 5487 to 5432 (Closes #11924)

changelog.d/maintenance/11965-nightly-jobs-omni-light.md

@@ -1 +0,0 @@
-- Move the four nightly jobs that build the backend (`nightly-schemathesis`, `nightly-llm-security` promptfoo + garak, `nightly-resilience` axe-a11y) off the hosted 7 GB runner — where they died on `release/v3.8.51` unseen — onto the box's new `omni-light` pool (two listeners), and document the reshaped fleet (4 active OmniRoute listeners: 2 `omni-build` + 2 `omni-light`, janitor ceiling 4) (Closes #11965)

changelog.d/maintenance/11976-docker-publish-webpack-and-advisory-build.md

@@ -1 +0,0 @@
-- Stop painting every fork PR into `release/**` red: `quality.yml` `Build (advisory)` is skipped (GitHub still reports `continue-on-error` failures as check FAILURE). Hosted `ubuntu-latest` cannot finish `npm run build` on this tree — same class as #11962 taking `build.yml` off the PR rail. `docker-publish.yml` amd64 now runs on the `.113` `omni-build` pool (31 GB / 32 cores, two listeners) with Turbopack, shares the `heavy-build-main` lane with `ci.yml` `Build` so it queues instead of becoming a third heavy, and keeps per-ref concurrency (a merge storm was starting 8 concurrent OOM builds). arm64 stays on `ubuntu-24.04-arm` with webpack — there is no ARM box. Fallback when `USE_VPS_RUNNER` is off: hosted amd64 + webpack (#11976).

changelog.d/maintenance/11976-docker-publish-webpack-omni-build.md

@@ -1 +0,0 @@
-- `docker-publish.yml` builds with webpack (`OMNIROUTE_USE_TURBOPACK=0`) on **both** arches, including amd64 on the `.113` `omni-build` pool. Turbopack had the RAM (31 GB, `omniroute-113-6`) and still panicked (`TurbopackInternalError: there must be a path to a root`, run 33253576569, 26 min in). The same tree's arm64 webpack build on hosted `ubuntu-24.04-arm` succeeded (run 33264823398). Dockerfile already documents webpack as the Docker escape hatch (#11976).

changelog.d/maintenance/12226-free-verdict-two-regimes.md

@@ -1 +0,0 @@
-- **docs(free-tier):** declare the counting vs deciding regimes for "is it free?" and guard the deciding path from DB-backed catalog resolution ([#12226](https://github.com/diegosouzapw/OmniRoute/pull/12226))

changelog.d/maintenance/ci-coverage-codecov-step-timeout.md

@@ -1 +0,0 @@
-- `Coverage` job on `ci.yml`: the informational Codecov upload gets its own 5-minute ceiling and `continue-on-error`, and the job budget grows from 20 to 30 minutes (the 8-shard c8 merge alone takes ~10) — a stalled upload no longer ends the job `cancelled` and drags a fully green `main` run's conclusion down with it