feat(cli): boot exposure warning for unauthenticated LAN bind (GHSA-wmgv-ph3p-rv57)

The shipped default (bind 0.0.0.0 + no API-key requirement) is a deliberate, documented local-first posture — but an operator on an untrusted network should learn that at startup, not after a surprise quota bill. serve now prints a loud warning naming both escape hatches (REQUIRE_API_KEY=true or OMNIROUTE_SERVER_HOST=127.0.0.1) whenever the resolved bind is non-loopback and no key is required. Silent on loopback binds and when REQUIRE_API_KEY is enabled. The default posture itself is unchanged (operator decision).
fix(security): A2A REST auth + task owner scoping (GHSA-jcm5-6wpp-wjj8)
2026-08-25 00:22:09 +03:00 · 2026-08-23 12:50:42 -03:00 · 2026-08-23 12:50:04 -03:00 · 2026-08-23 12:48:02 -03:00 · 2026-08-23 12:46:50 -03:00
734 changed files with 16231 additions and 47800 deletions
--- a/.env.example
+++ b/.env.example
@@ -65,12 +65,6 @@ INITIAL_PASSWORD=CHANGEME
 # OMNIROUTE_RELEASE_REF=origin/main
 # OMNIROUTE_ALLOW_CANARY_BUILD=1

-# Build-phase signal (#10060). Set to 1 by scripts/build/build-next-isolated.mjs and
-# inherited by every spawned build worker so the DB layer returns a no-op stub instead
-# of loading the native better-sqlite3 addon (which aborts the worker on exit).
-# Never set this for the running server. Used by: src/lib/buildPhase.ts, src/lib/db/core.ts
-# OMNIROUTE_BUILDING=1
-
 # Encryption key for SQLite database encryption at rest.
 # Used by: src/lib/db/encryption.ts — encrypts the entire SQLite database.
 # Generate: openssl rand -hex 32  |  Leave empty to disable DB encryption.
@@ -1027,16 +1021,6 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # Used by: open-sse/services/compression/engines/rtk/filterLoader.ts.  Default: 0.
 #OMNIROUTE_RTK_TRUST_PROJECT_FILTERS=0

-# Maximum concurrent synchronous compression workers. Excess jobs wait FIFO.
-# Used by: open-sse/services/compression/compressionWorkerPool.ts. Default: 2.
-#OMNI_COMPRESSION_WORKERS=2
-# Per-job worker timeout (ms). A timed-out worker is terminated and the request fails open.
-# Used by: open-sse/services/compression/compressionWorkerPool.ts. Default: 120000.
-#OMNI_COMPRESSION_WORKER_TIMEOUT_MS=120000
-# Terminate idle compression workers after this many milliseconds.
-# Used by: open-sse/services/compression/compressionWorkerPool.ts. Default: 60000.
-#OMNI_COMPRESSION_WORKER_IDLE_MS=60000
-
 # T02 stacked-pipeline engine circuit-breaker (OPT-IN, default off). When enabled, a compression
 # engine that throws repeatedly across requests is skipped (fail-open) for a cooldown.
 # Used by: open-sse/services/compression/pipelineEngineBreaker.ts.
@@ -1319,36 +1303,6 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # set to true/1/yes to enable. Used by: open-sse/executors/codex.ts.
 # OMNIROUTE_CODEX_DROP_NONSTANDARD_EVENTS=true

-# Codex app-server WebSocket transport (opt-in). When a WebSocket URL and a
-# capability token are both provided, Codex requests are routed through a local
-# `codex app-server` sidecar over JSON-RPC instead of the HTTP Responses API.
-# Each var is also settable per-connection via providerSpecificData; the env var
-# is the process-wide fallback. Used by:
-# open-sse/executors/codex/appServerConfig.ts.
-#
-# WebSocket endpoint of the codex app-server (ws:// or wss://). Required to
-# enable the transport; leaving it unset keeps Codex on its HTTP transports.
-# OMNIROUTE_CODEX_APPSERVER_WS=ws://127.0.0.1:8081
-# Inline capability/bearer token presented to the app-server.
-# OMNIROUTE_CODEX_APPSERVER_WS_TOKEN=deadbeef...
-# Path to a file holding the capability token (produced by
-# `codex app-server --ws-token-file <path>`). Used when the inline token above
-# is not set.
-# OMNIROUTE_CODEX_APPSERVER_WS_TOKEN_FILE=/run/codex-ws-token
-# Working directory the app-server turn runs in (defaults to /tmp).
-# OMNIROUTE_CODEX_APPSERVER_CWD=/tmp
-# Approval policy passed to the app-server turn (e.g. never, on-request).
-# OMNIROUTE_CODEX_APPSERVER_APPROVAL=never
-# Sandbox policy passed to the app-server turn (e.g. read-only,
-# workspace-write, danger-full-access). When unset, the executor defaults to
-# "workspace-write" (hardened; used to be "danger-full-access").
-# OMNIROUTE_CODEX_APPSERVER_SANDBOX=read-only
-# Auto-approve the app-server's own approval prompts (command/file/permission
-# execution on the host). Defaults to OFF — prompts are auto-denied. Set to
-# true/1/yes only when you trust the deployment to run codex-decided host
-# commands. Per-connection override: providerSpecificData.codexAppServerAutoApprove.
-# OMNIROUTE_CODEX_APPSERVER_AUTO_APPROVE=false
-
 # ═══════════════════════════════════════════════════════════════════════════════
 # 13. CLI FINGERPRINT COMPATIBILITY (Anti-Detection)
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -2021,9 +1975,6 @@ APP_LOG_TO_FILE=true
 # CLIPROXYAPI_HOST=127.0.0.1
 # CLIPROXYAPI_PORT=5544
 # CLIPROXYAPI_CONFIG_DIR=~/.cli-proxy-api
-# Management key for an externally managed instance. Embedded instances use
-# OmniRoute's encrypted service key.
-# CLIPROXYAPI_MANAGEMENT_KEY=

 # ── Mux embedded service ──
 # Override the port where the embedded Mux (coder/mux) agent-orchestration
@@ -2433,10 +2384,10 @@ APP_LOG_TO_FILE=true
 # test suite must NEVER mutate the OS trust store (a fake test PEM installed via
 # update-ca-certificates broke all system TLS on a persistent runner, 2026-07-05).
 # OMNIROUTE_SKIP_SYSTEM_TRUST=1
-# check-changelog-integrity.mjs (anti CHANGELOG-eat gate): explicit base ref override.
-# Intentional transformations require an exact reviewed entry in
-# config/release/changelog-reconciliations.json; there is no runtime bypass.
+# check-changelog-integrity.mjs (anti CHANGELOG-eat gate): explicit base ref
+# override, and the justified-removal escape hatch for intentional bullet removals.
 # CHANGELOG_BASE_REF=origin/release/v0.0.0
+# ALLOW_CHANGELOG_REMOVALS=1

 # ── Remote audio provider nodes ──
 # Used by: src/app/api/v1/_shared/audioProviderNodes.ts — lets the /v1/audio/*
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,11 +0,0 @@
-# Shell scripts must always be checked out with LF line endings.
-#
-# On Windows, core.autocrlf=true converts text files to CRLF in the working
-# tree. Scripts that are kernel-exec'd (Docker ENTRYPOINT, bin/*.sh on Linux
-# hosts) then fail with `exec ...: no such file or directory` because the
-# shebang becomes "#!/bin/sh\r". eol=lf overrides autocrlf for these files.
-*.sh text eol=lf
-
-# This file must stay LF too: git parses it as-is, and a trailing CR would
-# corrupt every pattern (e.g. "*.sh\r" matches nothing).
-.gitattributes text eol=lf
--- a/.github/workflows/opencode-plugin-ci.yml
+++ b/.github/workflows/opencode-plugin-ci.yml
@@ -2,11 +2,11 @@ name: opencode-plugin CI

 on:
  push:
-    branches: [main, "release/**"]
+    branches: [main, release/v3.8.2]
    paths:
      - "@omniroute/opencode-plugin/**"
  pull_request:
-    branches: [main, "release/**"]
+    branches: [main, release/v3.8.2]
    paths:
      - "@omniroute/opencode-plugin/**"
    types: [opened, synchronize, reopened, ready_for_review]
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -92,9 +92,5 @@
      # - x-api-key PUBLICO do Firefly web (documentado em open-sse/utils/publicCreds.ts:207);
      #   as duas ocorrencias sinalizadas estao em COMENTARIOS JSDoc, o runtime le de resolvePublicCred().
      '''omniroute-kimi-sponsor-banner-dismissed-v\d+''',
-      # CheaperInference sponsor banner localStorage key (upstream #11196 /
-      # eb5797370). Same UI-identifier pattern as the kimi banner above, not a
-      # credential; the generic-api-key rule flags the long hyphenated string.
-      '''omniroute-cheaperinference-sponsor-banner-dismissed-v\d+''',
      '''SunbreakWebUI1''',
    ]
--- a/@omniroute/opencode-plugin/package.json
+++ b/@omniroute/opencode-plugin/package.json
@@ -23,7 +23,7 @@
  "scripts": {
    "build": "tsup",
    "clean": "rm -rf dist",
-    "test": "node --import tsx/esm --test tests/scaffold.test.ts tests/auth.test.ts tests/options-schema.test.ts tests/multi-instance.test.ts tests/fetch-interceptor.test.ts tests/provider.test.ts tests/gemini-sanitize.test.ts tests/combos.test.ts tests/config-shim.test.ts tests/features.test.ts tests/feature-defaults.test.ts tests/usable-combo.test.ts tests/disk-snapshot-perms.test.ts tests/fork-features.test.ts tests/auto-combo-context.test.ts tests/provider-id-routing.test.ts tests/management-read-token.test.ts tests/auto-sync.test.ts tests/model-allowlist.test.ts tests/log-level.test.ts tests/effort-tier-variants.test.ts",
+    "test": "node --import tsx/esm --test tests/scaffold.test.ts tests/auth.test.ts tests/options-schema.test.ts tests/multi-instance.test.ts tests/fetch-interceptor.test.ts tests/provider.test.ts tests/gemini-sanitize.test.ts tests/combos.test.ts tests/config-shim.test.ts tests/features.test.ts tests/feature-defaults.test.ts tests/usable-combo.test.ts tests/disk-snapshot-perms.test.ts tests/fork-features.test.ts tests/auto-combo-context.test.ts tests/provider-id-routing.test.ts tests/management-read-token.test.ts tests/auto-sync.test.ts tests/model-allowlist.test.ts tests/log-level.test.ts",
    "prepublishOnly": "npm run clean && npm run build && npm test"
  },
  "keywords": [
--- a/@omniroute/opencode-plugin/src/index.ts
+++ b/@omniroute/opencode-plugin/src/index.ts
@@ -1161,8 +1161,6 @@ export interface OmniRouteRawModelEntry {
    attachment?: boolean;
    structured_output?: boolean;
    temperature?: boolean;
-    /** Runtime-learned or synced reasoning tiers (server-gated, blind-mapped). */
-    effort_tiers?: string[];
  };
  release_date?: string;
  last_updated?: string;
@@ -1304,18 +1302,6 @@ export function mapRawModelToModelV2(
  ctx: { providerId: string; baseURL: string; apiFormat?: { anthropicPrefixes?: string[] } }
 ): ModelV2 {
  const caps = raw.capabilities ?? {};
-  // effort_tiers loop: server-declared tiers become ModelV2 variants so the
-  // UI offers exactly the tiers OmniRoute vouches for (instead of opencode's
-  // invented [low, medium, high] fallback). Blind: filtering/exclusion rules
-  // live server-side. Absent/empty/malformed => key omitted ENTIRELY (an
-  // empty variants object would suppress opencode's fallback for this model).
-  const declaredTiers = Array.isArray(caps.effort_tiers)
-    ? caps.effort_tiers.filter((t): t is string => typeof t === "string" && t.length > 0)
-    : [];
-  const variants =
-    declaredTiers.length > 0
-      ? Object.fromEntries(declaredTiers.map((tier) => [tier, { reasoningEffort: tier }]))
-      : undefined;
  const inMods = new Set(raw.input_modalities ?? ["text"]);
  const outMods = new Set(raw.output_modalities ?? ["text"]);

@@ -1329,7 +1315,10 @@ export function mapRawModelToModelV2(
    // OpenCode looks up `-m <plugin>/<combo>` as model id `<combo>` under
    // the plugin provider (#10345). Other bare ids still prefix with
    // `providerId` so credentials resolve as `(omniroute, model)`.
-    id: raw.id.includes("/") || raw.owned_by === "combo" ? raw.id : `${ctx.providerId}/${raw.id}`,
+    id:
+      raw.id.includes("/") || raw.owned_by === "combo"
+        ? raw.id
+        : `${ctx.providerId}/${raw.id}`,
    /**
     * Display name. Falls back to raw.id when no enrichment is available;
     * the caller (`createOmniRouteProviderHook`) overlays
@@ -1368,7 +1357,6 @@ export function mapRawModelToModelV2(
      ...(typeof raw.max_input_tokens === "number" ? { input: raw.max_input_tokens } : {}),
      output: typeof raw.max_output_tokens === "number" ? raw.max_output_tokens : 0,
    },
-    ...(variants ? { variants } : {}),
    status: "active",
    options: {},
    headers: {},
--- a/@omniroute/opencode-plugin/tests/effort-tier-variants.test.ts
+++ b/@omniroute/opencode-plugin/tests/effort-tier-variants.test.ts
@@ -1,62 +0,0 @@
-/**
- * effort_tiers loop — plugin maps server-declared tiers to ModelV2 variants.
- * Blind mapping (I3): no owned_by/provider knowledge here — the SERVER gates
- * eligibility (shouldExposeSyncedEffortVariants). Absence semantics (M3):
- * no tiers => NO variants key at all (an empty object would also kill
- * opencode's own fallback for non-tiered models).
- */
-import test from "node:test";
-import assert from "node:assert/strict";
-import { mapRawModelToModelV2, type OmniRouteRawModelEntry } from "../src/index.js";
-
-const CTX = { providerId: "omniroute", baseURL: "http://127.0.0.1:20128" } as const;
-
-test("maps declared tiers to reasoningEffort variants", () => {
-  const raw: OmniRouteRawModelEntry = {
-    id: "oc/x-preview-f-free",
-    owned_by: "opencode",
-    capabilities: { reasoning: true, effort_tiers: ["low", "high", "max"] },
-  };
-  const model = mapRawModelToModelV2(raw, { ...CTX });
-  const variants = (model as unknown as Record<string, unknown>).variants as
-    Record<string, Record<string, unknown>> | undefined;
-  assert.ok(variants, "variants key present when tiers declared");
-  assert.deepEqual(Object.keys(variants).sort(), ["high", "low", "max"]);
-  assert.deepEqual(variants.max, { reasoningEffort: "max" });
-  assert.deepEqual(variants.low, { reasoningEffort: "low" });
-});
-
-test("no tiers => NO variants key (not an empty object)", () => {
-  const raw: OmniRouteRawModelEntry = {
-    id: "plain-model",
-    capabilities: { reasoning: true },
-  };
-  const model = mapRawModelToModelV2(raw, { ...CTX }) as unknown as Record<string, unknown>;
-  assert.equal("variants" in model, false);
-});
-
-test("empty or malformed tiers array => NO variants key", () => {
-  const empty = mapRawModelToModelV2(
-    { id: "m", capabilities: { effort_tiers: [] } },
-    { ...CTX }
-  ) as unknown as Record<string, unknown>;
-  assert.equal("variants" in empty, false);
-
-  const junk = mapRawModelToModelV2(
-    { id: "m", capabilities: { effort_tiers: [42, null, "ok"] as unknown as string[] } },
-    { ...CTX }
-  ) as unknown as Record<string, unknown>;
-  const variants = junk.variants as Record<string, Record<string, unknown>> | undefined;
-  assert.deepEqual(Object.keys(variants ?? {}), ["ok"], "non-string tokens dropped");
-});
-
-test("static registry entry WITH tiers also gets variants (N1 blast radius)", () => {
-  const raw: OmniRouteRawModelEntry = {
-    id: "some-static-model",
-    owned_by: "registry",
-    capabilities: { effort_tiers: ["minimal", "high"] },
-  };
-  const model = mapRawModelToModelV2(raw, { ...CTX }) as unknown as Record<string, unknown>;
-  const variants = model.variants as Record<string, Record<string, unknown>> | undefined;
-  assert.deepEqual(Object.keys(variants ?? {}).sort(), ["high", "minimal"]);
-});
--- a/@omniroute/opencode-plugin/tests/provider.test.ts
+++ b/@omniroute/opencode-plugin/tests/provider.test.ts
@@ -104,10 +104,7 @@ test("models: extracts apiKey from ctx.auth (type=api) and calls fetcher with it
  // #6859: dynamic-hook catalog keys use the unprefixed omnirouteProviderId
  // ("omniroute"), not the OC-gate-prefixed hook.id ("opencode-omniroute") —
  // that prefix must never leak into anything OmniRoute's server parses.
-  // #10345/#10821: bare combo ids (owned_by: "combo") stay unprefixed —
-  // OpenCode looks up `-m <plugin>/<combo>` as model id `<combo>` under the
-  // plugin provider, so `claude-primary` here carries no provider prefix.
-  assert.ok(out["claude-primary"]);
+  assert.ok(out["omniroute/claude-primary"]);
 });

 test("models: returns {} when ctx.auth is null/undefined/wrong-type/empty-key", async () => {
@@ -162,15 +159,11 @@ test("models: maps a sample /v1/models entry to ModelV2 (sanity)", async () => {
  // omnirouteProviderId ("omniroute") — the OC-gate prefix ("opencode-")
  // must stay OC-internal (hook.id / AuthHook.provider) and never leak into
  // anything OmniRoute's own server parses for credential lookup.
-  // #10345/#10821: bare **combo** ids (owned_by: "combo", e.g.
-  // "claude-primary") must also stay unprefixed — OpenCode looks up
-  // `-m <plugin>/<combo>` as model id `<combo>` under the plugin provider.
-  const claude = out["claude-primary"];
+  const claude = out["omniroute/claude-primary"];
  assert.ok(claude, "claude-primary present");
-  // `mapRawModelToModelV2` leaves bare combo ids unprefixed (see
-  // src/index.ts mapRawModelToModelV2) so OC's `-m <plugin>/<combo>` lookup
-  // resolves the combo id directly.
-  assert.equal(claude.id, "claude-primary");
+  // `mapRawModelToModelV2` stamps the provider prefix on the id so OC's
+  // static-catalog reader resolves `(providerID, modelID)` from the key.
+  assert.equal(claude.id, "omniroute/claude-primary");
  assert.equal(claude.name, "claude-primary");
  assert.equal(claude.providerID, "omniroute");
  assert.equal(claude.api.id, "openai-compatible");
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -180,7 +180,6 @@ _Living section — regenerated 2026-08-12 from all cycle commits (cycle open `e

 ### 🐛 Bug Fixes

- **fix(build):** every route no longer answers HTTP 500 on artifacts built from the release tip ([#11343](https://github.com/diegosouzapw/OmniRoute/issues/11343)) — `next.config.mjs` aliased `better-sqlite3` to its build-time stub **unconditionally**, on the premise that `serverExternalPackages` still won at runtime. It does not: a Turbopack `resolveAlias` rewrites the request *before* the externals check, so the request stopped matching the `better-sqlite3` external entry and the stub was baked into the shipped bundle. The sync driver then failed with `r(...) is not a constructor`, fell through `node:sqlite` and sql.js, and the instrumentation hook aborted at boot. Same failure shape as [#6344](https://github.com/diegosouzapw/OmniRoute/issues/6344), so it gets the same treatment: the alias is opt-in via `OMNIROUTE_BETTER_SQLITE3_STUB=1` through the shared `scripts/build/better-sqlite3-stub-flag.mjs` helper — set it only on a build host that actually hits the SIGABRT build-worker teardown ([#10060](https://github.com/diegosouzapw/OmniRoute/issues/10060)); default builds externalize the real native addon. Regression guards: `tests/unit/better-sqlite3-stub-alias-11343.test.mjs` (5) and the env matrix in `tests/unit/next-config.test.ts`.
 - **security(search)**: block SSRF via `/v1/search` `provider_options.baseUrl` for the Firecrawl search provider — the client-controlled override is now validated as a public URL before it is used to build the server-side fetch target, so a caller with a valid API key can no longer redirect search requests at loopback, RFC1918, or cloud-metadata hosts — thanks @zmf963
 - **providers**: honor `PATCH /api/providers/[id]` so `omniroute providers rotate` stops 405ing (the OpenAPI spec and CLI already use PATCH) (PR #10366)
 - **cli**: route provider test commands through configured connection test endpoints (#10570)
--- a/32
+++ b/32
@@ -59,12 +59,6 @@ RUN set -eux; \
 # ── Builder ────────────────────────────────────────────────────────────────
 FROM base AS builder

-# No telemetry, anywhere. Disable Next.js's anonymous build-time telemetry
-# (it otherwise pings Vercel during `next build`). Set on the builder stage so
-# every image build is silent; the runtime never builds, so this covers the
-# only phase Next telemetry can fire.
-ENV NEXT_TELEMETRY_DISABLED=1
-
 # Build tools for native module compilation
 # apt-get update needed here because base's rm -rf clears the shared cache
 RUN --mount=type=cache,id=s/92ca8a61-c1ba-421f-a389-d48ac7258c2d-apt-cache,target=/var/cache/apt,sharing=locked \
@@ -172,33 +166,9 @@ ENV OMNIROUTE_MITM_STUB=1
 # child (build-next-isolated.mjs → resolveNextBuildEnv spreads process.env).
 # Build-only; the runtime heap is set separately on the runner stage
 # (OMNIROUTE_MEMORY_MB). Override: `--build-arg OMNIROUTE_BUILD_MEMORY_MB=6144`.
-# Default raised 4096 → 6144 (#10060): the Next 16 production pass on a codebase
-# this size intermittently OOMs a build worker at 4 GB on memory-tight hosts.
-ARG OMNIROUTE_BUILD_MEMORY_MB=6144
+ARG OMNIROUTE_BUILD_MEMORY_MB=4096
 ENV NODE_OPTIONS="--max-old-space-size=${OMNIROUTE_BUILD_MEMORY_MB}"

-# Cap Next.js build worker pools. Next 16 defaults to `os.cpus().length - 1`
-# workers for page-data collection (31 on a 32-core builder); on memory-tight
-# hosts 31 workers + webpack's multi-GB heap blow past RAM and a worker dies
-# with SIGSEGV at teardown ("worker exited with code: null and signal: SIGSEGV"),
-# silently leaving no standalone bundle. Next derives the worker count from
-# CIRCLE_NODE_TOTAL (workers = N-1). (#10060)
-#
-# Lowered 8 → 3 (7 workers → 2). Every page-data worker inherits NODE_OPTIONS
-# above, so the ceiling is per PROCESS, not per build: 7 workers on a 16 GB
-# GitHub runner (ubuntu-24.04 / ubuntu-24.04-arm, 4 vCPU) exhausted the host and
-# buildkit failed the whole step with `ResourceExhausted: ... cannot allocate
-# memory`. The compile phase always finished ("✓ Compiled successfully in
-# 4.2min"); the kernel killed the build right after "Collecting page data using
-# 7 workers". It was intermittent for a while and went 100% on 2026-08-22, which
-# is what a threshold being crossed by ordinary codebase growth looks like.
-# tests/unit/docker-build-memory-budget.test.ts does the arithmetic and fails if
-# either knob is raised past what a 16 GB runner holds. 2 workers also stops
-# oversubscribing the runner's 4 vCPU, which 7 did. Override for a big builder:
-# `--build-arg OMNIROUTE_BUILD_WORKERS=8`.
-ARG OMNIROUTE_BUILD_WORKERS=3
-ENV CIRCLE_NODE_TOTAL=${OMNIROUTE_BUILD_WORKERS}
-
 COPY . ./
 RUN --mount=type=cache,id=s/92ca8a61-c1ba-421f-a389-d48ac7258c2d-next-cache,target=/app/.build/next/cache \
  mkdir -p /app/data \
--- a/README.md
+++ b/README.md
@@ -7,7 +7,7 @@

 # 🚀 OmniRoute — The Free AI Gateway

-<img src="./docs/diagrams/readme-hero.svg" width="100%" alt="OmniRoute — Never stop coding. Every AI tool → 350 providers — 90+ free — through one endpoint. Claude Code, Codex, Cursor, Cline, Copilot & Antigravity into FREE Claude / GPT / Gemini with auto-fallback. RTK + Caveman stacked compression saves 15–95% tokens (~89% avg) — never hit limits. 350 AI providers · 90+ free tiers · ~1.51B free tokens/mo · 19 routing strategies · $0 to start."/>
+<img src="./docs/diagrams/readme-hero.svg" width="100%" alt="OmniRoute — Never stop coding. Every AI tool → 349 providers — 90+ free — through one endpoint. Claude Code, Codex, Cursor, Cline, Copilot & Antigravity into FREE Claude / GPT / Gemini with auto-fallback. RTK + Caveman stacked compression saves 15–95% tokens (~89% avg) — never hit limits. 350 AI providers · 90+ free tiers · ~1.51B free tokens/mo · 19 routing strategies · $0 to start."/>

 </div>

@@ -17,9 +17,9 @@

 </div>

-> Stacking free tiers by hand is painful — dozens of SDKs, dozens of rate limits, and no idea how much you actually have. OmniRoute catalogs **455 free-tier entries across 40 recurring pool keys** and computes the token headline from the **20 pools with a published positive monthly budget**, deduplicated by shared pool. The result stays visible on the dashboard (`/dashboard/free-tiers`).
+> Stacking free tiers by hand is painful — dozens of SDKs, dozens of rate limits, and no idea how much you actually have. OmniRoute aggregates the **documented** free tiers of **42 provider pools / 495 models** into one honest number and shows it live on the dashboard (`/dashboard/free-tiers`).

-<img src="./docs/diagrams/free-tier-budget.svg" width="100%" alt="OmniRoute free-tier budget card: ~1.51B free tokens per month steady, up to ~2.13B in the first month with signup credits, from 40 documented recurring pool keys covering 455 cataloged free-tier entries behind one endpoint. Honest pool-deduped math — each shared pool counted once, including 20 recurring pools with a published positive monthly token budget; 15 providers are marked avoid in the terms-risk catalog so you decide. Budget bar includes Mistral 1B, LLM7 150M, Nara 150M, Gemini 60M and smaller pools, plus first-month signup credits and permanently-free no-token-cap providers surfaced separately so they never inflate the headline. Live used/remaining on /dashboard/free-tiers."/>
+<img src="./docs/diagrams/free-tier-budget.svg" width="100%" alt="OmniRoute free-tier budget card: ~1.51B free tokens per month steady, up to ~2.13B in the first month with signup credits, from the documented free tiers of 42 provider pools / 495 models behind one endpoint. Honest pool-deduped math — each shared pool counted once (counting every rate limit 24/7 would read ~10B; not published), 15 providers ToS-flagged so you decide. Budget bar of the countable free pools with per-model grid (Mistral Large 3 1B, GPT-4o mini 150M, Gemini 2.5 Flash 60M … Claude Sonnet 4.5 25K), one-time first-month signup credits (vertex 300M, agentrouter 200M, predibase 25M, together 25M, glm-cn 20M, doubao 15M, ai21 10M, longcat 10M, deepseek 5M, hyperbolic 5M, nscale 5M), plus permanently-free no-token-cap providers (SiliconFlow, Z.AI GLM-Flash, Kilo, OpenCode Zen, baidu …) and a $10 OpenRouter top-up unlocking +24M/mo — surfaced separately so they never inflate the headline. Live used/remaining on /dashboard/free-tiers."/>

 > Animated summary of the live `/dashboard/free-tiers` page. Full methodology (pool dedupe, credit tiers, provider terms): **[docs/reference/FREE_TIERS.md](docs/reference/FREE_TIERS.md)**.
 >
@@ -61,14 +61,14 @@

 <div align="center">

-|                           | v3.8.49 |        **v3.8.50**        | `v3.8.51+`  |
-| ------------------------- | :-----: | :-----------------------: | :---------: |
-| 🌐 Providers              |   290   |          **350**          | more queued |
-| 🧠 Unique chat model IDs  |  1185   |         **1312**          |      —      |
-| 🖼️ Modality Bridge        |    —    | 🆕 vision + audio + video |      —      |
-| 📡 Radar free catalog     |    —    |         🆕 opt-in         |      —      |
-| ⚖️ Quota-aware scheduling |    —    |      🆕 Quota-Share       |      —      |
-| 📊 Quota telemetry        |    —    |          🆕 live          |      —      |
+|                           | v3.8.49 | **v3.8.50** | `v3.8.51+`  |
+| ------------------------- | :-----: | :---------: | :---------: |
+| 🌐 Providers              |   290   |   **342**   | more queued |
+| 🧠 Documented models      |  1185   |  **1202**   |      —      |
+| 🖼️ Modality Bridge        |    —    |  🆕 vision  |    video    |
+| 📡 Radar free catalog     |    —    |  🆕 opt-in  |      —      |
+| ⚖️ Quota-aware scheduling |    —    |      —      |   🔭 next   |
+| 📊 Quota telemetry        |    —    |      —      |   🔭 next   |

 **→ [Roadmap](ROADMAP.md) — riding the rail to `v3.9.0 LTS`**

@@ -101,7 +101,7 @@
  <tr>
    <td align="right"><b>⚙️ Features</b></td>
    <td align="center"><a href="#-combos--the-flagship">🎯 Combos</a></td>
-    <td align="center"><a href="#-350-ai-providers--154-catalog-marked-free">🌐 Providers</a></td>
+    <td align="center"><a href="#-349-ai-providers--90-free">🌐 Providers</a></td>
    <td align="center"><a href="#-full-cli--a2a--mcp">🔌 CLI &amp; MCP</a></td>
  </tr>
  <tr>
@@ -126,7 +126,7 @@
    <td align="right"><b>📦 Project</b></td>
    <td align="center"><a href="#%EF%B8%8F-tech-stack">🛠️ Tech Stack</a></td>
    <td align="center"><a href="#-documentation">📖 Docs</a></td>
-    <td align="center"><a href="#-600-contributors">👥 Contributors</a></td>
+    <td align="center"><a href="#-500-contributors">👥 Contributors</a></td>
  </tr>
 </table>

@@ -210,7 +210,7 @@ curl http://localhost:20128/v1/chat/completions \

 </div>

-<img src="./docs/diagrams/promise-pillars.svg" width="100%" alt="The Promise — One endpoint and 350 providers. Automatic fallback keeps routing while another healthy target is available. Six pillars: resilient fallback across 350 providers · up to 95% token savings on eligible workloads · $0 to start with 90+ free tiers and 56 recurring/keyless free-forever providers · 35 CLI/agent integrations through one config · OpenAI, Claude, Gemini and Responses API compatibility at /v1 · production controls including circuit breakers, TLS stealth, MCP 110 tools, A2A, memory, guardrails, evals and 39,000+ static test declarations across 5,100+ tracked test files."/>
+<img src="./docs/diagrams/promise-pillars.svg" width="100%" alt="The Promise — One endpoint. 349 providers. Never stop building — OmniRoute picks the cheapest one that works. Six pillars: Never hit limits (auto-fallback across 349 providers in milliseconds, zero downtime) · Save up to 95% tokens (RTK + Caveman stacked compression cuts 15–95%, ~89% avg on tool-heavy sessions) · $0 to start (90+ free tiers, 56 free forever — no card needed) · Every tool works (33 coding agents through one config) · One endpoint (OpenAI ↔ Claude ↔ Gemini ↔ Responses API at /v1) · Production-grade (circuit breakers, TLS stealth, MCP 110 tools, A2A, memory, guardrails, evals — 25,000+ tests)."/>

 <br/>
 <br/>
@@ -225,7 +225,7 @@ curl http://localhost:20128/v1/chat/completions \

 <div align="center">

-<img src="./docs/diagrams/tier-cascade.svg" width="100%" alt="OmniRoute request flow: your IDE or CLI (Claude Code, Cursor, Cline…) calls one local endpoint (http://localhost:20128/v1); the OmniRoute Smart Router (RTK + Caveman compression, 19 routing strategies, circuit breakers, TLS stealth, MCP, A2A, guardrails) can fall back across 4 provider tiers while an eligible healthy target remains — Tier 1 Subscription, Tier 2 API Key, Tier 3 Cheap and Tier 4 Free."/>
+<img src="./docs/diagrams/tier-cascade.svg" width="100%" alt="OmniRoute request flow: your IDE or CLI (Claude Code, Cursor, Cline…) calls one local endpoint (http://localhost:20128/v1); the OmniRoute Smart Router (RTK + Caveman compression, 19 routing strategies, circuit breakers, TLS stealth, MCP, A2A, guardrails) auto-falls back across 4 provider tiers — Tier 1 Subscription (Claude Code, Codex, Copilot), quota out? Tier 2 API Key (DeepSeek, Groq, xAI), budget hit? Tier 3 Cheap (GLM $0.5, MiniMax $0.2), budget hit? Tier 4 Free (Kiro, Qoder, Pollinations) — always on."/>

 </div>

@@ -318,7 +318,7 @@ curl http://localhost:20128/v1/chat/completions \

 <img src="./docs/diagrams/strategies-grid.svg" width="100%" alt="All 19 combo routing strategies animated — one tile per strategy: priority, fill-first, weighted, round-robin, p2c, least-used, random, strict-random, cost-optimized, headroom, reset-window, reset-aware, context-relay, context-optimized, cache-optimized, lkgp, auto, fusion, pipeline. See the table above for what each one does."/>

-> A **combo** is a chain of models OmniRoute routes across **automatically**. If quota runs out, a provider fails, or costs spike, the combo can move to the next eligible healthy model. 🛡️
+> A **combo** is a chain of models OmniRoute routes across **automatically**. Quota runs out, a provider fails, or costs spike — the combo silently slides to the next model. **This is what makes OmniRoute unbreakable.** 🛡️

 ### ⚡ Zero-config — just use `auto`

@@ -429,7 +429,7 @@ All **19** strategies — mix & match per combo step:
  <tr>
    <td align="center">17</td>
    <td nowrap><code>auto</code></td>
-    <td>15-factor live scoring across every connection 🤖</td>
+    <td>14-factor live scoring across every connection 🤖</td>
  </tr>
  <tr>
    <td align="center">18</td>
@@ -443,7 +443,7 @@ All **19** strategies — mix & match per combo step:
  </tr>
 </table>

-<sub>The Auto-Combo engine scores every candidate on **15 factors** (health, quota, cost, latency, task fit, quality, session availability…) — see [`docs/routing/AUTO-COMBO.md`](docs/routing/AUTO-COMBO.md).</sub>
+<sub>The Auto-Combo engine scores every candidate on **14 factors** (health, quota, cost, latency, success rate, freshness…) — see [`docs/routing/AUTO-COMBO.md`](docs/routing/AUTO-COMBO.md).</sub>

 ##

@@ -461,7 +461,7 @@ All **19** strategies — mix & match per combo step:

 </div>

-<img src="./docs/diagrams/comparison-table.svg" width="100%" alt="What sets OmniRoute apart — a dated feature snapshot vs 9router, OpenRouter, CLIProxyAPI and LiteLLM across 13 capabilities. OmniRoute: 350 providers, 90+ free tiers built in, 19 routing strategies, 12-engine token compression, built-in MCP server with 110 tools, A2A agent protocol, persistent memory, guardrails, cloud agents, TLS fingerprint stealth, Desktop/Termux/PWA and 43 i18n UI locales. OmniRoute is MIT-licensed and self-hostable. Competitor capabilities and counts may change; see the linked methodology."/>
+<img src="./docs/diagrams/comparison-table.svg" width="100%" alt="What sets OmniRoute apart — comparison table vs 9router, OpenRouter, CLIProxyAPI and LiteLLM across 13 capabilities. OmniRoute: 349 providers, 90+ free providers built-in, 19 routing strategies, 12-engine token compression, built-in MCP server with 110 tools, A2A agent protocol, persistent memory, guardrails, cloud agents, TLS fingerprint stealth, Desktop/Termux/PWA, 43 i18n UI locales, 100% MIT self-hosted. OmniRoute is the only one with the full set; competitors show a mix of checks, partials and crosses. Verified from each project&apos;s docs."/>

 <sub>📊 Full methodology &amp; per-feature detail vs 9router, OpenRouter, CLIProxyAPI &amp; LiteLLM → [`docs/comparison/OMNIROUTE_VS_ALTERNATIVES.md`](docs/comparison/OMNIROUTE_VS_ALTERNATIVES.md)</sub>

@@ -517,9 +517,9 @@ Pix copia-e-cola:

 ## 📡 OmniRoute Radar

-The main free-tier headline remains **~1.51B tokens/month** from the documented,
+The main free-tier headline remains **~1.53B tokens/month** from the documented,
 pool-deduplicated catalog above. Temporary provider signup credits can separately lift the first
-month to **~2.13B**. Radar is an optional, signed catalog overlay for people who want fresher
+month to **~2.15B**. Radar is an optional, signed catalog overlay for people who want fresher
 free-model availability between OmniRoute releases; the community catalog and every existing free
 feature remain free.

@@ -548,7 +548,7 @@ the current catalog at **[radar.omniroute.online/planos](https://radar.omniroute
 - **🗜️ Compression hardening** — default-on inflation guard, Caveman packs for DE / FR / JA + Chinese (wényán), RTK filters for Gradle & .NET. → [Compression](docs/compression/COMPRESSION_ENGINES.md)
 - **💸 Honest flat-rate cost** — subscription / coding-plan providers read **$0** in cost analytics; budget, quota & routing keep estimating. → [API Reference](docs/reference/API_REFERENCE.md)
 - **⚖️ Quota-Share routing** — split a shared account's quota fairly across pooled keys, work-conserving so idle slices are lent out. → [Resilience Guide](docs/architecture/RESILIENCE_GUIDE.md)
- **🤖 One-command CLI/agent setup** — 12 registered `setup-*` commands; `omniroute run` launches 7 CLIs (Claude Code, Codex, Aider, Goose, OpenCode, Qwen Code, Gemini CLI); `omniroute configure` supports 9 targets with an interactive provider+model picker and per-context favorites. → [CLI Integrations](docs/guides/CLI-INTEGRATIONS.md)
+- **🤖 One-command CLI/agent setup** — `setup-*` configures 12+ coding tools; `omniroute run` launches 7 CLIs (Claude Code, Codex, Aider, Goose, OpenCode, Qwen Code, Gemini CLI) with zero config written; `omniroute configure` is an interactive provider+model picker with per-context favorites. → [CLI Integrations](docs/guides/CLI-INTEGRATIONS.md)
 - **🛰️ Remote mode** — drive a remote OmniRoute with scoped tokens (`connect` / `contexts` / `tokens`) + an `antigravity` OAuth helper for VPS installs. → [Remote Mode](docs/guides/REMOTE-MODE.md)
 - **🧭 Smarter auto-routing** — `auto/<category>:<tier>` combos, **Fusion** (model panel + judge), task-aware routing, per-request model / mode / USD-budget overrides. → [Auto-Combo](docs/routing/AUTO-COMBO.md)
 - **🗜️ Pluggable compression** — 12 composable engines + Compression Studios: LLMLingua-2, two-tier Ultra, omniglyph, per-step fidelity gate, GCF v3.2, drag-reorder editor. → [Compression](docs/compression/COMPRESSION_ENGINES.md)
@@ -612,7 +612,7 @@ the current catalog at **[radar.omniroute.online/planos](https://radar.omniroute
 <b>＋ also works with</b> · Kiro · Command Code · Antigravity · Windsurf · AMP · <b>any OpenAI-compatible tool</b>
 </div>

-<sub>📖 Per-tool setup for all 35 tools (26 CLI Code's + 9 CLI Agents) → [`docs/reference/CLI-TOOLS.md`](docs/reference/CLI-TOOLS.md) · 🧩 OpenCode plugin → [`@omniroute/opencode-provider`](https://www.npmjs.com/package/@omniroute/opencode-provider)</sub>
+<sub>📖 Per-tool setup for all 34 tools (26 CLI Code's + 8 CLI Agents) → [`docs/reference/CLI-TOOLS.md`](docs/reference/CLI-TOOLS.md) · 🧩 OpenCode plugin → [`@omniroute/opencode-provider`](https://www.npmjs.com/package/@omniroute/opencode-provider)</sub>

 </div>

@@ -642,11 +642,11 @@ of your shell history. → [CLI Integrations](docs/guides/CLI-INTEGRATIONS.md)

 <div align="center">

-## 🌐 350 AI Providers — 154 Catalog-Marked Free
+## 🌐 349 AI Providers — 90+ Free

 </div>

-> **350 registered providers** across the canonical chat, media, search, local, cloud-agent and system collections, including **154 carrying `hasFree: true` discovery metadata**. The chat model registry covers **268 providers / 2,566 distinct provider-model pairs / 1,312 raw model IDs**; the separate free-budget catalog has **455 per-model rows**, **40 recurring pools** and **56 recurring/keyless free-forever providers**. These are different denominators by design; definitions and pool-deduped calculations live in the [Provider Reference](docs/reference/PROVIDER_REFERENCE.md) and [Free Tiers](docs/reference/FREE_TIERS.md).
+> The most complete catalog of any open-source router: **349 providers**, **90+ with a free tier**, **56 free forever**.

 <div align="center">

@@ -679,7 +679,7 @@ of your shell history. → [CLI Integrations](docs/guides/CLI-INTEGRATIONS.md)
  </tr>
 </table>

-<sub>…and 330+ more — every icon resolves live from the dashboard's provider catalog. 📖 [Provider Reference](docs/reference/PROVIDER_REFERENCE.md)</sub>
+<sub>…and 220+ more — every icon resolves live from the dashboard's provider catalog. 📖 [Provider Reference](docs/reference/PROVIDER_REFERENCE.md)</sub>

 <br/>

@@ -769,7 +769,7 @@ From inside the editor: open the **Extensions** view, search **"OmniRoute"**, cl

 </div>

-<img src="./docs/diagrams/privacy-local.svg" width="100%" alt="Private and local-first — OmniRoute's gateway and control plane run on your machine. Prompts are sent to the upstream provider selected for each request; OmniRoute adds no hosted prompt-processing hop and telemetry is disabled by default. Credentials are encrypted at rest with AES-256-GCM; controls include API-key scoping, IP filtering, rate limits, prompt-injection guards, upstream-header scrubbing, opt-in PII redaction, sanitized errors and a local SQLite audit trail. OmniRoute is MIT-licensed and self-hostable."/>
+<img src="./docs/diagrams/privacy-local.svg" width="100%" alt="Private and local-first — your keys, your machine, your data; OmniRoute is a local proxy that never phones home. Eleven guarantees: runs 100% on your hardware (0 cloud hops), zero telemetry by default, credentials encrypted at rest (AES-256-GCM), no account or sign-up, hardened gateway (API-key scoping, IP filtering, rate limits, prompt-injection guard), loopback-only process routes, upstream header scrubbing, strictly opt-in PII redaction, sanitized errors that never leak internals, a local audit trail in your own SQLite, and MIT-licensed fully open-source code."/>

 <sub>📖 [Authorization](docs/architecture/AUTHZ_GUIDE.md) · [Guardrails](docs/security/GUARDRAILS.md) · [Compliance](docs/security/COMPLIANCE.md)</sub>

@@ -810,7 +810,7 @@ Tokens are scoped `read` / `write` / `admin`; process-spawning routes stay loopb

 <div align="left">

-<img src="./docs/diagrams/cli-terminal.svg" width="50%" alt="Animated terminal demoing the OmniRoute CLI — omniroute providers list, omniroute combo list and omniroute health — cycling over the 85-command top-level surface: providers · oauth · keys · combo · nodes · models · cache · compression · cost · usage · quota · health · resilience · telemetry · logs · audit · mcp · a2a · cloud · memory · skills · eval · tunnel · backup · sync · webhooks · policy · pricing · translator · simulate …"/>
+<img src="./docs/diagrams/cli-terminal.svg" width="50%" alt="Animated terminal demoing the OmniRoute CLI — omniroute providers list, omniroute combo list, omniroute health — cycling over the 80+ command surface: providers · oauth · keys · combo · nodes · models · cache · compression · cost · usage · quota · health · resilience · telemetry · logs · audit · mcp · a2a · cloud · memory · skills · eval · tunnel · backup · sync · webhooks · policy · pricing · translator · simulate …"/>

 </div>

@@ -846,7 +846,7 @@ claude mcp add-server omniroute --type http --url http://localhost:20128/api/mcp

 ### 📖 How it works — pipeline, architecture & savings math

-<img src="./docs/diagrams/compression-pipeline.svg" width="100%" alt="OmniRoute compression pipeline: an illustrative 10,000-token client request passes through 12 composable engines — Session-Dedup, CCR, Lite, RTK, Responses Tool Output, Headroom, Relevance, Caveman, Aggressive, LLMLingua-2, Ultra and OmniGlyph — and can reach the provider at about 1,080 tokens in the documented stacked example. Structured content is protected by preservation guards and per-step fidelity gates; explicit lossy or experimental modes may transform eligible content."/>
+<img src="./docs/diagrams/compression-pipeline.svg" width="100%" alt="OmniRoute compression pipeline: a client request of 10,000 tokens passes through 12 stacked engines — Session-Dedup, CCR, Lite, RTK, Responses Tool Output, Headroom, Relevance, Caveman, Aggressive, LLMLingua-2, Ultra, OmniGlyph — and reaches the provider at about 1,080 tokens, up to 95% saved. Code, URLs and JSON are always preserved byte-perfect."/>

 Default stacked combo runs `RTK → Caveman`. When both act on the same tool/context payload, savings compound:

@@ -1013,7 +1013,6 @@ Full table: [Docker Guide — runtime RAM](docs/guides/DOCKER_GUIDE.md#runtime-r
 **🥟 Bun**

 Standard `bun install` and global installation (`bun install -g omniroute`) are supported via Bun runtime detection:
-
 - **Built-in `bun:sqlite`**: OmniRoute uses Bun's built-in `bun:sqlite` driver when running under Bun, falling back to `better-sqlite3` on Node.js or `sql.js`.
 - **Automatic Webpack bundler selection**: Development (`bun run dev`) and production builds (`bun run build`) automatically detect Bun and disable Turbopack in favor of Webpack to prevent native V8 binding incompatibilities.
 - **Dedicated Bun Dockerfile**: Multi-stage `Dockerfile.bun` for native Bun production deployments (`docker build -f Dockerfile.bun -t omniroute:bun .`).
@@ -1106,7 +1105,7 @@ same process on one port, so there is no separate CLI-only package today.

 <div align="center">

-<sub>Snapshot do painel em 2026-08-24 · Catálogo bruto: YT 809 | TT 137 | IG 124 · Frescor (dias): YT 1 | TT 21 | IG 22</sub>
+<sub>Dados de cobertura social em 2026-08-17 · YT: 741 | TT: 137 | IG: 124 · Frescor (dias): YT 0 · TT 14 · IG 15</sub>

 <table>
  <tr>
@@ -1115,52 +1114,52 @@ same process on one port, so there is no separate CLI-only package today.
        <img src="https://placehold.co/320x180/111827/FFFFFF?text=Instagram+Reel+%7C+nick_saraev&font=montserrat&bold=true" alt="Instagram Reel" width="300"/>
      </a><br/>
      <b>🎬 #1 — Instagram</b><br/>
-      <sub>nick_saraev — 3,042,474 views</sub>
-    </td>
-    <td align="center" width="320">
-      <a href="https://www.instagram.com/reel/DaSs65mMrHk/">
-        <img src="https://placehold.co/320x180/111827/FFFFFF?text=Instagram+Reel+%7C+theopenstack&font=montserrat&bold=true" alt="Instagram Reel — theopenstack" width="300"/>
-      </a><br/>
-      <b>🎬 #2 — Instagram</b><br/>
-      <sub>theopenstack — 692,419 views</sub>
-    </td>
-    <td align="center" width="320">
-      <a href="https://www.tiktok.com/@milesreevesai/video/7667980059189366019">
-        <img src="https://placehold.co/320x180/111827/FFFFFF?text=TikTok+%7C+milesreevesai&font=montserrat&bold=true" alt="TikTok — milesreevesai" width="300"/>
-      </a><br/>
-      <b>🎬 #3 — TikTok</b><br/>
-      <sub>milesreevesai — 620,400 views</sub>
+      <sub>nick_saraev — 1,628,910 views</sub>
    </td>
    <td align="center" width="320">
      <a href="https://www.youtube.com/watch?v=QucgvbO5gsM">
        <img src="https://img.youtube.com/vi/QucgvbO5gsM/maxresdefault.jpg" alt="YouTube — Vaibhav Sisinty" width="300"/>
      </a><br/>
-      <b>🎬 #4 — YouTube</b><br/>
-      <sub>Vaibhav Sisinty — 391,109 views</sub>
+      <b>🎬 #2 — YouTube</b><br/>
+      <sub>Vaibhav Sisinty — 373,084 views</sub>
    </td>
    <td align="center" width="320">
-      <a href="https://www.instagram.com/reel/DbIt9AjK7-U/">
-        <img src="https://placehold.co/320x180/111827/FFFFFF?text=Instagram+Reel+%7C+buildwithai.club&font=montserrat&bold=true" alt="Instagram Reel — buildwithai.club" width="300"/>
+      <a href="https://www.youtube.com/shorts/fZIBK_4fKq8">
+        <img src="https://img.youtube.com/vi/fZIBK_4fKq8/maxresdefault.jpg" alt="YouTube Shorts" width="300"/>
      </a><br/>
-      <b>🎬 #5 — Instagram</b><br/>
-      <sub>buildwithai.club — 347,652 views</sub>
+      <b>🎬 #3 — YouTube Shorts</b><br/>
+      <sub>Nick Automates — 207,714 views</sub>
+    </td>
+    <td align="center" width="320">
+      <a href="https://www.tiktok.com/@milesreevesai/video/7667980059189366019">
+        <img src="https://placehold.co/320x180/111827/FFFFFF?text=TikTok+Top+1&font=montserrat&bold=true" alt="TikTok Thumbnail" width="300"/>
+      </a><br/>
+      <b>🎬 #4 — TikTok</b><br/>
+      <sub>milesreevesai — 620,400 views</sub>
+    </td>
+    <td align="center" width="320">
+      <a href="https://www.youtube.com/watch?v=LkP6ocAoQkk">
+        <img src="https://img.youtube.com/vi/LkP6ocAoQkk/maxresdefault.jpg" alt="Valency Labs" width="300"/>
+      </a><br/>
+      <b>🎬 #5 — YouTube</b><br/>
+      <sub>Valency Labs — 135,974 views</sub>
    </td>
  </tr>
 </table>

 </div>

-**Ranking completo (URLs canônicas deduplicadas, `v > 0`, maior alcance):**
+**Ranking completo (`v > 0`, maior alcance):**

-| #1                                                                                     | #2                                                                                    | #3                                                                                                      | #4                                                                                     | #5                                                                                        |
-| -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
-| [nick_saraev — Instagram](https://www.instagram.com/reel/Da8ZthUPK98/) — **3,042,474** | [theopenstack — Instagram](https://www.instagram.com/reel/DaSs65mMrHk/) — **692,419** | [milesreevesai — TikTok](https://www.tiktok.com/@milesreevesai/video/7667980059189366019) — **620,400** | [Vaibhav Sisinty — YouTube](https://www.youtube.com/watch?v=QucgvbO5gsM) — **391,109** | [buildwithai.club — Instagram](https://www.instagram.com/reel/DbIt9AjK7-U/) — **347,652** |
+| #1                                                                                     | #2                                                                                                      | #3                                                                                     | #4                                                                                          | #5                                                                                          |
+| -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
+| [nick_saraev — Instagram](https://www.instagram.com/reel/Da8ZthUPK98/) — **1,628,910** | [milesreevesai — TikTok](https://www.tiktok.com/@milesreevesai/video/7667980059189366019) — **620,400** | [Vaibhav Sisinty — YouTube](https://www.youtube.com/watch?v=QucgvbO5gsM) — **373,084** | [Nick Automates — YouTube Shorts](https://www.youtube.com/shorts/fZIBK_4fKq8) — **207,714** | [midudev — TikTok](https://www.tiktok.com/@midudev/video/7664636453544152342) — **177,800** |

-| #6                                                                                  | #7                                                                                      | #8                                                                                          | #9                                                                                        | #10                                                                                         |
-| ----------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
-| [nivedan.ai — Instagram](https://www.instagram.com/reel/DbIrCksJiqq/) — **331,973** | [vaibhavsisinty — Instagram](https://www.instagram.com/reel/Dae05TSAK1l/) — **263,744** | [Nick Automates — YouTube Shorts](https://www.youtube.com/shorts/fZIBK_4fKq8) — **218,174** | [theroshankrishna — Instagram](https://www.instagram.com/reel/Dapjs58z0P0/) — **186,786** | [midudev — TikTok](https://www.tiktok.com/@midudev/video/7664636453544152342) — **177,800** |
+| #6                                                                                    | #7                                                                                                  | #8                                                                                  | #9                                                                           | #10                                                                                    |
+| ------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- |
+| [theopenstack — Instagram](https://www.instagram.com/reel/DaSs65mMrHk/) — **155,453** | [t.ghoush.ai — TikTok](https://www.tiktok.com/@t.ghoush.ai/video/7669497680527248656) — **152,800** | [Valency Labs — YouTube](https://www.youtube.com/watch?v=LkP6ocAoQkk) — **135,974** | [Asati — YouTube](https://www.youtube.com/watch?v=JjPtJcqwhqg) — **126,130** | [Vaibhav Sisinty — YouTube](https://www.youtube.com/watch?v=NuNDpeZYQ28) — **122,672** |

-Métricas canônicas em 2026-08-24: **1.029 vídeos únicos** · **11.132.922 visualizações conhecidas** (`v > 0`) · **639 canais/perfis por rede**. O painel bruto contém 1.070 linhas; 41 duplicatas do Instagram foram normalizadas pela URL canônica, mantendo a maior contagem por vídeo.
+Métricas de validação: 1002 vídeos rastreados · 7,069,190 visualizações conhecidas · 595 perfis/canais · 13+ idiomas · 13+ criadores.

 > 🎬 **Made a video about OmniRoute?** Open an [issue](https://github.com/diegosouzapw/OmniRoute/issues/new) or [discussion](https://github.com/diegosouzapw/OmniRoute/discussions) with the link — we'll feature it here.

@@ -1212,7 +1211,7 @@ Métricas canônicas em 2026-08-24: **1.029 vídeos únicos** · **11.132.922 vi
  <tr><td nowrap><b>Stealth</b></td><td>wreq-js — JA3 / JA4 TLS fingerprint impersonation, 3-level proxy</td></tr>
  <tr><td nowrap><b>Resilience</b></td><td>Circuit breaker, exponential backoff, anti-thundering-herd, auto-combo self-healing</td></tr>
  <tr><td nowrap><b>Logging</b></td><td>pino — structured JSON logs with request context</td></tr>
-  <tr><td nowrap><b>Testing</b></td><td>Node.js test runner + Vitest — <b>39,000+ static test declarations</b> across 5,100+ tracked test files (unit, integration, E2E, security, ecosystem)</td></tr>
+  <tr><td nowrap><b>Testing</b></td><td>Node.js test runner + Vitest — <b>25,000+ test cases</b> across 3,300+ files (unit, integration, E2E, security, ecosystem)</td></tr>
  <tr><td nowrap><b>Platforms</b></td><td>Desktop (Electron) · Android (Termux) · PWA (any browser)</td></tr>
  <tr><td nowrap><b>CI/CD</b></td><td>GitHub Actions — auto npm publish + Docker Hub on release</td></tr>
  <tr><td nowrap><b>Links</b></td><td><a href="https://omniroute.online">Website</a> · <a href="https://www.npmjs.com/package/omniroute">npm</a> · <a href="https://hub.docker.com/r/diegosouzapw/omniroute">Docker Hub</a></td></tr>
@@ -1263,9 +1262,9 @@ Métricas canônicas em 2026-08-24: **1.029 vídeos únicos** · **11.132.922 vi
  <tr><td nowrap><b><a href="docs/compression/COMPRESSION_RULES_FORMAT.md">Compression Rules Format</a></b></td><td>JSON rule-pack schemas for Caveman and RTK filters</td></tr>
  <tr><td nowrap><b><a href="docs/compression/COMPRESSION_LANGUAGE_PACKS.md">Compression Language Packs</a></b></td><td>Language detection and Caveman rule-pack authoring</td></tr>
  <tr><td nowrap><b><a href="docs/architecture/RESILIENCE_GUIDE.md">Resilience Guide</a></b></td><td>Circuit breakers, cooldowns, queue, anti-thundering herd, TLS spoofing</td></tr>
-  <tr><td nowrap><b><a href="docs/routing/AUTO-COMBO.md">Auto-Combo Engine</a></b></td><td>15-factor scoring, mode packs, self-healing</td></tr>
+  <tr><td nowrap><b><a href="docs/routing/AUTO-COMBO.md">Auto-Combo Engine</a></b></td><td>14-factor scoring, mode packs, self-healing</td></tr>
  <tr><td nowrap><b><a href="docs/ops/PROXY_GUIDE.md">Proxy Guide</a></b></td><td>3-level proxy system, 1proxy marketplace, registry CRUD</td></tr>
-  <tr><td nowrap><b><a href="docs/reference/FREE_TIERS.md">Free Tiers</a></b></td><td>Consolidated directory: 40 documented recurring pools / 455 cataloged free-tier entries</td></tr>
+  <tr><td nowrap><b><a href="docs/reference/FREE_TIERS.md">Free Tiers</a></b></td><td>90+ free providers consolidated directory (42 documented token pools / 495 models)</td></tr>
  <tr><td nowrap><b><a href="docs/guides/FEATURES.md">Features Gallery</a></b></td><td>Visual dashboard tour with screenshots</td></tr>
  <tr><td nowrap><b><a href="docs/architecture/CODEBASE_DOCUMENTATION.md">Codebase Documentation</a></b></td><td>Beginner-friendly codebase walkthrough</td></tr>
 </table>
@@ -1276,7 +1275,7 @@ Métricas canônicas em 2026-08-24: **1.029 vídeos únicos** · **11.132.922 vi
  <tr><th align="left">Document</th><th align="left">Description</th></tr>
  <tr><td nowrap><b><a href="docs/reference/API_REFERENCE.md">API Reference</a></b></td><td>All endpoints with examples</td></tr>
  <tr><td nowrap><b><a href="docs/openapi.yaml">OpenAPI Spec</a></b></td><td>OpenAPI 3.0 specification</td></tr>
-  <tr><td nowrap><b><a href="open-sse/mcp-server/README.md">MCP Server</a></b></td><td>110 MCP tools, IDE configs, Python/TS/Go clients</td></tr>
+  <tr><td nowrap><b><a href="open-sse/mcp-server/README.md">MCP Server</a></b></td><td>109 MCP tools, IDE configs, Python/TS/Go clients</td></tr>
  <tr><td nowrap><b><a href="docs/frameworks/MCP-SERVER.md">MCP Server Guide</a></b></td><td>MCP installation, transports, and tool reference</td></tr>
  <tr><td nowrap><b><a href="src/lib/a2a/README.md">A2A Server</a></b></td><td>JSON-RPC 2.0 protocol, skills, streaming, task mgmt</td></tr>
  <tr><td nowrap><b><a href="docs/frameworks/A2A-SERVER.md">A2A Server Guide</a></b></td><td>A2A agent card, tasks, skills, and streaming</td></tr>
@@ -1292,7 +1291,7 @@ Métricas canônicas em 2026-08-24: **1.029 vídeos únicos** · **11.132.922 vi
  <tr><td nowrap><b><a href="SECURITY.md">Security Policy</a></b></td><td>Vulnerability reporting and security practices</td></tr>
  <tr><td nowrap><b><a href="docs/guides/I18N.md">i18n Guide</a></b></td><td>43-language support, translation workflow, RTL</td></tr>
  <tr><td nowrap><b><a href="docs/ops/RELEASE_CHECKLIST.md">Release Checklist</a></b></td><td>Pre-release validation steps</td></tr>
-  <tr><td nowrap><b><a href="docs/ops/COVERAGE_PLAN.md">Coverage Plan</a></b></td><td>Test coverage strategy for 39,000+ static test declarations across 5,100+ tracked test files</td></tr>
+  <tr><td nowrap><b><a href="docs/ops/COVERAGE_PLAN.md">Coverage Plan</a></b></td><td>Test coverage strategy and 25,000+ test suite</td></tr>
 </table>

 <br/>
@@ -1303,123 +1302,93 @@ Métricas canônicas em 2026-08-24: **1.029 vídeos únicos** · **11.132.922 vi

 > OmniRoute is shaped by a passionate open-source community. These individuals have made exceptional contributions that directly impact the quality, stability, and reach of the project. **Thank you.**

-### External contributors by merged pull requests
-
-<table>
-  <tr><th align="center">Rank</th><th align="left">Contributor</th><th align="center">Merged PRs</th><th align="right">~Changed lines</th></tr>
-  <tr><td align="center">1</td><td align="left"><a href="https://github.com/backryun"><b>backryun</b></a></td><td align="center">190</td><td align="right">227,977</td></tr>
-  <tr><td align="center">2</td><td align="left"><a href="https://github.com/oyi77"><b>oyi77</b></a></td><td align="center">180</td><td align="right">407,678</td></tr>
-  <tr><td align="center">3</td><td align="left"><a href="https://github.com/rdself"><b>rdself</b></a></td><td align="center">145</td><td align="right">80,663</td></tr>
-  <tr><td align="center">4</td><td align="left"><a href="https://github.com/JxnLexn"><b>JxnLexn</b></a></td><td align="center">128</td><td align="right">387,049</td></tr>
-  <tr><td align="center">5</td><td align="left"><a href="https://github.com/KooshaPari"><b>KooshaPari</b></a></td><td align="center">101</td><td align="right">125,747</td></tr>
-  <tr><td align="center">6</td><td align="left"><a href="https://github.com/herjarsa"><b>herjarsa</b></a></td><td align="center">88</td><td align="right">230,872</td></tr>
-  <tr><td align="center">7</td><td align="left"><a href="https://github.com/RaviTharuma"><b>RaviTharuma</b></a></td><td align="center">79</td><td align="right">55,106</td></tr>
-  <tr><td align="center">8</td><td align="left"><a href="https://github.com/maxmad64bis"><b>maxmad64bis</b></a></td><td align="center">69</td><td align="right">394,715</td></tr>
-  <tr><td align="center">9</td><td align="left"><a href="https://github.com/artickc"><b>artickc</b></a></td><td align="center">59</td><td align="right">33,260</td></tr>
-  <tr><td align="center">10</td><td align="left"><a href="https://github.com/HouMinXi"><b>HouMinXi</b></a></td><td align="center">51</td><td align="right">47,334</td></tr>
-  <tr><td align="center">10</td><td align="left"><a href="https://github.com/chirag127"><b>chirag127</b></a></td><td align="center">51</td><td align="right">5,153</td></tr>
-  <tr><td align="center">12</td><td align="left"><a href="https://github.com/xz-dev"><b>xz-dev</b></a></td><td align="center">50</td><td align="right">245,976</td></tr>
-  <tr><td align="center">13</td><td align="left"><a href="https://github.com/hartmark"><b>hartmark</b></a></td><td align="center">47</td><td align="right">52,185</td></tr>
-  <tr><td align="center">14</td><td align="left"><a href="https://github.com/rqzbeh"><b>rqzbeh</b></a></td><td align="center">39</td><td align="right">143,181</td></tr>
-  <tr><td align="center">15</td><td align="left"><a href="https://github.com/dhaern"><b>dhaern</b></a></td><td align="center">34</td><td align="right">19,559</td></tr>
-  <tr><td align="center">16</td><td align="left"><a href="https://github.com/Dingding-leo"><b>Dingding-leo</b></a></td><td align="center">33</td><td align="right">1,986</td></tr>
-  <tr><td align="center">17</td><td align="left"><a href="https://github.com/NomenAK"><b>NomenAK</b></a></td><td align="center">32</td><td align="right">13,854</td></tr>
-  <tr><td align="center">18</td><td align="left"><a href="https://github.com/MumuTW"><b>MumuTW</b></a></td><td align="center">30</td><td align="right">16,953</td></tr>
-  <tr><td align="center">19</td><td align="left"><a href="https://github.com/benzntech"><b>benzntech</b></a></td><td align="center">29</td><td align="right">11,641</td></tr>
-  <tr><td align="center">20</td><td align="left"><a href="https://github.com/pacocartones"><b>pacocartones</b></a></td><td align="center">24</td><td align="right">9,331</td></tr>
-  <tr><td align="center">20</td><td align="left"><a href="https://github.com/Prudhvivuda"><b>Prudhvivuda</b></a></td><td align="center">24</td><td align="right">6,312</td></tr>
-</table>
-
-<sub>Frozen at live <code>release/v3.8.50</code> tip <code>dafb4ae808</code>, with merges through 2026-08-24 05:26:03 UTC. The paginated GitHub GraphQL census contains 5,911 merged PRs: 2,707 by the repository owner, 179 by Dependabot, and <b>3,025 external PRs from 535 distinct contributors</b>. “Changed lines” is GitHub additions + deletions and includes generated files, lockfiles, catalogs, translations and documentation; it is churn, not authored LOC. Ties at the cutoff are retained.</sub>
-
-### GitHub-attributed commits
-
 <table>
  <tr>
-    <td align="center" width="160">
-      <a href="https://github.com/backryun">
-        <img src="https://github.com/backryun.png" width="40" style="border-radius:50%" alt="backryun"/><br/>
-        <b>backryun</b>
-      </a><br/>
-      <sub>🥇 220 GitHub-attributed commits</sub>
-    </td>
    <td align="center" width="160">
      <a href="https://github.com/oyi77">
-        <img src="https://github.com/oyi77.png" width="40" style="border-radius:50%" alt="Paijo"/><br/>
-        <b>Paijo</b>
+        <img src="https://github.com/oyi77.png" width="40" style="border-radius:50%" alt="oyi77"/><br/>
+        <b>oyi77</b>
      </a><br/>
-      <sub>🥈 219 GitHub-attributed commits</sub>
+      <sub>🥇 213 commits • +114K lines</sub><br/>
+      <sub>Analytics engine, SQL aggregations,<br/>proxy marketplace, test coverage</sub>
    </td>
    <td align="center" width="160">
      <a href="https://github.com/rdself">
-        <img src="https://github.com/rdself.png" width="40" style="border-radius:50%" alt="Randi"/><br/>
-        <b>Randi</b>
+        <img src="https://github.com/rdself.png" width="40" style="border-radius:50%" alt="R.D. &amp; Randi"/><br/>
+        <b>R.D. &amp; Randi</b>
      </a><br/>
-      <sub>🥉 108 GitHub-attributed commits</sub>
-    </td>
-    <td align="center" width="160">
-      <a href="https://github.com/RaviTharuma">
-        <img src="https://github.com/RaviTharuma.png" width="40" style="border-radius:50%" alt="Ravi Tharuma"/><br/>
-        <b>Ravi Tharuma</b>
-      </a><br/>
-      <sub>🏅 81 GitHub-attributed commits</sub>
+      <sub>🥈 108 commits • +38K lines</sub><br/>
+      <sub>Endpoints page, tunnel integrations,<br/>Docker workflows, A2A status, compression UI</sub>
    </td>
    <td align="center" width="160">
      <a href="https://github.com/christopher-s">
-        <img src="https://github.com/christopher-s.png" width="40" style="border-radius:50%" alt="Chris"/><br/>
-        <b>Chris</b>
+        <img src="https://github.com/christopher-s.png" width="40" style="border-radius:50%" alt="Chris Staley"/><br/>
+        <b>Chris Staley</b>
      </a><br/>
-      <sub>🏅 70 GitHub-attributed commits</sub>
-    </td>
-    <td align="center" width="160">
-      <a href="https://github.com/hartmark">
-        <img src="https://github.com/hartmark.png" width="40" style="border-radius:50%" alt="Markus Hartung"/><br/>
-        <b>Markus Hartung</b>
-      </a><br/>
-      <sub>🏅 69 GitHub-attributed commits · tied #6</sub>
-    </td>
-  </tr>
-  <tr>
-    <td align="center" width="160">
-      <a href="https://github.com/maxmad64bis">
-        <img src="https://github.com/maxmad64bis.png" width="40" style="border-radius:50%" alt="Dizzle"/><br/>
-        <b>Dizzle</b>
-      </a><br/>
-      <sub>🏅 69 GitHub-attributed commits · tied #6</sub>
-    </td>
-    <td align="center" width="160">
-      <a href="https://github.com/JxnLexn">
-        <img src="https://github.com/JxnLexn.png" width="40" style="border-radius:50%" alt="Jan Leon"/><br/>
-        <b>Jan Leon</b>
-      </a><br/>
-      <sub>🏅 64 GitHub-attributed commits</sub>
+      <sub>🥉 70 commits • +1.8K lines</sub><br/>
+      <sub>SSE stream hardening, Responses API,<br/>Gemini pagination, test regression fixes</sub>
    </td>
    <td align="center" width="160">
      <a href="https://github.com/zen0bit">
        <img src="https://github.com/zen0bit.png" width="40" style="border-radius:50%" alt="zenobit"/><br/>
        <b>zenobit</b>
      </a><br/>
-      <sub>🏅 62 GitHub-attributed commits</sub>
+      <sub>🏅 62 commits • +22K lines</sub><br/>
+      <sub>CI/CD pipeline, i18n for 33 languages,<br/>Void Linux package, platform fixes</sub>
    </td>
    <td align="center" width="160">
-      <a href="https://github.com/HouMinXi">
-        <img src="https://github.com/HouMinXi.png" width="40" style="border-radius:50%" alt="Bob.Hou"/><br/>
-        <b>Bob.Hou</b>
+      <a href="https://github.com/JxnLexn">
+        <img src="https://github.com/JxnLexn.png" width="40" style="border-radius:50%" alt="Jan Leon"/><br/>
+        <b>Jan Leon</b>
      </a><br/>
-      <sub>🏅 51 GitHub-attributed commits · tied #10</sub>
+      <sub>🏅 58 commits • +22K lines</sub><br/>
+      <sub>Reasoning-effort routing, proxy controls,<br/>quota visibility, Live Zone compression</sub>
+    </td>
+  </tr>
+  <tr>
+    <td align="center" width="160">
+      <a href="https://github.com/backryun">
+        <img src="https://github.com/backryun.png" width="40" style="border-radius:50%" alt="backryun"/><br/>
+        <b>backryun</b>
+      </a><br/>
+      <sub>🏅 53 commits • +70K lines</sub><br/>
+      <sub>Provider catalog curation — Perplexity, Kimi,<br/>Cerebras, Copilot, LMArena refreshes</sub>
    </td>
    <td align="center" width="160">
-      <a href="https://github.com/xz-dev">
-        <img src="https://github.com/xz-dev.png" width="40" style="border-radius:50%" alt="Xiangzhe"/><br/>
-        <b>Xiangzhe</b>
+      <a href="https://github.com/chirag127">
+        <img src="https://github.com/chirag127.png" width="40" style="border-radius:50%" alt="Chirag Singhal"/><br/>
+        <b>Chirag Singhal</b>
      </a><br/>
-      <sub>🏅 51 GitHub-attributed commits · tied #10</sub>
+      <sub>🏅 46 commits • +4.8K lines</sub><br/>
+      <sub>Error sanitization, MITM prefill fix,<br/>fusion judge, breaker/429 correctness</sub>
+    </td>
+    <td align="center" width="160">
+      <a href="https://github.com/kfiramar">
+        <img src="https://github.com/kfiramar.png" width="40" style="border-radius:50%" alt="kfiramar"/><br/>
+        <b>kfiramar</b>
+      </a><br/>
+      <sub>🏅 38 commits • +1.7K lines</sub><br/>
+      <sub>Codex websocket + passthrough, auth/onboarding,<br/>Electron hardening, DB migrations</sub>
+    </td>
+    <td align="center" width="160">
+      <a href="https://github.com/benzntech">
+        <img src="https://github.com/benzntech.png" width="40" style="border-radius:50%" alt="Benson K B"/><br/>
+        <b>Benson K B</b>
+      </a><br/>
+      <sub>🏅 28 commits • +9.2K lines</sub><br/>
+      <sub>Electron desktop app, auto-updater,<br/>release build workflows, cross-platform CI</sub>
+    </td>
+    <td align="center" width="160">
+      <a href="https://github.com/herjarsa">
+        <img src="https://github.com/herjarsa.png" width="40" style="border-radius:50%" alt="Hernan J. Ardila"/><br/>
+        <b>Hernan J. Ardila</b>
+      </a><br/>
+      <sub>🏅 25 commits • +174K lines</sub><br/>
+      <sub>Zero-latency combos, vision-bridge auto-routing,<br/>catalog context-length, resilience 429 hints</sub>
    </td>
  </tr>
 </table>

-<sub>Rechecked at 2026-08-24 06:14:31 UTC: GitHub-attributed commits reported by the repository Contributors API for the <code>release/v3.8.50</code> default branch. The API returned 525 identities (415 users, 2 bots, 108 anonymous); this table excludes the maintainer, bots and anonymous identities and retains competition ties. It is distinct from both the merged-PR ranking above and the 639-person Git-metadata census below.</sub>
-
 > 🙏 These contributors' features, bug fixes, and infrastructure improvements are a **core part** of what makes OmniRoute reliable and feature-rich. Every pull request, every test case, and every i18n translation file matters. Open source is built by people like them.

 </div>
@@ -1436,48 +1405,25 @@ A heartfelt thank-you to the people who fund OmniRoute out of their own pocket

 <table>
  <tr>
-    <td align="center" width="180">
-      <a href="https://github.com/drewbitt">
-        <img src="https://github.com/drewbitt.png?size=140" width="72" style="border-radius:50%" alt="Andrew"/><br/>
-        <b>Andrew</b>
-      </a><br/>
-      <sub>💛 Active monthly sponsor</sub>
-    </td>
-    <td align="center" width="180">
-      <a href="https://github.com/psylligent">
-        <img src="https://github.com/psylligent.png?size=140" width="72" style="border-radius:50%" alt="Vlad I"/><br/>
-        <b>Vlad I</b>
-      </a><br/>
-      <sub>💛 Active monthly sponsor</sub>
-    </td>
-    <td align="center" width="180">
-      <a href="https://github.com/pacocartones">
-        <img src="https://github.com/pacocartones.png?size=140" width="72" style="border-radius:50%" alt="Paco Cartones"/><br/>
-        <b>Paco Cartones</b>
-      </a><br/>
-      <sub>💛 Active one-time sponsor</sub>
-    </td>
    <td align="center" width="180">
      <a href="https://github.com/igormorais123">
        <img src="https://github.com/igormorais123.png?size=140" width="72" style="border-radius:50%" alt="Professor Igor Morais Vasconcelos"/><br/>
        <b>Prof. Igor Morais</b>
      </a><br/>
-      <sub>💛 Past one-time supporter</sub>
+      <sub>💛 Sponsor</sub>
    </td>
    <td align="center" width="180">
      <a href="https://github.com/longtao77">
        <img src="https://github.com/longtao77.png?size=140" width="72" style="border-radius:50%" alt="longtao"/><br/>
        <b>longtao</b>
      </a><br/>
-      <sub>💛 Past one-time supporter</sub>
+      <sub>💛 Sponsor</sub>
    </td>
  </tr>
 </table>

 <sub>… and others who prefer to stay private 💛</sub>

-<sub>Public GitHub Sponsors revalidated on 2026-08-24. GitHub's <code>activeOnly</code> status determines the active labels above; previously disclosed public one-time supporters remain thanked, and private sponsors remain anonymous.</sub>
-
 <b><a href="https://github.com/sponsors/diegosouzapw">💖 Become a sponsor →</a></b> — every dollar keeps OmniRoute free and independent.

 </div>
@@ -1486,13 +1432,11 @@ A heartfelt thank-you to the people who fund OmniRoute out of their own pocket

 <div align="center">

-## 👥 600+ Contributors
+## 👥 320+ Contributors

 </div>

-[![Contributors](https://contrib.rocks/image?repo=diegosouzapw/OmniRoute&max=639&columns=20&anon=1)](https://github.com/diegosouzapw/OmniRoute/graphs/contributors)
-
-<sub>Audited on 2026-08-24 at frozen base <code>ac02c5b42f</code> and rechecked at live <code>release/v3.8.50</code> tip <code>dafb4ae808</code>: <b>639 normalized human Git identities</b> — 407 appear as commit authors (including the maintainer) and 232 only in explicit <code>Co-authored-by</code> trailers. The census normalizes GitHub noreply handles, excludes 26 bot/agent/service/placeholder identities, and does not merge ordinary email addresses merely because their display names match.</sub>
+[![Contributors](https://contrib.rocks/image?repo=diegosouzapw/OmniRoute&max=400&columns=20&anon=1)](https://github.com/diegosouzapw/OmniRoute/graphs/contributors)

 ### How to Contribute

@@ -1509,8 +1453,7 @@ See [CONTRIBUTING.md](CONTRIBUTING.md) for detailed guidelines.

 ```bash
 # Create a release — npm publish happens automatically
-VERSION=x.y.z
-gh release create "v${VERSION}" --title "v${VERSION}" --generate-notes
+gh release create v3.8.2 --title "v3.8.2" --generate-notes
 ```

 <br/>
@@ -1552,108 +1495,88 @@ gh release create "v${VERSION}" --title "v${VERSION}" --generate-notes

 OmniRoute stands on the shoulders of giants. It started as a fork of **[9router](https://github.com/decolua/9router)** and a TypeScript port of the Go project **[CLIProxyAPI](https://github.com/router-for-me/CLIProxyAPI)** — and from there, every subsystem below was inspired by an open-source project that got there first. Each one shaped a concrete piece of OmniRoute. This is our thank-you to all of them. 🙏

-> ⭐ star counts verified from GitHub's REST API on August 24, 2026 — go give these projects a star. Counts are an exact dated snapshot and will naturally change.
+> ⭐ star counts as of July 2026 — go give these projects a star.

 ### 🧬 Lineage & gateway

 <table>
  <tr><th align="left">Project</th><th align="center">⭐</th><th align="left">How it inspired OmniRoute</th></tr>
-  <tr><td nowrap><b><a href="https://github.com/decolua/9router">9router</a></b></td><td align="center">26,161</td><td>The original project this fork is built on — extended here with multi-modal APIs and a full TypeScript rewrite.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/router-for-me/CLIProxyAPI">CLIProxyAPI</a></b></td><td align="center">48,497</td><td>The Go implementation that inspired this JavaScript / TypeScript port.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/BerriAI/litellm">LiteLLM</a></b></td><td align="center">57,100</td><td>The AI gateway whose public pricing dataset feeds our cost-tracking sync and whose provider-normalization model informed our routing.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/miuuyy/codex-chatgpt-web">codex-chatgpt-web</a></b></td><td align="center">1,410</td><td>MIT source adapted into the vendored ChatGPT Web → Codex Responses bridge, including browser-session, response-framing, usage and web-search adapters.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/Alishahryar1/free-claude-code">free-claude-code</a></b></td><td align="center">48,112</td><td>Patterns ported into stream recovery, no-thinking aliases, fallback web search, sliding-window limits, log redaction and hardened launcher flows.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/standardagents/composer-api">composer-api</a></b></td><td align="center">322</td><td>Cursor Composer tool-choice, output-constraint and tool-commit patterns adapted into the native Cursor executor.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/ndycode/codex-multi-auth">codex-multi-auth</a></b></td><td align="center">457</td><td>Fresh-login and refresh-token rotation patterns ported into Codex OAuth reauthentication.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/ex-machina-co/opencode-anthropic-auth">opencode-anthropic-auth</a></b></td><td align="center">510</td><td>Claude Code-compatible transform defaults and billing-header behavior generalized into OmniRoute's config-driven bridge.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/520mmxx/grok2api-merged">grok2api-merged</a></b></td><td align="center">2</td><td>Its Grok model mappings, fake-TypeError Statsig generator, request and device defaults, and NDJSON response processor were materially adapted into OmniRoute's Grok Web executor.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/TQZHR/grok2api">TQZHR/grok2api</a></b></td><td align="center">705</td><td>The principal transitive code source behind grok2api-merged; its model, header, payload, Statsig and processor implementations are preserved in the Grok Web lineage.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/chenyme/grok2api">chenyme/grok2api</a></b></td><td align="center">7,520</td><td>The underlying MIT source for Grok payload and device defaults, the Statsig generator, and the <code>result.response</code> processor carried through TQZHR and grok2api-merged.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/miuzhaii/grok2api-pro">grok2api-pro</a></b></td><td align="center">27</td><td>A transitive source credited by grok2api-merged for its proxy-pool layer; OmniRoute preserves that lineage notice but does not claim a proxy-pool port in its bounded Grok Web executor.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/CNFlyCat/GrokProxy">GrokProxy</a></b></td><td align="center">50</td><td>Its cookie-authenticated Grok proxy and <code>result.response.token</code> streaming pattern informed OmniRoute's Grok Web transport.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/lianying1716/GrokBridge">GrokBridge</a></b></td><td align="center">5</td><td>The original Grok Web implementation consulted its HTTP/browser upstream design; its direct HTTP path derives from GrokProxy, so no independent code port is claimed.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/imjustprism/grok-web-api">grok-web-api</a></b></td><td align="center">14</td><td>Its Rust <code>ChatOptions</code> and response-envelope schemas informed OmniRoute's TypeScript Grok request and streaming-response types.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/decolua/9router">9router</a></b></td><td align="center">22.7k</td><td>The original project this fork is built on — extended here with multi-modal APIs and a full TypeScript rewrite.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/router-for-me/CLIProxyAPI">CLIProxyAPI</a></b></td><td align="center">43.6k</td><td>The Go implementation that inspired this JavaScript / TypeScript port.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/BerriAI/litellm">LiteLLM</a></b></td><td align="center">54.0k</td><td>The AI gateway whose public pricing dataset feeds our cost-tracking sync and whose provider-normalization model informed our routing.</td></tr>
 </table>

 ### 🗜️ Context & token compression — engines

 <table>
  <tr><th align="left">Project</th><th align="center">⭐</th><th align="left">How it inspired OmniRoute</th></tr>
-  <tr><td nowrap><b><a href="https://github.com/JuliusBrussee/caveman">Caveman</a></b></td><td align="center">100,538</td><td>The viral "why use many token when few token do trick" project — its caveman-speak philosophy powers our standard compression mode and 30+ filler/condensation rules.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/rtk-ai/rtk">RTK – Rust Token Killer</a></b></td><td align="center">77,185</td><td>High-performance command-output compression — inspired our RTK engine, JSON filter DSL, raw-output recovery and the stacked RTK → Caveman pipeline.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/headroomlabs-ai/headroom">headroom</a></b></td><td align="center">67,310</td><td>Reversible context-compression (SmartCrusher) — inspired our <code>headroom</code> engine and the <code>ccr</code> retrieve-marker pattern.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/microsoft/LLMLingua">LLMLingua</a></b></td><td align="center">6,598</td><td>Prompt-compression research (LLMLingua / LLMLingua-2) — inspired our async, code-safe, fail-open <code>llmlingua</code> engine.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/atjsh/llmlingua-2-js">llmlingua-2-js</a></b></td><td align="center">31</td><td>The JS/ONNX port (MobileBERT / XLM-RoBERTa) used as the worker-thread backend for our LLMLingua engine.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/leninejunior/troglodita">Troglodita</a></b></td><td align="center">40</td><td>PT-BR token compression — powers our pt-BR language pack: pleonasm reduction and filler removal tuned for Brazilian-Portuguese grammar.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/DietrichGebert/ponytail">ponytail</a></b></td><td align="center">108,957</td><td>The viral "lazy senior dev" YAGNI-coder skill — inspired our <b>less-code</b> Output Style: smallest-working-change steering that cuts _generated_ code (the output-axis sibling to Caveman's terse prose).</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/ayghri/i-have-adhd">i-have-adhd</a></b></td><td align="center">23,526</td><td>Its action-first, ADHD-friendly response style was adapted into OmniRoute's concise output style across five languages.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/JuliusBrussee/caveman">Caveman</a></b></td><td align="center">90.8k</td><td>The viral "why use many token when few token do trick" project — its caveman-speak philosophy powers our standard compression mode and 30+ filler/condensation rules.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/rtk-ai/rtk">RTK – Rust Token Killer</a></b></td><td align="center">71.8k</td><td>High-performance command-output compression — inspired our RTK engine, JSON filter DSL, raw-output recovery and the stacked RTK → Caveman pipeline.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/headroomlabs-ai/headroom">headroom</a></b></td><td align="center">60.1k</td><td>Reversible context-compression (SmartCrusher) — inspired our <code>headroom</code> engine and the <code>ccr</code> retrieve-marker pattern.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/microsoft/LLMLingua">LLMLingua</a></b></td><td align="center">6.5k</td><td>Prompt-compression research (LLMLingua / LLMLingua-2) — inspired our async, code-safe, fail-open <code>llmlingua</code> engine.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/atjsh/llmlingua-2-js">llmlingua-2-js</a></b></td><td align="center">30</td><td>The JS/ONNX port (MobileBERT / XLM-RoBERTa) used as the worker-thread backend for our LLMLingua engine.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/leninejunior/troglodita">Troglodita</a></b></td><td align="center">26</td><td>PT-BR token compression — powers our pt-BR language pack: pleonasm reduction and filler removal tuned for Brazilian-Portuguese grammar.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/DietrichGebert/ponytail">ponytail</a></b></td><td align="center">86.0k</td><td>The viral "lazy senior dev" YAGNI-coder skill — inspired our <b>less-code</b> Output Style: smallest-working-change steering that cuts _generated_ code (the output-axis sibling to Caveman's terse prose).</td></tr>
 </table>

 ### 🧩 Compact formats, token research & code-aware tooling

 <table>
  <tr><th align="left">Project</th><th align="center">⭐</th><th align="left">How it inspired OmniRoute</th></tr>
-  <tr><td nowrap><b><a href="https://github.com/toon-format/toon">TOON</a></b></td><td align="center">25,233</td><td>Token-Oriented Object Notation — its columnar, header-plus-rows model shaped our tabular compaction stage.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/blackwell-systems/gcf">GCF – Graph Compact Format</a></b></td><td align="center">41</td><td>Its compact graph format and generic-profile design informed OmniRoute's tabular compaction and Headroom codec format.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/blackwell-systems/gcf-typescript">gcf-typescript</a></b></td><td align="center">4</td><td>The MIT TypeScript implementation directly vendored and extended as the Headroom generic-profile codec.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/ooples/token-optimizer-mcp">token-optimizer-mcp</a></b></td><td align="center">494</td><td>Brotli/SQLite cache + per-session context-delta — inspired our <code>session-dedup</code> engine.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/Mibayy/token-savior">token-savior</a></b></td><td align="center">1,122</td><td>Bash-output compaction + MCP profiles — inspired our compression bail-out discipline and MCP tool-manifest reduction.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/ppgranger/token-saver">token-saver</a></b></td><td align="center">138</td><td>Content-aware, per-file-type output compression with failure-aware bail-out — validated our per-type dispatch and minimum-gain skip.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/alexgreensh/token-optimizer">token-optimizer</a></b></td><td align="center">1,951</td><td>"Find the ghost tokens" — its offload + recoverable-handle pattern informed our CCR offload thinking.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/Shweta-Mishra-ai/tokenmizer">TokenMizer</a></b></td><td align="center">28</td><td>A session-graph + cross-turn line-dedup blueprint that informed our session-dedup design.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/toon-format/toon">TOON</a></b></td><td align="center">24.9k</td><td>Token-Oriented Object Notation — its columnar, header-plus-rows model shaped our tabular compaction stage.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/blackwell-systems/gcf">GCF – Graph Compact Format</a></b></td><td align="center">22</td><td>First inspired our tabular compaction stage; now its zero-dependency, lossless generic-profile encoder is <b>vendored directly</b> as the Headroom codec (MIT, SPDX-marked), with later numeric-domain and count-mismatch correctness fixes.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/ooples/token-optimizer-mcp">token-optimizer-mcp</a></b></td><td align="center">444</td><td>Brotli/SQLite cache + per-session context-delta — inspired our <code>session-dedup</code> engine.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/Mibayy/token-savior">token-savior</a></b></td><td align="center">1.1k</td><td>Bash-output compaction + MCP profiles — inspired our compression bail-out discipline and MCP tool-manifest reduction.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/ppgranger/token-saver">token-saver</a></b></td><td align="center">117</td><td>Content-aware, per-file-type output compression with failure-aware bail-out — validated our per-type dispatch and minimum-gain skip.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/alexgreensh/token-optimizer">token-optimizer</a></b></td><td align="center">1.7k</td><td>"Find the ghost tokens" — its offload + recoverable-handle pattern informed our CCR offload thinking.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/Shweta-Mishra-ai/tokenmizer">TokenMizer</a></b></td><td align="center">16</td><td>A session-graph + cross-turn line-dedup blueprint that informed our session-dedup design.</td></tr>
  <tr><td nowrap><b><a href="https://github.com/jessefreitas/OmniCompress">OmniCompress</a></b></td><td align="center">3</td><td>Rust columnar-JSON + content-addressed retrieve + cross-message dedup — validated our <code>headroom</code>/<code>ccr</code>/<code>session-dedup</code> engine design and the cache-stable "compressed form is position-independent" invariant.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/atlassian-labs/mcp-compressor">mcp-compressor</a></b></td><td align="center">113</td><td>MCP tool-schema/description compression — informed our MCP tool-manifest cardinality reduction.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/pdavis68/RepoMapper">RepoMapper</a></b></td><td align="center">197</td><td>Aider-style repo-map ranking — informed our repo-map / retrieval-ranking exploration.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/atlassian-labs/mcp-compressor">mcp-compressor</a></b></td><td align="center">98</td><td>MCP tool-schema/description compression — informed our MCP tool-manifest cardinality reduction.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/pdavis68/RepoMapper">RepoMapper</a></b></td><td align="center">187</td><td>Aider-style repo-map ranking — informed our repo-map / retrieval-ranking exploration.</td></tr>
  <tr><td nowrap><b><a href="https://github.com/mrsimpson/quiet-shell-mcp">quiet-shell-mcp</a></b></td><td align="center">4</td><td>Declarative shell-output reduction over MCP — validated our declarative bash-output compaction.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/dsherret/ts-morph">ts-morph</a></b></td><td align="center">6,162</td><td>TypeScript Compiler API toolkit — inspired our parser-based comment removal that preserves string, template and regex literals.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/dsherret/ts-morph">ts-morph</a></b></td><td align="center">6.1k</td><td>TypeScript Compiler API toolkit — inspired our parser-based comment removal that preserves string, template and regex literals.</td></tr>
 </table>

 ### 🧠 Memory & RAG

 <table>
  <tr><th align="left">Project</th><th align="center">⭐</th><th align="left">How it inspired OmniRoute</th></tr>
-  <tr><td nowrap><b><a href="https://github.com/mem0ai/mem0">Mem0</a></b></td><td align="center">63,902</td><td>Universal memory layer — its proxy-as-write/read-boundary model shaped our memory architecture.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/letta-ai/letta">Letta (MemGPT)</a></b></td><td align="center">24,382</td><td>Stateful agents with tiered memory — inspired our Context Control & Recovery (CCR) tiered model.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/onestardao/WFGY">WFGY</a></b></td><td align="center">1,781</td><td>The ProblemMap taxonomy of 16 recurring RAG/LLM failure modes — the shared vocabulary in our troubleshooting guide.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/mem0ai/mem0">Mem0</a></b></td><td align="center">61.2k</td><td>Universal memory layer — its proxy-as-write/read-boundary model shaped our memory architecture.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/letta-ai/letta">Letta (MemGPT)</a></b></td><td align="center">23.9k</td><td>Stateful agents with tiered memory — inspired our Context Control & Recovery (CCR) tiered model.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/onestardao/WFGY">WFGY</a></b></td><td align="center">1.8k</td><td>The ProblemMap taxonomy of 16 recurring RAG/LLM failure modes — the shared vocabulary in our troubleshooting guide.</td></tr>
 </table>

 ### 🛰️ Traffic inspection, MITM & transparent proxy

 <table>
  <tr><th align="left">Project</th><th align="center">⭐</th><th align="left">How it inspired OmniRoute</th></tr>
-  <tr><td nowrap><b><a href="https://github.com/chouzz/llm-interceptor">llm-interceptor</a></b></td><td align="center">66</td><td>MITM interception/analysis of coding-assistant ↔ LLM traffic — our Traffic Inspector ports its SSE merge, conversation normalization, host passthrough and secret masking. The upstream's complete license text is still under provenance review.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/InterceptSuite/ProxyBridge">ProxyBridge</a></b></td><td align="center">5,995</td><td>Transparent per-process proxy routing — inspired our crash-safe MITM teardown, socket idle-timeouts, <code>/proc</code> process attribution and TPROXY capture.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/chouzz/llm-interceptor">llm-interceptor</a></b></td><td align="center">49</td><td>MITM interception/analysis of coding-assistant ↔ LLM traffic — our Traffic Inspector ports its SSE merge, conversation normalization, host passthrough and secret masking (MIT).</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/InterceptSuite/ProxyBridge">ProxyBridge</a></b></td><td align="center">5.5k</td><td>Transparent per-process proxy routing — inspired our crash-safe MITM teardown, socket idle-timeouts, <code>/proc</code> process attribution and TPROXY capture.</td></tr>
 </table>

 ### 📚 Model data, observability & UI

 <table>
  <tr><th align="left">Project</th><th align="center">⭐</th><th align="left">How it inspired OmniRoute</th></tr>
-  <tr><td nowrap><b><a href="https://github.com/anomalyco/models.dev">models.dev</a></b></td><td align="center">6,555</td><td>Open database of AI model specs, pricing and capabilities — synced natively into our model catalog.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/xyflow/xyflow">React Flow / xyflow</a></b></td><td align="center">38,108</td><td>The node-based graph library powering our real-time Compression Studio and Combo/Routing Studio.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/langchain-ai/langgraph">LangGraph</a></b></td><td align="center">40,314</td><td>LangGraph Studio's live workflow-graph visualization inspired our Studios' real-time cascade view.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/langfuse/langfuse">Langfuse</a></b></td><td align="center">33,592</td><td>Its trace → span → generation observability model shaped our Compression Studio waterfall.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/kiali/kiali">Kiali</a></b></td><td align="center">3,631</td><td>Istio service-mesh observability — inspired our circuit-breaker badges and error-edge visuals in the Routing/Combo Studio.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/lobehub/lobe-icons">lobe-icons</a></b></td><td align="center">2,428</td><td>AI/LLM brand logos that render the provider icons across our dashboard.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/lipis/flag-icons">flag-icons</a></b></td><td align="center">12,354</td><td>Provides the MIT-licensed SVG flags used by the README language selector.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/anomalyco/models.dev">models.dev</a></b></td><td align="center">6.0k</td><td>Open database of AI model specs, pricing and capabilities — synced natively into our model catalog.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/xyflow/xyflow">React Flow / xyflow</a></b></td><td align="center">37.7k</td><td>The node-based graph library powering our real-time Compression Studio and Combo/Routing Studio.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/langchain-ai/langgraph">LangGraph</a></b></td><td align="center">37.6k</td><td>LangGraph Studio's live workflow-graph visualization inspired our Studios' real-time cascade view.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/langfuse/langfuse">Langfuse</a></b></td><td align="center">31.4k</td><td>Its trace → span → generation observability model shaped our Compression Studio waterfall.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/kiali/kiali">Kiali</a></b></td><td align="center">3.6k</td><td>Istio service-mesh observability — inspired our circuit-breaker badges and error-edge visuals in the Routing/Combo Studio.</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/lobehub/lobe-icons">lobe-icons</a></b></td><td align="center">2.2k</td><td>AI/LLM brand logos that render the provider icons across our dashboard.</td></tr>
 </table>

 ### 🛡️ Security

 <table>
  <tr><th align="left">Project</th><th align="center">⭐</th><th align="left">How it inspired OmniRoute</th></tr>
-  <tr><td nowrap><b><a href="https://github.com/tldrsec/awesome-secure-defaults">awesome-secure-defaults</a></b></td><td align="center">721</td><td>A curated list of secure-by-default libraries that guides our security choices (Helmet.js, DOMPurify, ssrf-req-filter, safe-regex, Google Tink).</td></tr>
+  <tr><td nowrap><b><a href="https://github.com/tldrsec/awesome-secure-defaults">awesome-secure-defaults</a></b></td><td align="center">710</td><td>A curated list of secure-by-default libraries that guides our security choices (Helmet.js, DOMPurify, ssrf-req-filter, safe-regex, Google Tink).</td></tr>
 </table>

 ### 🧭 Complementary tools

 <table>
  <tr><th align="left">Project</th><th align="center">⭐</th><th align="left">How it inspired OmniRoute</th></tr>
-  <tr><td nowrap><b><a href="https://github.com/BlockRunAI/ClawRouter">ClawRouter</a></b></td><td align="center">6,564</td><td>Inspired request deduplication, emergency zero-cost fallback, pluggable Auto-Combo strategies and multilingual intent classification.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/lbjlaq/Antigravity-Manager">Antigravity-Manager</a></b></td><td align="center">30,652</td><td>Its account-aware model remapping, executable-path validation and plan-label behavior informed OmniRoute's Antigravity runtime.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/jlcodes99/vscode-antigravity-cockpit">vscode-antigravity-cockpit</a></b></td><td align="center">4,817</td><td>Its compact quota-reset countdown format inspired the corresponding provider-limit display in OmniRoute.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/iOfficeAI/AionUi">AionUi</a></b></td><td align="center">32,230</td><td>Its ACP integrations inspired OmniRoute's automatic detection of installed CLI agents.</td></tr>
-  <tr><td nowrap><b><a href="https://github.com/steipete/CodexBar">CodexBar</a></b></td><td align="center">20,507</td><td>Identified the Grok Build quota surface; OmniRoute then verified and corrected the live wire format independently.</td></tr>
 </table>

 ## 📄 License
@@ -1666,7 +1589,7 @@ MIT License - see [LICENSE](LICENSE) for details.

 **[⬆ Back to top](#-omniroute)** · Built with ❤️ for the open-source AI community.

-<sub>OmniRoute v3.8.50 · Node ≥22.22.2 · MIT License · <a href="https://omniroute.online">omniroute.online</a></sub>
+<sub>OmniRoute v3.8.49 · Node ≥22.22.2 · MIT License · <a href="https://omniroute.online">omniroute.online</a></sub>

 </div>
 <!-- GitHub Discussions enabled for community Q&A -->
--- a/bin/cli/commands/auth-export.mjs
+++ b/bin/cli/commands/auth-export.mjs
@@ -22,15 +22,8 @@ const VALID_FORMATS = new Set(["json", "env"]);
 const SECURE_FILE_MODE = 0o600;

 export function registerAuthExport(program) {
-  // #11226: `.command("auth export")` does NOT register a two-word command — commander
-  // parses the bare word `export` as a required positional argument of `auth`, so the
-  // action received (exportArgValue, options, command) while expecting (options, command)
-  // and crashed with "cmd.optsWithGlobals is not a function". Register `export` as a
-  // proper nested subcommand instead; the CLI surface stays `omniroute auth export`.
  program
-    .command("auth")
-    .description(t("authExport.description"))
-    .command("export")
+    .command("auth export")
    .description(t("authExport.description"))
    .option("--id <id>", t("authExport.idOpt"))
    .option("--format <format>", t("authExport.formatOpt"), "json")
--- a/bin/cli/commands/combo.mjs
+++ b/bin/cli/commands/combo.mjs
@@ -3,7 +3,6 @@ import { printHeading } from "../io.mjs";
 import { withRuntime } from "../runtime.mjs";
 import { t } from "../i18n.mjs";
 import { apiFetch } from "../api.mjs";
-import { mcpCallTool } from "../mcpClient.mjs";
 import { emit } from "../output.mjs";
 import { resolveComboModels, collectModel } from "./comboModels.mjs";

@@ -64,7 +63,15 @@ export function extendComboSuggest(combo) {
        weights: opts.weights ? JSON.parse(opts.weights) : undefined,
        top: opts.top,
      };
-      const data = await mcpCallTool("omniroute_best_combo_for_task", body);
+      const res = await apiFetch("/api/mcp/tools/call", {
+        method: "POST",
+        body: { name: "omniroute_best_combo_for_task", arguments: body },
+      });
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.status}\n`);
+        process.exit(1);
+      }
+      const data = await res.json();
      const candidates = data.candidates ?? data;
      const rows = (Array.isArray(candidates) ? candidates : []).map((c, i) => ({
        rank: i + 1,
--- a/bin/cli/commands/compression.mjs
+++ b/bin/cli/commands/compression.mjs
@@ -1,6 +1,5 @@
 import { readFileSync } from "node:fs";
 import { apiFetch } from "../api.mjs";
-import { mcpCallTool } from "../mcpClient.mjs";
 import { emit } from "../output.mjs";
 import { t } from "../i18n.mjs";

@@ -79,17 +78,18 @@ async function restComboStats(period) {
 }

 async function mcpCall(name, args, restFallback) {
-  try {
-    return await mcpCallTool(name, args);
-  } catch (err) {
-    // Keep the REST fallback behavior for builds where the MCP surface
-    // is unreachable / not mounted. Anything else rethrows as an error.
-    const status = err?.status || err?.cause?.status;
-    if ((status === 404 || status === 501) && typeof restFallback === "function") {
-      return restFallback();
-    }
-    throw err;
+  const res = await apiFetch("/api/mcp/tools/call", {
+    method: "POST",
+    body: { name, arguments: args },
+  });
+  if (res.ok) return res.json();
+  // 404 = MCP tool surface not mounted on this build; 501 = not implemented.
+  // Anything else is a genuine error and we surface it.
+  if ((res.status === 404 || res.status === 501) && typeof restFallback === "function") {
+    return restFallback();
  }
+  process.stderr.write(`Error: ${res.status}\n`);
+  process.exit(1);
 }

 async function confirm(q) {
--- a/bin/cli/commands/mcp.mjs
+++ b/bin/cli/commands/mcp.mjs
@@ -61,12 +61,27 @@ export function registerMcp(program) {
            ? JSON.parse(argsPositional)
            : {};

-      const exitCode = await runMcpCallCommand(tool, args, {
-        ...opts,
-        stream: opts.stream,
-      }, globalOpts);
+      if (opts.stream) {
+        await runMcpStream(tool, args, globalOpts);
+        return;
+      }

-      if (exitCode !== 0) process.exit(exitCode);
+      const extraHeaders = opts.scope?.length ? { "X-MCP-Scopes": opts.scope.join(",") } : {};
+      const res = await apiFetch("/api/mcp/tools/call", {
+        method: "POST",
+        body: { name: tool, arguments: args },
+        headers: extraHeaders,
+      });
+      if (res.status === 403) {
+        process.stderr.write("Scope denied\n");
+        process.exit(4);
+      }
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.status}\n`);
+        process.exit(1);
+      }
+      const data = await res.json();
+      emit(data, globalOpts);
    });

  mcp
@@ -84,132 +99,112 @@ export function registerMcp(program) {
      const data = await res.json();
      emit(data.scopes ?? data, cmd.optsWithGlobals());
    });
+
+  // 5.2 — mcp tools + mcp audit
+  const tools = mcp.command("tools").description(t("mcp.tools.description"));
+
+  tools
+    .command("list")
+    .description(t("mcp.tools.list.description"))
+    .option("--scope <s>", t("mcp.tools.list.scope"))
+    .action(async (opts, cmd) => {
+      const params = new URLSearchParams();
+      if (opts.scope) params.set("scope", opts.scope);
+      const res = await apiFetch(`/api/mcp/tools?${params}`);
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.status}\n`);
+        process.exit(1);
+      }
+      const data = await res.json();
+      emit(data.tools ?? data, cmd.optsWithGlobals(), mcpToolSchema);
+    });
+
+  tools
+    .command("info <name>")
+    .description(t("mcp.tools.info.description"))
+    .action(async (name, opts, cmd) => {
+      const res = await apiFetch(`/api/mcp/tools?name=${encodeURIComponent(name)}`);
+      if (!res.ok) {
+        process.stderr.write(`Not found: ${name}\n`);
+        process.exit(1);
+      }
+      emit(await res.json(), cmd.optsWithGlobals());
+    });
+
+  tools
+    .command("schema <name>")
+    .description(t("mcp.tools.schema.description"))
+    .option("--io <kind>", t("mcp.tools.schema.io"), "input")
+    .action(async (name, opts, cmd) => {
+      const res = await apiFetch(`/api/mcp/tools?name=${encodeURIComponent(name)}&io=${opts.io}`);
+      if (!res.ok) {
+        process.stderr.write(`Not found: ${name}\n`);
+        process.exit(1);
+      }
+      const data = await res.json();
+      const globalOpts = cmd.optsWithGlobals();
+      if (globalOpts.output === "json") {
+        process.stdout.write(JSON.stringify(data.schema ?? data, null, 2) + "\n");
+      } else {
+        emit(data.schema ?? data, globalOpts);
+      }
+    });
+
+  const audit = mcp.command("audit").description(t("mcp.audit.description"));
+
+  audit
+    .command("tail")
+    .option("--follow", t("audit.tail.follow"))
+    .option("--limit <n>", t("audit.tail.limit"), parseInt, 100)
+    .action(async (opts, cmd) => {
+      const { runAuditTail } = await import("./audit.mjs");
+      await runAuditTail({ ...opts, source: "mcp" }, cmd);
+    });
+
+  audit
+    .command("stats")
+    .option("--period <p>", t("audit.stats.period"), "7d")
+    .action(async (opts, cmd) => {
+      const res = await apiFetch(`/api/mcp/audit/stats?period=${opts.period}`);
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.status}\n`);
+        process.exit(1);
+      }
+      emit(await res.json(), cmd.optsWithGlobals());
+    });
 }

-/**
- * Shared JSON-RPC 2.0 MCP client used by both stream and non-stream `mcp call`.
- *
- * Protocol:
- *   1. POST /api/mcp/stream with initialize → get Mcp-Session-Id header
- *   2. POST /api/mcp/stream with tools/call + Mcp-Session-Id header
- *
- * When `stream` is true, writes SSE data chunks to stdout as they arrive.
- * When `stream` is false, returns the parsed JSON-RPC result.
- *
- * Returns the exit code (0 = success, non-zero = failure).
- */
-async function mcpJsonRpcCall(tool, args, { stream = false, globalOpts = {} } = {}) {
+async function runMcpStream(tool, args, globalOpts) {
  const baseUrl = globalOpts.baseUrl ?? "http://localhost:20128";
  const apiKey = globalOpts.apiKey ?? "";
-  const streamUrl = `${baseUrl}/api/mcp/stream`;
-
-  const hdrs = {
-    "Content-Type": "application/json",
-    Accept: stream ? "text/event-stream" : "application/json",
-    ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
-  };
-
-  // Step 1 — initialize
-  const initRes = await fetch(streamUrl, {
+  const res = await fetch(`${baseUrl}/api/mcp/stream`, {
    method: "POST",
-    headers: hdrs,
-    body: JSON.stringify({
-      jsonrpc: "2.0",
-      id: 1,
-      method: "initialize",
-      params: {
-        protocolVersion: "2024-11-05",
-        capabilities: {},
-        clientInfo: { name: "omniroute-cli", version: "1.0" },
-      },
-    }),
+    headers: {
+      "Content-Type": "application/json",
+      ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
+    },
+    body: JSON.stringify({ name: tool, arguments: args }),
  });
-
-  if (!initRes.ok) {
-    const text = await initRes.text().catch(() => "");
-    process.stderr.write(`MCP initialize failed: HTTP ${initRes.status}${text ? ` — ${text}` : ""}\n`);
-    return 1;
+  if (!res.ok) {
+    process.stderr.write(`HTTP ${res.status}\n`);
+    process.exit(1);
  }
-
-  const sessionId = initRes.headers.get("mcp-session-id");
-  if (!sessionId) {
-    process.stderr.write("MCP initialize failed: no Mcp-Session-Id in response\n");
-    return 1;
-  }
-
-  // Step 2 — tools/call
-  const callHeaders = {
-    ...hdrs,
-    "mcp-session-id": sessionId,
-  };
-
-  const callRes = await fetch(streamUrl, {
-    method: "POST",
-    headers: callHeaders,
-    body: JSON.stringify({
-      jsonrpc: "2.0",
-      id: 2,
-      method: "tools/call",
-      params: { name: tool, arguments: args },
-    }),
-  });
-
-  if (!callRes.ok) {
-    const text = await callRes.text().catch(() => "");
-    process.stderr.write(`MCP call failed: HTTP ${callRes.status}${text ? ` — ${text}` : ""}\n`);
-    return 1;
-  }
-
-  if (stream) {
-    return readMcpSseStream(callRes.body);
-  }
-
-  // Non-stream: parse JSON-RPC response
-  const data = await callRes.json();
-  if (data.error) {
-    process.stderr.write(`MCP error: ${data.error.message || JSON.stringify(data.error)}\n`);
-    return 1;
-  }
-  // Print the result content
-  const content = data.result?.content;
-  if (content) {
-    for (const item of content) {
-      if (item.type === "text") {
-        process.stdout.write(item.text + "\n");
-      } else if (item.type === "resource") {
-        process.stdout.write(JSON.stringify(item.resource) + "\n");
-      } else {
-        process.stdout.write(JSON.stringify(item) + "\n");
-      }
-    }
-  } else {
-    process.stdout.write(JSON.stringify(data.result, null, 2) + "\n");
-  }
-  return 0;
-}
-
-async function readMcpSseStream(body) {
-  if (!body) return 1;
-  const reader = body.getReader();
+  const reader = res.body.getReader();
  const dec = new TextDecoder();
  let buf = "";
  while (true) {
    const { done, value } = await reader.read();
    if (done) break;
    buf += dec.decode(value, { stream: true });
-  }
-  const lines = buf.split("\n");
-  for (const line of lines) {
-    if (line.startsWith("data: ")) {
-      const raw = line.slice(6).trim();
-      if (raw && raw !== "[DONE]") process.stdout.write(raw + "\n");
+    const lines = buf.split("\n");
+    buf = lines.pop() ?? "";
+    for (const line of lines) {
+      if (line.startsWith("data: ")) {
+        const raw = line.slice(6).trim();
+        if (raw && raw !== "[DONE]") process.stdout.write(raw + "\n");
+      }
    }
  }
-  return 0;
-}
-
-export async function runMcpCallCommand(tool, args, opts = {}, globalOpts = {}) {
-  return mcpJsonRpcCall(tool, args, { stream: opts.stream, globalOpts });
 }

 export async function runMcpStatusCommand(opts = {}) {
@@ -238,8 +233,7 @@ export async function runMcpStatusCommand(opts = {}) {
    }

    const transport = status.transport || "stdio";
-    const online = status.online ?? status.running;
-    console.log(online ? t("mcp.running", { transport }) : t("mcp.stopped"));
+    console.log(status.running ? t("mcp.running", { transport }) : t("mcp.stopped"));
    if (status.toolsCount !== undefined) console.log(`  Tools: ${status.toolsCount}`);
    if (status.scopes?.length) {
      console.log("  Scopes:");
--- a/bin/cli/commands/oauth.mjs
+++ b/bin/cli/commands/oauth.mjs
@@ -258,7 +258,8 @@ async function runDeviceFlow(def, opts) {
    process.stdout.write(`\nAuthorization URL not available\n\n`);
  }

-  if (opts.browser !== false && verificationUri) await openBrowser(verificationUri);
+  if (opts.browser !== false && verificationUri)
+    await openBrowser(verificationUri);
  process.stderr.write("Waiting for device authorization...\n");
  const deadline = Date.now() + (opts.timeout ?? 300000);
  const intervalMs = (start.intervalMs ?? start.interval ?? 5) * 1000;
@@ -319,18 +320,7 @@ export async function runOAuthStatus(opts, cmd) {
    process.exit(1);
  }
  const data = await res.json();
-  const payload = data?.connections ?? data?.providers ?? data?.items ?? data;
-  // #11236 (bug 5 residual): a 200 whose body is out of contract (no
-  // connections/providers/items array — e.g. `{"status":"ok"}`) used to fall
-  // through to `.filter` on a non-array and crash with a bare TypeError plus a
-  // libuv teardown assertion on Windows. Coerce to an empty list with a
-  // sanitized one-line warning instead of dumping a stack trace.
-  if (!Array.isArray(payload)) {
-    process.stderr.write(
-      "Warning: unexpected response shape from /api/providers; showing no connections.\n"
-    );
-  }
-  const connections = (Array.isArray(payload) ? payload : []).filter(
+  const connections = (data.connections ?? data.providers ?? data.items ?? data).filter(
    (c) => c.authType === "oauth" || c.authType === "oauth2"
  );
  emit(connections, globalOpts, connectionSchema);
--- a/bin/cli/commands/oneproxy.mjs
+++ b/bin/cli/commands/oneproxy.mjs
@@ -1,5 +1,4 @@
 import { apiFetch } from "../api.mjs";
-import { mcpCallTool } from "../mcpClient.mjs";
 import { emit } from "../output.mjs";
 import { t } from "../i18n.mjs";

@@ -9,7 +8,15 @@ function fmtTs(v) {
 }

 async function mcpCall(name, args) {
-  return mcpCallTool(name, args);
+  const res = await apiFetch("/api/mcp/tools/call", {
+    method: "POST",
+    body: { name, arguments: args },
+  });
+  if (!res.ok) {
+    process.stderr.write(`MCP error: ${res.status}\n`);
+    process.exit(1);
+  }
+  return res.json();
 }

 const proxySchema = [
--- a/bin/cli/commands/resilience.mjs
+++ b/bin/cli/commands/resilience.mjs
@@ -1,7 +1,6 @@
 import { createInterface } from "node:readline";
 import { Argument } from "commander";
 import { apiFetch } from "../api.mjs";
-import { mcpCallTool } from "../mcpClient.mjs";
 import { emit } from "../output.mjs";
 import { t } from "../i18n.mjs";

@@ -167,7 +166,14 @@ export function registerResilience(program) {
      ])
    )
    .action(async (name, opts, cmd) => {
-      await mcpCallTool("omniroute_set_resilience_profile", { profile: name });
+      const res = await apiFetch("/api/mcp/tools/call", {
+        method: "POST",
+        body: { name: "omniroute_set_resilience_profile", arguments: { profile: name } },
+      });
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.status}\n`);
+        process.exit(1);
+      }
      process.stdout.write(`Profile: ${name}\n`);
    });

--- a/bin/cli/commands/serve.mjs
+++ b/bin/cli/commands/serve.mjs
@@ -1,7 +1,7 @@
 import { spawn } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
 import { platform, totalmem } from "node:os";
 import { t } from "../i18n.mjs";
 import { writePidFile, cleanupPidFile, waitForServer } from "../utils/pid.mjs";
@@ -20,7 +20,6 @@ import {
  buildNodeHeapArgs,
 } from "../../../scripts/build/runtime-env.mjs";
 import { resolveTlsOptions } from "../../../scripts/dev/tls-options.mjs";
-import { startDetachedTray, validateTrayOptions } from "../tray/detachedTray.mjs";

 const __dirname = dirname(fileURLToPath(import.meta.url));
 const _pkg = JSON.parse(readFileSync(join(__dirname, "..", "..", "..", "package.json"), "utf8"));
@@ -43,7 +42,7 @@ function parsePort(value, fallback) {
 }

 export function registerServe(program) {
-  const command = program
+  program
    .command("serve", { isDefault: true })
    .description(t("serve.description"))
    .option("--port <port>", t("serve.port"))
@@ -52,7 +51,7 @@ export function registerServe(program) {
    .option("--log", t("serve.log"))
    .option("--no-recovery", t("serve.no_recovery"))
    .option("--max-restarts <n>", t("serve.max_restarts"), parseInt, 2)
-    .option("--tray", t("serve.tray") || "Start in the system tray (desktop only)")
+    .option("--tray", t("serve.tray") || "Show system tray icon (desktop only)")
    .option("--no-tray", t("serve.no_tray") || "Disable system tray icon")
    .option(
      "--tls-cert <path>",
@@ -67,9 +66,6 @@ export function registerServe(program) {
    .action(async (opts) => {
      await runServe(opts);
    });
-  command.addOption(command.createOption("--tray-worker").hideHelp());
-  command.addOption(command.createOption("--tray-ready-port <port>").hideHelp());
-  command.addOption(command.createOption("--tray-ready-token <token>").hideHelp());
 }

 /** Once-per-process guard so the Android/Termux cache hint is not spammed. */
@@ -99,32 +95,6 @@ export function resetInstrumentationFailureHintForTests() {
 export async function runServe(opts = {}) {
  const startedAt = performance.now();

-  const trayOptionError = validateTrayOptions(opts);
-  if (trayOptionError) throw new Error(trayOptionError);
-
-  if (opts.tray === true && opts.trayWorker !== true) {
-    const port = parsePort(opts.port ?? process.env.PORT ?? "20128", 20128);
-    const tlsCert = opts.tlsCert ?? process.env.OMNIROUTE_TLS_CERT;
-    const tlsKey = opts.tlsKey ?? process.env.OMNIROUTE_TLS_KEY;
-    urlScheme = resolveTlsOptions({
-      ...process.env,
-      ...(tlsCert ? { OMNIROUTE_TLS_CERT: tlsCert } : {}),
-      ...(tlsKey ? { OMNIROUTE_TLS_KEY: tlsKey } : {}),
-    })
-      ? "https"
-      : "http";
-    const result = await startDetachedTray({
-      cliPath: join(ROOT, "bin", "omniroute.mjs"),
-      port,
-      maxRestarts: opts.maxRestarts ?? 2,
-      tlsCert,
-      tlsKey,
-    });
-    console.log(`\x1b[32m✔ OmniRoute tray started in background\x1b[0m`);
-    console.log(`  \x1b[1mDashboard:\x1b[0m  ${urlScheme}://localhost:${port}`);
-    return result;
-  }
-
  // Same prep as bin/omniroute.mjs — keep it here so a direct `runServe()` call
  // (tests / programmatic) still gets a writable Next.js cache dir before spawn.
  ensureAndroidCacheDir({ env: process.env });
@@ -294,8 +264,7 @@ export async function runServe(opts = {}) {
    opts.log === true,
    opts.maxRestarts ?? 2,
    startedAt,
-    useTray,
-    { trayReadyPort: opts.trayReadyPort, trayReadyToken: opts.trayReadyToken }
+    useTray
  );
 }

@@ -408,11 +377,9 @@ async function runWithSupervisor(
  showLog,
  maxRestarts,
  startedAt,
-  useTray = false,
-  { trayReadyPort, trayReadyToken } = {}
+  useTray = false
 ) {
  if (showLog) process.env.OMNIROUTE_SHOW_LOG = "1";
-  writePidFile("supervisor", process.pid);

  const supervisor = new ServerSupervisor({
    serverPath: serverJs,
@@ -423,7 +390,7 @@ async function runWithSupervisor(
      if (detectMitmCrash(crashLog)) {
        try {
          const PROJECT_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
-          const { updateSettings } = await import(pathToFileURL(join(PROJECT_ROOT, "src/lib/db/settings.ts")).href);
+          const { updateSettings } = await import(`${PROJECT_ROOT}/src/lib/db/settings.ts`);
          updateSettings({ mitmEnabled: false });
        } catch {}
        return "disable-mitm-and-retry";
@@ -436,38 +403,17 @@ async function runWithSupervisor(

  process.on("SIGINT", () => {
    killTrayIfActive();
-    cleanupPidFile("supervisor");
    supervisor.stop();
  });
  process.on("SIGTERM", () => {
    killTrayIfActive();
-    cleanupPidFile("supervisor");
    supervisor.stop();
  });

  if (!showLog) {
    waitForServer(dashboardPort, 60000).then(async (up) => {
      if (up) {
-        if (useTray) {
-          const trayReady = await maybeStartTray(dashboardPort, apiPort, supervisor);
-          if (!trayReady) {
-            cleanupPidFile("supervisor");
-            supervisor.stop();
-            process.exitCode = 1;
-            return;
-          }
-          if (trayReadyPort && trayReadyToken) {
-            const { notifyTrayReady } = await import("../tray/detachedTray.mjs");
-            try {
-              await notifyTrayReady(parsePort(trayReadyPort, 0), trayReadyToken);
-            } catch {
-              cleanupPidFile("supervisor");
-              supervisor.stop();
-              process.exitCode = 1;
-              return;
-            }
-          }
-        }
+        if (useTray) await maybeStartTray(dashboardPort, apiPort, supervisor);
        onReady(dashboardPort, apiPort, noOpen, startedAt);
      } else {
        reportReadinessTimeout(dashboardPort, supervisor);
@@ -514,30 +460,29 @@ function killTrayIfActive() {
 async function maybeStartTray(port, apiPort, supervisor) {
  try {
    const { initTray, isTraySupported } = await import("../tray/index.mjs");
-    if (!isTraySupported()) return false;
+    if (!isTraySupported()) return;
    const { default: open } = await import("open").catch(() => ({ default: null }));
    const dashboardUrl = `${urlScheme}://localhost:${port}`;
    const tray = await initTray({
      port,
      onQuit: () => {
        killTrayIfActive();
-        cleanupPidFile("supervisor");
        supervisor.stop();
      },
      onOpenDashboard: () => open?.(dashboardUrl),
-      onShowLogs: () => open?.(`${dashboardUrl}/dashboard/logs`),
+      onShowLogs: () => {
+        // In-place: open logs stream (best-effort)
+        process.stdout.write(`[omniroute][tray] Logs at: ${dashboardUrl}/logs\n`);
+      },
    });
    if (tray) {
      const { killTray } = await import("../tray/index.mjs");
      _killTray = killTray;
-      return true;
    }
-    return false;
  } catch (err) {
    // tray is optional — do not fail the server, but surface why it failed so
    // "--tray shows nothing" is diagnosable instead of silent (#4605).
    process.stderr.write(`[omniroute][tray] failed to start: ${err?.message ?? String(err)}\n`);
-    return false;
  }
 }

--- a/bin/cli/commands/setup-claude.mjs
+++ b/bin/cli/commands/setup-claude.mjs
@@ -169,8 +169,7 @@ export async function runSetupClaudeCommand(opts = {}) {
      let detail = `HTTP ${res.status}`;
      try {
        const errorBody = await res.json();
-        const serverMsg =
-          errorBody?.error?.message || errorBody?.error || errorBody?.message || "";
+        const serverMsg = errorBody?.error?.message || errorBody?.error || errorBody?.message || "";
        if (serverMsg) detail += ` — ${serverMsg}`;
      } catch {}
      throw new Error(detail);
--- a/bin/cli/commands/setup.mjs
+++ b/bin/cli/commands/setup.mjs
@@ -1,4 +1,4 @@
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
 import { dirname, resolve } from "node:path";
 import { createPrompt, printHeading, printInfo, printSuccess } from "../io.mjs";
 import { openOmniRouteDb } from "../sqlite.mjs";
@@ -16,7 +16,7 @@ import { t } from "../i18n.mjs";
 const PROJECT_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../../..");

 async function getListCliTools() {
-  const { listCliTools } = await import(pathToFileURL(resolve(PROJECT_ROOT, "src/shared/constants/cliTools.ts")).href);
+  const { listCliTools } = await import(`${PROJECT_ROOT}/src/shared/constants/cliTools.ts`);
  return listCliTools;
 }

--- a/bin/cli/commands/skills.mjs
+++ b/bin/cli/commands/skills.mjs
@@ -1,6 +1,5 @@
 import { readFileSync } from "node:fs";
 import { apiFetch } from "../api.mjs";
-import { mcpCallTool } from "../mcpClient.mjs";
 import { emit } from "../output.mjs";
 import { t } from "../i18n.mjs";

@@ -107,7 +106,14 @@ export async function runSkillsInstall(opts, cmd) {
 }

 export async function runSkillsEnable(id, opts, cmd) {
-  await mcpCallTool("omniroute_skills_enable", { skillId: id, enabled: true });
+  const res = await apiFetch("/api/mcp/tools/call", {
+    method: "POST",
+    body: { name: "omniroute_skills_enable", arguments: { skillId: id, enabled: true } },
+  });
+  if (!res.ok) {
+    process.stderr.write(`Error: ${res.status}\n`);
+    process.exit(1);
+  }
  process.stdout.write(`Enabled: ${id}\n`);
 }

@@ -116,7 +122,14 @@ export async function runSkillsDisable(id, opts, cmd) {
    const ok = await confirm(`Disable ${id}?`);
    if (!ok) return;
  }
-  await mcpCallTool("omniroute_skills_enable", { skillId: id, enabled: false });
+  const res = await apiFetch("/api/mcp/tools/call", {
+    method: "POST",
+    body: { name: "omniroute_skills_enable", arguments: { skillId: id, enabled: false } },
+  });
+  if (!res.ok) {
+    process.stderr.write(`Error: ${res.status}\n`);
+    process.exit(1);
+  }
  process.stdout.write(`Disabled: ${id}\n`);
 }

@@ -140,11 +153,16 @@ export async function runSkillsExecute(id, opts, cmd) {
    : opts.inputFile
      ? JSON.parse(readFileSync(opts.inputFile, "utf8"))
      : {};
-  const data = await mcpCallTool(
-    "omniroute_skills_execute",
-    { skillId: id, input },
-    { timeout: opts.timeout ?? 30000 },
-  );
+  const res = await apiFetch("/api/mcp/tools/call", {
+    method: "POST",
+    body: { name: "omniroute_skills_execute", arguments: { skillId: id, input } },
+    timeout: opts.timeout ?? 30000,
+  });
+  if (!res.ok) {
+    process.stderr.write(`Error: ${res.status}\n`);
+    process.exit(1);
+  }
+  const data = await res.json();
  emit(data, globalOpts);
 }

--- a/bin/cli/commands/update.mjs
+++ b/bin/cli/commands/update.mjs
@@ -5,7 +5,6 @@ import { fileURLToPath } from "node:url";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { t } from "../i18n.mjs";
-import { npmBin, npmExecOptions } from "../npm-exec.mjs";

 const execFileAsync = promisify(execFile);

@@ -32,13 +31,9 @@ export async function getCurrentVersion() {
 // they were already on the latest version (#4376). `execFn` is injectable for tests.
 export async function getLatestVersion(execFn = execFileAsync) {
  try {
-    // argv is all literals, so enabling the shell on win32 cannot splice a
-    // runtime value into the command line (Hard Rule #13).
-    const { stdout } = await execFn(
-      npmBin(),
-      ["view", "omniroute", "version", "--prefer-online"],
-      npmExecOptions(process.platform, { timeoutMs: 15000 })
-    );
+    const { stdout } = await execFn("npm", ["view", "omniroute", "version", "--prefer-online"], {
+      timeout: 15000,
+    });
    return stdout.trim();
  } catch {
    return null;
@@ -119,11 +114,9 @@ export async function runUpdateCommand(opts = {}) {

  if (showChangelog) {
    try {
-      const { stdout } = await execFileAsync(
-        npmBin(),
-        ["view", "omniroute", "changelog"],
-        npmExecOptions(process.platform, { timeoutMs: 15000 })
-      );
+      const { stdout } = await execFileAsync("npm", ["view", "omniroute", "changelog"], {
+        timeout: 10000,
+      });
      if (stdout.trim()) {
        console.log(stdout.trim());
      } else {
--- a/bin/cli/locales/en.json
+++ b/bin/cli/locales/en.json
@@ -254,7 +254,7 @@
    "log": "Show server logs inline",
    "no_recovery": "Disable auto-restart on crash (debugging mode)",
    "max_restarts": "Max crash restarts within 30s before giving up (default: 2)",
-    "tray": "Start in the system tray (desktop only, opt-in)",
+    "tray": "Show system tray icon (desktop only, opt-in)",
    "no_tray": "Disable system tray icon",
    "tls_cert": "Path to a TLS certificate (PEM) to serve HTTPS (also OMNIROUTE_TLS_CERT)",
    "tls_key": "Path to the TLS private key (PEM) to serve HTTPS (also OMNIROUTE_TLS_KEY)"
--- a/bin/cli/locales/pt-BR.json
+++ b/bin/cli/locales/pt-BR.json
@@ -26,8 +26,7 @@
    "testFailed": "Teste do provedor falhou: {error}",
    "loginEnabled": "Login: habilitado (senha atualizada)",
    "loginDisabled": "Login: desabilitado",
-    "providerInfo": "Provedor: {info}",
-    "opencode": "Instala e configura o plugin @omniroute/opencode-plugin incluído para o OpenCode"
+    "providerInfo": "Provedor: {info}"
  },
  "doctor": {
    "title": "OmniRoute Doctor",
@@ -255,9 +254,7 @@
    "no_recovery": "Desabilitar reinício automático em crash (modo debug)",
    "max_restarts": "Máximo de reinícios em 30s antes de desistir (padrão: 2)",
    "tray": "Mostrar ícone na bandeja do sistema (apenas desktop, opt-in)",
-    "no_tray": "Desabilitar ícone na bandeja do sistema",
-    "tls_cert": "Caminho para um certificado TLS (PEM) para servir HTTPS (também OMNIROUTE_TLS_CERT)",
-    "tls_key": "Caminho para a chave privada TLS (PEM) para servir HTTPS (também OMNIROUTE_TLS_KEY)"
+    "no_tray": "Desabilitar ícone na bandeja do sistema"
  },
  "backup": {
    "title": "Backup",
--- a/bin/cli/locales/zh-CN.json
+++ b/bin/cli/locales/zh-CN.json
@@ -38,8 +38,7 @@
    "testFailed": "提供者测试失败：{error}",
    "loginEnabled": "登录：已启用（密码已更新）",
    "loginDisabled": "登录：已禁用",
-    "providerInfo": "提供者：{info}",
-    "opencode": "安装并配置随附的 @omniroute/opencode-plugin 以用于 OpenCode"
+    "providerInfo": "提供者：{info}"
  },
  "doctor": {
    "title": "OmniRoute 诊断",
@@ -253,9 +252,7 @@
    "no_recovery": "禁用崩溃自动重启（调试模式）",
    "max_restarts": "30 秒内的最大崩溃重启次数（默认：2）",
    "tray": "显示系统托盘图标（仅桌面，选择加入）",
-    "no_tray": "禁用系统托盘图标",
-    "tls_cert": "用于提供 HTTPS 服务的 TLS 证书（PEM）路径（也可用 OMNIROUTE_TLS_CERT）",
-    "tls_key": "用于提供 HTTPS 服务的 TLS 私钥（PEM）路径（也可用 OMNIROUTE_TLS_KEY）"
+    "no_tray": "禁用系统托盘图标"
  },
  "backup": {
    "title": "备份",
@@ -1261,69 +1258,5 @@
    "search": "搜索 npm 注册表中的可用插件",
    "update": "更新已安装的插件",
    "scaffold": "搭建新的插件模板"
-  },
-  "authExport": {
-    "description": "导出已解密的提供者凭据（仅限本地，明文输出）",
-    "idOpt": "仅导出与此 id/名称/提供者匹配的连接",
-    "formatOpt": "输出格式：json 或 env",
-    "outOpt": "将输出写入文件而非标准输出（以 0600 权限写入）",
-    "forceOpt": "确认你了解此操作会打印/写入明文密钥",
-    "warning": "⚠ 此操作会打印/写入已解密的明文 API 密钥和 OAuth 令牌。请确保你的屏幕、shell 历史记录以及任何输出文件保持私密。",
-    "confirmHeading": "⚠ 警告：此操作会以明文导出已解密的提供者凭据",
-    "confirmBody": "此命令会为所选连接解密并打印/写入 apiKey、accessToken、refreshToken 和\nidToken。请将输出视为机密。",
-    "confirmFooter": "如需确认，请运行：\n  omniroute auth export --force",
-    "missingKey": "导出凭据需要 STORAGE_ENCRYPTION_KEY。",
-    "notFound": "未找到连接：{id}",
-    "invalidFormat": "无效格式：{format}。请使用 json 或 env。"
-  },
-  "radar": {
-    "description": "检查并同步本地 Radar 目录订阅源",
-    "status": "显示本地 Radar 设置和订阅源缓存状态",
-    "sync": "通过本地服务器同步目录、推荐、优惠和 Intel"
-  },
-  "launch": {
-    "description": "启动指向 OmniRoute 的 Claude Code（本地或远程，使用 --profile）",
-    "token": "Claude 客户端应发送的令牌（ANTHROPIC_AUTH_TOKEN）",
-    "notRunning": "无法在 {port} 访问 OmniRoute。请使用 “omniroute serve” 启动它。",
-    "notFound": "在 PATH 中未找到 “claude” CLI。"
-  },
-  "run": {
-    "description": "通过 OmniRoute 启动受支持的 CLI 目标"
-  },
-  "setupClaude": {
-    "description": "从 OmniRoute 模型目录生成 ~/.claude/profiles 的 Claude Code 配置文件"
-  },
-  "connect": {
-    "description": "连接到远程 OmniRoute 服务器并进入远程模式"
-  },
-  "tokens": {
-    "description": "管理限定范围的 CLI 访问令牌（远程模式）"
-  },
-  "configure": {
-    "description": "从活动服务器选择提供者+模型并配置受支持的本地 CLI"
-  },
-  "launchCodex": {
-    "description": "启动指向 OmniRoute 的 Codex CLI（本地或远程 VPS）"
-  },
-  "setupCodex": {
-    "description": "从 OmniRoute 实时模型目录生成 ~/.codex 配置文件"
-  },
-  "packs": {
-    "description": "管理可选的运行时包（ML / 浏览器自动化）",
-    "listDescription": "列出可选包及其安装状态",
-    "installDescription": "将可选包安装到 DATA_DIR",
-    "verifyDescription": "根据随附的校验和索引验证已安装的包",
-    "removeDescription": "移除已安装的可选包",
-    "sourceOpt": "存放包负载和包索引的目录",
-    "warnNoIndex": "未找到 optional-packs.index.json —— 此检出无法进行安装/验证（桌面捆绑包会附带它）",
-    "errUnknown": "未知的包：{name}",
-    "errNoIndex": "未找到包索引；请通过 --source <dir> 传入存放包负载的目录（桌面捆绑包会将其附带在应用旁）",
-    "installed": "包 “{name}” 已安装并在 {dir} 验证通过",
-    "restartHint": "请重启 OmniRoute 服务器（或桌面应用），以便运行时加载该包",
-    "removed": "包 “{name}” 已移除",
-    "notInstalled": "包 “{name}” 未安装",
-    "verifyOk": "所有已安装的包均已验证通过",
-    "verifyFailed": "{count} 个包验证失败",
-    "noneInstalled": "未安装可选包"
  }
 }
--- a/bin/cli/locales/zh-TW.json
+++ b/bin/cli/locales/zh-TW.json
@@ -38,8 +38,7 @@
    "testFailed": "提供者測試失敗：{error}",
    "loginEnabled": "登入：已啟用（密碼已更新）",
    "loginDisabled": "登入：已停用",
-    "providerInfo": "提供者：{info}",
-    "opencode": "安裝並配置隨附的 @omniroute/opencode-plugin 以用於 OpenCode"
+    "providerInfo": "提供者：{info}"
  },
  "doctor": {
    "title": "OmniRoute 診斷",
@@ -253,9 +252,7 @@
    "no_recovery": "停用崩潰自動重啟（除錯模式）",
    "max_restarts": "30 秒內的最大崩潰重啟次數（預設：2）",
    "tray": "顯示系統托盤圖示（僅桌面，選擇加入）",
-    "no_tray": "停用系統托盤圖示",
-    "tls_cert": "用於提供 HTTPS 服務的 TLS 憑證（PEM）路徑（也可用 OMNIROUTE_TLS_CERT）",
-    "tls_key": "用於提供 HTTPS 服務的 TLS 私鑰（PEM）路徑（也可用 OMNIROUTE_TLS_KEY）"
+    "no_tray": "停用系統托盤圖示"
  },
  "backup": {
    "title": "備份",
@@ -1261,69 +1258,5 @@
    "search": "搜尋 npm 登錄檔中的可用外掛",
    "update": "更新已安裝的外掛",
    "scaffold": "搭建新的外掛模板"
-  },
-  "authExport": {
-    "description": "匯出已解密的提供者憑據（僅限本機，明文輸出）",
-    "idOpt": "僅匯出與此 id/名稱/提供者相符的連線",
-    "formatOpt": "輸出格式：json 或 env",
-    "outOpt": "將輸出寫入檔案而非標準輸出（以 0600 權限寫入）",
-    "forceOpt": "確認你了解此操作會列印/寫入明文密鑰",
-    "warning": "⚠ 此操作會列印/寫入已解密的明文 API 金鑰和 OAuth 令牌。請確保你的螢幕、shell 歷史記錄以及任何輸出檔案保持私密。",
-    "confirmHeading": "⚠ 警告：此操作會以明文匯出已解密的提供者憑據",
-    "confirmBody": "此命令會為所選連線解密並列印/寫入 apiKey、accessToken、refreshToken 和\nidToken。請將輸出視為機密。",
-    "confirmFooter": "如需確認，請執行：\n  omniroute auth export --force",
-    "missingKey": "匯出憑據需要 STORAGE_ENCRYPTION_KEY。",
-    "notFound": "找不到連線：{id}",
-    "invalidFormat": "無效格式：{format}。請使用 json 或 env。"
-  },
-  "radar": {
-    "description": "檢查並同步本機 Radar 目錄訂閱來源",
-    "status": "顯示本機 Radar 設定和訂閱來源快取狀態",
-    "sync": "透過本機伺服器同步目錄、推薦、優惠和 Intel"
-  },
-  "launch": {
-    "description": "啟動指向 OmniRoute 的 Claude Code（本機或遠端，使用 --profile）",
-    "token": "Claude 用戶端應傳送的令牌（ANTHROPIC_AUTH_TOKEN）",
-    "notRunning": "無法在 {port} 存取 OmniRoute。請使用「omniroute serve」啟動它。",
-    "notFound": "在 PATH 中找不到「claude」CLI。"
-  },
-  "run": {
-    "description": "透過 OmniRoute 啟動受支援的 CLI 目標"
-  },
-  "setupClaude": {
-    "description": "從 OmniRoute 模型目錄產生 ~/.claude/profiles 的 Claude Code 配置檔"
-  },
-  "connect": {
-    "description": "連線到遠端 OmniRoute 伺服器並進入遠端模式"
-  },
-  "tokens": {
-    "description": "管理限定範圍的 CLI 存取令牌（遠端模式）"
-  },
-  "configure": {
-    "description": "從使用中的伺服器選擇提供者+模型並配置受支援的本機 CLI"
-  },
-  "launchCodex": {
-    "description": "啟動指向 OmniRoute 的 Codex CLI（本機或遠端 VPS）"
-  },
-  "setupCodex": {
-    "description": "從 OmniRoute 即時模型目錄產生 ~/.codex 配置檔"
-  },
-  "packs": {
-    "description": "管理可選的執行階段套件（ML / 瀏覽器自動化）",
-    "listDescription": "列出可選套件及其安裝狀態",
-    "installDescription": "將可選套件安裝到 DATA_DIR",
-    "verifyDescription": "根據隨附的總和檢查碼索引驗證已安裝的套件",
-    "removeDescription": "移除已安裝的可選套件",
-    "sourceOpt": "存放套件負載和套件索引的目錄",
-    "warnNoIndex": "找不到 optional-packs.index.json —— 此檢出無法進行安裝/驗證（桌面套件會隨附它）",
-    "errUnknown": "未知的套件：{name}",
-    "errNoIndex": "找不到套件索引；請透過 --source <dir> 傳入存放套件負載的目錄（桌面套件會將其隨附在應用程式旁）",
-    "installed": "套件「{name}」已安裝並在 {dir} 驗證通過",
-    "restartHint": "請重新啟動 OmniRoute 伺服器（或桌面應用程式），以便執行階段載入該套件",
-    "removed": "套件「{name}」已移除",
-    "notInstalled": "套件「{name}」未安裝",
-    "verifyOk": "所有已安裝的套件均已驗證通過",
-    "verifyFailed": "{count} 個套件驗證失敗",
-    "noneInstalled": "未安裝可選套件"
  }
 }
--- a/bin/cli/mcpClient.mjs
+++ b/bin/cli/mcpClient.mjs
@@ -1,127 +0,0 @@
-/**
- * Shared MCP JSON-RPC client for CLI commands.
- *
- * The server exposes MCP through /api/mcp/stream (Streamable HTTP transport).
- * Calling a tool requires:
- *   1. POST initialize → get Mcp-Session-Id response header
- *   2. POST tools/call with that session header
- *
- * Older CLI paths POSTed { name, arguments } to /api/mcp/tools/call, which is
- * not a registered route, so every MCP-backed command was broken.
- *
- * These functions route through apiFetch so CLI auth, remote contexts and
- * timeouts are handled the same way as every other management API call.
- */
-import { apiFetch } from "./api.mjs";
-
-function mcpError(message, status) {
-  const err = new Error(message);
-  if (status) err.status = status;
-  return err;
-}
-
-async function callMcpEndpoint(payload, { timeout, stream }) {
-  const res = await apiFetch("/api/mcp/stream", {
-    method: "POST",
-    body: payload,
-    timeout,
-    acceptNotOk: true,
-    headers: stream ? { Accept: "text/event-stream" } : {},
-  });
-
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw mcpError(
-      `${payload.method} ${payload.id}: HTTP ${res.status}${text ? ` — ${text}` : ""}`,
-      res.status,
-    );
-  }
-  return res;
-}
-
-/**
- * Call an MCP tool over /api/mcp/stream.
- *
- * Non-stream: returns the JSON-RPC result payload.
- * Stream: writes SSE `data:` chunks to stdout and returns null on success.
- */
-export async function mcpCallTool(name, args = {}, options = {}) {
-  const { timeout, scope } = options;
-  const scopeHeader = scope?.length ? { "X-MCP-Scopes": scope.join(",") } : {};
-
-  const initRes = await callMcpEndpoint(
-    {
-      jsonrpc: "2.0",
-      id: 1,
-      method: "initialize",
-      params: {
-        protocolVersion: "2024-11-05",
-        capabilities: {},
-        clientInfo: { name: "omniroute-cli", version: "1.0" },
-      },
-    },
-    { timeout, stream: options.stream },
-  );
-
-  const sessionId = initRes.headers.get("mcp-session-id");
-  if (!sessionId) {
-    throw mcpError("MCP initialize failed: no Mcp-Session-Id in response", 500);
-  }
-
-  const callRes = await callMcpEndpoint(
-    {
-      jsonrpc: "2.0",
-      id: 2,
-      method: "tools/call",
-      params: { name, arguments: args },
-    },
-    { timeout, stream: options.stream },
-  );
-
-  if (options.stream) {
-    return consumeSse(callRes.body, options.onChunk);
-  }
-
-  const data = await callRes.json();
-  if (data.error) {
-    const err = mcpError(`MCP error: ${data.error.message || JSON.stringify(data.error)}`);
-    err.code = data.error.code;
-    throw err;
-  }
-  if (data.result?.isError) {
-    const msg = data.result?.content?.[0]?.text || "unknown tool error";
-    throw mcpError(`MCP error: ${msg}`, 500);
-  }
-  return data.result;
-}
-
-async function consumeSse(body, onChunk) {
-  if (!body) throw mcpError("MCP stream returned no body", 500);
-  const reader = body.getReader();
-  const decoder = new TextDecoder();
-  let buf = "";
-  const flushLines = () => {
-    let idx;
-    while ((idx = buf.indexOf("\n")) >= 0) {
-      const line = buf.slice(0, idx);
-      buf = buf.slice(idx + 1);
-      if (line.startsWith("data: ")) {
-        const raw = line.slice(6).trim();
-        if (raw && raw !== "[DONE]") (onChunk ?? writeStdout)(raw);
-      }
-    }
-  };
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    buf += decoder.decode(value, { stream: true });
-    flushLines();
-  }
-  buf += decoder.decode();
-  flushLines();
-  return null;
-}
-
-function writeStdout(raw) {
-  process.stdout.write(raw + "\n");
-}
--- a/bin/cli/npm-exec.mjs
+++ b/bin/cli/npm-exec.mjs
@@ -1,34 +0,0 @@
-// Spawning npm from the CLI, on every platform.
-//
-// On Windows npm is `npm.cmd`, a batch wrapper. Node ≥ 24 refuses to spawn a
-// `.cmd` without a shell (nodejs/node#52554), and a bare `npm` can additionally
-// resolve to an extensionless shim that `CreateProcess` cannot execute — so the
-// call fails with `EINVAL` or `ENOENT` while npm works fine in the same terminal.
-// `src/lib/services/installers/utils.ts` already solves this for the server; this
-// is the same rule for the `bin/cli` entry points, which cannot import TypeScript.
-//
-// SECURITY (Hard Rule #13): enabling the shell means the SHELL splits the command
-// line, not `execFile`. Every argv element passed alongside these options must be
-// a literal — never a runtime value — or it must be validated first. Callers that
-// need to pass a user-supplied name have to guard it themselves.
-
-/** The npm binary to spawn on this platform. */
-export function npmBin(platform = process.platform) {
-  const isBun = Boolean(process.versions.bun);
-  if (platform === "win32") return isBun ? "bun.exe" : "npm.cmd";
-  return isBun ? "bun" : "npm";
-}
-
-/**
- * `execFile` / `spawnSync` options for an npm call.
- *
- * @param {NodeJS.Platform} platform
- * @param {{ timeoutMs?: number, stdio?: string }} [options]
- */
-export function npmExecOptions(platform = process.platform, options = {}) {
-  const base = {};
-  if (options.timeoutMs !== undefined) base.timeout = options.timeoutMs;
-  if (options.stdio !== undefined) base.stdio = options.stdio;
-  if (platform !== "win32") return { ...base, shell: false };
-  return { ...base, shell: true, windowsHide: true };
-}
--- a/bin/cli/provider-test.mjs
+++ b/bin/cli/provider-test.mjs
@@ -10,10 +10,6 @@ const PROVIDER_TEST_CONFIGS = {
    format: "openai",
    baseUrl: "https://openrouter.ai/api/v1",
    model: "openai/gpt-4o-mini",
-    // #11226: /models is public on OpenRouter (200 with any or no key) — probe the
-    // authenticated key-info endpoint instead so a bad key fails the test here
-    // instead of on the first real chat request.
-    keyCheckPath: "/auth/key",
  },
  groq: {
    format: "openai",
@@ -105,19 +101,13 @@ async function testOpenAILikeProvider(input, config) {
    "Content-Type": "application/json",
  };

-  // Providers whose /models endpoint is public (e.g. OpenRouter) declare a
-  // keyCheckPath pointing at an authenticated endpoint so the probe actually
-  // exercises the key instead of the public catalog.
-  const probeRes = await fetchWithTimeout(
-    joinUrl(config.baseUrl, config.keyCheckPath || "/models"),
-    {
-      method: "GET",
-      headers,
-    }
-  );
+  const modelsRes = await fetchWithTimeout(joinUrl(config.baseUrl, "/models"), {
+    method: "GET",
+    headers,
+  });

-  if (probeRes.ok || probeRes.status === 401 || probeRes.status === 403) {
-    return classifyResponse(probeRes);
+  if (modelsRes.ok || modelsRes.status === 401 || modelsRes.status === 403) {
+    return classifyResponse(modelsRes);
  }

  const chatRes = await fetchWithTimeout(joinUrl(config.baseUrl, "/chat/completions"), {
--- a/bin/cli/runtime.mjs
+++ b/bin/cli/runtime.mjs
@@ -1,14 +1,9 @@
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
 import { dirname, resolve } from "node:path";
 import { apiFetch, isServerUp } from "./api.mjs";

 const PROJECT_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..");

-// Dynamic `import()` resolves its specifier as a URL, not as a filesystem path.
-// On Windows an absolute path starts with a drive letter, which the ESM loader
-// reads as the unsupported URL scheme `e:` and rejects. Pass a file:// URL.
-const projectFileUrl = (relPath) => pathToFileURL(resolve(PROJECT_ROOT, relPath)).href;
-
 export class ServerOfflineError extends Error {
  constructor(message = "Server is offline and operation requires HTTP runtime") {
    super(message);
@@ -27,8 +22,8 @@ function makeHttpContext(opts) {

 async function importDbModules() {
  const [combos, recovery] = await Promise.all([
-    import(projectFileUrl("src/lib/db/combos.ts")),
-    import(projectFileUrl("src/lib/db/recovery.ts")),
+    import(`${PROJECT_ROOT}/src/lib/db/combos.ts`),
+    import(`${PROJECT_ROOT}/src/lib/db/recovery.ts`),
  ]);
  return { combos, recovery };
 }
--- a/bin/cli/runtime/sqliteRuntime.mjs
+++ b/bin/cli/runtime/sqliteRuntime.mjs
@@ -6,9 +6,7 @@ import { pathToFileURL } from "node:url";
 import { validateBinaryMagic, platformBinaryLabel } from "./magicBytes.mjs";

 const RUNTIME_DIR = join(homedir(), ".omniroute", "runtime");
-// Exported so the packaging coherence guard (tests/unit/pack-boot-runtime-paths.test.ts)
-// can assert this stays on the same major as optionalDependencies.better-sqlite3 (#11242).
-export const BETTER_SQLITE3_VERSION = "better-sqlite3@^13.0.2";
+const BETTER_SQLITE3_VERSION = "better-sqlite3@^12.10.1";

 let resolvedCached = null;

--- a/bin/cli/runtime/trayRuntime.ts
+++ b/bin/cli/runtime/trayRuntime.ts
@@ -2,7 +2,6 @@ import { existsSync, mkdirSync, writeFileSync, chmodSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { execSync } from "node:child_process";
-import { pathToFileURL } from "node:url";

 const RUNTIME_DIR = join(homedir(), ".omniroute", "runtime");
 // systray2 is a maintained fork with prebuilt binaries — installed lazily at runtime,
@@ -17,16 +16,6 @@ export const SYSTRAY_PACKAGE = "systray2";
 export const SYSTRAY_VERSION = "2.1.4";
 const SYSTRAY_SPEC = `${SYSTRAY_PACKAGE}@${SYSTRAY_VERSION}`;

-// Dynamic `import()` resolves its specifier as a URL, not a filesystem path.
-// On Windows the lazily-installed systray2 lives at an absolute path whose
-// leading drive letter the ESM loader parses as an unsupported URL scheme
-// (e.g. `c:`) and rejects. Build a file:// URL so the tray import works on
-// Windows too. Same defect fixed for the CLI db-fallback imports in #11238,
-// missed at this call site.
-export function systrayModuleSpecifier(runtimeDir: string): string {
-  return pathToFileURL(join(runtimeDir, "node_modules", SYSTRAY_PACKAGE)).href;
-}
-
 export function resolveSystrayBinName(platform: NodeJS.Platform): string | null {
  if (platform === "win32") return "tray_windows_release.exe";
  if (platform === "darwin") return "tray_darwin_release";
@@ -71,7 +60,8 @@ export async function loadSystray(): Promise<(new (...args: unknown[]) => unknow
  // drop the +x bit on extraction (observed on macOS).
  chmodSystrayBinAt(RUNTIME_DIR, process.platform);
  try {
-    const mod = await import(systrayModuleSpecifier(RUNTIME_DIR));
+    const modPath = join(RUNTIME_DIR, "node_modules", SYSTRAY_PACKAGE);
+    const mod = await import(modPath);
    return (mod.default ?? mod.SysTray ?? mod) as (new (...args: unknown[]) => unknown) | null;
  } catch (err) {
    console.warn(`[omniroute] tray runtime import failed: ${(err as Error).message}`);
--- a/bin/cli/tray/autostart.mjs
+++ b/bin/cli/tray/autostart.mjs
@@ -114,13 +114,10 @@ function writeLinuxSystemdUnit(cliPath) {
  const unitDir = dirname(linuxSystemdUnitPath());
  mkdirSync(unitDir, { recursive: true });
  const envFile = join(userHomeDir(), ".omniroute", ".env");
-  const nodeBinDir = dirname(process.execPath);
-  const userLocalBin = join(userHomeDir(), ".local", "bin");
-  const pathEnv = `${nodeBinDir}:${userLocalBin}:/usr/local/sbin:/usr/local/bin:/usr/bin:/bin`;
  const lines = [
    "[Unit]",
    "Description=OmniRoute AI proxy router",
-    "After=network-online.target graphical-session.target",
+    "After=network-online.target",
    "Wants=network-online.target",
    "",
    "[Service]",
@@ -137,7 +134,6 @@ function writeLinuxSystemdUnit(cliPath) {
    `ExecStart=${buildServeExecLine(cliPath, { tray: false })}`,
    "Restart=on-failure",
    "RestartSec=5",
-    `Environment="PATH=${pathEnv}"`,
  ];
  if (existsSync(envFile)) lines.push(`EnvironmentFile=-${envFile}`);
  lines.push("", "[Install]", "WantedBy=default.target", "");
@@ -280,10 +276,6 @@ function isAgentSelfMac() {
  }
 }

-function isDetachedTrayWorker() {
-  return process.argv.includes("--tray-worker");
-}
-
 function enableMac() {
  const plistDir = join(homedir(), "Library", "LaunchAgents");
  mkdirSync(plistDir, { recursive: true });
@@ -308,7 +300,7 @@ function enableMac() {
  // If we're already the running agent, launchctl load/unload would SIGTERM us.
  // The plist is updated on disk and launchd already has us loaded under our own
  // PID — nothing more to do for the current session.
-  if (isAgentSelfMac() || isDetachedTrayWorker()) return existsSync(plistPath);
+  if (isAgentSelfMac()) return existsSync(plistPath);
  try {
    execSync("launchctl load -w " + JSON.stringify(plistPath), { stdio: "ignore" });
  } catch {}
@@ -321,7 +313,7 @@ function disableMac() {
  // `launchctl unload` sends SIGTERM and a user clicking "Disable Autostart"
  // from the tray would lose the tray icon instead of just flipping the label.
  // Removing the plist file is enough to stop the agent at the next login.
-  if (!isAgentSelfMac() && !isDetachedTrayWorker()) {
+  if (!isAgentSelfMac()) {
    try {
      execSync("launchctl unload -w " + JSON.stringify(plistPath), { stdio: "ignore" });
    } catch {}
--- a/bin/cli/tray/detachedTray.mjs
+++ b/bin/cli/tray/detachedTray.mjs
@@ -1,176 +0,0 @@
-import { execFileSync, spawn } from "node:child_process";
-import { randomBytes, timingSafeEqual } from "node:crypto";
-import { createServer, connect } from "node:net";
-
-/** Builds arguments for the hidden process that owns the server and tray. */
-export function buildTrayWorkerArgs({ port, maxRestarts, readyPort, readyToken, tlsCert, tlsKey }) {
-  const args = [
-    "serve",
-    "--tray",
-    "--tray-worker",
-    "--no-open",
-    "--port",
-    String(port),
-    "--max-restarts",
-    String(maxRestarts),
-    "--tray-ready-port",
-    String(readyPort),
-    "--tray-ready-token",
-    readyToken,
-  ];
-  if (tlsCert) args.push("--tls-cert", tlsCert);
-  if (tlsKey) args.push("--tls-key", tlsKey);
-  return args;
-}
-
-/** Builds the platform command that starts the hidden tray worker. */
-export function buildTrayLaunch({ platform, execPath, cliPath, workerArgs, label }) {
-  if (platform === "darwin") {
-    return {
-      command: "launchctl",
-      args: ["submit", "-l", label, "--", execPath, cliPath, ...workerArgs],
-      options: { stdio: "ignore" },
-    };
-  }
-  return {
-    command: execPath,
-    args: [cliPath, ...workerArgs],
-    options: { detached: true, stdio: "ignore", windowsHide: true },
-  };
-}
-
-/** Returns an error for command modes that conflict with detached tray mode. */
-export function validateTrayOptions(opts) {
-  if (opts.trayWorker && (!opts.trayReadyPort || !opts.trayReadyToken)) {
-    return "tray worker requires readiness credentials";
-  }
-  if (!opts.tray || opts.trayWorker) return null;
-  if (opts.daemon) return "--tray cannot use --daemon";
-  if (opts.log) return "--tray cannot use --log";
-  if (opts.noRecovery || opts.recovery === false) return "--tray cannot use --no-recovery";
-  return null;
-}
-
-/** Creates a token-protected loopback server for tray worker readiness. */
-export async function createTrayReadinessServer(token) {
-  let markReady;
-  const ready = new Promise((resolve) => {
-    markReady = resolve;
-  });
-  const expected = Buffer.from(token);
-  const server = createServer((socket) => {
-    let data = "";
-    socket.setEncoding("utf8");
-    socket.on("data", (chunk) => {
-      data += chunk;
-      if (data.length > 256) socket.destroy();
-    });
-    socket.on("end", () => {
-      const received = Buffer.from(data);
-      if (received.length !== expected.length || !timingSafeEqual(received, expected)) {
-        socket.end("ERROR");
-        return;
-      }
-      socket.end("READY");
-      markReady();
-    });
-  });
-  await new Promise((resolve, reject) => {
-    server.once("error", reject);
-    server.listen(0, "127.0.0.1", resolve);
-  });
-  const address = server.address();
-  return {
-    port: address.port,
-    wait(timeoutMs) {
-      return new Promise((resolve, reject) => {
-        const timer = setTimeout(
-          () => reject(new Error("Tray worker did not become ready")),
-          timeoutMs
-        );
-        ready.then(() => {
-          clearTimeout(timer);
-          resolve();
-        });
-      });
-    },
-    close() {
-      server.close();
-    },
-  };
-}
-
-/** Notifies the parent process that the server and tray are ready. */
-export async function notifyTrayReady(port, token) {
-  await new Promise((resolve, reject) => {
-    const socket = connect({ host: "127.0.0.1", port }, () => socket.end(token));
-    let reply = "";
-    socket.setEncoding("utf8");
-    socket.on("data", (chunk) => {
-      reply += chunk;
-    });
-    socket.on("end", () => {
-      if (reply === "READY") resolve();
-      else reject(new Error("Tray readiness token was rejected"));
-    });
-    socket.on("error", reject);
-  });
-}
-
-/** Starts a detached tray worker and waits until its server and tray are ready. */
-export async function startDetachedTray(
-  { cliPath, port, maxRestarts, tlsCert, tlsKey, timeoutMs = 60000 },
-  { platform = process.platform, spawnProcess = spawn } = {}
-) {
-  const token = randomBytes(32).toString("hex");
-  const readiness = await createTrayReadinessServer(token);
-  const label = `com.omniroute.tray.${process.pid}.${Date.now()}`;
-  const workerArgs = buildTrayWorkerArgs({
-    port,
-    maxRestarts,
-    readyPort: readiness.port,
-    readyToken: token,
-    tlsCert,
-    tlsKey,
-  });
-  const launch = buildTrayLaunch({
-    platform,
-    execPath: process.execPath,
-    cliPath,
-    workerArgs,
-    label,
-  });
-  const child = spawnProcess(launch.command, launch.args, launch.options);
-  const spawnFailure = new Promise((_, reject) => {
-    child.once("error", reject);
-    child.once("exit", (code) => {
-      if (platform !== "darwin" || code !== 0) {
-        reject(new Error(`Tray worker exited before readiness with code ${code ?? "unknown"}`));
-      }
-    });
-  });
-  if (platform !== "darwin") child.unref?.();
-  try {
-    await Promise.race([readiness.wait(timeoutMs), spawnFailure]);
-    return { platform, pid: child.pid, label: platform === "darwin" ? label : null };
-  } catch (err) {
-    if (platform === "darwin") {
-      try {
-        execFileSync("launchctl", ["bootout", `gui/${process.getuid()}/${label}`], {
-          stdio: "ignore",
-        });
-      } catch {}
-    } else if (platform === "win32" && child.pid) {
-      try {
-        execFileSync("taskkill", ["/PID", String(child.pid), "/T", "/F"], { stdio: "ignore" });
-      } catch {}
-    } else if (child.pid) {
-      try {
-        process.kill(child.pid, "SIGTERM");
-      } catch {}
-    }
-    throw err;
-  } finally {
-    readiness.close();
-  }
-}
--- a/bin/cli/tray/traySystray.mjs
+++ b/bin/cli/tray/traySystray.mjs
@@ -97,7 +97,9 @@ export async function initSystrayUnix(
    }
  });

-  await tray.ready();
+  tray.ready().catch((err) => {
+    process.stderr.write(`[omniroute][tray] systray2 failed: ${err?.message ?? String(err)}\n`);
+  });

  return tray;
 }
--- a/changelog.d/features/10556-elevenlabs-native-routes.md
+++ b/changelog.d/features/10556-elevenlabs-native-routes.md
@@ -1 +0,0 @@
- **feat(audio):** proxy native ElevenLabs voices, text-to-speech, and speech-to-text HTTP routes through stored OmniRoute credentials, preserving query strings, multipart uploads, binary responses, and upstream errors (#10556).
--- a/changelog.d/features/10590-google-ai-studio-tts.md
+++ b/changelog.d/features/10590-google-ai-studio-tts.md
@@ -1 +0,0 @@
- Added Google AI Studio Gemini batch text-to-speech support through `POST /v1/audio/speech`.
--- a/changelog.d/features/11023-compression-worker-pool.md
+++ b/changelog.d/features/11023-compression-worker-pool.md
@@ -1,3 +0,0 @@
- Run synchronous RTK and Caveman request compression in a bounded worker-thread pool, keeping
-  large `/v1/responses` compression heaps outside the HTTP isolate while preserving strict
-  fail-open behavior and per-engine telemetry.
--- a/changelog.d/features/11134-configurable-max-global-attempts.md
+++ b/changelog.d/features/11134-configurable-max-global-attempts.md
@@ -1 +0,0 @@
- **feat(combo):** the shared per-request combo attempt budget is now operator-configurable via `maxGlobalAttempts` (combo config / `comboDefaults` cascade), instead of the hardcoded 30. Lower it to fail fast on a dead target pool, raise it for large combos; clamped to `[1, 200]` so an unbounded budget can never cause runaway background requests ([#11134](https://github.com/diegosouzapw/OmniRoute/issues/11134))
--- a/changelog.d/features/11251-connection-max-wait-ms-override.md
+++ b/changelog.d/features/11251-connection-max-wait-ms-override.md
@@ -1 +0,0 @@
- **feat(providers):** allow overriding the rate-limit queue wait timeout (`maxWaitMs`) per connection, alongside the existing `rpm`/`tpm`/`tpd`/`minTime`/`maxConcurrent` overrides — a single slow provider no longer has to lower the global wait budget for every other provider (#11251)
--- a/changelog.d/features/11282-first-run-readiness-card.md
+++ b/changelog.d/features/11282-first-run-readiness-card.md
@@ -1 +0,0 @@
- **feat(dashboard):** replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282))
--- a/changelog.d/features/11283-traffic-inspector-purpose-header.md
+++ b/changelog.d/features/11283-traffic-inspector-purpose-header.md
@@ -1 +0,0 @@
- **feat(dashboard):** lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283))
--- a/changelog.d/features/11286-essentials-sidebar-preset.md
+++ b/changelog.d/features/11286-essentials-sidebar-preset.md
@@ -1 +0,0 @@
- **feat(dashboard):** add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286))
--- a/changelog.d/features/11369-video-bridge-drilldown-isolation.md
+++ b/changelog.d/features/11369-video-bridge-drilldown-isolation.md
@@ -1 +0,0 @@
- **feat(video bridge):** harden the optional drill-down cache substrate with exact-path broker policy, canonical principal/session/media isolation, independent retained-byte quotas, cancellation-safe commits, rejection of excess or non-canonical Base64 padding and non-JPEG/truncated media, warning-sensitive full JPEG canonicalization that strips trailing polyglot bytes, server-derived dimensions, and auditable derivation metadata; production tenant binding and multi-resolution selection remain follow-up work ([#11369](https://github.com/diegosouzapw/OmniRoute/pull/11369))
--- a/changelog.d/features/11383-video-bridge-focused-mode.md
+++ b/changelog.d/features/11383-video-bridge-focused-mode.md
@@ -1 +0,0 @@
- **feat(video):** add an opt-in focused analysis mode that safely uses a normalized, 500-code-point latest-user hint for task-aware frame captions while preserving full-mode prompts, temporal-window isolation, and cache identity without storing raw task text ([#11383](https://github.com/diegosouzapw/OmniRoute/pull/11383)).
--- a/changelog.d/features/6342-cliproxy-account-health.md
+++ b/changelog.d/features/6342-cliproxy-account-health.md
@@ -1 +0,0 @@
- feat(services): show sanitized CLIProxyAPI account health from its authenticated management API without exposing credentials, file paths, or raw account metadata (#6342)
--- a/changelog.d/features/effort-tiers-loop-learned-sets.md
+++ b/changelog.d/features/effort-tiers-loop-learned-sets.md
@@ -1 +0,0 @@
- **feat(catalog):** surface runtime-learned `reasoning_effort` tiers in `/v1/models` `capabilities.effort_tiers` (learned set replaces synced metadata when present), map them to OpenCode `ModelV2.variants` in the OmniRoute plugin, and align dispatch `-<tier>` suffix validation to the effective (learned ?? synced) set — so the UI offers exactly the tiers the upstream accepts (e.g. `{low, high, max}` for `oc/x-preview-f-free`) and each advertised variant completes. Excludes codex/glm/kimi, which keep their own dedicated `-{effort}` suffix mechanism and never gain `effort_tiers` from this path (related to #7694, builds on #11232)
--- a/changelog.d/features/unreleased-detached-cli-tray.md
+++ b/changelog.d/features/unreleased-detached-cli-tray.md
@@ -1 +0,0 @@
- **feat(cli):** run `omniroute serve --tray` as a detached desktop process after server and tray readiness, with graphical login auto-start support.
--- a/changelog.d/fixes/10060-build-sqlite-native-addon-guard.md
+++ b/changelog.d/fixes/10060-build-sqlite-native-addon-guard.md
@@ -1 +0,0 @@
- **fix(build):** stop the native `better-sqlite3` addon from loading during the Next.js production build (#10060). Its `Statement` destructor aborts with `SIGABRT` when a build worker thread exits (assertion in `node::RemoveEnvironmentCleanupHook`, `env == nullptr`), which can leave the build with no standalone bundle. Every DB entry point now keys off a reliable `OMNIROUTE_BUILDING=1` signal (set by `build-next-isolated.mjs` and inherited by every spawned build worker, because Next.js workers sometimes drop `NEXT_PHASE`): `getDbInstance()` returns a no-op SQLite stub during build, `driverFactory` skips the native driver and falls through to `node:sqlite`, and the `codegraph`/`kiro-import` lazy loaders fail closed. A build-time `better-sqlite3` alias to a stub (`next.config.mjs`, turbopack) backs this up without changing runtime behaviour (the real package is still `require()`d natively via `serverExternalPackages`). Also raises the default build heap 4096→6144 MB and caps Next build worker pools (`CIRCLE_NODE_TOTAL=8`) to avoid the many-core page-data-collection SIGSEGV, and adds `.gitattributes` (`*.sh text eol=lf`) so kernel-exec'd shell scripts never ship with CRLF shebangs. Deliberately does NOT downgrade the Node base image: per the maintainer's review on #10060, `release/v3.8.50` moved to `node:26-trixie-slim` through several considered commits, so the `OMNIROUTE_BUILDING` guard is re-derived against the current base rather than reverting the FROM line; the npm pin and binary-hide dance from the original PR are dropped because our build already rebuilds `better-sqlite3` deterministically via `node-gyp` and floats `npm@latest` for the CVE overlay.
--- a/changelog.d/fixes/10286-gemini-3-5-flash-thinking.md
+++ b/changelog.d/fixes/10286-gemini-3-5-flash-thinking.md
@@ -0,0 +1 @@
+- fix(sse): mark gemini-3.5-flash as thinking-capable so reasoning_effort is no longer rejected with a spurious 400 (#10286)
--- a/changelog.d/fixes/10352-github-access-token-health.md
+++ b/changelog.d/fixes/10352-github-access-token-health.md
@@ -1 +0,0 @@
- **fix(github):** proactive credential health now verifies GitHub access tokens through the existing Copilot token exchange, marks only a confirmed `401 Unauthorized` as expired, and leaves rate limits, permission failures, upstream failures, and network errors routable ([#10352](https://github.com/diegosouzapw/OmniRoute/issues/10352)) — thanks @RaviTharuma
--- a/changelog.d/fixes/10815-kiro-social-multi-account.md
+++ b/changelog.d/fixes/10815-kiro-social-multi-account.md
@@ -1 +0,0 @@
- fix(oauth): stop treating the Kiro profile ARN as an account identity in `findKiroConnectionByIdentity()`, so a second Google/GitHub social login creates a new connection instead of overwriting the first — distinct Builder ID accounts share the same CodeWhisperer profile ARN, and the social token is not a JWT, so no e-mail was available to disambiguate them (#10815)
--- a/changelog.d/fixes/10851-openapi-spec-auth-contract.md
+++ b/changelog.d/fixes/10851-openapi-spec-auth-contract.md
@@ -1 +0,0 @@
- Document the conditional management authentication and 401/403 responses for `GET /api/openapi/spec`.
--- a/changelog.d/fixes/10959-single-target-reasoning-fallback.md
+++ b/changelog.d/fixes/10959-single-target-reasoning-fallback.md
@@ -1 +0,0 @@
- fix(sse): default single-target incompatible reasoning to drop for agentic replay — single-target requests to opaque reasoning targets now gracefully strip incompatible plaintext reasoning history instead of returning HTTP 400, matching combo default behavior while preserving operator and per-request overrides ([#10959](https://github.com/diegosouzapw/OmniRoute/issues/10959))
--- a/changelog.d/fixes/11271-ollama-capability-routing.md
+++ b/changelog.d/fixes/11271-ollama-capability-routing.md
@@ -1 +0,0 @@
- **fix(ollama):** Ollama Local models are no longer flattened to `chat` at sync time — the synced store persists every advertised capability and chat filtering moves to read time, so `/v1/embeddings` and `/v1/images/generations` stop rejecting models the daemon reports as capable ([#11271](https://github.com/diegosouzapw/OmniRoute/pull/11271)) — thanks @yourspraveen
--- a/changelog.d/fixes/11284-antigravity-empty-projectid-rejection.md
+++ b/changelog.d/fixes/11284-antigravity-empty-projectid-rejection.md
@@ -1 +0,0 @@
- **fix(providers):** Antigravity OAuth marks connects with no Cloud Code projectId as degraded instead of a false "Connected"; BYOP detection at connect time, auto-disable of confirmed-missing accounts, and selection-side rotation ([#11284](https://github.com/diegosouzapw/OmniRoute/issues/11284))
--- a/changelog.d/fixes/11297-opencode-subagent-sessionid.md
+++ b/changelog.d/fixes/11297-opencode-subagent-sessionid.md
@@ -1 +0,0 @@
- **fix(translator):** preserve omitted OpenCode `subagent.sessionID` values — optional default-less plain strings now use the Responses `null = omit` sentinel and are stripped before the client sees the tool call, so Codex/Responses no longer invent filler session IDs ([#11297](https://github.com/diegosouzapw/OmniRoute/pull/11297)) — thanks @ofonseca-pyming
--- a/changelog.d/fixes/11311-group-model-pattern-regex-escape.md
+++ b/changelog.d/fixes/11311-group-model-pattern-regex-escape.md
@@ -1 +0,0 @@
- **fix(db):** group model patterns escape regex metacharacters, so `gpt-4.1*` no longer matches `gpt-4o1-preview` and a pattern like `gpt-4(*` no longer throws `SyntaxError` out of the completion and `/v1/models` paths ([#11311](https://github.com/diegosouzapw/OmniRoute/pull/11311))
--- a/changelog.d/fixes/11319-upstream-proxy-host-spelling.md
+++ b/changelog.d/fixes/11319-upstream-proxy-host-spelling.md
@@ -1 +0,0 @@
- **fix(db):** the upstream proxy URL check judges the host by address instead of by spelling, so `http://[::ffff:169.254.169.254]`, `[::ffff:10.0.0.5]`, ULA/link-local and CGNAT targets are refused like their dotted equivalents ([#11319](https://github.com/diegosouzapw/OmniRoute/pull/11319))
--- a/changelog.d/fixes/11325-i18n-pt-placeholder-parity.md
+++ b/changelog.d/fixes/11325-i18n-pt-placeholder-parity.md
@@ -1 +0,0 @@
- **fix(i18n):** three `pt` strings had dropped their placeholders — the cache tile's subtitle repeated its own label instead of showing `{total}` — and a unit test now enforces placeholder parity with `en` across all locales ([#11325](https://github.com/diegosouzapw/OmniRoute/pull/11325))
--- a/changelog.d/fixes/11326-kie-market-google-imagen-ids.md
+++ b/changelog.d/fixes/11326-kie-market-google-imagen-ids.md
@@ -1 +0,0 @@
- **fix(kie):** map the remaining `google-imagen/*` KIE Market catalog ids (`nano-banana`, `nano-banana-pro`, `nano-banana-edit`) to their real, KIE-documented upstream `model` values — `#11225`'s fix only covered `nano-banana-2` ([#11326](https://github.com/diegosouzapw/OmniRoute/pull/11326)).
--- a/changelog.d/fixes/11328-upstream-headers-proxy-auth.md
+++ b/changelog.d/fixes/11328-upstream-headers-proxy-auth.md
@@ -1 +0,0 @@
- **fix(security):** `proxy-authorization` and `proxy-authenticate` are refused as upstream/custom headers, so a proxy credential is no longer forwarded to the model provider — the canonical denylist now matches the RFC 7230 §6.1 set the rest of the codebase already strips ([#11328](https://github.com/diegosouzapw/OmniRoute/pull/11328))
--- a/changelog.d/fixes/11344-video-bridge-scene-aware-sampler.md
+++ b/changelog.d/fixes/11344-video-bridge-scene-aware-sampler.md
@@ -1 +0,0 @@
- **fix(video-bridge):** fall back to the deterministic active-window midpoint when a one-frame scene-aware budget cannot preserve both timeline ends; a real FFmpeg fixture matrix now covers rapid cuts, gradual changes, static and short clips, and detector failure ([#11344](https://github.com/diegosouzapw/OmniRoute/pull/11344)).
--- a/changelog.d/fixes/11347-codex-claude-empty-tool-use.md
+++ b/changelog.d/fixes/11347-codex-claude-empty-tool-use.md
@@ -1 +0,0 @@
- **fix(translator):** Codex Responses tool calls translated for Claude clients no longer emit a duplicate `tool_use` block with the same ID and an empty name, preventing Claude Code from terminating with `No such tool available` ([#11347](https://github.com/diegosouzapw/OmniRoute/pull/11347))
--- a/changelog.d/fixes/11350-video-bridge-contact-sheet-labels.md
+++ b/changelog.d/fixes/11350-video-bridge-contact-sheet-labels.md
@@ -1 +0,0 @@
- **fix(video-bridge):** burn high-contrast timestamps into every bounded contact-sheet cell and add a real-model A/B harness whose promotion verdict stays `HOLD` until token, latency, and quality evidence is actually executed ([#11350](https://github.com/diegosouzapw/OmniRoute/pull/11350))
--- a/changelog.d/fixes/11362-video-bridge-result-cache.md
+++ b/changelog.d/fixes/11362-video-bridge-result-cache.md
@@ -1 +0,0 @@
- **fix(video):** fingerprint protected Video Bridge bytes, coalesce concurrent work, and fail open when the bounded TTL/LRU result cache is unavailable or corrupt ([#11362](https://github.com/diegosouzapw/OmniRoute/pull/11362))
--- a/changelog.d/fixes/11367-catalog-eventloop-9147.md
+++ b/changelog.d/fixes/11367-catalog-eventloop-9147.md
@@ -1 +0,0 @@
- **fix(catalog):** keep large `/v1/models` builds responsive by reusing the build-local capability snapshot throughout enrichment and Auto-Combo preparation, yielding cooperatively while constructing virtual candidate pools, and avoiding unrelated synchronous database diagnostics on the cache-TTL read path ([#11367](https://github.com/diegosouzapw/OmniRoute/pull/11367))
--- a/changelog.d/fixes/11382-video-bridge-dedup-policy.md
+++ b/changelog.d/fixes/11382-video-bridge-dedup-policy.md
@@ -1 +0,0 @@
- **fix(video):** apply the caption-frame cap after bounded visual deduplication, preserve first/final candidates plus small high-contrast motion and text changes, and version the dedup policy in result-cache identity ([#11382](https://github.com/diegosouzapw/OmniRoute/pull/11382)).
--- a/changelog.d/fixes/11394-modelsdev-interval-slider.md
+++ b/changelog.d/fixes/11394-modelsdev-interval-slider.md
@@ -1 +0,0 @@
- **fix(dashboard):** Model Database sync interval slider ticks now match the thumb position — checkpoint-space slider with magnetic snap on release ([#11394](https://github.com/diegosouzapw/OmniRoute/pull/11394)) — thanks @An0nym0us92
--- a/changelog.d/fixes/7764-quota-window-order.md
+++ b/changelog.d/fixes/7764-quota-window-order.md
@@ -1 +0,0 @@
- **fix(usage):** keep session/weekly/monthly quota windows in chronological order on every provider card. The order is now derived from the quota keys themselves instead of a provider whitelist, so Claude, MiniMax, Z.ai and Command Code stop rendering the two bars in opposite positions across sibling accounts ([#7764](https://github.com/diegosouzapw/OmniRoute/issues/7764))
--- a/changelog.d/fixes/cli-update-npm-win32-11335.md
+++ b/changelog.d/fixes/cli-update-npm-win32-11335.md
@@ -1 +0,0 @@
- **fix(cli):** `omniroute update` now finds npm on Windows. It called `execFile("npm", …)` with no shell, and on Node ≥ 24 a `.cmd` wrapper cannot be spawned that way (nodejs/node#52554) — while a bare `npm` can also resolve to an extensionless shim `CreateProcess` refuses. The result was `✖ Could not check latest version. Is npm available?` in a terminal where `npm view omniroute version` worked fine, so the updater was unusable on Windows even though nothing was wrong with the install. This is the same class as #5379/#5542, which fixed the server-side calls; the CLI entry points were missed because they are plain `.mjs` and cannot import the TypeScript helper. `bin/cli/npm-exec.mjs` now states the same rule for them: `npm.cmd` plus a shell on win32, no shell anywhere else. Both npm lookups in `update.mjs` (version and changelog) pass a literal argv array, so enabling the shell cannot splice a runtime value into the command line — a test asserts that and fails if a future edit interpolates one. (#11335)
--- a/changelog.d/fixes/codex-appserver-hardening.md
+++ b/changelog.d/fixes/codex-appserver-hardening.md
@@ -1 +0,0 @@
- Hardened the Codex app-server transport after the post-merge security review of #11205: approval prompts from the app-server (its own command/file/permission execution — not the harness tool passthrough) are now auto-denied by default, with opt-in auto-approval via `providerSpecificData.codexAppServerAutoApprove` / `OMNIROUTE_CODEX_APPSERVER_AUTO_APPROVE`; the default codex sandbox changed from `danger-full-access` to `workspace-write` (override per connection or env); env-sourced capability tokens are now only sent to env-sourced URLs or operator-local hosts (loopback/RFC1918/link-local/ULA/localhost/single-label LAN names/*.local/*.ts.net/*.internal), so a connection's providerSpecificData URL can no longer exfiltrate the operator's env token; and the `/readyz` health probe no longer follows redirects while carrying the bearer token.
--- a/changelog.d/fixes/codex-max-context-window.md
+++ b/changelog.d/fixes/codex-max-context-window.md
@@ -1 +0,0 @@
- fix(codex): prefer `max_context_window` over the `context_window` pricing tier as the usable input limit in discovery, and raise the static Codex OAuth catalog to the same usable window so the conservative discovery merge no longer caps live values at the 272K pricing tier
--- a/changelog.d/fixes/compression-worker-bundler-resolve.md
+++ b/changelog.d/fixes/compression-worker-bundler-resolve.md
@@ -1 +0,0 @@
- **fix(compression):** use `pathToFileURL` in `compressionWorkerPool` so bundlers (Webpack / Turbopack) do not attempt static asset resolution of missing `compressionWorker.js` during build
--- a/changelog.d/fixes/glm-credit-limit-quota.md
+++ b/changelog.d/fixes/glm-credit-limit-quota.md
@@ -1 +0,0 @@
- **fix(usage):** z.ai/GLM coding-plan subscription keys now render their quota cards again, with absolute credits. Z.ai's `/api/monitor/usage/quota/limit` switched these keys from `TOKENS_LIMIT` to `CREDIT_LIMIT` rows (same `unit`/`number` semantics: unit=3/number=5 → 5-hour window, unit=6/number=1 → weekly), and the parser only matched `TOKENS_LIMIT`/`TIME_LIMIT`, so both rows were dropped and the subscription card rendered empty. `CREDIT_LIMIT` is now accepted alongside `TOKENS_LIMIT`, and when the row carries absolute credit fields (`usage`/`currentValue`/`remaining`) they are preferred over the percent-only scale, so the card shows `3341 / 28000` like z.ai's own dashboard instead of `11 / 100`
--- a/changelog.d/fixes/lasterror-provider-error-detail.md
+++ b/changelog.d/fixes/lasterror-provider-error-detail.md
@@ -1 +0,0 @@
- **fix(auth):** a connection's `lastError` now names the real upstream failure instead of the bare string `Provider error`. `markAccountUnavailable` kept the reason only when it was already a string, so every other shape collapsed to that literal — and the shape that matters most is not a string: a failed `fetch` arrives as `TypeError: fetch failed` with the actionable part on `error.cause.code`, which means a wrong port, a firewall, a DNS failure and a blocked proxy all looked identical in the dashboard and in the console line. `describeUpstreamFailure` (in `src/shared/utils/upstreamError.ts`, reusing the `extractErrorMessage` that already parsed provider bodies) reads Error messages and appends the transport code when the message does not already carry it, reads the usual provider JSON shapes (`error.message`, `message`, string `error`, `detail`, `errors[]`), and falls back to the code alone before giving up. It never serializes the error object wholesale, so a request body or header attached to an error cannot leak into the stored reason — pinned by a test.
--- a/changelog.d/fixes/live-ws-public-url-runtime.md
+++ b/changelog.d/fixes/live-ws-public-url-runtime.md
@@ -1 +0,0 @@
- **fix(live-ws):** the Live dashboard socket can now be pointed at a reverse proxy without rebuilding the image. `NEXT_PUBLIC_*` is inlined at BUILD time, so a prebuilt Docker or npm image never carries an operator's `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL` — which is exactly why the browser discovers the socket through `/api/v1/ws?handshake=1` instead. The server side of that handshake, however, read only the `NEXT_PUBLIC_`-prefixed name, so it had nothing to echo: behind Traefik the dashboard kept dialling `wss://<host>:20132/live-ws` and sat on "Live disabled — WebSocket disconnected. Showing last known state." `LIVE_WS_PUBLIC_URL` is now read at runtime alongside the existing `LIVE_WS_HOST` / `LIVE_WS_PORT`, and the prefixed name stays supported as the fallback, so deployments that already set it are unaffected. Only `ws://` and `wss://` values are accepted, matching the guard the client already applies. (#11331)
--- a/changelog.d/fixes/secret-leak-error-surface-hardening.md
+++ b/changelog.d/fixes/secret-leak-error-surface-hardening.md
@@ -1 +0,0 @@
- **fix(security):** harden three secret-leak paths surfaced by an audit of the error/log surface. (1) `upstreamErrorPassthrough` relays an upstream provider's 4xx body verbatim to Claude-Code-format clients (the capability-recovery contract needs the exact wording); it now refuses passthrough when the body actually carries a credential pattern (`Bearer`/`Basic` token, `sk-…`, or an `api_key`/`token`/`authorization`/`cookie`/`secret` assignment) so a provider that echoes the offending request can't relay a key to the client, falling back to the sanitized error path. The credential regex is bounded (ReDoS-safe, verified linear at 60k chars). (2) The OCR and moderations handlers no longer forward an upstream error body byte-for-byte; they run it through the (now exported) structure-preserving `redactSensitiveErrorText` first. (3) `protectPayloadForLog`'s sensitive-key set gains `cookie`/`storageState`/`runtimeKey`/`capability` so web-impersonation credentials (Meta AI `ecto_1_sess`, chatgpt-web `storageState`) that land in a request/response body field are redacted before the call-log artifact is written to disk. No behavior change for secret-free error bodies; the Claude Code verbatim-wording contract is preserved.
--- a/changelog.d/maintenance/11018-database-cache-docs.md
+++ b/changelog.d/maintenance/11018-database-cache-docs.md
@@ -1 +0,0 @@
- **docs(database):** align the SQLite cache guide with the 65,536 KiB runtime default, supported 1–1,000,000 KiB range, and live Settings application behavior ([#11018](https://github.com/diegosouzapw/OmniRoute/issues/11018))
--- a/changelog.d/maintenance/11247-ratchet-no-unused-vars.md
+++ b/changelog.d/maintenance/11247-ratchet-no-unused-vars.md
@@ -1 +0,0 @@
- **chore(lint):** ratchet `@typescript-eslint/no-unused-vars` scoped to `src/` + `open-sse/` + `tests/` (`args: "all"`, `_`-prefix escape hatch) and freeze the 1393 pre-existing violations via bulk suppressions — same pattern as the #7879 `toNumber` ratchet. New unused bindings now fail lint. ([#11247](https://github.com/diegosouzapw/OmniRoute/pull/11247))
--- a/changelog.d/maintenance/11342-pnpm-optional-peers-license-policy.md
+++ b/changelog.d/maintenance/11342-pnpm-optional-peers-license-policy.md
@@ -1,3 +0,0 @@
- **fix(deps):** prevent pnpm from auto-installing the unused `@lobehub/ui` peer subtree of
-  `@lobehub/icons`, keeping six unneeded packages with incompatible or unverifiable license
-  metadata out of production installs ([#11342](https://github.com/diegosouzapw/OmniRoute/pull/11342)).
--- a/changelog.d/maintenance/11345-changelog-reconciliation-ledger.md
+++ b/changelog.d/maintenance/11345-changelog-reconciliation-ledger.md
@@ -1 +0,0 @@
- **ci(changelog):** replace the broad removal bypass with an exact, hash-bound reconciliation ledger and bind merge-train checks to their requested release base ([#11345](https://github.com/diegosouzapw/OmniRoute/pull/11345)).
--- a/changelog.d/maintenance/11356-readme-live-metrics.md
+++ b/changelog.d/maintenance/11356-readme-live-metrics.md
@@ -1,5 +0,0 @@
- **docs(readme):** reconcile live v3.8.50 provider, free-tier, CLI, routing, test,
-  community, sponsor, acknowledgment, and SVG metrics with their audited source
-  denominators, including a deduplicated OmniRoute-in-Action snapshot and distinct
-  contributor rankings for merged pull requests, GitHub-attributed commits, and Git history
-  ([#11356](https://github.com/diegosouzapw/OmniRoute/pull/11356)).
--- a/changelog.d/maintenance/11363-openapi-try-operation-coverage.md
+++ b/changelog.d/maintenance/11363-openapi-try-operation-coverage.md
@@ -1 +0,0 @@
- **docs(openapi):** document the conditionally management-authenticated, same-origin `POST /api/openapi/try` proxy contract and restore the release branch's operation-coverage ratchet ([#11363](https://github.com/diegosouzapw/OmniRoute/pull/11363))
--- a/changelog.d/maintenance/11381-video-bridge-fu07-structural-sampling.md
+++ b/changelog.d/maintenance/11381-video-bridge-fu07-structural-sampling.md
@@ -1 +0,0 @@
- **fix(video-bridge):** make opt-in segment-aware sampling use one bounded structural FFmpeg pass (scene, freeze, blur, exposure, and SI/TI), preserve long trailing segments, fail open to uniform sampling, and add real-media structural-oracle, overhead, post-dedup caption-call, and false-positive evidence while holding unconfigured model quality and gain-versus-cost claims ([#11381](https://github.com/diegosouzapw/OmniRoute/pull/11381)).
--- a/config/quality/dependency-allowlist.json
+++ b/config/quality/dependency-allowlist.json
@@ -1,9 +1,5 @@
 {
  "_comment": "Allowlist anti-slopsquatting (check-deps.mjs). Toda dep nova exige adicao EXPLICITA aqui apos verificar que e legitima.",
-  "_justifications": {
-    "@testing-library/dom": "Peer dep obrigatoria de @testing-library/react v16 (adicionada no PR #11224); Refs #9985.",
-    "@testing-library/user-event": "Utilitario oficial do ecossistema testing-library para testes de UI (adicionada no PR #11224); Refs #9985."
-  },
  "allowed": [
    "@atjsh/llmlingua-2",
    "@aws-sdk/client-bedrock-runtime",
@@ -24,10 +20,8 @@
    "@stryker-mutator/tap-runner",
    "@swc/helpers",
    "@tailwindcss/postcss",
-    "@testing-library/dom",
    "@testing-library/jest-dom",
    "@testing-library/react",
-    "@testing-library/user-event",
    "@toon-format/toon",
    "@types/better-sqlite3",
    "@types/bun",
--- a/config/quality/eslint-suppressions.json
+++ b/config/quality/eslint-suppressions.json
--- a/config/quality/file-size-baseline.json
+++ b/config/quality/file-size-baseline.json
@@ -227,9 +227,7 @@
    "tests/unit/translator-resp-gemini-to-openai.test.ts": 1604,
    "tests/unit/usage-service-hardening.test.ts": 1928,
    "tests/unit/vscode-token-routes.test.ts": 1633,
-    "tests/unit/executor-antigravity.test.ts": 1427,
-    "tests/unit/guardrails/videoBridgeResultCache.test.ts": 1040,
-    "_rebaseline_2026_08_24_video_bridge_fu01_fu03_fu04_result_cache_tests": "PRs #11362 (FU-01 cache hardening) + #11382 (FU-03 visual dedup policy identity) + #11383 (FU-04 focused analysis mode) own test growth: videoBridgeResultCache.test.ts <1000->1040, +40 (sum of three stacked PRs boarded together in the same merge-batch, each adding its own cache-identity assertions on the shared result-cache seam). Owner pre-authorized rebaseline for legitimate PR growth (2026-08-19 directive)."
+    "tests/unit/executor-antigravity.test.ts": 1427
  },
  "_rebaseline_2026_06_09": "Re-baseline consciente pre-release v3.8.19: 9 arquivos cresceram durante o ciclo (features mergeadas: RequestLoggerV2 +281 request-logger rework, stream +101, combo +73, chatCore +45, catalog +32 fable-5/catalog-flag, callLogs +4, accountFallback +2, usageHistory novo 840) + core.ts +7 (fix resetAllDbModuleState, PR 3536). A catraca segue valendo destes valores — proximo crescimento falha. Decisao: encolher (esp. RequestLoggerV2/chatCore) e a issue #3501 ficam para o ciclo seguinte.",
  "_rebaseline_2026_06_11_phase1f": "Phase 1f (#3501): ProviderDetailPageClient.tsx 4948→4062 (-886 LOC); 3 novos hooks extraídos. useProviderConnections.ts=954 acima do cap=800 — justificado: extração direta do god-component (zero lógica nova), própria redução do cliente supera o custo. useProviderSettings.ts=263 e useProviderModels.ts=154 já abaixo do cap.",
@@ -310,7 +308,7 @@
  "_rebaseline_2026_07_27_v3849_train1h": "Merge-train 1H (31 PRs) — owner-approved 2026-07-27. Two distinct causes, kept separate on purpose: (1) GENUINE irreducible growth at existing chokepoints — providerLimits/auth (#8632 Kimi quota-reset recovery), rateLimitManager (#8616 idle wedged limiters), models-catalog-route.test (#8610 OpenCode Go effort aliases); (2) COLLISION with #8585, which banked shrinks measured on the pre-train release tip while 30 sibling PRs in the SAME train grew those files again — chat/accountFallback (#8628), chatCore (#8613), videoGeneration (#8581), imageGeneration. The zero-headroom frozen entries cannot absorb either. Ceilings re-pinned to the post-merge tip; #8612 (also in this train) automates shrink-banking so this self-inflicted drift stops recurring. Detail: src/lib/usage/providerLimits.ts 1006->1013 (#8632); src/sse/services/auth.ts 2492->2508 (#8632); open-sse/services/rateLimitManager.ts 1014->1060 (#8616); src/sse/handlers/chat.ts 1842->1845 (#8628); open-sse/handlers/chatCore.ts 4939->4955 (#8613); open-sse/handlers/imageGeneration.ts 3100->3101 ((sem PR — teto do #8585)); open-sse/handlers/videoGeneration.ts 1038->1063 (#8581); open-sse/services/accountFallback.ts 1965->1966 (#8628); tests/unit/models-catalog-route.test.ts 1608->1636 (#8610)",
  "frozen": {
    "_rebaseline_2026_08_20_10878_10799_provider_health_probes": "PRs #10878 (unsupported OpenAI-like validation probes stay neutral) + #10799 (preserve credential health on inconclusive NVIDIA-timeout/Antigravity-400 probes) own growth: src/app/api/providers/[id]/test/route.ts 946->1025 (+79, sum of both boarded together). Both add narrowly-scoped classification branches at the existing test-route dispatch chokepoint (unsupported-capability skip, credential-inconclusive detection) rather than new files, mirroring the prior 2026_06_27_5193 rebaseline of the same file. Covered by tests/unit/provider-validation-unsupported-neutral.test.ts + tests/unit/provider-health-inconclusive-probes.test.ts.",
-    "src/app/api/providers/[id]/test/route.ts": 1237,
+    "src/app/api/providers/[id]/test/route.ts": 1215,
    "_rebaseline_2026_08_23_11141_oauth_400_recovery": "PR #11141 (HouMinXi) own growth: test/route.ts 1025->1215 (+190, the reactive-400 recovery path — a fully rebuilt probe for refresh+retry on refreshable non-rotating connections, with inconclusive-status preservation and rotating-provider exclusion; all growth is the new probe builder + guards at the existing test-route dispatch, extraction would split the retry flow mid-logic). Covered by tests/unit/oauth-400-recovery.test.ts (8, bug-injection proof). Owner pre-authorized baseline bumps 2026-08-22.",
    "_rebaseline_2026_06_22_4644_deepseek_web_tools": "PR #4644 (BugsBag/robust deepseek-web tool-call parsing): open-sse/executors/deepseek-web.ts 1117->1125 (+8). The new agentic tool-call path emits surrounding text + reasoning before tool_calls and swaps to the dedicated deepseekWebTools.ts parser; the +8 lines are cohesive wiring at the existing transformSSE chokepoint (the parser itself lives in the new deepseekWebTools.ts file, already under cap). The PR's own fast-gate (PR->release) does not run check:file-size, so this surfaced only at release reconcile. Covered by tests/unit/deepseek-web-tools-variants.test.ts + deepseek-web-tools-execute.test.ts.",
    "_rebaseline_2026_06_23_4712_deepseek_web_tool_results": "PR for #4712 (deepseek-web drops role:tool): open-sse/executors/deepseek-web.ts 1125->1148 (+23). messagesToPrompt() now folds role:\"tool\" results into the single-prompt transcript (recovering the tool name from the preceding assistant tool_calls by tool_call_id) instead of silently dropping them; the lines are cohesive wiring inside the existing function. Covered by tests/unit/deepseek-web-tool-result-prompt-4712.test.ts.",
@@ -435,8 +433,7 @@
    "src/shared/components/analytics/charts.tsx": 1346,
    "src/shared/services/cliRuntime.ts": 1459,
    "src/sse/handlers/chat.ts": 2493,
-    "src/sse/services/auth.ts": 3346,
-    "_rebaseline_2026_08_24_lasterror_provider_error_detail": "PR (ntdat812) own growth: src/sse/services/auth.ts 3344->3346 (+2). One line is the import of describeUpstreamFailure from @/shared/utils/upstreamError, which replaces the string-only collapse `typeof errorText === \"string\" ? errorText.slice(0, 100) : \"Provider error\"` at the single markAccountUnavailable chokepoint (net 0 lines there) — the logic itself lives in upstreamError.ts, next to the extractErrorMessage it reuses, so nothing else moved into this file. The second line is the repo's own lint-staged prettier pass splitting a pre-existing two-statements-on-one-line at getProviderCredentials (`invalidateManagedLease(...);      log.warn(...)`); it re-applies on any commit that touches this file, so it is not separable from the change. Covered by tests/unit/provider-error-detail-lastError.test.ts.",
+    "src/sse/services/auth.ts": 3337,
    "_rebaseline_2026_08_23_11186_synced_inventory_routing": "PR #11186 (pacocartones) own growth: src/sse/services/auth.ts 3260->3337 (+77, loadAdvertisedModelsForSelfHostedConnections + the modelNotAdvertised candidate-filter predicate — pins chat routing to the connection whose synced inventory actually advertises the model, fixing spurious model-not-found on multi-host self-hosted setups; at the existing credential-selection chokepoint, not extractable without splitting the selection flow). Covered by tests/unit/chat-routing-synced-inventory-11089.test.ts. Owner pre-authorized baseline bumps 2026-08-22.",
    "tests/unit/account-fallback-service.test.ts": 2044,
    "tests/unit/provider-validation-specialty.test.ts": 3880,
@@ -454,8 +451,7 @@
      "src/shared/components/ModelSelectModal.tsx": 1138,
      "src/shared/constants/providers/apikey/gateways.ts": 1250
    },
-    "src/app/(dashboard)/dashboard/providers/[id]/components/modals/AddApiKeyModal.tsx": 1173,
-    "_rebaseline_2026_08_23_11207_aws_polly_fields": "PR #11207 (rafacpti23, draft) own growth: AddApiKeyModal.tsx 1082->1173 (+91, AWS SigV4 credential fields for aws-polly — Access Key ID / Region / optional Session Token blocks with providerText i18n labels, at the existing per-provider form-section chokepoint; the file is the known god-modal with repeated dated rebaselines). Covered by tests/unit/dashboard/aws-polly-connection-modal-fields.test.ts. Owner pre-authorized baseline bumps 2026-08-22.",
+    "src/app/(dashboard)/dashboard/providers/[id]/components/modals/AddApiKeyModal.tsx": 1082,
    "_rebaseline_2026_08_22_11156_enter_check_disabled": "PR #11156 (rqzbeh) own growth: AddApiKeyModal.tsx 1080->1082 (+2, Enter keydown handler now mirrors the isCheckDisabled condition — owner-requested post-merge polish from #11056; the rest of the diff is Prettier reflow). Covered by tests/unit/ui/add-api-key-modal-enter-key.test.tsx (jsdom render test, Enter dispatch assertions).",
    "src/app/(dashboard)/dashboard/providers/[id]/hooks/useProviderConnections.ts": 1051,
    "src/shared/components/ModelSelectModal.tsx": 1138,
@@ -467,18 +463,14 @@
    "src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts": 1014,
    "open-sse/config/imageRegistry.ts": 1034,
    "src/sse/handlers/chatHelpers.ts": 1019,
-    "src/shared/middleware/chatBodyAdmission.ts": 1118,
+    "src/shared/middleware/chatBodyAdmission.ts": 1009,
    "_rebaseline_2026_08_22_11020_sigterm_drain": "PR #11020 (RaviTharuma) own growth: chatBodyAdmission.ts 1005->1009 (+4, heavyweight admission leases now increment the SIGTERM drain counter and releaseChatAdmissionWhenDone holds it for the SSE lifetime — closes #11015; +4 are the lease/drain wiring lines at the existing admission chokepoint). Covered by tests/unit/chat-body-admission.test.ts heavyweight-lease cases. Owner pre-authorized baseline bumps 2026-08-22.",
    "_rebaseline_2026_08_20_10668_tabitoken_gateway": "#10668 (yawar-aquil) own catalog growth: src/shared/constants/providers/apikey/gateways.ts 1268->1283 (+15, entirely this PR diff -- one new tabitoken gateway entry, data lines only; base moved from 1255 to 1268 via other merges since the PR forked). Not combination drift: reproducible on the PR branch alone, so the WS5.5 release-captain rule does not apply. Extraction is not available -- the file is pure data (own header: \"Pure data; merged by apikey/index.ts via spread\") and already split into 6 family files under apikey/. Same precedent as _rebaseline_2026_08_14_imagetotext_servicekinds (#10275/#10291, gateways.ts 1250->1255, data lines only) and _rebaseline_2026_08_11_v3850_merge_storm_provider_registry (owner-authorized for this same file).",
    "open-sse/executors/commandCode.ts": 1059,
    "_rebaseline_2026_08_21_10859_vision_bridge_catalog": "#10859 own growth (Vision Bridge fixes #10808/#10809): src/lib/modelCapabilities.ts 1006->1016 (+10, cmd/gpt-5.3-codex* text-only capability resolution) and open-sse/executors/commandCode.ts 988->1023 (+35, Command Code wire-model normalization for bare ids + reasoning field fallback for opencode-routed gateways). Cohesive bug fixes at the existing capability-resolution / executor chokepoints; not extractable mid-fix. Covered by tests/unit/model-capabilities-command-code-codex-textonly-10703.test.ts, tests/unit/command-code-vision.test.ts, tests/unit/opencode-mimo-reasoning-details-nonstream.test.ts. Pushed directly to release (own-session miss: the original rebaseline was made in a throwaway validation worktree and never landed on the PR branch or the release before merge).",
    "_rebaseline_2026_08_21_10907_sticky_pin_clear": "#10907 own growth: open-sse/executors/commandCode.ts 1023->1038 (+15, effort-suffix sanitization threading for the sticky-pin-clear fix). Cohesive change at the existing executor chokepoint. Covered by tests/unit/command-code-executor.test.ts.",
    "_rebaseline_2026_08_21_10986_reasoning_only_content": "#10986 own growth: open-sse/executors/commandCode.ts 1038->1059 (+21, reasoning-only content fallback — when upstream emits only reasoning-delta events and never a text-delta, surface the reasoning text as message.content in createJsonResponse and emit a synthetic content delta in createStreamResponse). Cohesive bug fix at the existing executor chokepoint (mirrors precedent style of #10907/#10859). Covered by tests/unit/command-code-executor.test.ts (2 new cases: non-stream + streaming).",
-    "_rebaseline_2026_08_21_11069_m365_har_import": "#11069 own growth: AddApiKeyModal.tsx 1073->1080 (+7 = Import .har file button for the copilot-m365-web credential modal — M365 is the only provider whose credential (access_token+chathubPath) must be extracted from a DevTools HAR WebSocket URL, added as a new modal affordance). Cohesive UI at the existing modal chokepoint; not extractable. Covered by tests/unit/m365-har-import*.test.ts.",
-    "_rebaseline_2026_08_23_tip_drift_post_batch0823": "Tip drift after the 2026-08-23 merge wave: chatBodyAdmission.ts 1009->1118 (+109, gate count incl. +1) and auth.ts 3337->3344 (+7), both grown by merges already on origin/release/v3.8.50 (verified identical on the pristine tip) — not by the codex-appserver-hardening PR that carries this bump. Owner pre-authorized baseline bumps 2026-08-22.",
-    "_rebaseline_2026_08_24_11355_cooldown_recovery_guards": "PR #11355 own growth: test/route.ts 1215->1237, +22 (startup crash-recovery guard: clearStaleCrashCooldowns() now parses the persisted rate_limited_until deadline and skips clearing rows still genuinely in the future, instead of clearing every non-terminal cooldown unconditionally). Cohesive fix at the existing test-route dispatch chokepoint alongside the #11141 probe builder. Covered by tests/unit/startup-stale-cooldown-recovery.test.ts + tests/unit/repro-zai-cooldown-cleared-by-connection-test.test.ts.",
-    "src/lib/guardrails/videoBridgeRuntime.ts": 1009,
-    "_rebaseline_2026_08_24_video_bridge_fu02_fu07_sampler": "PRs #11344 (FU-02 one-frame scene-aware determinism) + #11381 (FU-07 opt-in segment_aware structural sampling) own growth: videoBridgeRuntime.ts <1000->1009, +9 (sum of both boarded together in the same merge-batch). #11344 adds the deterministic one-frame midpoint fallback + policyEffective=uniform report at the existing scene_aware seam; #11381 adds the bounded local-only FFmpeg structural pre-analysis pass (scene/freeze/blur/exposure/SI-TI) and its budget-reallocation logic. Covered by tests/unit/guardrails/videoBridgeSampler.test.ts, tests/unit/guardrails/videoBridgeFu07StructuralSampling.test.ts, tests/integration/video-bridge-sampler-ffmpeg.test.ts. Owner pre-authorized rebaseline for legitimate PR growth (2026-08-19 directive)."
+    "_rebaseline_2026_08_21_11069_m365_har_import": "#11069 own growth: AddApiKeyModal.tsx 1073->1080 (+7 = Import .har file button for the copilot-m365-web credential modal — M365 is the only provider whose credential (access_token+chathubPath) must be extracted from a DevTools HAR WebSocket URL, added as a new modal affordance). Cohesive UI at the existing modal chokepoint; not extractable. Covered by tests/unit/m365-har-import*.test.ts."
  },
  "_rebaseline_base_2026_08_10_proxyfetch": "Base-red fix (green-prs sweep, issue #9985): open-sse/utils/proxyFetch.ts 1207 > cap 1000 — new proxied-TLS fetch helper introduced by the Fal reference-image work. Owner-authorized quick rebaseline to green; structural slim tracked for v3.9.0.",
  "_rebaseline_2026_07_27_v3849_train2": "Merge-train 2 (7 PRs) — owner-approved 2026-07-27. Single entry: chatCore.ts 4955->5006 (#8595, Responses multi-turn image compaction before the context hard-reject). Genuine irreducible growth at the existing compaction chokepoint in handleChatCore — the PR adds a last-resort retry against the concrete budget plus the estimateFinalInputTokens helper, both wired at the pre-existing call site rather than a new branch. Covered by tests/unit/8560-responses-image-compaction.test.ts (4 tests).",
--- a/config/release/changelog-reconciliations.json
+++ b/config/release/changelog-reconciliations.json
@@ -1,4 +0,0 @@
-{
-  "schemaVersion": 1,
-  "reconciliations": []
-}
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -43,21 +43,8 @@ x-common: &common
    - LIVE_WS_ALLOWED_ORIGINS=${LIVE_WS_ALLOWED_ORIGINS:-http://localhost:20128,http://127.0.0.1:20128}
    - REDIS_URL=${REDIS_URL:-redis://redis:6379}
    - NODE_OPTIONS=--max-old-space-size=2048
-    # Codex App-Server transport (provider: codex-app-server). Inert unless the
-    # `codex-app-server` compose profile is up (the sidecar below). Points the app
-    # at the internal sidecar; the capability token is shared via the mounted file.
-    - OMNIROUTE_CODEX_APPSERVER_WS=${OMNIROUTE_CODEX_APPSERVER_WS:-ws://codex-app-server:1456}
-    - OMNIROUTE_CODEX_APPSERVER_WS_TOKEN_FILE=${OMNIROUTE_CODEX_APPSERVER_WS_TOKEN_FILE:-/run/codex-appserver/token}
  volumes:
    - ./data:/app/data
-    # Shared capability token + codex auth for the app-server WS. Only meaningful
-    # when the codex-app-server profile is active. The token dir carries the WS
-    # capability token; the codex home is where the dashboard "Apply auth" writes
-    # ~/.codex/auth.json (getCliConfigPaths("codex") = <home>/.codex; the base
-    # image runs as `node`, so /home/node/.codex) and the SAME volume is mounted
-    # into the sidecar so its `codex app-server` reads the same auth.
-    - codex-appserver-token:/run/codex-appserver
-    - codex-appserver-home:/home/node/.codex
  healthcheck:
    test: ["CMD", "node", "healthcheck.mjs"]
    interval: 30s
@@ -303,59 +290,6 @@ services:
    profiles:
      - cliproxyapi

-  # ── Profile: codex-app-server (Codex CLI app-server sidecar) ──────────
-  # A PLAIN Codex app-server for the `codex-app-server` provider: OmniRoute drives
-  # the Codex CLI's own `codex app-server` over JSON-RPC/WebSocket instead of
-  # replaying a session token to the API. It listens ONLY on the internal compose
-  # network (ws://codex-app-server:1456), guarded by a capability token — it is
-  # NEVER published to the host / internet. The Codex CLI (baked into
-  # omniroute:base) self-manages its OpenAI OAuth via the shared ~/.codex volume,
-  # which the dashboard "Apply auth" (device-OAuth) writes and this sidecar reads.
-  #
-  # NOTE: this is the GENERIC public sidecar. An operator wanting residential /
-  # UDP egress (via a TUN sidecar) runs that separately as an override; it is
-  # intentionally not shipped here.
-  codex-app-server:
-    image: omniroute:base
-    container_name: omniroute-codex-app-server
-    restart: unless-stopped
-    # Generate the WS capability token on first boot if absent, then run the
-    # app-server. entrypoint is overridden because the base image's default is the
-    # Next.js server.
-    entrypoint: ["/bin/sh", "-c"]
-    command:
-      - |
-        set -e
-        TOKEN_FILE=/run/codex-appserver/token
-        mkdir -p /run/codex-appserver
-        if [ ! -s "$$TOKEN_FILE" ]; then
-          # 32-byte hex capability token; shared with the app via the token volume.
-          TF="$$TOKEN_FILE" node -e 'require("fs").writeFileSync(process.env.TF, require("crypto").randomBytes(32).toString("hex"))' 2>/dev/null || \
-            { head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n' > "$$TOKEN_FILE"; }
-          chmod 600 "$$TOKEN_FILE"
-        fi
-        exec codex app-server \
-          --listen ws://0.0.0.0:1456 \
-          --ws-auth capability-token \
-          --ws-token-file "$$TOKEN_FILE"
-    environment:
-      - CODEX_HOME=/home/node/.codex
-      - RUST_LOG=${CODEX_APPSERVER_RUST_LOG:-warn}
-    volumes:
-      - codex-appserver-token:/run/codex-appserver
-      - codex-appserver-home:/home/node/.codex
-    # No `ports:` — internal-only. Reached at ws://codex-app-server:1456 over the
-    # compose network by the omniroute app.
-    healthcheck:
-      test:
-        ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:1456/readyz',r=>process.exit(r.statusCode===200?0:1)).on('error',()=>process.exit(1))"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-      start_period: 10s
-    profiles:
-      - codex-app-server
-
 volumes:
  chatgpt-web-codex-browser-data:
    name: omniroute-chatgpt-web-codex-browser-data
@@ -367,7 +301,3 @@ volumes:
    name: omniroute-qdrant-data
  bifrost-data:
    name: omniroute-bifrost-data
-  codex-appserver-token:
-    name: omniroute-codex-appserver-token
-  codex-appserver-home:
-    name: omniroute-codex-appserver-home
--- a/docs/architecture/ARCHITECTURE.md
+++ b/docs/architecture/ARCHITECTURE.md
@@ -17,7 +17,7 @@ It provides a single OpenAI-compatible endpoint (`/v1/*`) and routes traffic acr

 Core capabilities:

- OpenAI-compatible API surface for CLI/tools (349 providers, 107 executors)
+- OpenAI-compatible API surface for CLI/tools (338 providers, 100 executors)
 - Request/response translation across provider formats
 - Model combo fallback (multi-model sequence)
 - Structured combo steps (`provider + model + connection`) with runtime ordering by `compositeTiers`
--- a/docs/architecture/AUTHZ_GUIDE.md
+++ b/docs/architecture/AUTHZ_GUIDE.md
@@ -108,48 +108,24 @@ A successful policy returns `AuthSubject` with `kind ∈ { client_api_key, dashb

 `src/shared/constants/publicApiRoutes.ts` is the explicit allowlist:

-The list is split by **shape**, and the split is load-bearing (GHSA-74g9-q8f6-793h): a prefix is
-matched with `startsWith()`, so it also matches every adjacent path sharing its leading characters.
-`/api/usage/om-usage` as a prefix marked `/api/usage/om-usage<anything>` PUBLIC, and Next resolves
-that to `/api/usage/[connectionId]` — a handler with no auth of its own.
-
 ```ts
-// Genuine subtrees. Every entry MUST end in "/" (asserted by a unit test).
 PUBLIC_API_ROUTE_PREFIXES = [
-  "/api/auth/oidc/",
-  "/api/v1/", // treated as CLIENT_API in classify, not as "no-auth public"
-  "/api/oauth/",
-  "/api/codex/connect/",
-  "/api/telegram/",
-  "/api/cursor-cli/",
-];
-
-// Single routes, matched EXACTLY (with or without a trailing slash).
-PUBLIC_API_ROUTES_EXACT = new Set([
  "/api/auth/login",
  "/api/auth/logout",
  "/api/auth/status",
  "/api/init",
+  "/api/v1/", // treated as CLIENT_API in classify, not as "no-auth public"
+  "/api/cloud/",
  "/api/sync/bundle",
-  "/api/cli/connect",
-  "/api/usage/om-usage",
-  "/api/skills/collect/chaos",
-]);
-
-// Read-only single routes that also take the CORS origin relaxation.
-PUBLIC_READONLY_CORS_API_ROUTES = [
-  "/api/health/ping",
-  "/api/monitoring/health",
-  "/api/settings/require-login",
+  "/api/oauth/",
 ];

-// Read-only single route WITHOUT the CORS relaxation.
-PUBLIC_READONLY_API_ROUTES_EXACT = new Set(["/api/health"]);
+PUBLIC_READONLY_API_ROUTE_PREFIXES = ["/api/monitoring/health", "/api/settings/require-login"];

 PUBLIC_READONLY_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
 ```

-Read-only routes are public **only** for safe methods. Note: `classifyRoute()` excludes `/api/v1/*` and `/api/v1beta/*` from the PUBLIC fall-through — those are always `CLIENT_API` so the Bearer-key policy still applies.
+Read-only prefixes are public **only** for safe methods. Note: `classifyRoute()` excludes `/api/v1/*` and `/api/v1beta/*` from the PUBLIC fall-through — those are always `CLIENT_API` so the Bearer-key policy still applies.

 ## Adding a New Route

@@ -192,7 +168,7 @@ export async function POST(request: Request) {

 ### Pattern 3 — Adding to the public allowlist

-Pick the set by shape, not by convenience. One route goes in `PUBLIC_API_ROUTES_EXACT` (or `PUBLIC_READONLY_CORS_API_ROUTES` for GET-only); only a genuine subtree goes in `PUBLIC_API_ROUTE_PREFIXES`, and it **must end in `/`**. Putting a single route in the prefix list also publishes every adjacent path that shares its leading characters — including dynamic-segment siblings added later (GHSA-74g9-q8f6-793h). Update unit tests at `tests/unit/public-api-routes.test.ts`, `tests/unit/authz/public-route-exact-match.test.ts` and `tests/unit/authz/classify.test.ts`.
+Add the prefix to `PUBLIC_API_ROUTE_PREFIXES` (or `PUBLIC_READONLY_API_ROUTE_PREFIXES` for GET-only). Update unit tests at `tests/unit/public-api-routes.test.ts` and `tests/unit/authz/classify.test.ts`.

 ## Scopes

--- a/docs/architecture/CODEBASE_DOCUMENTATION.md
+++ b/docs/architecture/CODEBASE_DOCUMENTATION.md
@@ -451,7 +451,7 @@ open-sse/
 ├── types.d.ts
 ├── config/                 Provider registries, header profiles, identity, …
 ├── handlers/               Request handlers (chat, embeddings, audio, image, …)
-├── executors/              107 provider-specific HTTP executors
+├── executors/              101 provider-specific HTTP executors
 ├── translator/             Format conversion (OpenAI ↔ Claude ↔ Gemini ↔ Cursor ↔ Kiro)
 ├── transformer/            Responses API ↔ Chat Completions stream transformer
 ├── services/               80+ service modules (combos, fallback, quotas, identity, …)
--- a/docs/diagrams/README.md
+++ b/docs/diagrams/README.md
@@ -16,7 +16,7 @@ Mermaid sources (`.mmd`) and exported SVGs for OmniRoute v3.8.0 architecture flo
 | [auto-combo-12factor.mmd](./auto-combo-12factor.mmd) | [SVG](./exported/auto-combo-12factor.svg) | docs/routing/AUTO-COMBO.md                                                     |
 | [resilience-3layers.mmd](./resilience-3layers.mmd)   | [SVG](./exported/resilience-3layers.svg)  | docs/architecture/RESILIENCE_GUIDE.md, CLAUDE.md                               |
 | [i18n-flow.mmd](./i18n-flow.mmd)                     | [SVG](./exported/i18n-flow.svg)           | docs/guides/I18N.md                                                            |
-| [mcp-tools-107.mmd](./mcp-tools-107.mmd)             | [SVG](./exported/mcp-tools-107.svg)       | docs/frameworks/MCP-SERVER.md                                                  |
+| [mcp-tools-107.mmd](./mcp-tools-107.mmd)               | [SVG](./exported/mcp-tools-107.svg)        | docs/frameworks/MCP-SERVER.md                                                  |
 | [cloud-agent-flow.mmd](./cloud-agent-flow.mmd)       | [SVG](./exported/cloud-agent-flow.svg)    | docs/frameworks/CLOUD_AGENT.md                                                 |
 | [authz-pipeline.mmd](./authz-pipeline.mmd)           | [SVG](./exported/authz-pipeline.svg)      | docs/architecture/AUTHZ_GUIDE.md                                               |
 | [db-schema-overview.mmd](./db-schema-overview.mmd)   | [SVG](./exported/db-schema-overview.svg)  | docs/architecture/CODEBASE_DOCUMENTATION.md                                    |
@@ -34,11 +34,11 @@ inside GitHub's `<img>` sandbox:
 | [combo-always-on.svg](./combo-always-on.svg)           | style reference  | Animated priority-combo fallback (4 layers, 16s loop). Edit the SVG directly — there is no `.mmd` source.                                                                                                                 |
 | [cli-terminal.svg](./cli-terminal.svg)                 | README.md (root) | Compact half-height animated terminal (1200×350): 3 real CLI commands cycling with typewriter + scrolling subcommand ticker; first frame = completed providers screen. Edit the SVG directly — there is no `.mmd` source. |
 | [compression-pipeline.svg](./compression-pipeline.svg) | README.md (root) | Animated 10-engine compression funnel (8s loop). Edit the SVG directly — there is no `.mmd` source.                                                                                                                       |
-| [free-tier-budget.svg](./free-tier-budget.svg)         | README.md (root) | Animated free-tier budget card (~1.51B/mo quantified headline, 20-pool budget bar, per-pool grid, signup credits, 10s loop). Edit the SVG directly — there is no `.mmd` source.                                           |
-| [readme-hero.svg](./readme-hero.svg)                   | README.md (root) | Animated hero card (tagline, live provider/free-access headline, full-width compression bar demo, 6 stat chips). Edit the SVG directly — there is no `.mmd` source.                                                       |
+| [free-tier-budget.svg](./free-tier-budget.svg)         | README.md (root) | Animated free-tier budget card (~1.53B/mo quantified headline, 19-pool budget bar, per-model grid, signup credits, 10s loop). Edit the SVG directly — there is no `.mmd` source.                                              |
+| [readme-hero.svg](./readme-hero.svg)                   | README.md (root) | Animated hero card (tagline, live provider/free-access headline, full-width compression bar demo, 6 stat chips). Edit the SVG directly — there is no `.mmd` source.                                                      |
 | [promise-pillars.svg](./promise-pillars.svg)           | README.md (root) | Animated "The Promise" 6-pillar card (12s border-highlight sweep). Edit the SVG directly — there is no `.mmd` source.                                                                                                     |
 | [why-pain-fix.svg](./why-pain-fix.svg)                 | README.md (root) | Animated "Why OmniRoute" 10-row pain-vs-fix ledger (15s green row sweep). Edit the SVG directly — there is no `.mmd` source.                                                                                              |
-| [strategies-grid.svg](./strategies-grid.svg)           | README.md (root) | Animated grid illustrating 18 of the 19 routing strategies; `cache-optimized` remains documented in the adjacent table. Edit the SVG directly — there is no `.mmd` source.                                                |
+| [strategies-grid.svg](./strategies-grid.svg)           | README.md (root) | Animated grid illustrating 18 of the 19 routing strategies; `cache-optimized` remains documented in the adjacent table. Edit the SVG directly — there is no `.mmd` source.                                               |
 | [privacy-local.svg](./privacy-local.svg)               | README.md (root) | Animated "Private & Local-First" 11-row guarantee ledger with receipt chips (16s green row sweep). Edit the SVG directly — there is no `.mmd` source.                                                                     |
 | [resilience-layers.svg](./resilience-layers.svg)       | README.md (root) | Animated 3-layer resilience card (breaker states CLOSED→OPEN→HALF-OPEN, key cooldown with ×2 backoff, model lockout — 18s loops). Edit the SVG directly — there is no `.mmd` source.                                      |

--- a/docs/diagrams/auto-combo-12factor.mmd
+++ b/docs/diagrams/auto-combo-12factor.mmd
@@ -1,28 +1,24 @@
-%% Auto-Combo 15-factor scoring
+%% Auto-Combo 13-factor scoring
 %% Reflects: open-sse/services/autoCombo/scoring.ts (DEFAULT_WEIGHTS, sum = 1.0)
-%% v3.8.50
-%% svg-title: OmniRoute Auto-Combo 15-factor scoring
-%% svg-description: Flow from an incoming request through eligible candidates, the 15 weighted scoring factors, descending score sort, top-N selection, and sequential dispatch.
+%% v3.8.49
 flowchart TB
  Request["Incoming request"] --> Candidates["Eligible candidates<br/>(provider × model × account)"]
  Candidates --> Score["Compute composite score<br/>per candidate"]

-  subgraph Factors["15-factor scoring weights (sum = 1.0)"]
-    f1["quota (0.1429)"]
-    f2["health (0.1605)"]
-    f3["costInv (0.1429)"]
-    f4["latencyInv (0.1143)"]
-    f5["taskFit (0.0762)"]
-    f6["stability (0.0476)"]
-    f7["tierPriority (0.0476)"]
-    f8["tierAffinity (0.0476)"]
-    f9["specificityMatch (0.0476)"]
-    f10["contextAffinity (0.0476)"]
-    f11["cacheAffinity (0.0000)"]
-    f12["sessionAvailability (0.0476)"]
-    f13["resetWindowAffinity (0.0000)"]
-    f14["connectionDensity (0.0476)"]
-    f15["quality (0.0300)"]
+  subgraph Factors["13-factor scoring weights (sum = 1.0)"]
+    f1["health (0.20)"]
+    f2["quota (0.15)"]
+    f3["costInv (0.15)"]
+    f4["latencyInv (0.12)"]
+    f5["taskFit (0.08)"]
+    f6["stability (0.05)"]
+    f7["tierPriority (0.05)"]
+    f8["tierAffinity (0.05)"]
+    f9["specificityMatch (0.05)"]
+    f10["contextAffinity (0.05)"]
+    f11["connectionDensity (0.05)"]
+    f12["cacheAffinity (0.00)"]
+    f13["resetWindowAffinity (0.00)"]
  end

  Score --> Factors
--- a/docs/diagrams/cli-terminal.svg
+++ b/docs/diagrams/cli-terminal.svg
@@ -1,12 +1,12 @@
-<svg viewBox="0 0 1200 350" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="Animated terminal demoing the OmniRoute CLI: omniroute providers list (350 providers registered, anthropic, codex, glm, kimi shown active), omniroute combo list (always-on priority, cost-saver, fusion-panel, context-relay) and omniroute health (healthy, 18412 requests in 24h, p95 412ms, circuit breakers 24 closed, 1 half-open, 0 open), cycling over 85 top-level commands: providers, oauth, keys, combo, nodes, models, cache, compression, cost, usage, quota, health, resilience, telemetry, logs, audit, mcp, a2a, cloud, memory, skills, eval, doctor, repl, tunnel, backup, sync, webhooks, policy, pricing, translator, simulate and more.">
+<svg viewBox="0 0 1200 350" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="Animated terminal demoing the OmniRoute CLI: omniroute providers list (350 providers registered, anthropic, codex, glm, kimi shown active), omniroute combo list (always-on priority, cost-saver, fusion-panel, context-relay) and omniroute health (healthy, 18412 requests in 24h, p95 412ms, circuit breakers 24 closed, 1 half-open, 0 open), cycling over the 80+ command surface: providers, oauth, keys, combo, nodes, models, cache, compression, cost, usage, quota, health, resilience, telemetry, logs, audit, mcp, a2a, cloud, memory, skills, eval, doctor, repl, tunnel, backup, sync, webhooks, policy, pricing, translator, simulate and more.">
 <desc>Compact animated terminal cycling three real OmniRoute CLI commands with a typewriter effect and a scrolling subcommand ticker; the first frame shows the completed providers-list screen.</desc>
 <defs><clipPath id="tickerClip"><rect x="12" y="304" width="1176" height="40"/></clipPath><clipPath id="tw0"><rect x="64" y="46" height="26" width="0"><animate attributeName="width" calcMode="discrete" values="0;31;61;92;122;153;184;214;245;245" keyTimes="0;0.012;0.018;0.024;0.030;0.036;0.042;0.048;0.054;1" dur="18s" repeatCount="indefinite"/></rect></clipPath><clipPath id="tw1"><rect x="64" y="46" height="26" width="0"><animate attributeName="width" calcMode="discrete" values="0;26;51;76;102;128;153;178;204;204" keyTimes="0;0.348;0.351;0.357;0.363;0.369;0.375;0.381;0.387;1" dur="18s" repeatCount="indefinite"/></rect></clipPath><clipPath id="tw2"><rect x="64" y="46" height="26" width="0"><animate attributeName="width" calcMode="discrete" values="0;20;41;61;82;102;122;143;163;163" keyTimes="0;0.678;0.684;0.690;0.696;0.702;0.708;0.714;0.720;1" dur="18s" repeatCount="indefinite"/></rect></clipPath></defs>
 <rect width="1200" height="350" fill="#0d1117"/>
 <rect x="0" y="0" width="1200" height="34" fill="#161b22"/>
 <path d="M 0 34 L 1200 34" stroke="#ffffff" stroke-opacity="0.08" stroke-width="1"/>
 <circle cx="24" cy="17" r="6" fill="#ff5f56"/><circle cx="46" cy="17" r="6" fill="#ffbd2e"/><circle cx="68" cy="17" r="6" fill="#27c93f"/>
-<text x="600" y="22" text-anchor="middle" font-family="Consolas, 'Courier New', monospace" font-size="13" fill="#71717a">omniroute &#8212; 85 top-level commands</text>
-<g font-family="Consolas, 'Courier New', monospace" font-size="17"><animate attributeName="opacity" values="1;0;0" keyTimes="0;0.006;1" dur="18s" repeatCount="indefinite"/><text x="64" y="66" fill="#F7F6FC">omniroute providers list</text><text x="40" y="100" font-weight="700" fill="#38bdf8">OmniRoute Providers</text><text x="40" y="128" fill="#a1a1aa">1f3a9c2e&#160;&#160;anthropic&#160;&#160;&#160;Claude Max 20x&#160;&#160;&#160;&#160;<tspan fill='#22c55e'>active</tspan></text><text x="40" y="154" fill="#a1a1aa">8c2d5b1a&#160;&#160;codex&#160;&#160;&#160;&#160;&#160;&#160;&#160;Codex Pro (team)&#160;&#160;<tspan fill='#22c55e'>active</tspan></text><text x="40" y="180" fill="#a1a1aa">f4e0a97b&#160;&#160;glm&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;GLM Coding Plan&#160;&#160;&#160;<tspan fill='#22c55e'>active</tspan></text><text x="40" y="206" fill="#a1a1aa">03bd6e5f&#160;&#160;kimi&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;Kimi K2 free&#160;&#160;&#160;&#160;&#160;&#160;<tspan fill='#22c55e'>active</tspan></text><text x="40" y="232" fill="#71717a">&#8230; 346 more providers</text></g><g opacity="1" font-family="Consolas, 'Courier New', monospace" font-size="17">
+<text x="600" y="22" text-anchor="middle" font-family="Consolas, 'Courier New', monospace" font-size="13" fill="#71717a">omniroute &#8212; 80+ commands</text>
+<g font-family="Consolas, 'Courier New', monospace" font-size="17"><animate attributeName="opacity" values="1;0;0" keyTimes="0;0.006;1" dur="18s" repeatCount="indefinite"/><text x="64" y="66" fill="#F7F6FC">omniroute providers list</text><text x="40" y="100" font-weight="700" fill="#38bdf8">OmniRoute Providers</text><text x="40" y="128" fill="#a1a1aa">1f3a9c2e&#160;&#160;anthropic&#160;&#160;&#160;Claude Max 20x&#160;&#160;&#160;&#160;<tspan fill='#22c55e'>active</tspan></text><text x="40" y="154" fill="#a1a1aa">8c2d5b1a&#160;&#160;codex&#160;&#160;&#160;&#160;&#160;&#160;&#160;Codex Pro (team)&#160;&#160;<tspan fill='#22c55e'>active</tspan></text><text x="40" y="180" fill="#a1a1aa">f4e0a97b&#160;&#160;glm&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;GLM Coding Plan&#160;&#160;&#160;<tspan fill='#22c55e'>active</tspan></text><text x="40" y="206" fill="#a1a1aa">03bd6e5f&#160;&#160;kimi&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;Kimi K2 free&#160;&#160;&#160;&#160;&#160;&#160;<tspan fill='#22c55e'>active</tspan></text><text x="40" y="232" fill="#71717a">&#8230; 334 more providers</text></g><g opacity="1" font-family="Consolas, 'Courier New', monospace" font-size="17">
 <animate attributeName="opacity" values="1;1;0;0" keyTimes="0;0.315;0.33;1" dur="18s" repeatCount="indefinite"/>
 <text x="40" y="66" fill="#22c55e">$</text>
 <g clip-path="url(#tw0)"><text x="64" y="66" fill="#F7F6FC">omniroute providers list</text></g>
@@ -14,7 +14,7 @@
  <animate attributeName="x" calcMode="discrete" values="64;95;125;156;186;217;248;278;309;309" keyTimes="0.000;0.012;0.018;0.024;0.030;0.036;0.042;0.048;0.054;1" dur="18s" repeatCount="indefinite"/>
  <animate attributeName="opacity" values="0;0;1;0.2;1;0.2;1;0;0" keyTimes="0;0.011;0.012;0.022;0.032;0.042;0.052;0.074;1" dur="18s" repeatCount="indefinite"/>
 </rect>
-<text x="40" y="100" font-weight="700" fill="#38bdf8" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.045;0.047" dur="18s" repeatCount="indefinite"/>OmniRoute Providers</text><text x="40" y="128" fill="#a1a1aa" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.053;0.055" dur="18s" repeatCount="indefinite"/>1f3a9c2e&#160;&#160;anthropic&#160;&#160;&#160;Claude Max 20x&#160;&#160;&#160;&#160;<tspan fill='#22c55e'>active</tspan></text><text x="40" y="154" fill="#a1a1aa" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.061;0.063" dur="18s" repeatCount="indefinite"/>8c2d5b1a&#160;&#160;codex&#160;&#160;&#160;&#160;&#160;&#160;&#160;Codex Pro (team)&#160;&#160;<tspan fill='#22c55e'>active</tspan></text><text x="40" y="180" fill="#a1a1aa" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.069;0.07100000000000001" dur="18s" repeatCount="indefinite"/>f4e0a97b&#160;&#160;glm&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;GLM Coding Plan&#160;&#160;&#160;<tspan fill='#22c55e'>active</tspan></text><text x="40" y="206" fill="#a1a1aa" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.077;0.079" dur="18s" repeatCount="indefinite"/>03bd6e5f&#160;&#160;kimi&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;Kimi K2 free&#160;&#160;&#160;&#160;&#160;&#160;<tspan fill='#22c55e'>active</tspan></text><text x="40" y="232" fill="#71717a" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.085;0.08700000000000001" dur="18s" repeatCount="indefinite"/>&#8230; 346 more providers</text>
+<text x="40" y="100" font-weight="700" fill="#38bdf8" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.045;0.047" dur="18s" repeatCount="indefinite"/>OmniRoute Providers</text><text x="40" y="128" fill="#a1a1aa" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.053;0.055" dur="18s" repeatCount="indefinite"/>1f3a9c2e&#160;&#160;anthropic&#160;&#160;&#160;Claude Max 20x&#160;&#160;&#160;&#160;<tspan fill='#22c55e'>active</tspan></text><text x="40" y="154" fill="#a1a1aa" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.061;0.063" dur="18s" repeatCount="indefinite"/>8c2d5b1a&#160;&#160;codex&#160;&#160;&#160;&#160;&#160;&#160;&#160;Codex Pro (team)&#160;&#160;<tspan fill='#22c55e'>active</tspan></text><text x="40" y="180" fill="#a1a1aa" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.069;0.07100000000000001" dur="18s" repeatCount="indefinite"/>f4e0a97b&#160;&#160;glm&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;GLM Coding Plan&#160;&#160;&#160;<tspan fill='#22c55e'>active</tspan></text><text x="40" y="206" fill="#a1a1aa" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.077;0.079" dur="18s" repeatCount="indefinite"/>03bd6e5f&#160;&#160;kimi&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;Kimi K2 free&#160;&#160;&#160;&#160;&#160;&#160;<tspan fill='#22c55e'>active</tspan></text><text x="40" y="232" fill="#71717a" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.085;0.08700000000000001" dur="18s" repeatCount="indefinite"/>&#8230; 334 more providers</text>
 </g><g opacity="0" font-family="Consolas, 'Courier New', monospace" font-size="17">
 <animate attributeName="opacity" values="0;0;1;1;0;0" keyTimes="0;0.333;0.34800000000000003;0.648;0.663;1" dur="18s" repeatCount="indefinite"/>
 <text x="40" y="66" fill="#22c55e">$</text>
@@ -32,11 +32,11 @@
  <animate attributeName="x" calcMode="discrete" values="64;84;105;125;146;166;186;207;227;227" keyTimes="0;0.678;0.684;0.690;0.696;0.702;0.708;0.714;0.720;1" dur="18s" repeatCount="indefinite"/>
  <animate attributeName="opacity" values="0;0;1;0.2;1;0.2;1;0;0" keyTimes="0;0.677;0.678;0.688;0.698;0.708;0.718;0.74;1" dur="18s" repeatCount="indefinite"/>
 </rect>
-<text x="40" y="100" font-weight="700" fill="#38bdf8" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.711;0.713" dur="18s" repeatCount="indefinite"/>OmniRoute Health</text><text x="40" y="128" fill="#a1a1aa" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.719;0.721" dur="18s" repeatCount="indefinite"/>&#160;&#160;Status: <tspan fill='#22c55e'>healthy</tspan>&#160;&#160;&#160;Uptime: 4d 12h 33m</text><text x="40" y="154" fill="#a1a1aa" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.727;0.729" dur="18s" repeatCount="indefinite"/>&#160;&#160;Requests (24h): 18,412&#160;&#160;&#160;p95: 412ms</text><text x="40" y="180" fill="#a1a1aa" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.735;0.737" dur="18s" repeatCount="indefinite"/>&#160;&#160;Breakers: <tspan fill='#22c55e'>&#9679; 24 closed</tspan>&#160;&#160;<tspan fill='#f59e0b'>&#9682; 1 half-open</tspan>&#160;&#160;<tspan fill='#ef4444'>&#9675; 0 open</tspan></text><text x="40" y="206" fill="#a1a1aa" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.743;0.745" dur="18s" repeatCount="indefinite"/>&#160;&#160;Providers: 350 registered&#160;&#160;&#160;90+ free tiers</text><text x="40" y="232" fill="#71717a" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.751;0.753" dur="18s" repeatCount="indefinite"/>&#8230; live: /dashboard &#183; omniroute status</text>
+<text x="40" y="100" font-weight="700" fill="#38bdf8" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.711;0.713" dur="18s" repeatCount="indefinite"/>OmniRoute Health</text><text x="40" y="128" fill="#a1a1aa" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.719;0.721" dur="18s" repeatCount="indefinite"/>&#160;&#160;Status: <tspan fill='#22c55e'>healthy</tspan>&#160;&#160;&#160;Uptime: 4d 12h 33m</text><text x="40" y="154" fill="#a1a1aa" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.727;0.729" dur="18s" repeatCount="indefinite"/>&#160;&#160;Requests (24h): 18,412&#160;&#160;&#160;p95: 412ms</text><text x="40" y="180" fill="#a1a1aa" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.735;0.737" dur="18s" repeatCount="indefinite"/>&#160;&#160;Breakers: <tspan fill='#22c55e'>&#9679; 24 closed</tspan>&#160;&#160;<tspan fill='#f59e0b'>&#9682; 1 half-open</tspan>&#160;&#160;<tspan fill='#ef4444'>&#9675; 0 open</tspan></text><text x="40" y="206" fill="#a1a1aa" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.743;0.745" dur="18s" repeatCount="indefinite"/>&#160;&#160;Providers: 338 registered&#160;&#160;&#160;90+ free tiers</text><text x="40" y="232" fill="#71717a" opacity="0"><animate attributeName="opacity" calcMode="discrete" values="0;0;1" keyTimes="0;0.751;0.753" dur="18s" repeatCount="indefinite"/>&#8230; live: /dashboard &#183; omniroute status</text>
 </g>
 <path d="M 0 300 L 1200 300" stroke="#ffffff" stroke-opacity="0.08" stroke-width="1"/>
 <g clip-path="url(#tickerClip)"><g font-family="Consolas, 'Courier New', monospace" font-size="14" fill="#71717a">
 <animateTransform attributeName="transform" type="translate" from="0 0" to="-2432 0" dur="55s" repeatCount="indefinite"/>
 <text x="24" y="330"><tspan fill="#8b5cf6">providers</tspan> &#183; oauth &#183; keys &#183; <tspan fill="#8b5cf6">combo</tspan> &#183; nodes &#183; models &#183; cache &#183; <tspan fill="#8b5cf6">compression</tspan> &#183; cost &#183; usage &#183; quota &#183; <tspan fill="#8b5cf6">health</tspan> &#183; resilience &#183; telemetry &#183; logs &#183; audit &#183; <tspan fill="#8b5cf6">mcp</tspan> &#183; a2a &#183; cloud &#183; <tspan fill="#8b5cf6">memory</tspan> &#183; skills &#183; eval &#183; <tspan fill="#8b5cf6">doctor</tspan> &#183; repl &#183; tunnel &#183; backup &#183; sync &#183; webhooks &#183; policy &#183; pricing &#183; translator &#183; simulate &#8230;</text><text x="2456" y="330"><tspan fill="#8b5cf6">providers</tspan> &#183; oauth &#183; keys &#183; <tspan fill="#8b5cf6">combo</tspan> &#183; nodes &#183; models &#183; cache &#183; <tspan fill="#8b5cf6">compression</tspan> &#183; cost &#183; usage &#183; quota &#183; <tspan fill="#8b5cf6">health</tspan> &#183; resilience &#183; telemetry &#183; logs &#183; audit &#183; <tspan fill="#8b5cf6">mcp</tspan> &#183; a2a &#183; cloud &#183; <tspan fill="#8b5cf6">memory</tspan> &#183; skills &#183; eval &#183; <tspan fill="#8b5cf6">doctor</tspan> &#183; repl &#183; tunnel &#183; backup &#183; sync &#183; webhooks &#183; policy &#183; pricing &#183; translator &#183; simulate &#8230;</text>
 </g></g>
-</svg>
+</svg>
--- a/docs/diagrams/comparison-table.svg
+++ b/docs/diagrams/comparison-table.svg
@@ -23,7 +23,7 @@
  <g font-family="Inter, 'Segoe UI', Arial, Helvetica, system-ui, sans-serif">
    <g opacity="0"><animate attributeName="opacity" values="0;1" dur="0.4s" begin="0.15s" fill="freeze"/>
      <text x="44" y="196" font-size="14.5" fill="#c9d1d9">Providers</text>
-      <text x="440" y="196" text-anchor="middle" font-family="Inter, 'Segoe UI', Arial, Helvetica, system-ui, sans-serif" font-size="15" font-weight="800" fill="#7ee787">350</text>
+      <text x="440" y="196" text-anchor="middle" font-family="Inter, 'Segoe UI', Arial, Helvetica, system-ui, sans-serif" font-size="15" font-weight="800" fill="#7ee787">338</text>
      <text x="604" y="196" text-anchor="middle" font-family="Inter, 'Segoe UI', Arial, Helvetica, system-ui, sans-serif" font-size="13.5" font-weight="600" fill="#8b949e">40+</text>
      <text x="760" y="196" text-anchor="middle" font-family="Inter, 'Segoe UI', Arial, Helvetica, system-ui, sans-serif" font-size="13.5" font-weight="600" fill="#8b949e">400+*</text>
      <text x="916" y="196" text-anchor="middle" font-family="Inter, 'Segoe UI', Arial, Helvetica, system-ui, sans-serif" font-size="13.5" font-weight="600" fill="#8b949e">~5</text>
@@ -57,7 +57,7 @@
    </g>
    <g opacity="0"><animate attributeName="opacity" values="0;1" dur="0.4s" begin="0.51s" fill="freeze"/>
      <text x="44" y="364" font-size="14.5" fill="#c9d1d9">Built-in MCP server (own tools)</text>
-      <text x="440" y="364" text-anchor="middle" font-family="Inter, 'Segoe UI', Arial, Helvetica, system-ui, sans-serif" font-size="15" font-weight="800" fill="#7ee787">110</text>
+      <text x="440" y="364" text-anchor="middle" font-family="Inter, 'Segoe UI', Arial, Helvetica, system-ui, sans-serif" font-size="15" font-weight="800" fill="#7ee787">109</text>
      <use href="#no" x="604" y="359"/>
      <use href="#mid" x="760" y="359"/>
      <use href="#no" x="916" y="359"/>
--- a/docs/diagrams/exported/auto-combo-12factor.svg
+++ b/docs/diagrams/exported/auto-combo-12factor.svg
--- a/docs/diagrams/free-tier-budget.svg
+++ b/docs/diagrams/free-tier-budget.svg
@@ -1,5 +1,4 @@
-<svg viewBox="0 0 1200 842" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="OmniRoute free-tier budget: about 1.51 billion free tokens per month steady, up to about 2.13 billion in the first month with signup credits. The catalog contains 455 rows, 448 active and 7 discontinued, grouped into 40 recurring pool keys; 20 pools have a published positive monthly token budget and 20 have a zero, uncapped, or keyless budget. Honest pool-deduped math counts each shared free pool once; 15 providers carry a terms-of-service avoid flag. The 20 quantified pools are Mistral 1 billion, LLM7 150 million, Nara 150 million, Gemini 60 million, Cerebras 30 million, Cloudflare AI 30 million, API Airforce 24 million, Ollama Cloud 20 million, Groq 15 million, Bluesminds 7.2 million, SambaNova 6 million, Arcee 4.8 million, Navy 4.5 million, BazaarLink 3.6 million, OpenRouter 1.2 million, Cohere 800 thousand, HuggingChat 500 thousand, Morph 400 thousand, Hugging Face 200 thousand, and Kiro 25 thousand. One-time signup credits add about 626 million. Uncapped providers and the OpenRouter top-up boost are shown separately so they do not inflate the headline. Live usage remains available at /dashboard/free-tiers.">
-  <desc>Pool-deduplicated chart of the 20 recurring free-token pools with positive published budgets, plus signup credits and uncapped providers shown separately.</desc>
+<svg viewBox="0 0 1200 842" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="OmniRoute free-tier budget: about 1.51 billion free tokens per month steady, up to about 2.13 billion in your first month with signup credits, aggregated from the documented free tiers of 40 provider pools and 495 models behind one endpoint, live on /dashboard/free-tiers. Honest pool-deduped math: each shared free pool is counted once — counting every rate limit 24/7 would read about 10B, which we don't publish; 15 providers carry a ToS flag so you decide. Budget bar of the 19 countable free pools with per-model breakdown: Mistral Large 3 1B, GPT-4o mini 150M, Gemini 2.5 Flash 60M, GLM 4.7 30M, Llama 3.3 70B 30M, Grok-3 24M, DeepSeek V4 Pro 20M, GPT-4.1 18M, Llama 4 Scout 15M, GPT-4o 7M, MiniMax-M2.7 6M, Arcee Trinity 5M, and more. First month adds one-time signup credits of about 626M (vertex 300M, agentrouter 200M, predibase 25M, together 25M, glm-cn 20M, doubao 15M, ai21 10M, longcat 10M, deepseek 5M, hyperbolic 5M, nscale 5M). Plus the un-countable: permanently-free no-token-cap providers (SiliconFlow, Z.AI GLM-Flash, Kilo, OpenCode Zen, baidu and more) and a $10 OpenRouter top-up unlocking +24M per month, surfaced separately so they never inflate the headline. Live used/remaining and per-model breakdown on the dashboard.">
  <defs>
    <pattern id="gridPaperF" width="32" height="32" patternUnits="userSpaceOnUse">
      <path d="M 32 0 L 0 0 0 32" fill="none" stroke="#ffffff" stroke-opacity="0.06" stroke-width="1"/>
@@ -64,7 +63,7 @@
  <text x="60" y="228" font-family="Consolas, 'Courier New', monospace" font-size="104" font-weight="800" fill="url(#gradBrandF)">~1.51B</text>
  <text x="62" y="266" font-family="Consolas, 'Courier New', monospace" font-size="15" letter-spacing="3" font-weight="700" fill="#a1a1aa">FREE TOKENS / MONTH &#183; <tspan fill="#22c55e">STEADY</tspan></text>
  <text x="62" y="298" font-family="Inter, 'Segoe UI', Arial, Helvetica, system-ui, sans-serif" font-size="16" fill="#F7F6FC">up to <tspan font-weight="800" fill="#22c55e">~2.13B</tspan> in your first month &#8212; signup credits</text>
-  <text x="62" y="326" font-family="Consolas, 'Courier New', monospace" font-size="12" fill="#71717a">documented free tiers &#183; <tspan fill="#8b5cf6">40 recurring pools</tspan> &#183; <tspan fill="#8b5cf6">455 catalog entries</tspan> &#183; one endpoint</text>
+  <text x="62" y="326" font-family="Consolas, 'Courier New', monospace" font-size="12" fill="#71717a">documented free tiers &#183; <tspan fill="#8b5cf6">40 provider pools</tspan> &#183; <tspan fill="#8b5cf6">495 models</tspan> &#183; one endpoint</text>

  <!-- ═══ Panel · The honest math ═══ -->
  <rect x="680" y="84" width="460" height="216" rx="14" fill="#161b22" stroke="#ffffff" stroke-opacity="0.08" stroke-width="1"/>
@@ -80,61 +79,59 @@
  <text x="836" y="244" font-family="Consolas, 'Courier New', monospace" font-size="11.5" fill="#22c55e">counted once &#10003;</text>
  <text x="704" y="280" font-family="Consolas, 'Courier New', monospace" font-size="12" fill="#f59e0b"><tspan font-weight="800">15 providers</tspan> ToS-flagged <tspan fill="#71717a">&#8212; we flag it &#183; you decide</tspan></text>

-  <!-- ═══ Budget bar · 20 quantified recurring pools ═══ -->
-  <text x="60" y="356" font-family="Consolas, 'Courier New', monospace" font-size="10.5" letter-spacing="2.5" font-weight="700" fill="#a78bfa">WHERE IT COMES FROM &#183; <tspan fill="#F7F6FC">20 QUANTIFIED RECURRING POOLS</tspan></text>
+  <!-- ═══ Budget bar · 19 countable pools ═══ -->
+  <text x="60" y="356" font-family="Consolas, 'Courier New', monospace" font-size="10.5" letter-spacing="2.5" font-weight="700" fill="#a78bfa">WHERE IT COMES FROM &#183; <tspan fill="#F7F6FC">19 COUNTABLE FREE POOLS</tspan></text>
  <g clip-path="url(#barShapeF)">
    <rect x="60" y="372" width="1080" height="18" fill="#1c2230"/>
    <g clip-path="url(#barRevF)">
-      <rect x="60.0" y="372" width="661.4" height="18" fill="#6c5ce7"/>
-      <rect x="722.4" y="372" width="99.2" height="18" fill="#00b894"/>
-      <rect x="822.6" y="372" width="99.2" height="18" fill="#0984e3"/>
-      <rect x="922.9" y="372" width="39.7" height="18" fill="#e17055"/>
-      <rect x="963.5" y="372" width="19.8" height="18" fill="#fdcb6e"/>
-      <rect x="984.4" y="372" width="19.8" height="18" fill="#e84393"/>
-      <rect x="1005.2" y="372" width="15.9" height="18" fill="#00cec9"/>
-      <rect x="1022.1" y="372" width="13.2" height="18" fill="#d63031"/>
-      <rect x="1036.3" y="372" width="9.9" height="18" fill="#a29bfe"/>
-      <rect x="1047.3" y="372" width="7.5" height="18" fill="#55efc4"/>
-      <rect x="1055.8" y="372" width="7.5" height="18" fill="#74b9ff"/>
-      <rect x="1064.3" y="372" width="7.5" height="18" fill="#ffeaa7"/>
-      <rect x="1072.8" y="372" width="7.5" height="18" fill="#fab1a0"/>
-      <rect x="1081.3" y="372" width="7.5" height="18" fill="#81ecec"/>
-      <rect x="1089.9" y="372" width="7.5" height="18" fill="#6c5ce7"/>
-      <rect x="1098.4" y="372" width="7.5" height="18" fill="#00b894"/>
-      <rect x="1106.9" y="372" width="7.5" height="18" fill="#0984e3"/>
-      <rect x="1115.4" y="372" width="7.5" height="18" fill="#e17055"/>
-      <rect x="1124.0" y="372" width="7.5" height="18" fill="#fdcb6e"/>
-      <rect x="1132.5" y="372" width="7.5" height="18" fill="#e84393"/>
+      <rect x="60.0" y="372" width="662.3" height="18" fill="#6c5ce7"/>
+      <rect x="723.3" y="372" width="106.7" height="18" fill="#00b894"/>
+      <rect x="831.0" y="372" width="47.9" height="18" fill="#0984e3"/>
+      <rect x="879.9" y="372" width="28.3" height="18" fill="#e17055"/>
+      <rect x="909.2" y="372" width="28.3" height="18" fill="#fdcb6e"/>
+      <rect x="938.5" y="372" width="24.4" height="18" fill="#e84393"/>
+      <rect x="963.9" y="372" width="21.8" height="18" fill="#00cec9"/>
+      <rect x="986.7" y="372" width="20.5" height="18" fill="#d63031"/>
+      <rect x="1008.2" y="372" width="18.5" height="18" fill="#a29bfe"/>
+      <rect x="1027.7" y="372" width="13.3" height="18" fill="#55efc4"/>
+      <rect x="1042.0" y="372" width="12.6" height="18" fill="#74b9ff"/>
+      <rect x="1055.6" y="372" width="12.0" height="18" fill="#ffeaa7"/>
+      <rect x="1068.6" y="372" width="11.3" height="18" fill="#fab1a0"/>
+      <rect x="1080.9" y="372" width="9.4" height="18" fill="#81ecec"/>
+      <rect x="1091.3" y="372" width="9.2" height="18" fill="#6c5ce7"/>
+      <rect x="1101.5" y="372" width="9.0" height="18" fill="#00b894"/>
+      <rect x="1111.5" y="372" width="9.0" height="18" fill="#0984e3"/>
+      <rect x="1121.5" y="372" width="8.8" height="18" fill="#e17055"/>
+      <rect x="1131.3" y="372" width="8.7" height="18" fill="#fdcb6e"/>
    </g>
  </g>
  <circle r="3.2" fill="#F7F6FC">
    <animateMotion path="M 60,381 L 1140,381" keyPoints="0;0;1;1" keyTimes="0;0.02;0.24;1" calcMode="linear" dur="10s" repeatCount="indefinite"/>
    <animate attributeName="opacity" values="0;1;1;0;0" keyTimes="0;0.02;0.23;0.26;1" dur="10s" repeatCount="indefinite"/>
  </circle>
-  <text x="60" y="416" font-family="Consolas, 'Courier New', monospace" font-size="11.5" fill="#71717a">each segment = one recurring pool &#183; widths floored so every pool shows &#183; audited pool budgets below</text>
+  <text x="60" y="416" font-family="Consolas, 'Courier New', monospace" font-size="11.5" fill="#71717a">each segment = one free pool &#183; widths floored so every provider shows &#183; honest numbers below</text>

-  <!-- ═══ Per-pool grid (20 quantified recurring pools) ═══ -->
+  <!-- ═══ Per-model grid (19 pools) ═══ -->
  <g font-family="Consolas, 'Courier New', monospace" font-size="12.5">
-    <circle cx="66" cy="452" r="5" fill="#6c5ce7"/><text x="78" y="456" fill="#c9d1d9">Mistral <tspan fill="#71717a">1.00B</tspan></text>
-    <circle cx="346" cy="452" r="5" fill="#00b894"/><text x="358" y="456" fill="#c9d1d9">LLM7 <tspan fill="#71717a">150M</tspan></text>
-    <circle cx="626" cy="452" r="5" fill="#0984e3"/><text x="638" y="456" fill="#c9d1d9">Nara <tspan fill="#71717a">150M</tspan></text>
-    <circle cx="906" cy="452" r="5" fill="#e17055"/><text x="918" y="456" fill="#c9d1d9">Gemini <tspan fill="#71717a">60M</tspan></text>
-    <circle cx="66" cy="482" r="5" fill="#fdcb6e"/><text x="78" y="486" fill="#c9d1d9">Cerebras <tspan fill="#71717a">30M</tspan></text>
-    <circle cx="346" cy="482" r="5" fill="#e84393"/><text x="358" y="486" fill="#c9d1d9">Cloudflare AI <tspan fill="#71717a">30M</tspan></text>
-    <circle cx="626" cy="482" r="5" fill="#00cec9"/><text x="638" y="486" fill="#c9d1d9">API Airforce <tspan fill="#71717a">24M</tspan></text>
-    <circle cx="906" cy="482" r="5" fill="#d63031"/><text x="918" y="486" fill="#c9d1d9">Ollama Cloud <tspan fill="#71717a">20M</tspan></text>
-    <circle cx="66" cy="512" r="5" fill="#a29bfe"/><text x="78" y="516" fill="#c9d1d9">Groq <tspan fill="#71717a">15M</tspan></text>
-    <circle cx="346" cy="512" r="5" fill="#55efc4"/><text x="358" y="516" fill="#c9d1d9">Bluesminds <tspan fill="#71717a">7.2M</tspan></text>
-    <circle cx="626" cy="512" r="5" fill="#74b9ff"/><text x="638" y="516" fill="#c9d1d9">SambaNova <tspan fill="#71717a">6M</tspan></text>
-    <circle cx="906" cy="512" r="5" fill="#ffeaa7"/><text x="918" y="516" fill="#c9d1d9">Arcee <tspan fill="#71717a">4.8M</tspan></text>
-    <circle cx="66" cy="542" r="5" fill="#fab1a0"/><text x="78" y="546" fill="#c9d1d9">Navy <tspan fill="#71717a">4.5M</tspan></text>
-    <circle cx="346" cy="542" r="5" fill="#81ecec"/><text x="358" y="546" fill="#c9d1d9">BazaarLink <tspan fill="#71717a">3.6M</tspan></text>
-    <circle cx="626" cy="542" r="5" fill="#6c5ce7"/><text x="638" y="546" fill="#c9d1d9">OpenRouter <tspan fill="#71717a">1.2M</tspan></text>
-    <circle cx="906" cy="542" r="5" fill="#00b894"/><text x="918" y="546" fill="#c9d1d9">Cohere <tspan fill="#71717a">800K</tspan></text>
-    <circle cx="66" cy="572" r="5" fill="#0984e3"/><text x="78" y="576" fill="#c9d1d9">HuggingChat <tspan fill="#71717a">500K</tspan></text>
-    <circle cx="346" cy="572" r="5" fill="#e17055"/><text x="358" y="576" fill="#c9d1d9">Morph <tspan fill="#71717a">400K</tspan></text>
-    <circle cx="626" cy="572" r="5" fill="#fdcb6e"/><text x="638" y="576" fill="#c9d1d9">Hugging Face <tspan fill="#71717a">200K</tspan></text>
-    <circle cx="906" cy="572" r="5" fill="#e84393"/><text x="918" y="576" fill="#c9d1d9">Kiro <tspan fill="#71717a">25K</tspan></text>
+    <circle cx="66" cy="452" r="5" fill="#6c5ce7"/><text x="78" y="456" fill="#c9d1d9">Mistral Large 3 <tspan fill="#71717a">1.00B</tspan></text>
+    <circle cx="346" cy="452" r="5" fill="#00b894"/><text x="358" y="456" fill="#c9d1d9">GPT-4o mini <tspan fill="#71717a">150M</tspan></text>
+    <circle cx="626" cy="452" r="5" fill="#0984e3"/><text x="638" y="456" fill="#c9d1d9">Gemini 2.5 Flash <tspan fill="#71717a">60M</tspan></text>
+    <circle cx="906" cy="452" r="5" fill="#e17055"/><text x="918" y="456" fill="#c9d1d9">GLM 4.7 <tspan fill="#71717a">30M</tspan></text>
+    <circle cx="66" cy="482" r="5" fill="#fdcb6e"/><text x="78" y="486" fill="#c9d1d9">Llama 3.3 70B <tspan fill="#71717a">30M</tspan></text>
+    <circle cx="346" cy="482" r="5" fill="#e84393"/><text x="358" y="486" fill="#c9d1d9">Grok-3 <tspan fill="#71717a">24M</tspan></text>
+    <circle cx="626" cy="482" r="5" fill="#00cec9"/><text x="638" y="486" fill="#c9d1d9">DeepSeek V4 Pro <tspan fill="#71717a">20M</tspan></text>
+    <circle cx="906" cy="482" r="5" fill="#d63031"/><text x="918" y="486" fill="#c9d1d9">GPT-4.1 <tspan fill="#71717a">18M</tspan></text>
+    <circle cx="66" cy="512" r="5" fill="#a29bfe"/><text x="78" y="516" fill="#c9d1d9">Llama 4 Scout <tspan fill="#71717a">15M</tspan></text>
+    <circle cx="346" cy="512" r="5" fill="#55efc4"/><text x="358" y="516" fill="#c9d1d9">GPT-4o <tspan fill="#71717a">7M</tspan></text>
+    <circle cx="626" cy="512" r="5" fill="#74b9ff"/><text x="638" y="516" fill="#c9d1d9">MiniMax-M2.7 <tspan fill="#71717a">6M</tspan></text>
+    <circle cx="906" cy="512" r="5" fill="#ffeaa7"/><text x="918" y="516" fill="#c9d1d9">Arcee Trinity Large Prev <tspan fill="#71717a">5M</tspan></text>
+    <circle cx="66" cy="542" r="5" fill="#fab1a0"/><text x="78" y="546" fill="#c9d1d9">Auto Free <tspan fill="#71717a">4M</tspan></text>
+    <circle cx="346" cy="542" r="5" fill="#81ecec"/><text x="358" y="546" fill="#c9d1d9">Auto <tspan fill="#71717a">1M</tspan></text>
+    <circle cx="626" cy="542" r="5" fill="#6c5ce7"/><text x="638" y="546" fill="#c9d1d9">Command A Reasoning <tspan fill="#71717a">800K</tspan></text>
+    <circle cx="906" cy="542" r="5" fill="#00b894"/><text x="918" y="546" fill="#c9d1d9">ERNIE 4.5 VL 424B <tspan fill="#71717a">500K</tspan></text>
+    <circle cx="66" cy="572" r="5" fill="#0984e3"/><text x="78" y="576" fill="#c9d1d9">morph-v3-large <tspan fill="#71717a">400K</tspan></text>
+    <circle cx="346" cy="572" r="5" fill="#e17055"/><text x="358" y="576" fill="#c9d1d9">Llama 3.1 8B <tspan fill="#71717a">200K</tspan></text>
+    <circle cx="626" cy="572" r="5" fill="#fdcb6e"/><text x="638" y="576" fill="#c9d1d9">Claude Sonnet 4.5 <tspan fill="#71717a">25K</tspan></text>
  </g>

  <!-- ═══ First-month signup credits ═══ -->
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Xiangzhe	ac206e9375	feat(cli): boot exposure warning for unauthenticated LAN bind (GHSA-wmgv-ph3p-rv57) The shipped default (bind 0.0.0.0 + no API-key requirement) is a deliberate, documented local-first posture — but an operator on an untrusted network should learn that at startup, not after a surprise quota bill. serve now prints a loud warning naming both escape hatches (REQUIRE_API_KEY=true or OMNIROUTE_SERVER_HOST=127.0.0.1) whenever the resolved bind is non-loopback and no key is required. Silent on loopback binds and when REQUIRE_API_KEY is enabled. The default posture itself is unchanged (operator decision).	2026-08-23 12:50:42 -03:00
Xiangzhe	0fb4eb6878	fix(security): A2A REST auth + task owner scoping (GHSA-jcm5-6wpp-wjj8) The REST task routes (/api/a2a/tasks, /api/a2a/tasks/[id], /[id]/cancel) had NO authentication call at all — open regardless of configuration — and the task manager stored tasks in an owner-less Map, so any caller could read or cancel any task by id over either the JSON-RPC or the REST surface. - New shared src/lib/a2a/authenticate.ts (the v54m JSON-RPC posture, lifted so both surfaces cannot drift) + src/app/api/a2a/_auth.ts implementing the full posture matrix: REQUIRE_API_KEY=true demands a valid key (management session also passes via alwaysRequireAuth); requireLogin=true accepts management or a valid key; the keyless local-first default stays open by design. - Tasks bind to an owner (hashed API key) at creation; get/cancel/list are owner-scoped. Another principal's task answers with the same not-found a missing one would (no existence oracle). Ownerless tasks (keyless posture) stay visible to everyone; management/operator view sees all tasks. - Callers discriminate the auth failure with instanceof Response, never instanceof NextResponse — createErrorResponse() returns a plain Response, which silently fell through to the handler (caught by the 401-vs-404 test).	2026-08-23 12:50:04 -03:00
Xiangzhe	81cc000cf5	fix(security): SSRF guard on client-controlled search baseUrl (GHSA-j7j4-g9qc-q69c) /v1/search accepted provider_options.baseUrl / providerSpecificData.baseUrl verbatim and flowed it through resolveSearchBaseUrl() into every builder's server-side fetch target, while the sink (searchProxy.ts) is a plain fetch(). The Firecrawl sibling was fixed in #10738; this shared resolver was missed — full-read SSRF to cloud metadata (IMDS credential theft) and JSON-speaking internal services, reachable with no credentials on the default posture. resolveSearchBaseUrl() now validates any request-supplied override with parseAndValidateNonMetadataUrl (block-metadata): self-hosted searxng on loopback/LAN — the provider's primary use case — keeps working, while cloud-metadata endpoints are rejected. The catalog's operator-configured baseUrl stays untouched.	2026-08-23 12:48:02 -03:00
Xiangzhe	e1fdfc40a5	fix(security): harden authz tiers — legacy export/import + MITM loopback GHSA-v7g9-7f55-5g46 (follow-up to mghq): /api/settings/export-json dumps every stored credential and /api/settings/import-json irreversibly replaces settings, yet both were left out of the mghq ALWAYS_PROTECTED fix and their handlers only gate on isAuthRequired() — false under requireLogin=false. Added to ALWAYS_PROTECTED_API_PATHS alongside /api/settings/database and /api/db-backups. GHSA-x7vm-hp44-9p79: the MITM management routes (/api/settings/mitm, /api/cli-tools/antigravity-mitm) install a system-wide trusted root CA and write /etc/hosts DNS overrides, but were MANAGEMENT-only — remotely reachable under requireLogin=false, violating the documented loopback contract for privileged surfaces (Hard Rules #15/#17). Added to LOCAL_ONLY_API_PREFIXES and SPAWN_CAPABLE_PREFIXES (never manage-scope bypassable), same tier as /api/tools/agent-bridge/.	2026-08-23 12:46:50 -03:00
				`@@ -1 +0,0 @@`
				`- feat(audio): proxy native ElevenLabs voices, text-to-speech, and speech-to-text HTTP routes through stored OmniRoute credentials, preserving query strings, multipart uploads, binary responses, and upstream errors (#10556).`
				`@@ -1 +0,0 @@`
				- Added Google AI Studio Gemini batch text-to-speech support through `POST /v1/audio/speech`.
				`@@ -1 +0,0 @@`
				- feat(combo): the shared per-request combo attempt budget is now operator-configurable via `maxGlobalAttempts` (combo config / `comboDefaults` cascade), instead of the hardcoded 30. Lower it to fail fast on a dead target pool, raise it for large combos; clamped to `[1, 200]` so an unbounded budget can never cause runaway background requests ([#11134](https://github.com/diegosouzapw/OmniRoute/issues/11134))
				`@@ -1 +0,0 @@`
				- feat(providers): allow overriding the rate-limit queue wait timeout (`maxWaitMs`) per connection, alongside the existing `rpm`/`tpm`/`tpd`/`minTime`/`maxConcurrent` overrides — a single slow provider no longer has to lower the global wait budget for every other provider (#11251)
				`@@ -1 +0,0 @@`
				`- feat(dashboard): replace the hard Home → onboarding redirect with a dismissable first-run readiness card so returning users can stay on Home while new users still get a clear 4-step path ([#11282](https://github.com/diegosouzapw/OmniRoute/pull/11282))`
				`@@ -1 +0,0 @@`
				`- feat(dashboard): lead Traffic Inspector with a purpose-first header that separates "what happened" from "how it happened", so beginners can read request outcomes without drowning in protocol detail ([#11283](https://github.com/diegosouzapw/OmniRoute/pull/11283))`
				`@@ -1 +0,0 @@`
				`- feat(dashboard): add an Essentials sidebar preset that shows only the beginner core path (Home → Endpoints → API Keys → Providers → Health → Settings) while keeping Advanced tools reachable via Command Palette search ([#11286](https://github.com/diegosouzapw/OmniRoute/pull/11286))`
				`@@ -1 +0,0 @@`
				- feat(video bridge): harden the optional drill-down cache substrate with exact-path broker policy, canonical principal/session/media isolation, independent retained-byte quotas, cancellation-safe commits, rejection of excess or non-canonical Base64 padding and non-JPEG/truncated media, warning-sensitive full JPEG canonicalization that strips trailing polyglot bytes, server-derived dimensions, and auditable derivation metadata; production tenant binding and multi-resolution selection remain follow-up work ([#11369](https://github.com/diegosouzapw/OmniRoute/pull/11369))
				`@@ -1 +0,0 @@`
				`- feat(video): add an opt-in focused analysis mode that safely uses a normalized, 500-code-point latest-user hint for task-aware frame captions while preserving full-mode prompts, temporal-window isolation, and cache identity without storing raw task text ([#11383](https://github.com/diegosouzapw/OmniRoute/pull/11383)).`