fix(dashboard): restore the 8 bulk-import state declarations deleted by #6625 hook extraction (ReferenceError: bulkImportOpen — release E2E)

The test asserted both max_tokens and max_completion_tokens=4096 on the
nvidia/openai/gpt-oss-120b emergency fallback request. Commit a34fb6b3e
(#6912, merged into this release tip) added a symmetric normalization in
chatCore.ts that renames/deletes the redundant max_completion_tokens field
whenever the target provider supportsMaxTokens() (nvidia does), so only
max_tokens reaches the upstream request. The old dual-field assertion is
an outdated contract, not a regression. Align the test to the new
intentional behavior while keeping the max_tokens=4096 cap assertion as
the fallback-cap guard.

.dockerignore

@@ -125,3 +125,4 @@ app.__qa_backup/
 .worktrees
 .next-playwright/
 cloud/
+electron/dist-electron

.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.sh]
+indent_size = 4

.env.example

@@ -73,16 +73,25 @@ DISABLE_SQLITE_AUTO_BACKUP=false
 # Default: 20128
 PORT=20128
 
+# Base path (URL subpath) when serving OmniRoute behind a reverse proxy under a subpath.
+# Used by: next.config.mjs — sets Next.js `basePath`; auth redirects are basePath-aware.
+# Default: "" (served at the domain root). Example: /omniroute to serve under https://host/omniroute
+# OMNIROUTE_BASE_PATH=
+
 # Split-port mode: serve Dashboard and API on separate ports for network isolation.
 # Used by: src/lib/runtime/ports.ts — overrides PORT for each service.
 # API_PORT=20129
 # API_HOST=0.0.0.0
 # DASHBOARD_PORT=20128
 
+# Connection backpressure: cap concurrent in-flight chat connections (503 + Retry-After when full).
+# Used by: src/sse/utils/backpressure.ts — disabled when unset/0.
+# OMNI_MAX_CONCURRENT_CONNECTIONS=0
+
 # Port for the real-time WebSocket live monitoring server.
 # Used by: src/server/ws/liveServer.ts, src/app/api/v1/ws/route.ts
-# Default: 20129
-# LIVE_WS_PORT=20129
+# Default: 20132
+# LIVE_WS_PORT=20132
 
 # Bind address for the live WebSocket server.
 # Default: 127.0.0.1 (loopback only). Set to 0.0.0.0 to expose on LAN —
@@ -92,11 +101,29 @@ PORT=20128
 # Comma-separated extra origins allowed to open a live WebSocket. The
 # loopback dashboard origins are already permitted by default; use this
 # var when fronting the server with a domain (e.g. https://omni.local).
+# ⚠️  When using NEXT_PUBLIC_LIVE_WS_PUBLIC_URL or exposing the WS server
+# beyond loopback, this MUST include the public origin(s) — otherwise
+# the Origin allow-list check will reject all browser connections.
+# Example: LIVE_WS_ALLOWED_ORIGINS=https://omni.local,https://dashboard.example.com,https://ws.my-ai.com
 # LIVE_WS_ALLOWED_ORIGINS=https://omni.local,https://dashboard.example.com
 
-# Disable the standalone live WebSocket helper used by scripts/start-ws-server.mjs.
-# Used by: scripts/start-ws-server.mjs (CI/embedded harness toggle).
-# OMNIROUTE_DISABLE_LIVE_WS=0
+# Comma-separated extra hostnames allowed to open a live WebSocket (LAN/Tailscale).
+# Unlike LIVE_WS_ALLOWED_ORIGINS (which matches full origin URLs), this matches
+# only the host portion — useful for wildcard-ish LAN/Tailscale setups.
+# Used by: src/server/ws/liveServerAllowList.ts
+# Example: LIVE_WS_ALLOWED_HOSTS=omni.local,tailscale-host,192.168.1.50
+# LIVE_WS_ALLOWED_HOSTS=omni.local,tailscale-host,192.168.1.50
+
+# Public URL for the live dashboard WebSocket (client-side, browser only).
+# Set this when fronting the WS server with a reverse proxy or Cloudflare Tunnel.
+# The browser will connect to this URL instead of ws://hostname:20132.
+# The path portion of this URL (e.g. ws://localhost:20132/live-ws -> /live-ws) is also used by the dev proxy
+# (scripts/dev/standalone-server-ws.mjs) and the handshake response to route
+# WebSocket upgrades. Default path: /live-ws.
+# Used by: src/hooks/useLiveDashboard.ts, src/app/api/v1/ws/route.ts,
+# scripts/dev/standalone-server-ws.mjs, and scripts/start-ws-server.mjs.
+# Example: NEXT_PUBLIC_LIVE_WS_PUBLIC_URL=wss://ws.my-ai.com/live-ws
+# NEXT_PUBLIC_LIVE_WS_PUBLIC_URL=ws://localhost:20132/live-ws
 
 # Enable the real-time dashboard WebSocket server.
 # Used by: src/server/ws/liveServer.ts, scripts/start-ws-server.mjs
@@ -149,6 +176,12 @@ OMNIROUTE_USE_TURBOPACK=1
 # hints in production logs.
 # OMNIROUTE_PROXY_FETCH_DEBUG=true
 
+# Set to any non-empty value to emit `[omniroute completion]` diagnostics from
+# the CLI shell-completion cache paths (read/refresh/write) in
+# bin/cli/commands/completion.mjs. Off by default — these caches fail silently
+# so a missing/corrupt cache never breaks tab-completion.
+# OMNIROUTE_DEBUG_COMPLETION=1
+
 # Docker production port mappings (docker-compose.prod.yml only).
 # These set the HOST-side published ports. Container ports use PORT/API_PORT.
 # PROD_DASHBOARD_PORT=20130
@@ -162,8 +195,13 @@ OMNIROUTE_USE_TURBOPACK=1
 # Hostname/bind address for the Next.js server.
 # Used by: scripts/dev/run-next.mjs (HOST), Playwright runner (HOSTNAME).
 # Default: 0.0.0.0 (HOST) / 127.0.0.1 (HOSTNAME inside tests).
-#HOST=0.0.0.0
-#HOSTNAME=127.0.0.1
+# NOTE: Do NOT use `HOSTNAME` — it is a POSIX shell variable automatically set to
+# the machine name by bash/zsh. The .env loader cannot override it (first-wins
+# semantics). Use OMNIROUTE_SERVER_HOST instead for `omniroute serve`.
+# See: https://github.com/diegosouzapw/OmniRoute/issues/6194
+# HOST=0.0.0.0
+# HOSTNAME=127.0.0.1
+# OMNIROUTE_SERVER_HOST=0.0.0.0
 
 # Environment mode — affects Next.js behavior, logging verbosity, and caching.
 # Values: production | development  |  Default: production
@@ -175,6 +213,17 @@ NODE_ENV=production
 # gives the correct fix instructions (podman unshare chown vs sudo chown).
 CONTAINER_HOST=docker
 
+# Container runtime override for skill sandboxing.
+# Used by: src/lib/skills/sandbox.ts + src/lib/skills/containerProvider.ts
+# Values: auto | docker | apple | wsl | orbstack | podman
+# - auto:    OS-aware auto-detect (apple/orbstack on macOS, wsl on Windows, podman on Linux)
+# - apple:   Apple Container (native OCI on macOS 26+)
+# - wsl:     WSL Container CLI (wslc.exe on Windows)
+# - orbstack: OrbStack (high-perf Linux VM + docker shim on macOS)
+# - podman:  Podman (rootless, daemonless)
+# - docker:  Docker (default fallback)
+SKILLS_SANDBOX_RUNTIME=auto
+
 # ═══════════════════════════════════════════════════════════════════════════════
 # 4. SECURITY & AUTHENTICATION
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -239,10 +288,33 @@ ALLOW_API_KEY_REVEAL=false
 # Default: 10485760 (10 MB)
 # MAX_BODY_SIZE_BYTES=10485760
 
-# CORS configuration — controls which origins can call the API.
-# Used by: Next.js middleware — sets Access-Control-Allow-Origin header.
-# Default: * (all origins)  |  Restrict for production security.
-# CORS_ORIGIN=https://your-domain.com
+# Heap-pressure-aware admission for POST /v1/chat/completions (#5152). A large
+# coding-agent "compact" body amplifies into hundreds of MB of transient JS objects
+# on the combo path; concurrent compacts can stack past the V8 heap ceiling and OOM
+# the process. These shed a LARGE body with 503 (Retry-After) only while the heap is
+# already under pressure — healthy heap admits every body untouched.
+# Used by: src/shared/middleware/chatBodyAdmission.ts
+# Bodies below this size skip the guard entirely (heap not even sampled). Default 262144 (256 KB).
+# OMNIROUTE_CHAT_LARGE_BODY_BYTES=262144
+# Hard cap — bodies above this are rejected with 413 before any clone/parse. Default 52428800 (50 MB).
+# OMNIROUTE_CHAT_HARD_MAX_BODY_BYTES=52428800
+# Shed large bodies once heapUsed/heap_size_limit reaches this ratio (0<r<1). Default 0.75.
+# OMNIROUTE_CHAT_HEAP_SHED_RATIO=0.75
+
+# Hard cap (bytes) for a non-streaming upstream response buffered fully into memory
+# (#5152). Past this the upstream reader is cancelled and the request fails fast
+# instead of growing an unbounded string until the V8 heap is exhausted.
+# Used by: open-sse/handlers/chatCore/nonStreamingResponseBody.ts
+# Default: 67108864 (64 MB)
+# OMNIROUTE_MAX_NONSTREAMING_RESPONSE_BYTES=67108864
+
+# CORS configuration — controls which cross-origin browser clients can call the API.
+# Used by: src/server/cors/origins.ts — sets Access-Control-Allow-Origin.
+# Same-origin dashboard requests behind a reverse proxy do not need CORS; they
+# use session-bound CSRF protection. No wildcard is sent unless CORS_ALLOW_ALL=true.
+# CORS_ALLOWED_ORIGINS=https://your-frontend.example.com
+# CORS_ORIGIN=https://your-frontend.example.com  # legacy single-origin alias
+# CORS_ALLOW_ALL=false
 
 # Allow provider URLs pointing to private/local networks (localhost, 192.168.x.x, etc.).
 # REQUIRED for self-hosted providers: LM Studio, Ollama, vLLM, Llamafile, Triton, etc.
@@ -332,6 +404,7 @@ ALLOW_API_KEY_REVEAL=false
 # URLs used for internal sync jobs, OAuth callbacks, and cloud relay.
 
 # Internal base URL — used by server-side sync jobs to call /api/sync/cloud.
+# Keep this as a loopback/container URL even when the app is publicly proxied.
 # Used by: src/lib/cloudSync.ts, src/lib/initCloudSync.ts
 # Default: http://localhost:20128
 BASE_URL=http://localhost:20128
@@ -345,27 +418,39 @@ CLOUD_URL=
 # Default: 12000 (12 seconds)
 # CLOUD_SYNC_TIMEOUT_MS=12000
 
-# Public-facing base URL — CRITICAL for reverse proxy / OAuth callback setups.
-# Used by: OAuth redirect_uri computation, Dashboard UI links, cloud/model sync.
-# Set to your public URL when behind nginx/Caddy (e.g., https://omniroute.example.com).
+# Public-facing base URL — required for stable reverse proxy / OAuth callback setups.
+# Used by: OAuth redirect_uri computation, Dashboard UI links, and generated public URLs.
+# Set to your stable public URL when OAuth callbacks or generated browser links need a
+# canonical host behind nginx/Caddy (e.g., https://omniroute.example.com).
 #
 # Dashboard display behavior: when this variable is unset, the dashboard
 # auto-detects the base URL shown in curl examples and CLI tool snippets
 # from window.location.origin (the host the user is browsing). Setting it
 # explicitly is only required when running behind a reverse proxy with a
-# different public hostname, or when OAuth callbacks must point to a
-# canonical URL.
+# different public hostname, or when OAuth callbacks / generated browser links must point
+# to a canonical URL. Authenticated dashboard writes use same-origin requests plus
+# session-bound CSRF protection and do not require a static public base URL.
 #
 # Default: http://localhost:20128
 NEXT_PUBLIC_BASE_URL=http://localhost:20128
 
 # Browser-facing OmniRoute origin for generated assets in API responses.
+# Highest-priority public origin override; also used by non-dashboard public-origin validation.
 # Used by: chatgpt-web image generation cache URLs (/v1/chatgpt-web/image/<id>).
 # Set this when OpenWebUI or another relay reaches OmniRoute by an internal URL
 # but the user's browser must fetch images from a LAN, tunnel, or public origin.
 # Do not include /v1; if included accidentally it will be normalized away.
 # OMNIROUTE_PUBLIC_BASE_URL=http://192.168.0.15:20128
 
+# Absolute provider plugin manifest URL advertised to sidecar clients.
+# Used by: open-sse/config/providerPluginManifestUrl.ts. When unset, OmniRoute
+# derives the URL from request origin or HOST/PORT using OMNIROUTE_PUBLIC_PROTOCOL.
+# OMNIROUTE_PROVIDER_MANIFEST_URL=https://omniroute.example.com/api/v1/provider-plugin-manifest
+
+# Protocol used when deriving provider plugin manifest URLs without a request origin.
+# Used by: open-sse/config/providerPluginManifestUrl.ts. Defaults to http.
+# OMNIROUTE_PUBLIC_PROTOCOL=http
+
 # Max wait time for an async chatgpt-web image to land via the celsius
 # WebSocket, in milliseconds. Default 180000 (3 minutes). Increase during
 # upstream queue-deep windows ("Lots of people are creating images right now").
@@ -377,12 +462,30 @@ NEXT_PUBLIC_BASE_URL=http://localhost:20128
 # is heavy and clients are racing the 30-minute TTL.
 # OMNIROUTE_CGPT_WEB_IMAGE_CACHE_MAX_MB=256
 
+# Overall wait budget for a chatgpt-web GPT-5.5 Pro background-poll handoff,
+# in milliseconds. Default 1200000 (20 minutes). Pro reasoning runs are slow
+# and complete out-of-band, so OmniRoute polls until the answer lands or this
+# budget elapses. Raise it if Pro requests time out before finishing.
+# OMNIROUTE_CGPT_WEB_PRO_TIMEOUT_MS=1200000
+
+# Interval between chatgpt-web GPT-5.5 Pro background-poll attempts, in
+# milliseconds. Default 4000 (4 seconds). Lower for snappier completion at the
+# cost of more upstream polling; raise to reduce request volume.
+# OMNIROUTE_CGPT_WEB_PRO_POLL_INTERVAL_MS=4000
+
 # Public cloud URL — client-side mirror of CLOUD_URL.
 NEXT_PUBLIC_CLOUD_URL=
 
 # Legacy alias — fallback for NEXT_PUBLIC_BASE_URL in sync schedulers.
 # NEXT_PUBLIC_APP_URL=http://localhost:20128
 
+# Advanced reverse-proxy trust mode for deriving public origin from Forwarded /
+# X-Forwarded-* headers when no explicit public base URL is set. Prefer setting
+# NEXT_PUBLIC_BASE_URL. Only enable if direct client access to OmniRoute is blocked
+# and your proxy strips/rebuilds incoming forwarded headers.
+# Values: true/loopback (trust loopback proxy peers), private/lan (also trust LAN peers).
+# OMNIROUTE_TRUST_PROXY=
+
 # Public callback URL for asynchronous image/audio jobs (kie.ai, etc.).
 # Used by: open-sse/utils/kieTask.ts — overrides callbackUrlFromBaseUrl().
 # Honor order: KIE_CALLBACK_URL → OMNIROUTE_KIE_CALLBACK_URL → OMNIROUTE_PUBLIC_URL.
@@ -400,7 +503,6 @@ NEXT_PUBLIC_CLOUD_URL=
 # debugging or when routing through a corporate mirror. Used by:
 # open-sse/services/usage.ts.
 #OMNIROUTE_CROF_USAGE_URL=https://crof.ai/usage_api/
-#OMNIROUTE_GEMINI_CLI_USAGE_URL=https://cloudcode-pa.googleapis.com/v1internal:loadCodeAssist
 #OMNIROUTE_CODEWHISPERER_BASE_URL=https://codewhisperer.us-east-1.amazonaws.com
 #OMNIROUTE_OPENCODE_QUOTA_URL=https://opencode.ai/zen/go/v1/quota
 #OMNIROUTE_OPENCODE_GO_QUOTA_URL=https://api.z.ai/api/monitor/usage/quota/limit
@@ -415,6 +517,18 @@ NEXT_PUBLIC_CLOUD_URL=
 #OPENCODE_GO_AUTH_COOKIE=auth=...
 #OMNIROUTE_OPENCODE_GO_AUTH_COOKIE=auth=...
 
+# OpenCode Go/Zen VPS egress (#5997): on a datacenter VPS, Cloudflare in front of
+# opencode.ai/zen/go 403s chat requests that lack OpenCode CLI identity headers.
+# When your clients don't already send them, set this to synthesize the CLI headers
+# (User-Agent, x-opencode-client, x-opencode-project, fresh request/session UUIDs) on
+# absent keys. OFF by default — forward-only is safer when clients already send them.
+# Values are overridable via OPENCODE_GO_USER_AGENT / OPENCODE_USER_AGENT / OPENCODE_CLIENT /
+# OPENCODE_PROJECT (defaults: opencode-cli/1.0.0 / cli / default).
+#OPENCODE_SYNTHESIZE_CLI_HEADERS=true
+#OPENCODE_USER_AGENT=opencode-cli/1.0.0
+#OPENCODE_CLIENT=cli
+#OPENCODE_PROJECT=default
+
 # Ollama Cloud quota scraping. Prefer configuring this per connection in
 # Dashboard → Providers → Ollama Cloud. The cookie is sensitive.
 #OLLAMA_USAGE_COOKIE=__Secure-session=...
@@ -486,6 +600,14 @@ NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
 # Allow OmniRoute to write CLI config files (token refresh, etc.).
 # CLI_ALLOW_CONFIG_WRITES=true
 
+# Auto-sync CLI profile files after provider model discovery changes. OPT-IN, default OFF for
+# both. When enabled, writes only the tool's profile files (~/.codex/*.config.toml or
+# ~/.claude/profiles/<name>/settings.json); never changes the active/default config. Both also
+# require CLI_ALLOW_CONFIG_WRITES (default on). Toggle from the CLI Code dashboard, or set here.
+# Leave unset to disable. (Feature flags — a DB/dashboard override takes precedence over env.)
+# OMNIROUTE_AUTO_SYNC_CODEX_PROFILES=true
+# OMNIROUTE_AUTO_SYNC_CLAUDE_PROFILES=true
+
 # Override binary paths for individual CLI tools.
 # CLI_CLAUDE_BIN=claude
 # CLI_CODEX_BIN=codex
@@ -496,6 +618,8 @@ NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
 # CLI_CONTINUE_BIN=cn
 # CLI_QODER_BIN=qoder
 # CLI_QWEN_BIN=qwen
+# CLI_AUGGIE_BIN=auggie
+# AUGGIE_BIN=auggie
 
 # Override the Hermes Agent home directory (where OmniRoute reads/writes the
 # Hermes CLI config). Matches the env var the Hermes PowerShell installer sets
@@ -563,6 +687,14 @@ PROVIDER_LIMITS_SYNC_INTERVAL_MINUTES=70
 # to opt out (restores fully concurrent fetches). Default: 1500
 PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 
+# Min interval (ms) between consecutive UPSTREAM quota fetches on the per-request
+# preflight/monitor path (e.g. Codex /wham/usage), complementing the bulk-sync
+# spacing above. Many accounts on one IP fetching quota in the same second can look
+# like automation to the upstream and get an OAuth token revoked (#6009). This gate
+# serializes genuine network calls (cache hits are unaffected). Set to 0 to disable.
+# Default: 250 (clamped 0..5000).
+# OMNIROUTE_QUOTA_FETCH_MIN_INTERVAL_MS=250
+
 # Delay (ms) before refreshing provider limits after a real usage event (e.g. a
 # completed request). Gives the upstream quota API time to register the consumption
 # before the dashboard polls. Default: 5000
@@ -631,6 +763,25 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # Used by: open-sse/services/compression/engines/rtk/filterLoader.ts.  Default: 0.
 #OMNIROUTE_RTK_TRUST_PROJECT_FILTERS=0
 
+# T02 stacked-pipeline engine circuit-breaker (OPT-IN, default off). When enabled, a compression
+# engine that throws repeatedly across requests is skipped (fail-open) for a cooldown.
+# Used by: open-sse/services/compression/pipelineEngineBreaker.ts.
+#COMPRESSION_PIPELINE_BREAKER_ENABLED=false       # master switch (default false)
+#COMPRESSION_PIPELINE_BREAKER_THRESHOLD=3         # consecutive failures before the engine opens
+#COMPRESSION_PIPELINE_BREAKER_COOLDOWN_MS=30000   # ms the engine stays skipped before a probe
+
+# T08/H8 — CCR retrieval-feedback ramp factor. Each prior retrieval of a stored block raises its
+# effective minChars linearly, so frequently-retrieved content is compressed progressively less
+# (>= 3 retrievals = never compressed). 1 disables the ramp (binary skip at the threshold only).
+# Used by: open-sse/services/compression/engines/ccr/index.ts.  Default: 2.
+#COMPRESSION_CCR_RETRIEVAL_RAMP_FACTOR=2
+# T08/H5 — usage-observed prefix freeze (OPT-IN, default off). When enabled, a system prompt seen
+# >= THRESHOLD times is treated as a stable cacheable prefix and preserved from compression even
+# for providers the static cache-aware heuristic does not recognize (freeze = preserve, never
+# mutates). Used by: open-sse/services/compression/prefixFreeze.ts.
+#COMPRESSION_PREFIX_FREEZE_ENABLED=false     # master switch (default false)
+#COMPRESSION_PREFIX_FREEZE_THRESHOLD=3       # observations before a prefix is frozen
+
 # Skip the postinstall native-runtime warm-up (useful in CI / headless installs). Default: 0.
 # Used by: scripts/postinstall.mjs.
 #OMNIROUTE_SKIP_POSTINSTALL=0
@@ -708,7 +859,7 @@ CODEX_OAUTH_CLIENT_ID=app_EMoamEEZ73f0CkXaXp7hrann
 # Used by: open-sse/executors/theoldllm.ts. Default: 30000 (30s).
 # THEOLDLLM_NAV_TIMEOUT_MS=30000
 
-# ── Gemini / Gemini CLI / Antigravity / Windsurf (all Google-based) ──
+# ── Gemini / Antigravity / Windsurf (all Google-based) ──
 # These providers ship public OAuth client_id/secret values (or Firebase Web
 # keys) embedded in their public CLIs/binaries. Defaults are baked into the
 # code via open-sse/utils/publicCreds.ts — leave the env vars unset to use
@@ -717,8 +868,6 @@ CODEX_OAUTH_CLIENT_ID=app_EMoamEEZ73f0CkXaXp7hrann
 #
 # GEMINI_OAUTH_CLIENT_ID=
 # GEMINI_OAUTH_CLIENT_SECRET=
-# GEMINI_CLI_OAUTH_CLIENT_ID=
-# GEMINI_CLI_OAUTH_CLIENT_SECRET=
 # ANTIGRAVITY_OAUTH_CLIENT_ID=
 # ANTIGRAVITY_OAUTH_CLIENT_SECRET=
 # WINDSURF_FIREBASE_API_KEY=
@@ -735,7 +884,7 @@ GITHUB_OAUTH_CLIENT_ID=Iv1.b507a08c87ecfe98
 # ── GitLab Duo ──
 # Register an OAuth app at: https://gitlab.com/-/profile/applications
 # Set redirect URI to: http://localhost:20128/callback (or your NEXT_PUBLIC_BASE_URL + /callback)
-# Required scopes: api, read_user, openid, profile, email
+# Required scopes: ai_features, read_user (matches GITLAB_DUO_CONFIG.scope in src/lib/oauth/constants/oauth.ts)
 # GITLAB_DUO_OAUTH_CLIENT_ID=***
 # GITLAB_DUO_OAUTH_CLIENT_SECRET=***  # optional — PKCE flow does not require a secret
 #
@@ -780,6 +929,8 @@ GITHUB_OAUTH_CLIENT_ID=Iv1.b507a08c87ecfe98
 # QODER_PERSONAL_ACCESS_TOKEN=
 # QODER_CLI_WORKSPACE=
 # OMNIROUTE_QODER_WORKSPACE=
+# Override the Qoder CLI config dir (isolated PAT session, avoids clobbering a browser login).
+# QODER_CLI_CONFIG_DIR=
 
 # ── Blackbox Web validated-token override (issue #2252) ──
 # Used by: open-sse/executors/blackbox-web.ts. Blackbox `/api/chat` rejects
@@ -806,7 +957,7 @@ GITHUB_OAUTH_CLIENT_ID=Iv1.b507a08c87ecfe98
 # VISION_BRIDGE_API_KEY=
 
 # ─────────────────────────────────────────────────────────────────────────────
-# ⚠️  GOOGLE OAUTH (Antigravity, Gemini CLI) & OTHER PROVIDERS — REMOTE SERVERS
+# ⚠️  GOOGLE OAUTH (Antigravity) & OTHER PROVIDERS — REMOTE SERVERS
 # ─────────────────────────────────────────────────────────────────────────────
 # The default Client IDs above ONLY work when OmniRoute runs on localhost.
 # For remote/VPS hosting (including Docker containers on remote servers):
@@ -834,7 +985,7 @@ GITHUB_OAUTH_CLIENT_ID=Iv1.b507a08c87ecfe98
 # Used by: open-sse/executors/base.ts — buildHeaders() dynamic lookup.
 # Update these when providers release new CLI versions to avoid blocks.
 
-CLAUDE_USER_AGENT="claude-cli/2.1.187 (external, cli)"
+CLAUDE_USER_AGENT="claude-cli/2.1.207 (external, cli)"
 
 # Disable the deterministic tool-name cloak applied on both Anthropic-bound paths
 # (executors/base.ts native OAuth + executors/cliproxyapi.ts CLIProxyAPI) —
@@ -843,8 +994,8 @@ CLAUDE_USER_AGENT="claude-cli/2.1.187 (external, cli)"
 # stream with a misleading 400 out-of-extra-usage placeholder. Set to true to
 # forward the original names verbatim (debugging only).
 # CLAUDE_DISABLE_TOOL_NAME_CLOAK=false
-CODEX_USER_AGENT="codex-cli/0.142.0 (Windows 10.0.26200; x64)"
-GITHUB_USER_AGENT="GitHubCopilotChat/0.45.1"
+CODEX_USER_AGENT="codex-cli/0.144.1 (Windows 10.0.26200; x64)"
+GITHUB_USER_AGENT="GitHubCopilotChat/0.54.0"
 ANTIGRAVITY_USER_AGENT="antigravity/2.0.1 linux/arm64 google-api-nodejs-client/10.3.0"
 KIRO_USER_AGENT="AWS-SDK-JS/3.0.0 kiro-ide/1.0.0"
 # KIRO_VERIFY_FULL_CRC=false           # opt-in: full per-frame message CRC validation on the Kiro event stream (debug corrupted streams; prelude CRC + TLS already protect framing)
@@ -859,13 +1010,12 @@ KIRO_USER_AGENT="AWS-SDK-JS/3.0.0 kiro-ide/1.0.0"
 # Used by: open-sse/executors/kiro.ts
 # KIRO_VERIFY_FULL_CRC=false
 QODER_USER_AGENT="Qoder-Cli"
-QWEN_USER_AGENT="QwenCode/0.15.11 (linux; x64)"
+QWEN_USER_AGENT="QwenCode/0.19.3 (linux; x64)"
 CURSOR_USER_AGENT="Cursor/3.4"
-GEMINI_CLI_USER_AGENT="google-api-nodejs-client/10.3.0"
 
 # Override Codex client version sent in headers independently of the
 # CODEX_USER_AGENT string. Used by: open-sse/config/codexClient.ts.
-# CODEX_CLIENT_VERSION=0.142.0
+# CODEX_CLIENT_VERSION=0.144.1
 
 # Kill-switch to strip non-standard `codex.*` SSE events (e.g. codex.rate_limits)
 # from the Codex Responses stream. These frames break the OpenAI SDK's
@@ -949,12 +1099,22 @@ GEMINI_CLI_USER_AGENT="google-api-nodejs-client/10.3.0"
 # fallback when FETCH_TIMEOUT_MS is unset. Default: 120000 (2 min).
 # OMNIROUTE_DEFAULT_FETCH_TIMEOUT_MS=120000
 
+# ── Firecrawl web-fetch executor ──
+# Point at a self-hosted Firecrawl instance (defaults to the public cloud API).
+# When set to a non-cloud base URL, the API key becomes optional.
+# FIRECRAWL_BASE_URL=https://api.firecrawl.dev
+# FIRECRAWL_TIMEOUT_MS=30000            # Per-request timeout (default: 30000 = 30s)
+
 # ── ChatGPT TLS sidecar (Firefox-fingerprinted client) ──
 # Used by: open-sse/services/chatgptTlsClient.ts — wire-level timeout for
 # the bogdanfinn/tls-client koffi binding and the JS-side grace window
 # layered on top of it when the native library is wedged.
 # OMNIROUTE_CHATGPT_TLS_TIMEOUT_MS=60000
 # OMNIROUTE_CHATGPT_TLS_GRACE_MS=10000
+# Max wait for the FIRST streamed byte from the ChatGPT TLS sidecar before the
+# request is aborted as a dead stream, in milliseconds. Default 30000 (30s).
+# Raise it if upstream cold-starts routinely exceed the window.
+# OMNIROUTE_CHATGPT_STREAM_FIRST_BYTE_TIMEOUT_MS=30000
 
 # ── Claude TLS sidecar (Chromium-fingerprinted client) ──
 # Used by: open-sse/services/claudeTlsClient.ts — wire-level timeout for
@@ -1011,6 +1171,17 @@ GEMINI_CLI_USER_AGENT="google-api-nodejs-client/10.3.0"
 # STREAM_IDLE_TIMEOUT_MS=600000      # Max silence between SSE chunks (default: 600000)
 #                                     # Extended-thinking models rarely pause >90s.
 # STREAM_READINESS_TIMEOUT_MS=80000  # Time to receive the first non-ping SSE event
+# STREAM_READINESS_MAX_TIMEOUT_MS=180000 # Cap for adaptive first-event extensions
+#                                         # (large/tool-heavy/high-reasoning requests).
+# OMNIROUTE_AGENT_GOAL_POLICY_ENABLED=true             # Kill-switch for the /goal heuristic below.
+#                                                       # Set to false to fully disable detection —
+#                                                       # readiness timeouts and stream recovery are
+#                                                       # never elevated by request body/headers when off.
+# OMNIROUTE_AGENT_GOAL_READINESS_MAX_TIMEOUT_MS=600000 # Auto cap for detected /goal agent runs
+# OMNIROUTE_AGENT_GOAL_STREAM_RECOVERY=true            # Auto early stream recovery for /goal runs.
+#                                                       # NOTE: this can only ADD recovery on top of the
+#                                                       # operator default — it never overrides an explicit
+#                                                       # STREAM_RECOVERY_ENABLED / DB settings opt-out.
 
 # ── TLS client (wreq-js fingerprint proxy) ──
 # TLS_CLIENT_TIMEOUT_MS=600000       # Inherits from FETCH_TIMEOUT_MS by default
@@ -1046,7 +1217,7 @@ GEMINI_CLI_USER_AGENT="google-api-nodejs-client/10.3.0"
 APP_LOG_TO_FILE=true
 
 # Path to the application log file.
-# Default: logs/application/app.log (relative to project root / DATA_DIR)
+# Default: <DATA_DIR>/logs/application/app.log (DATA_DIR defaults to ~/.omniroute)
 # APP_LOG_FILE_PATH=logs/application/app.log
 
 # Maximum single log file size before rotation.
@@ -1221,6 +1392,13 @@ APP_LOG_TO_FILE=true
 # Default: 86400 (24 hours)
 # MODELS_DEV_SYNC_INTERVAL=86400
 
+# Self-correcting context-window reconciler interval in seconds (feature 5004).
+# Pins provider-declared windows from /models discovery as auto:discovery overrides
+# when they diverge from the catalog. Set to 0 to disable. Never overwrites manual overrides.
+# Used by: src/lib/contextWindowResolver.ts
+# Default: 86400 (24 hours)
+# CONTEXT_WINDOW_RECONCILE_INTERVAL=86400
+
 # ═══════════════════════════════════════════════════════════════════════════════
 # 20. PROVIDER-SPECIFIC SETTINGS
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -1332,6 +1510,13 @@ APP_LOG_TO_FILE=true
 # CLIPROXYAPI_PORT=5544
 # CLIPROXYAPI_CONFIG_DIR=~/.cli-proxy-api
 
+# ── Mux embedded service ──
+# Override the port where the embedded Mux (coder/mux) agent-orchestration
+# daemon listens. Always bound to 127.0.0.1 — never configurable to 0.0.0.0.
+# Rarely needed — defaults to 8322.
+# Used by: src/lib/services/bootstrap.ts, src/app/api/services/mux/_lib.ts
+# MUX_SERVICE_PORT=8322
+
 # ── Local hostnames (Docker networking) ──
 # Comma-separated additional hostnames treated as "local" for provider routing.
 # Used by: open-sse/config/providerRegistry.ts — allows Docker service names.
@@ -1346,9 +1531,38 @@ APP_LOG_TO_FILE=true
 # Timeout for fast-fail health checks (ms).  Default: 2000
 # PROXY_FAST_FAIL_TIMEOUT_MS=2000
 
+# Time window (hours) for calculating the average latency of candidate proxies
+# in the latency-optimized pool strategy.  Default: 3
+# Used by: src/lib/db/proxies.ts
+# PROXY_LATENCY_WINDOW_HOURS=3
+
 # Health check result cache TTL (ms).  Default: 30000 (30s)
 # PROXY_HEALTH_CACHE_TTL_MS=30000
 
+# Unhealthy health check result cache TTL (ms). Default: 2000 (2s)
+# Keeps transient fast-fail timeouts from poisoning a proxy for the full
+# healthy-result cache window under high concurrency.
+# PROXY_HEALTH_UNHEALTHY_CACHE_TTL_MS=2000
+
+# Background proxy health scheduler (src/lib/proxyHealth/scheduler.ts).
+# Periodically probes every registered proxy and (optionally) removes dead ones.
+# Set "false" to disable the scheduler entirely. Default: enabled.
+# PROXY_HEALTH_ENABLED=true
+# Sweep interval in ms (minimum 60000). Default: 600000 (10min).
+# PROXY_HEALTH_INTERVAL_MS=600000
+# Reachability probe target for the scheduler and the auto-test endpoint.
+# Point it at an internal/self-hosted URL to avoid the public default.
+# PROXY_HEALTH_TEST_URL=https://httpbin.org/ip
+# Set "true" to let the scheduler auto-remove proxies after repeated failures.
+# PROXY_AUTO_REMOVE=false
+# Consecutive failures before an auto-remove fires. Default: 3.
+# PROXY_AUTO_REMOVE_AFTER=3
+# Let automated reachability probes (the scheduler + the "Test All" button) WRITE
+# a proxy's status. Default "false": probes are read-only and never deactivate a
+# proxy — only the operator sets active/inactive (a flaky probe must not strand an
+# assigned proxy; #6246). Set "true" to restore the legacy test-and-set behaviour.
+# PROXY_HEALTH_AUTO_DEACTIVATE=false
+
 # Allow OAuth and provider validation flows to bypass a pinned proxy and connect
 # directly when proxy reachability pre-checks fail. Default: false.
 # Also configurable from Dashboard > Settings > Feature Flags.
@@ -1440,10 +1654,19 @@ APP_LOG_TO_FILE=true
 # Used by: open-sse/utils/cursorImages.ts.
 # CURSOR_IMAGE_FETCH_TIMEOUT_MS=15000
 
-# Cursor state DB path override (for cursor version detection).
+# Cursor state DB path override (for IDE cursor version detection).
 # Used by: open-sse/utils/cursorVersionDetector.ts. Default: probed automatically.
 # CURSOR_STATE_DB_PATH=
 
+# Cursor Agent CLI build id for AgentService/Run impersonation (YYYY.MM.DD-<hash>).
+# Used by: open-sse/utils/cursorAgentCliVersion.ts. Default: detect local install, else pin.
+# CURSOR_AGENT_CLI_VERSION=2026.07.08-0c04a8a
+
+# Cursor Agent CLI data directory override (versions live under <dir>/versions/).
+# Used by: open-sse/utils/cursorAgentCliVersion.ts. Default: ~/.local/share/cursor-agent (unix)
+# or %LOCALAPPDATA%\cursor-agent (win32). Official agent CLI also honors this var.
+# CURSOR_DATA_DIR=
+
 # Direct Cursor bearer token used by scripts/ad-hoc/cursor-tap.cjs (developer tooling).
 # CURSOR_TOKEN=
 
@@ -1530,6 +1753,20 @@ APP_LOG_TO_FILE=true
 # Routing-decision log verbosity: 0 silences, higher values log more bypass/route
 # decisions (src/mitm/server.cjs, _internal/bypass.cjs).
 # MITM_VERBOSE=1
+# Strip the leading `sudo` from MITM cert-trust commands (src/mitm/systemCommands.ts) —
+# for root-less / user-namespaced deployments (e.g. rootless Docker/Podman)
+# where the operator trusts the CA manually (e.g. via Node's extra-CA-certs mechanism).
+# OMNIROUTE_NO_SUDO=0
+
+# ── Test/CI-only guards (never needed in production) ──
+# Set automatically by tests/_setup/isolateDataDir.ts and the CI workflows: the
+# test suite must NEVER mutate the OS trust store (a fake test PEM installed via
+# update-ca-certificates broke all system TLS on a persistent runner, 2026-07-05).
+# OMNIROUTE_SKIP_SYSTEM_TRUST=1
+# check-changelog-integrity.mjs (anti CHANGELOG-eat gate): explicit base ref
+# override, and the justified-removal escape hatch for intentional bullet removals.
+# CHANGELOG_BASE_REF=origin/release/v0.0.0
+# ALLOW_CHANGELOG_REMOVALS=1
 
 # ── 1Proxy egress pool ──
 # Used by: src/lib/oneproxySync.ts — fetches proxy nodes from the OmniRoute
@@ -1560,6 +1797,15 @@ APP_LOG_TO_FILE=true
 # FREE_PROXY_IPLOCATE_ENABLED=false
 # FREE_PROXY_IPLOCATE_BASE_URL=https://raw.githubusercontent.com/iplocate/free-proxy-list/main/protocols
 
+# ── Free Proxy Pool (Webshare source) ──
+# Used by: src/lib/freeProxyProviders/webshare.ts
+# Paid, per-account proxy list — requires FREE_PROXY_WEBSHARE_API_KEY to activate,
+# regardless of FREE_PROXY_WEBSHARE_ENABLED.
+# FREE_PROXY_WEBSHARE_ENABLED=true
+# FREE_PROXY_WEBSHARE_API_KEY=
+# FREE_PROXY_WEBSHARE_API_URL=https://proxy.webshare.io/api/v2/proxy/list/
+# FREE_PROXY_WEBSHARE_MAX=500
+
 # ── Vercel Relay ──
 # Used by: src/app/api/settings/proxy/vercel-deploy/route.ts
 # Hides the "Deploy Relay" button when set to false.
@@ -1602,6 +1848,15 @@ APP_LOG_TO_FILE=true
 # SKILLS_SANDBOX_NETWORK_ENABLED=0
 # SKILLS_ALLOWED_SANDBOX_IMAGES=
 
+# Container runtime used by the skill sandbox. Accepted values:
+#   auto     — pick the best installed runtime per host OS (default)
+#   docker   — Docker Engine / Docker Desktop
+#   apple    — Apple Container (macOS native, micro-VM)
+#   wsl      — WSL Container (Windows native via wslc.exe)
+#   orbstack — OrbStack (high-perf Linux VM + docker shim on macOS)
+#   podman   — Podman (rootless, daemonless)
+# SKILLS_SANDBOX_RUNTIME=auto
+
 # ═══════════════════════════════════════════════════════════════════════════════
 # 25. TEST & E2E
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -1647,7 +1902,7 @@ APP_LOG_TO_FILE=true
 # OMNIROUTE_TRANSLATION_API_URL=
 # Bearer token for the translation backend (NEVER commit a real key here).
 # OMNIROUTE_TRANSLATION_API_KEY=
-# Model id, e.g. gpt-4o-mini or cx/gpt-5.4-mini.
+# Model id, e.g. gpt-4o-mini or cx/gpt-5.6-sol.
 # OMNIROUTE_TRANSLATION_MODEL=gpt-4o-mini
 # Per-request timeout in milliseconds (default 60000).
 # OMNIROUTE_TRANSLATION_TIMEOUT_MS=60000
@@ -1702,6 +1957,11 @@ PLAYGROUND_COMPARE_MAX_COLUMNS=4
 # MEMORY_VEC_TOP_K=20                           # default top-K for vector search
 # MEMORY_RRF_K=60                               # RRF k constant (sqlite-vec hybrid recipe)
 # HF_HUB_ENDPOINT=https://huggingface.co        # override Hugging Face Hub base URL for static potion downloads
+# TV6 typed memory decay (OPT-IN, default off — the sweep DELETES decayed memories)
+# MEMORY_TYPED_DECAY_ENABLED=false              # master switch for the destructive sweep (default off)
+# MEMORY_TYPED_DECAY_EPISODIC_DAYS=30           # episodic TTL in days; 0 = episodic immune too
+# MEMORY_TYPED_DECAY_ACCESS_IMMUNITY=3          # access_count >= N → immune; 0 disables access immunity
+# MEMORY_TYPED_DECAY_SWEEP_INTERVAL=0           # periodic sweep interval (seconds); 0 = no periodic sweep
 # AgentBridge + Traffic Inspector (Group A)
 
 # AgentBridge
@@ -1759,6 +2019,10 @@ QUOTA_STORE_DRIVER=sqlite              # sqlite | redis
 # duplicated). Falls back to TS path via X-Bifrost-Fallback header on
 # timeout/failure. See bin/omniroute for the local-redis companion.
 # BIFROST_BASE_URL=
+# Port the supervised Bifrost embedded service binds to (127.0.0.1:<port>), read by
+# src/lib/services/bootstrap.ts when OmniRoute manages the Bifrost sidecar lifecycle.
+# Default: 8080.
+# BIFROST_PORT=8080
 # API key for the Bifrost gateway (sent as Authorization: Bearer ...). If
 # unset, the route expects the request to carry a valid OmniRoute API key;
 # this key is for gateway-side auth only.
@@ -1770,8 +2034,29 @@ QUOTA_STORE_DRIVER=sqlite              # sqlite | redis
 # Per-request timeout when proxying to the Bifrost gateway. Default: 30000 (30s).
 # BIFROST_TIMEOUT_MS=
 # Alias for BIFROST_API_KEY (used by scripts that read the env via
-# OMNIROUTE_*). Falls back to BIFROST_API_KEY when unset.
+# OMNIROUTE_*). BIFROST_API_KEY takes precedence when both are set.
 # OMNIROUTE_BIFROST_KEY=
+# Relay backend selection for the OpenAI-compatible relay endpoint:
+# ts | bifrost | auto. "ts" (default when Bifrost is not configured) uses the
+# TypeScript relay; "auto" selects Bifrost when BIFROST_BASE_URL is set (and
+# BIFROST_ENABLED != 0) and falls back to TS if the sidecar is unreachable;
+# "bifrost" forces Bifrost (strict — no TS fallback). Auth, rate limits,
+# injection guard and model allowlists always run in the Next route first.
+# RELAY_ROUTING_BACKEND is an accepted alias. Responses carry X-Routing-Backend
+# and X-Routing-Fallback.
+# OMNIROUTE_RELAY_BACKEND=
+# RELAY_ROUTING_BACKEND=
+# Cooldown (ms) after a Bifrost sidecar hop fails in "auto" mode before the relay
+# re-attempts the sidecar; it goes straight to the TS path while the cooldown lasts.
+# 0 disables. Default 5000. Only applies when OMNIROUTE_RELAY_BACKEND=auto.
+# OMNIROUTE_BIFROST_FAILURE_COOLDOWN_MS=
+# Opt-in native HTTPS/TLS for `omniroute serve` (equivalent to --tls-cert /
+# --tls-key). Provide BOTH a PEM certificate and its private key and the
+# standalone server terminates TLS on the same listener (wss:// works
+# unchanged). With neither set the server stays plain HTTP; providing only one
+# (or an unreadable path) logs a warning and stays HTTP (never half-enables).
+# OMNIROUTE_TLS_CERT=
+# OMNIROUTE_TLS_KEY=
 
 # ─── 1-click local service launchers (PR-3 in #3932) ────────────────────────
 # Master switch for /api/local/* routes. When unset or "0", all /api/local/*
@@ -1819,7 +2104,30 @@ QUOTA_STORE_DRIVER=sqlite              # sqlite | redis
 # gateway as a separate sidecar (helps in 3+ replica deployments where you want
 # provider rotation centralised). See docs/architecture/cluster-decisions.md §
 # "Bifrost (bifrost profile)".
+# Set OMNIROUTE_RELAY_BACKEND=auto to use this sidecar when healthy, or
+# OMNIROUTE_RELAY_BACKEND=bifrost to require it without TS fallback.
 # BIFROST_BASE_URL=http://bifrost:8080
 # BIFROST_API_KEY=
 # BIFROST_STREAMING_ENABLED=true
 # BIFROST_TIMEOUT_MS=30000
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Account rotation config (operator-managed; consumed by open-sse/services/rotationConfig.ts)
+# Lets a supervising front-end mirror its rotation rules onto the backend's account-fallback
+# engine. All optional; defaults preserve the historical behavior.
+# ─────────────────────────────────────────────────────────────────────────────
+# OMNIROUTE_ROTATION_ENABLED=true
+# OMNIROUTE_ROTATION_RATE_LIMIT_RESET_SECONDS=0
+# OMNIROUTE_ROTATION_DISABLE_TAG_WITHOUT_RESET=true
+# OMNIROUTE_ROTATE_ON_429=true
+# OMNIROUTE_ROTATE_429_THRESHOLD=1
+# OMNIROUTE_ROTATE_429_WINDOW_SECONDS=120
+# OMNIROUTE_ROTATE_ON_500=true
+# OMNIROUTE_ROTATE_500_THRESHOLD=1
+# OMNIROUTE_ROTATE_500_WINDOW_SECONDS=120
+# OMNIROUTE_ROTATE_ON_502=true
+# OMNIROUTE_ROTATE_502_THRESHOLD=1
+# OMNIROUTE_ROTATE_502_WINDOW_SECONDS=120
+# OMNIROUTE_ROTATE_ON_400=false
+# OMNIROUTE_ROTATE_400_THRESHOLD=1
+# OMNIROUTE_ROTATE_400_WINDOW_SECONDS=120

.github/workflows/ci.yml

@@ -16,6 +16,10 @@ permissions:
   contents: read
 
 env:
+  # CI must never mutate the runner's OS trust store (2026-07-05: a cert-flow
+  # test installed a fake PEM on a persistent self-hosted runner and broke all
+  # system TLS). Belt-and-suspenders with tests/_setup/isolateDataDir.ts.
+  OMNIROUTE_SKIP_SYSTEM_TRUST: "1"
   CI_NODE_VERSION: "24"
   CI_NODE_24_VERSION: "24"
   CI_NODE_26_VERSION: "26"
@@ -34,12 +38,17 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.CI_NODE_VERSION }}
       - id: classify
         env:
           EVENT_NAME: ${{ github.event_name }}
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
+          # Single source of truth: scripts/quality/classify-pr-changes.mjs
+          # (unit-tested). Push/dispatch always enable every lane.
           if [ "$EVENT_NAME" != "pull_request" ]; then
             {
               echo "code=true"
@@ -50,48 +59,18 @@ jobs:
             exit 0
           fi
 
-          code=false
-          docs=false
-          i18n=false
-          workflow=false
-
           git diff --name-only "$BASE_SHA" "$HEAD_SHA" > changed-files.txt
-
-          while IFS= read -r file; do
-            case "$file" in
-              .github/workflows/*|.zizmor.yml)
-                workflow=true
-                code=true
-                ;;
-              docs/*|*.md)
-                docs=true
-                ;;
-              src/i18n/*|src/i18n/messages/*|scripts/i18n/*|config/i18n.json)
-                i18n=true
-                code=true
-                ;;
-              src/*|open-sse/*|bin/*|electron/*|tests/*|scripts/*|package.json|package-lock.json|tsconfig*.json|next.config.*|vitest*.config.*|playwright.config.*)
-                code=true
-                ;;
-              db/*|config/*)
-                code=true
-                ;;
-              *)
-                code=true
-                ;;
-            esac
-          done < changed-files.txt
-
-          {
-            echo "code=$code"
-            echo "docs=$docs"
-            echo "i18n=$i18n"
-            echo "workflow=$workflow"
-          } >> "$GITHUB_OUTPUT"
+          node scripts/quality/classify-pr-changes.mjs changed-files.txt >> "$GITHUB_OUTPUT"
 
   lint:
     name: Lint
     runs-on: ubuntu-latest
+    needs: changes
+    # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
+    # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
+    # Path filter: pure docs / pure message-catalog PRs skip the code lint bag + typecheck.
+    # Existence reason of this job is code regression; docs/i18n have dedicated jobs.
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
     env:
       # tsx gates below (known-symbols, route-guard-membership) import modules that
       # open SQLite on load; provide DB env so a fresh CI DB initializes cleanly.
@@ -109,7 +88,27 @@ jobs:
       - uses: ./.github/actions/npm-ci-retry
       - run: npm run check:node-runtime
       - run: npm run audit:deps
-      - run: npm run lint
+      - name: Restore ESLint file cache
+        uses: actions/cache@v6
+        with:
+          path: |
+            .eslintcache
+            .eslintcache-complexity
+          key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'eslint.complexity-ratchets.config.mjs', 'config/quality/eslint-suppressions.json', 'package-lock.json') }}
+          restore-keys: |
+            eslint-${{ runner.os }}-
+      # Single ESLint inventory (JSON) — quality-gate reuses the artifact instead of
+      # a second cold full-tree pass for eslintWarnings ratchet counts.
+      - name: ESLint (JSON report)
+        run: npm run lint:json
+      - name: Upload ESLint results
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: eslint-results
+          path: .artifacts/eslint-results.json
+          if-no-files-found: warn
+          retention-days: 7
       - run: npm run check:cycles
       - run: npm run check:route-validation:t06
       - run: npm run check:any-budget:t11
@@ -130,16 +129,16 @@ jobs:
       # check:docs-sync is run by the docs-sync-strict job (via check:docs-all) and the
       # husky pre-commit hook; the standalone copy here was redundant (ROI dedup).
       - run: npm run typecheck:core
-      # typecheck:noimplicit:core is a forward-looking gate (noImplicitAny).
-      # Run informationally for now — many pre-existing call sites still need
-      # explicit annotations; track in a dedicated follow-up.
-      - run: npm run typecheck:noimplicit:core
-        continue-on-error: true
+      # typecheck:noimplicit:core dropped from this job (2026-07 optimize):
+      # it was advisory (continue-on-error) and largely subsumed by the blocking
+      # check:type-coverage ratchet in quality-gate. Local: npm run typecheck:noimplicit:core.
 
   quality-gate:
     name: Quality Ratchet
     runs-on: ubuntu-latest
-    needs: test-coverage
+    # needs lint so eslint-results artifact is available (same inventory as the
+    # blocking lint step). Allow lint failure so other ratchets still run.
+    needs: [changes, test-coverage, lint]
     # Run even when test-coverage was SKIPPED/FAILED (e.g. a single flaky Coverage
     # Shard breaks the shard→coverage→ratchet chain). The DETERMINISTIC ratchets
     # (eslint / complexity / cognitive-complexity / duplication / codeql) do NOT need
@@ -148,7 +147,8 @@ jobs:
     # release PR #4854, where the drift cascade only surfaced post-merge in #5029).
     # The coverage.* metrics degrade gracefully: the download is continue-on-error and
     # the ratchet runs with --allow-missing, so absent coverage is skipped, not failed.
-    if: ${{ !cancelled() }}
+    # Path filter: code-only — pure docs/i18n PRs have nothing for these ratchets to guard.
+    if: ${{ !cancelled() && (github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true' && (needs.lint.result == 'success' || needs.lint.result == 'failure'))) }}
     # security-events: read lets the CodeQL ratchet read open code-scanning alerts
     # via `gh api .../code-scanning/alerts`. contents: read keeps checkout working.
     permissions:
@@ -163,6 +163,15 @@ jobs:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
       - uses: ./.github/actions/npm-ci-retry
+      - name: Restore ESLint file cache
+        uses: actions/cache@v6
+        with:
+          path: |
+            .eslintcache
+            .eslintcache-complexity
+          key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'eslint.complexity-ratchets.config.mjs', 'config/quality/eslint-suppressions.json', 'package-lock.json') }}
+          restore-keys: |
+            eslint-${{ runner.os }}-
       # Coverage mergeada (coverage-summary.json) p/ o ratchet de cobertura.
       # continue-on-error: o artifact pode não existir se a job test-coverage foi
       # SKIPPED (shard flaky). Nesse caso collect-metrics pula coverage.* (ausente sem
@@ -173,6 +182,13 @@ jobs:
         with:
           name: coverage-report
           path: coverage/
+      # Prefer lint job's ESLint JSON (one inventory, two consumers).
+      - name: Download ESLint results
+        continue-on-error: true
+        uses: actions/download-artifact@v8
+        with:
+          name: eslint-results
+          path: .artifacts/
       - run: npm run quality:collect
       # Catraca: falha se qualquer métrica regredir vs quality-baseline.json (commitado).
       # Hoje: contagem de warnings do ESLint. Fase 4 estende com cobertura (lida do
@@ -194,15 +210,13 @@ jobs:
       # para não pesar no caminho crítico do lint.
       - name: Duplication ratchet
         run: npm run check:duplication
-      - name: Complexity ratchet
-        run: npm run check:complexity
-      # Fase 7 INT: dead-code, cognitive-complexity, type-coverage promovidos de
-      # advisory (quality-extended) para BLOQUEANTES aqui. Os 3 leem seus baseline
-      # de quality-baseline.json e saem 1 em regressão.
+      # Complexity + cognitive: one ESLint walk, two independent baselines (by ruleId).
+      - name: Complexity + cognitive ratchets
+        run: npm run check:complexity-ratchets
+      # Fase 7 INT: dead-code, type-coverage promovidos de advisory (quality-extended)
+      # para BLOQUEANTES aqui. cognitive-complexity is folded into the step above.
       - name: Dead-code ratchet (knip)
         run: npm run check:dead-code
-      - name: Cognitive complexity ratchet (sonarjs)
-        run: npm run check:cognitive-complexity
       - name: Type coverage ratchet
         run: npm run check:type-coverage
       - name: Compression budget ratchet (F2.4 / N4)
@@ -240,6 +254,11 @@ jobs:
   quality-extended:
     name: Quality Gates (Extended)
     runs-on: ubuntu-latest
+    needs: changes
+    # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
+    # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
+    # Path filter: code-only (scanners/ratchets target production surface).
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
     steps:
       # fetch-depth: 0 — the OpenAPI breaking-change gate (oasdiff) reads the base
       # spec via `git show <base_ref>:docs/openapi.yaml`; a shallow clone
@@ -347,6 +366,11 @@ jobs:
   docs-sync-strict:
     name: Docs Sync (Strict)
     runs-on: ubuntu-latest
+    needs: changes
+    # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
+    # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
+    # Run when docs OR code change: API/route code can break doc/OpenAPI contract gates.
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && (needs.changes.outputs.docs == 'true' || needs.changes.outputs.code == 'true')) }}
     steps:
       - uses: actions/checkout@v7
         with:
@@ -366,16 +390,20 @@ jobs:
         run: npm run check:openapi-coverage
       - name: OpenAPI security-tier consistency (advisory)
         run: npm run check:openapi-security-tiers
-      - name: OpenAPI spec paths resolve to real routes (anti-hallucination)
-        run: npm run check:openapi-routes
-      - name: Doc /api refs resolve to real routes (anti-hallucination)
-        run: npm run check:docs-symbols
+      # One FS inventory of src/app/api for both anti-hallucination directions.
+      - name: API docs refs (openapi + prose → routes)
+        run: npm run check:api-docs-refs
       - name: i18n translation drift (warn)
         run: node scripts/i18n/check-translation-drift.mjs --warn
 
   docs-lint:
     name: Docs Lint (prose — advisory)
     runs-on: ubuntu-latest
+    needs: changes
+    # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
+    # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
+    # Prose/markdown only — skip when the PR has no doc surface.
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.docs == 'true') }}
     # Advisory (warning-first): prose/markdown style must not block merges while the
     # existing doc corpus is brought up to style. Promote to blocking once it converges.
     continue-on-error: true
@@ -402,6 +430,11 @@ jobs:
   i18n-ui-coverage:
     name: i18n UI Coverage
     runs-on: ubuntu-latest
+    needs: changes
+    # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
+    # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
+    # UI keys move with dashboard code OR message catalogs.
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && (needs.changes.outputs.i18n == 'true' || needs.changes.outputs.code == 'true')) }}
     steps:
       - uses: actions/checkout@v7
         with:
@@ -413,30 +446,20 @@ jobs:
       - uses: ./.github/actions/npm-ci-retry
       - run: node scripts/i18n/check-ui-keys-coverage.mjs --threshold=65
 
-  i18n-matrix:
-    name: Build language matrix
-    runs-on: ubuntu-latest
-    outputs:
-      langs: ${{ steps.langs.outputs.langs }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - id: langs
-        run: |
-          LANG_DIR="src/i18n/messages"
-          LANGS=$(ls "$LANG_DIR"/*.json | xargs -n1 basename | sed 's/.json$//' | grep -v '^en$' | jq -R . | jq -s . | jq -c .)
-          echo "langs=${LANGS}" >> "$GITHUB_OUTPUT"
-
+  # D4 (plano mestre testes+CI): a matrix de ~40 jobs de <1min por idioma saturava sozinha
+  # a concorrência de jobs da conta (Free = 20 slots, compartilhados entre TODOS os repos)
+  # e pagava spin-up + arredondamento de billing por idioma. Um único job itera os idiomas
+  # (mesmo script), com grupo de log por idioma e artifact único de resultados nomeados por
+  # idioma (a matrix antiga subia 40 artifacts cujo result.txt colidia no merge-multiple).
   i18n:
-    name: i18n Validation
+    name: i18n Validation (all languages)
     runs-on: ubuntu-latest
+    needs: changes
+    # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
+    # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
+    # Message-catalog / i18n-tooling only — pure code without i18n surface skips this lane.
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.i18n == 'true') }}
     continue-on-error: true
-    strategy:
-      fail-fast: false
-      matrix:
-        lang: ${{ fromJson(needs.i18n-matrix.outputs.langs) }}
-    needs: i18n-matrix
     steps:
       - uses: actions/checkout@v7
         with:
@@ -444,27 +467,35 @@ jobs:
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
-
-      - name: Validate ${{ matrix.lang }}
-        env:
-          # Pass the matrix value via env (never interpolate ${{ ... }} straight
-          # into the run: script body) so the shell receives a variable, not
-          # inlined text — zizmor template-injection mitigation. Named MATRIX_LANG
-          # to avoid clobbering the POSIX `LANG` locale variable.
-          MATRIX_LANG: ${{ matrix.lang }}
+      - name: Validate all languages
         run: |
-          python3 scripts/i18n/validate_translation.py quick -l "$MATRIX_LANG" > result.txt
-
-      - name: Upload result
+          set -uo pipefail
+          mkdir -p i18n-results
+          FAIL=0
+          for f in src/i18n/messages/*.json; do
+            lang=$(basename "$f" .json)
+            [ "$lang" = "en" ] && continue
+            echo "::group::i18n $lang"
+            if python3 scripts/i18n/validate_translation.py quick -l "$lang" > "i18n-results/$lang.txt" 2>&1; then
+              echo "OK $lang"
+            else
+              FAIL=1
+              echo "FAIL $lang"
+              cat "i18n-results/$lang.txt"
+            fi
+            echo "::endgroup::"
+          done
+          exit "$FAIL"
+      - name: Upload results
         if: always()
         uses: actions/upload-artifact@v7
         with:
-          name: i18n-${{ matrix.lang }}
-          path: result.txt
+          name: i18n-results
+          path: i18n-results/
 
   pr-test-policy:
     name: PR Test Policy
-    if: ${{ github.event_name == 'pull_request' }}
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -495,9 +526,17 @@ jobs:
 
   build:
     name: Build
-    runs-on: ubuntu-latest
+    # Dynamic runner: when the release captain flips the USE_VPS_RUNNER repo var to
+    # 'true' (scripts/vps/release-runner-up.sh does it after the self-hosted VM is
+    # online), the heavy jobs run on the dedicated 32-core VPS runners (label
+    # omni-release) instead of queueing on the 20-concurrent-job hosted pool.
+    # Safety: fork PRs NEVER reach the self-hosted runner — the expression falls
+    # back to ubuntu-latest unless the PR head repo is this repository (push /
+    # dispatch events are own-origin by definition). Any failure path (VM down,
+    # var unset/false) also falls back to ubuntu-latest.
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     needs: changes
-    if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.code == 'true' }}
+    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
     steps:
       - uses: actions/checkout@v7
         with:
@@ -508,14 +547,21 @@ jobs:
           cache: npm
       - uses: ./.github/actions/npm-ci-retry
       - run: npm run check:node-runtime
-      - name: Cache Next.js build cache
-        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8
-        with:
-          path: .build/next/cache
-          key: nextjs-${{ runner.os }}-node-${{ env.CI_NODE_VERSION }}-${{ hashFiles('package-lock.json') }}-${{ hashFiles('src/**/*', 'open-sse/**/*', 'db/**/*', 'next.config.mjs', 'tsconfig*.json', 'postcss.config.*', 'tailwind.config.*') }}
-          restore-keys: |
-            nextjs-${{ runner.os }}-node-${{ env.CI_NODE_VERSION }}-${{ hashFiles('package-lock.json') }}-
+      # NOTE: the webpack `.build/next/cache` actions/cache step was removed with the
+      # Turbopack switch below — Turbopack does not read/write the webpack cache dir
+      # (its persistent FS cache is still experimental and intentionally NOT enabled),
+      # so restoring the old ~0.5 GB webpack cache would only waste download time.
+      # Rolling back to webpack = revert this commit (cache step comes back with it).
+      #
+      # Turbopack production build (Next 16, stable): benchmarked 1.9× faster than the
+      # webpack pass (9min0s vs 17min15s on a 32-core box; multi-core Rust vs webpack's
+      # single-threaded compile). Standalone output smoke-validated (server boots,
+      # /api/monitoring/health 200). Downstream jobs (e2e ×9, package-artifact,
+      # electron-package-smoke) consume this artifact, so a green run here validates
+      # the Turbopack artifact end-to-end.
       - run: npm run build
+        env:
+          OMNIROUTE_USE_TURBOPACK: "1"
       - name: Archive Next.js build for downstream jobs
         # Use tar so the archive preserves paths relative to CWD (.build/next/...).
         # upload-artifact path-stripping is ambiguous when exclude patterns are used;
@@ -603,9 +649,16 @@ jobs:
 
   test-unit:
     name: Unit Tests (${{ matrix.shard }}/8)
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    needs: build
+    # Same dynamic-runner rule as Build (own-origin only; fallback ubuntu-latest).
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
+    timeout-minutes: 25
+    # needs: changes (not build) — this job never downloads the next-build artifact;
+    # gating it on Build only serialized ~20min of wall-clock for nothing. Jobs that
+    # DO consume the artifact (e2e, package-artifact, electron-package-smoke) keep
+    # needs: build. The `if` mirrors Build's own skip condition so docs-only PRs
+    # still skip the suite.
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
     strategy:
       fail-fast: false
       matrix:
@@ -624,13 +677,39 @@ jobs:
           cache: npm
       - uses: ./.github/actions/npm-ci-retry
       - run: npm run check:node-runtime
-      - run: node --max-old-space-size=4096 --import tsx --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 --test-shard=${{ matrix.shard }}/8 tests/unit/*.test.ts "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui,usage}/**/*.test.ts"
+      # QW-d (plano mestre): fonte única — o MESMO npm script dos runs locais (adiciona o
+      # setupPolyfill que o comando inline omitia; o glob canônico vive só no package.json).
+      # D3 (plano mestre): a coverage é coletada NESTE mesmo run (c8/NODE_V8_COVERAGE propaga
+      # aos filhos através do npm) — elimina a matrix Coverage Shard ×8, que re-executava a
+      # suíte inteira só para medir o gate. Padrão usado pelo CI do próprio nodejs/node.
+      - name: Unit tests (shard ${{ matrix.shard }}/8) with V8 coverage
+        env:
+          TEST_SHARD: ${{ matrix.shard }}/8
+        run: |
+          rm -rf coverage-shard coverage-shard-report
+          npx c8 \
+            --temp-directory=coverage-shard \
+            --reports-dir=coverage-shard-report \
+            --reporter=json \
+            --exclude=tests/** \
+            --exclude=**/*.test.* \
+            npm run test:unit:ci:shard
+      - name: Upload raw shard coverage
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-shard-${{ matrix.shard }}
+          path: coverage-shard/*.json
+          if-no-files-found: error
 
   test-vitest:
     name: Vitest (MCP / autoCombo / UI components)
-    runs-on: ubuntu-latest
+    # Same dynamic-runner rule as Build (own-origin only; fallback ubuntu-latest).
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     timeout-minutes: 15
-    needs: build
+    # needs: changes (not build) — no artifact consumed; see test-unit note.
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
     env:
       JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
       API_KEY_SECRET: ci-test-api-key-secret-long
@@ -653,138 +732,16 @@ jobs:
       - run: npm run test:vitest:ui
         continue-on-error: true
 
-  node-24-compat:
-    name: Node 24 Compatibility Tests (${{ matrix.shard }}/4)
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    needs: build
-    strategy:
-      fail-fast: false
-      matrix:
-        shard: [1, 2, 3, 4]
-    env:
-      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
-      API_KEY_SECRET: ci-test-api-key-secret-long
-      DISABLE_SQLITE_AUTO_BACKUP: "true"
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v6
-        with:
-          node-version: ${{ env.CI_NODE_24_VERSION }}
-          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
-      - run: npm run check:node-runtime
-      - run: node --max-old-space-size=4096 --import tsx --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 --test-shard=${{ matrix.shard }}/4 tests/unit/*.test.ts "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui,usage}/**/*.test.ts"
-
-  node-26-compat-build:
-    name: Node 26 Compatibility Build
-    runs-on: ubuntu-latest
-    timeout-minutes: 25
-    needs: build
-    env:
-      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
-      API_KEY_SECRET: ci-test-api-key-secret-long
-      DISABLE_SQLITE_AUTO_BACKUP: "true"
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v6
-        with:
-          node-version: ${{ env.CI_NODE_26_VERSION }}
-          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
-      - run: npm run check:node-runtime
-      - name: Cache Next.js build cache
-        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8
-        with:
-          path: .build/next/cache
-          key: nextjs-${{ runner.os }}-node-${{ env.CI_NODE_26_VERSION }}-${{ hashFiles('package-lock.json') }}-${{ hashFiles('src/**/*', 'open-sse/**/*', 'db/**/*', 'next.config.mjs', 'tsconfig*.json', 'postcss.config.*', 'tailwind.config.*') }}
-          restore-keys: |
-            nextjs-${{ runner.os }}-node-${{ env.CI_NODE_26_VERSION }}-${{ hashFiles('package-lock.json') }}-
-      - run: npm run build
-
-  node-26-compat:
-    name: Node 26 Compatibility Tests (${{ matrix.shard }}/4)
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    needs: node-26-compat-build
-    strategy:
-      fail-fast: false
-      matrix:
-        shard: [1, 2, 3, 4]
-    env:
-      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
-      API_KEY_SECRET: ci-test-api-key-secret-long
-      DISABLE_SQLITE_AUTO_BACKUP: "true"
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v6
-        with:
-          node-version: ${{ env.CI_NODE_26_VERSION }}
-          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
-      - run: npm run check:node-runtime
-      - run: node --max-old-space-size=4096 --import tsx --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 --test-shard=${{ matrix.shard }}/4 tests/unit/*.test.ts "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui,usage}/**/*.test.ts"
-
-  test-coverage-shard:
-    name: Coverage Shard (${{ matrix.shard }}/8)
-    runs-on: ubuntu-latest
-    timeout-minutes: 25
-    needs: build
-    strategy:
-      fail-fast: false
-      matrix:
-        shard: [1, 2, 3, 4, 5, 6, 7, 8]
-    env:
-      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
-      API_KEY_SECRET: ci-test-api-key-secret-long
-      DISABLE_SQLITE_AUTO_BACKUP: "true"
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v6
-        with:
-          node-version: ${{ env.CI_NODE_VERSION }}
-          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
-      - run: npm run check:node-runtime
-      - name: Run c8 over shard ${{ matrix.shard }}/8
-        run: |
-          rm -rf coverage-shard coverage-shard-report
-          # `--temp-directory` (writable via NODE_V8_COVERAGE) is what the merge
-          # job reads with `c8 report --temp-directory ...`. Using `--output-dir`
-          # only produces the final json *report* and leaves the raw v8 files in
-          # `coverage/tmp`, so uploading `coverage-shard/` was empty. Pin the temp
-          # dir so the raw coverage files live there and the artifact upload picks
-          # them up regardless of `--test-force-exit` timing.
-          npx c8 \
-            --temp-directory=coverage-shard \
-            --reports-dir=coverage-shard-report \
-            --reporter=json \
-            --exclude=tests/** \
-            --exclude=**/*.test.* \
-            node --max-old-space-size=4096 --import tsx --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 \
-              --test-shard=${{ matrix.shard }}/8 tests/unit/*.test.ts "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui,usage}/**/*.test.ts"
-      - name: Upload raw shard coverage
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: coverage-shard-${{ matrix.shard }}
-          path: coverage-shard/*.json
-          if-no-files-found: error
-
+  # Node 24/26 compatibility matrices moved to .github/workflows/nightly-compat.yml
+  # (plano mestre testes+CI, Eixo D2 — they cost ~28% of every heavy run to catch a
+  # failure class that rarely originates in a PR; nightly catches it within 24h and
+  # the release gate can still exercise them via workflow_dispatch when needed).
   test-coverage:
     name: Coverage
     runs-on: ubuntu-latest
     timeout-minutes: 10
-    needs: test-coverage-shard
-    if: ${{ !cancelled() && needs.test-coverage-shard.result == 'success' }}
+    needs: test-unit
+    if: ${{ !cancelled() && needs.test-unit.result == 'success' }}
     env:
       JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
       API_KEY_SECRET: ci-test-api-key-secret-long
@@ -889,17 +846,33 @@ jobs:
           else
             echo "SonarQube scan skipped because SONAR_TOKEN or SONAR_HOST_URL is not configured." >> "$GITHUB_STEP_SUMMARY"
           fi
+      - name: Read project version
+        if: ${{ github.event_name == 'pull_request' && env.SONAR_TOKEN != '' && env.SONAR_HOST_URL != '' }}
+        id: pkg
+        run: |
+          VERSION="$(node -p "require('./package.json').version")"
+          # Harden against output injection: only accept a plain semver-ish string.
+          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
+            echo "Invalid package.json version: $VERSION" >&2; exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
       - name: SonarQube Scan
         if: ${{ github.event_name == 'pull_request' && env.SONAR_TOKEN != '' && env.SONAR_HOST_URL != '' }}
         uses: SonarSource/sonarqube-scan-action@v8
         env:
           SONAR_TOKEN: ${{ env.SONAR_TOKEN }}
           SONAR_HOST_URL: ${{ env.SONAR_HOST_URL }}
+        with:
+          # sonar.projectVersion advances the "previous_version" new-code baseline at
+          # each release; without it the baseline never moves (it stays pinned to the
+          # analysis where the version last changed) and legacy issues pile up as
+          # "new code" in the quality gate.
+          args: -Dsonar.projectVersion=${{ steps.pkg.outputs.version }}
 
   coverage-pr-comment:
     name: PR Coverage Comment
     runs-on: ubuntu-latest
-    if: ${{ !cancelled() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false && needs.changes.outputs.code == 'true' }}
+    if: ${{ !cancelled() && github.event_name == 'pull_request' && github.event.pull_request.draft == false && github.event.pull_request.head.repo.fork == false && needs.changes.outputs.code == 'true' }}
     needs:
       - changes
       - pr-test-policy
@@ -1004,7 +977,7 @@ jobs:
       - uses: ./.github/actions/npm-ci-retry
       - run: npm run check:node-runtime
       - name: Cache Playwright browsers
-        uses: actions/cache@v6.0.0
+        uses: actions/cache@v6
         with:
           path: ~/.cache/ms-playwright
           key: playwright-chromium-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
@@ -1024,7 +997,9 @@ jobs:
     name: Integration Tests (${{ matrix.shard }}/2)
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    needs: build
+    # needs: changes (not build) — no artifact consumed; see test-unit note.
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
     strategy:
       fail-fast: false
       matrix:
@@ -1045,12 +1020,15 @@ jobs:
           cache: npm
       - uses: ./.github/actions/npm-ci-retry
       - run: npm run check:node-runtime
-      - run: node --import tsx --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=1 --test-shard=${{ matrix.shard }}/2 tests/integration/*.test.ts
+      # (tsx/esm = QW-b; o alinhamento de ESCOPO do integration com o npm script fica p/ follow-up)
+      - run: node --import tsx/esm --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=1 --test-shard=${{ matrix.shard }}/2 tests/integration/*.test.ts
 
   test-security:
     name: Security Tests
     runs-on: ubuntu-latest
-    needs: build
+    # needs: changes (not build) — no artifact consumed; see test-unit note.
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
     env:
       JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
       API_KEY_SECRET: ci-test-api-key-secret-long
@@ -1082,9 +1060,6 @@ jobs:
       - package-artifact
       - electron-package-smoke
       - test-unit
-      - node-24-compat
-      - node-26-compat-build
-      - node-26-compat
       - test-coverage
       - sonarqube
       - coverage-pr-comment
@@ -1134,15 +1109,12 @@ jobs:
           echo "| Build Matrix | $(status '${{ needs.build.result }}') |" >> "$GITHUB_STEP_SUMMARY"
           echo "| Package Artifact | $(status '${{ needs.package-artifact.result }}') |" >> "$GITHUB_STEP_SUMMARY"
           echo "| Electron Package Smoke | $(status '${{ needs.electron-package-smoke.result }}') |" >> "$GITHUB_STEP_SUMMARY"
-          echo "| Node 26 Compatibility Build | $(status '${{ needs.node-26-compat-build.result }}') |" >> "$GITHUB_STEP_SUMMARY"
 
           echo "" >> "$GITHUB_STEP_SUMMARY"
           echo "## 🧪 Tests" >> "$GITHUB_STEP_SUMMARY"
           echo "| Suite | Status |" >> "$GITHUB_STEP_SUMMARY"
           echo "|-------|--------|" >> "$GITHUB_STEP_SUMMARY"
           echo "| Unit | $(status '${{ needs.test-unit.result }}') |" >> "$GITHUB_STEP_SUMMARY"
-          echo "| Node 24 Compatibility Tests | $(status '${{ needs.node-24-compat.result }}') |" >> "$GITHUB_STEP_SUMMARY"
-          echo "| Node 26 Compatibility Tests | $(status '${{ needs.node-26-compat.result }}') |" >> "$GITHUB_STEP_SUMMARY"
           echo "| Coverage | $(status '${{ needs.test-coverage.result }}') |" >> "$GITHUB_STEP_SUMMARY"
           echo "| PR Coverage Comment | $(status '${{ needs.coverage-pr-comment.result }}') |" >> "$GITHUB_STEP_SUMMARY"
           echo "| E2E | $(status '${{ needs.test-e2e.result }}') |" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/codeql.yml

@@ -22,10 +22,10 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           languages: javascript-typescript
           queries: security-extended
-      - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           category: "/language:javascript-typescript"

.github/workflows/docker-publish.yml

@@ -98,11 +98,13 @@ jobs:
             PROMOTE="${PROMOTE_INPUT:-false}"
           else
             git fetch --tags --quiet || true
-            HIGHEST=$(git tag -l 'v[0-9]*' | sed 's/^v//' | grep -vE -- '-(rc|alpha|beta|pre|next)' | sort -V | tail -1 || echo "")
-            if [ -n "$HIGHEST" ] && [ "$VERSION" = "$HIGHEST" ]; then
-              PROMOTE="true"
-            else
-              echo "Version $VERSION is not the highest semver tag (highest=${HIGHEST:-<none>}). Not promoting :latest."
+            # Decide via the extracted helper, which folds VERSION into the
+            # candidate set so the result is independent of git-tag sync timing
+            # on `release` events (#5301). Without that, the freshly-created tag
+            # is often not yet visible here and :latest stays a release behind.
+            PROMOTE=$(git tag -l 'v[0-9]*' | bash scripts/ci/should-promote-latest.sh "$VERSION")
+            if [ "$PROMOTE" != "true" ]; then
+              echo "Version $VERSION is not the highest stable semver. Not promoting :latest."
             fi
           fi
           echo "promote_latest=$PROMOTE" >> "$GITHUB_OUTPUT"
@@ -344,6 +346,15 @@ jobs:
 
       # Visibility scan: reports HIGH + CRITICAL into the SARIF (Security tab) but
       # never blocks (exit-code 0). The blocking gate below narrows to CRITICAL.
+      #
+      # ignore-unfixed mirrors the blocking gate: the Security tab must surface only
+      # ACTIONABLE vulnerabilities — ones with a published fix we can pull by rebuilding
+      # on a patched base or bumping the dep. Without it the advisory upload floods the
+      # tab with unfixable base-image OS CVEs (Debian trixie packages with no upstream
+      # patch yet, overwhelmingly local-only and not reachable from the proxy request
+      # surface), which is noise an operator cannot act on. trivyignores points at the
+      # repo-root .trivyignore so accepted-risk fixable CVEs have one auditable home.
+      # See docs/security/SUPPLY_CHAIN.md.
       - name: Trivy image scan (SARIF, advisory)
         if: needs.prepare.outputs.version != 'main'
         continue-on-error: true
@@ -353,6 +364,8 @@ jobs:
           format: sarif
           output: trivy-results.sarif
           severity: HIGH,CRITICAL
+          ignore-unfixed: true
+          trivyignores: .trivyignore
           exit-code: "0"
 
       # BLOCKING gate (v3.8.27 cycle-end): fail the release on a CRITICAL CVE in the

.github/workflows/electron-release.yml

@@ -94,7 +94,7 @@ jobs:
           cache: npm
 
       - name: Cache node_modules
-        uses: actions/cache@v6.0.0
+        uses: actions/cache@v6.1.0
         with:
           path: node_modules
           key: ${{ runner.os }}-node-${{ hashFiles('package-lock.json') }}
@@ -201,6 +201,12 @@ jobs:
               [ -f "$file" ] && cp "$file" "../../release-assets/OmniRoute.exe" && break
             done
           fi
+          # electron-updater manifests (latest.yml / latest-mac.yml / latest-linux.yml)
+          # must be published alongside the installers, or autoUpdater fails with
+          # "Cannot find latest.yml in the latest release artifacts" (#6766).
+          for file in latest*.yml; do
+            [ -f "$file" ] && cp "$file" ../../release-assets/
+          done
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v7
@@ -263,6 +269,7 @@ jobs:
             release-assets/*.AppImage
             release-assets/*.deb
             release-assets/*.blockmap
+            release-assets/*.yml
             release-assets/*.source.tar.gz
             release-assets/*.source.zip
         env:

.github/workflows/nightly-compat.yml

@@ -0,0 +1,126 @@
+name: Nightly Node Compat
+
+# Plano mestre testes+CI (Eixo D2, aprovado 2026-07-04): as matrizes de compatibilidade
+# Node 24/26 custavam ~28% de CADA run do CI pesado (2 execuções completas da suíte por
+# sync da release-PR) para pegar uma classe de quebra que raramente nasce num PR típico.
+# Elas rodam aqui 1×/dia contra o tip da release ativa (mesmo alvo do nightly-release-green)
+# e continuam obrigatórias no gate de release via workflow_dispatch do ci.yml se preciso.
+# fail-fast desligado: numa quebra queremos saber TODAS as versões afetadas de uma vez.
+
+on:
+  schedule:
+    - cron: "47 6 * * *" # 06:47 UTC diário — slot distinto dos demais nightlies
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: "Branch to validate (default: highest release/vX.Y.Z)"
+        required: false
+        type: string
+
+permissions:
+  contents: read
+  issues: write
+
+concurrency:
+  group: nightly-compat
+  cancel-in-progress: true
+
+jobs:
+  resolve-branch:
+    name: Resolve active release branch
+    runs-on: ubuntu-latest
+    outputs:
+      target: ${{ steps.branch.outputs.target }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Resolve active release branch
+        id: branch
+        env:
+          INPUT_BRANCH: ${{ github.event.inputs.branch }}
+        run: |
+          set -euo pipefail
+          if [ -n "${INPUT_BRANCH:-}" ]; then
+            TARGET="$INPUT_BRANCH"
+          else
+            TARGET=$(git for-each-ref --format='%(refname:short)' 'refs/remotes/origin/release/v*' \
+              | sed 's#origin/##' \
+              | sort -t/ -k2 -V \
+              | tail -1)
+          fi
+          case "$TARGET" in
+            release/v[0-9]*.[0-9]*.[0-9]*) ;;
+            *) echo "Refusing non-canonical branch name: $TARGET"; exit 1 ;;
+          esac
+          echo "target=$TARGET" >> "$GITHUB_OUTPUT"
+
+  compat-build-26:
+    name: Node 26 Compatibility Build
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    needs: resolve-branch
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ needs.resolve-branch.outputs.target }}
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "26"
+          cache: npm
+      - uses: ./.github/actions/npm-ci-retry
+      - run: npm run build
+
+  compat-tests:
+    name: Node ${{ matrix.node }} Compat Tests (${{ matrix.shard }}/4)
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    needs: resolve-branch
+    strategy:
+      fail-fast: false
+      matrix:
+        node: [24, 26]
+        shard: [1, 2, 3, 4]
+    env:
+      JWT_SECRET: ci-nightly-secret-with-sufficient-length-for-validation
+      API_KEY_SECRET: ci-nightly-api-key-secret-long
+      DISABLE_SQLITE_AUTO_BACKUP: "true"
+      TEST_SHARD: ${{ matrix.shard }}/4
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ needs.resolve-branch.outputs.target }}
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+      - uses: ./.github/actions/npm-ci-retry
+      - run: npm run check:node-runtime
+      - run: npm run test:unit:ci:shard
+
+  report:
+    name: Open / update tracking issue on failure
+    runs-on: ubuntu-latest
+    if: ${{ !cancelled() && (needs.compat-tests.result == 'failure' || needs.compat-build-26.result == 'failure') }}
+    needs: [resolve-branch, compat-build-26, compat-tests]
+    permissions:
+      issues: write
+    steps:
+      - name: Open or update issue
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TARGET: ${{ needs.resolve-branch.outputs.target }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          TITLE="🌙 nightly-compat: Node 24/26 failures on $TARGET"
+          EXISTING=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open --search "$TITLE in:title" --json number --jq '.[0].number')
+          BODY="Nightly Node-compat run failed on \`$TARGET\`: $RUN_URL — triage which Node version/shard broke (fail-fast off, all versions reported)."
+          if [ -n "$EXISTING" ]; then
+            gh issue comment "$EXISTING" --repo "$GITHUB_REPOSITORY" --body "$BODY"
+          else
+            gh issue create --repo "$GITHUB_REPOSITORY" --title "$TITLE" --body "$BODY"
+          fi

.github/workflows/nightly-mutation.yml

@@ -113,7 +113,7 @@ jobs:
           cache: npm
       - run: npm ci
       - name: Restore Stryker incremental cache
-        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: reports/mutation/stryker-incremental.json
           key: stryker-incremental-${{ matrix.batch.name }}-${{ github.run_id }}

.github/workflows/nightly-release-green.yml

@@ -31,10 +31,17 @@ concurrency:
   group: nightly-release-green
   cancel-in-progress: true
 
+env:
+  OMNIROUTE_SKIP_SYSTEM_TRUST: "1"
+
 jobs:
   release-green:
     name: Validate active release branch
-    runs-on: ubuntu-latest
+    # Dynamic runner: with USE_VPS_RUNNER=true (release window / on-demand pre-flight)
+    # this runs on the dedicated VPS runner — clean env (no operator OMNIROUTE_API_KEY,
+    # no local noauth CLIs => zero machine-specific false positives) and no contention.
+    # Nightly cron normally finds the var false (VM off) and falls back to hosted.
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && fromJSON('["self-hosted","omni-release"]')) || 'ubuntu-latest' }}
     env:
       JWT_SECRET: ci-nightly-secret-with-sufficient-length-for-validation
       API_KEY_SECRET: ci-nightly-api-key-secret-long
@@ -88,7 +95,14 @@ jobs:
         id: validate
         run: |
           set +e
-          node scripts/quality/validate-release-green.mjs --json --with-build \
+          # --hermetic: scrub live-test trigger vars (self-hosted runner may carry
+          # operator env; hosted ignores the unknown flag before #6300 lands).
+          # --full-ci: ALSO run every static gate from ci.yml's gate jobs (lint,
+          # quality-gate, quality-extended, docs-sync-strict, pr-test-policy). PRs into
+          # release/** only get the fast-gates, so these accrue silently and explode in
+          # layers on the release PR (v3.8.46: 11 static base-reds leaked). Running them
+          # nightly opens the tracking issue the moment one lands, not at release time.
+          node scripts/quality/validate-release-green.mjs --json --with-build --hermetic --full-ci \
             1> release-green.json 2> release-green.log
           echo "exit=$?" >> "$GITHUB_OUTPUT"
           echo "------- report -------"
@@ -128,7 +142,7 @@ jobs:
 
       - name: Upload report artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: release-green-report
           path: |

.github/workflows/nightly-resilience.yml

@@ -100,7 +100,7 @@ jobs:
           cache: npm
       - run: npm ci
       - name: Cache Playwright browsers
-        uses: actions/cache@v6.0.0
+        uses: actions/cache@v6.1.0
         with:
           path: ~/.cache/ms-playwright
           key: playwright-chromium-${{ runner.os }}-${{ hashFiles('package-lock.json') }}

.github/workflows/npm-publish.yml

@@ -205,6 +205,8 @@ jobs:
         uses: actions/checkout@v7
         with:
           persist-credentials: false
+          fetch-depth: 0
+          # Full history needed for auto-bump: git diff against previous release tag
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
@@ -212,6 +214,47 @@ jobs:
           node-version: ${{ env.NPM_PUBLISH_NODE_VERSION }}
           registry-url: https://registry.npmjs.org
 
+      - name: Auto-bump plugin version if plugin changed since last release
+        id: bump
+        working-directory: "@omniroute/opencode-plugin"
+        env:
+          CURRENT_TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+
+          PKG_VERSION=$(node -p "require('./package.json').version")
+          PKG_NAME=$(node -p "require('./package.json').name")
+
+          # 1) Skip if current version is not yet published (no bump needed)
+          PUBLISHED="$(npm view "${PKG_NAME}@${PKG_VERSION}" version 2>/dev/null || true)"
+          if [ "$PUBLISHED" != "$PKG_VERSION" ]; then
+            echo "✅ ${PKG_NAME}@${PKG_VERSION} is new — no bump needed."
+            echo "bumped=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # 2) Find the previous release tag (exclude the current one)
+          PREV_TAG=$(git tag -l 'v*' --sort=-version:refname \
+            | grep -v "^${CURRENT_TAG}$" | head -1 || echo "")
+          if [ -z "$PREV_TAG" ]; then
+            echo "No previous tag to compare — skipping bump."
+            echo "bumped=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # 3) Check if plugin dir actually changed since that tag
+          if git diff --quiet "$PREV_TAG" -- "@omniroute/opencode-plugin/"; then
+            echo "⏭️ No plugin changes since $PREV_TAG — nothing to publish."
+            echo "bumped=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # 4) Auto-bump patch version
+          npm version patch --no-git-tag-version --allow-same-version
+          NEW_VERSION=$(node -p "require('./package.json').version")
+          echo "bumped=true" >> "$GITHUB_OUTPUT"
+          echo "📦 Auto-bumped ${PKG_NAME} from ${PKG_VERSION} to ${NEW_VERSION}"
+
       - name: Install plugin dependencies
         working-directory: "@omniroute/opencode-plugin"
         run: npm install --no-audit --no-fund

.github/workflows/quality.yml

@@ -14,12 +14,80 @@ permissions:
   contents: read
 
 env:
+  # CI must never mutate the runner's OS trust store (2026-07-05: a cert-flow
+  # test installed a fake PEM on a persistent self-hosted runner and broke all
+  # system TLS). Belt-and-suspenders with tests/_setup/isolateDataDir.ts.
+  OMNIROUTE_SKIP_SYSTEM_TRUST: "1"
   CI_NODE_VERSION: "24"
 
 jobs:
+  # Same classifier as ci.yml (scripts/quality/classify-pr-changes.mjs) so PR→release
+  # path filters share existence reasons: code / docs / i18n / workflow.
+  changes:
+    name: Change Classification
+    runs-on: ubuntu-latest
+    outputs:
+      code: ${{ steps.classify.outputs.code }}
+      docs: ${{ steps.classify.outputs.docs }}
+      i18n: ${{ steps.classify.outputs.i18n }}
+      workflow: ${{ steps.classify.outputs.workflow }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.CI_NODE_VERSION }}
+      - id: classify
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          if [ "$EVENT_NAME" != "pull_request" ]; then
+            {
+              echo "code=true"
+              echo "docs=true"
+              echo "i18n=true"
+              echo "workflow=true"
+            } >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          git diff --name-only "$BASE_SHA" "$HEAD_SHA" > changed-files.txt
+          node scripts/quality/classify-pr-changes.mjs changed-files.txt >> "$GITHUB_OUTPUT"
+
+  # Docs/OpenAPI contract gates only — existence reason is doc accuracy + route refs.
+  # Split out of fast-gates so pure-docs PRs skip typecheck/unit while still validating docs.
+  docs-gates:
+    name: Docs Gates (fast-path)
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && (needs.changes.outputs.docs == 'true' || needs.changes.outputs.code == 'true')) }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.CI_NODE_VERSION }}
+          cache: npm
+      - run: npm ci
+      # One walk of src/app/api for openapi-routes + docs-symbols (both still fail independently).
+      - run: npm run check:api-docs-refs
+      - name: Docs accuracy (fabricated-docs + i18n mirrors, strict)
+        run: npm run check:docs-all
+
   fast-gates:
     name: Fast Quality Gates
-    runs-on: ubuntu-latest
+    needs: changes
+    # Code surface only — pure docs/i18n PRs skip this bag (docs-gates covers docs).
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
+    # Dynamic runner (same rule as ci.yml): use the self-hosted VPS pool only when the
+    # release captain has USE_VPS_RUNNER=true AND this is not a fork PR (own-origin
+    # branches only — a fork PR must never execute on the LAN runner). Var unset/false
+    # or a fork PR falls back to ubuntu-latest, so this is inert until the flag flips.
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     # tsx gates (known-symbols, route-guard-membership) import modules that open
     # SQLite on load; provide DB env so a fresh CI DB initializes cleanly.
     env:
@@ -36,12 +104,18 @@ jobs:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
       - run: npm ci
+      - name: Restore ESLint file cache
+        uses: actions/cache@v6
+        with:
+          path: |
+            .eslintcache
+            .eslintcache-complexity
+          key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'eslint.complexity-ratchets.config.mjs', 'config/quality/eslint-suppressions.json', 'package-lock.json') }}
+          restore-keys: |
+            eslint-${{ runner.os }}-
       - run: npm run check:provider-consistency
       - run: npm run check:fetch-targets
-      - run: npm run check:openapi-routes
-      - run: npm run check:docs-symbols
-      - name: Docs accuracy (fabricated-docs + i18n mirrors, strict)
-        run: npm run check:docs-all
+      # docs-all / openapi-routes / docs-symbols live in docs-gates (path-filtered).
       - run: npm run check:deps
       - run: npm run check:file-size
       - run: npm run check:error-helper
@@ -52,6 +126,10 @@ jobs:
       - run: npm run check:route-guard-membership
       - run: npm run check:test-discovery
       - run: npm run check:test-runner-api
+      # Guards tap.testFiles drift: a covering unit test absent from stryker.conf.json
+      # tap.testFiles makes its module's mutants survive on a cold nightly-mutation run,
+      # false-failing the blocking mutationScore ratchet. See check-mutation-test-coverage.mjs.
+      - run: npm run check:mutation-test-coverage
       - run: npm run check:any-budget:t11
       # Build-scope guard: fails if worktrees/cruft leak into the tsconfig include
       # scope (would OOM `next build`). Instant. See incident 2026-06-25 / #5031.
@@ -60,25 +138,21 @@ jobs:
       # leaking into the npm tarball (v3.8.36: 6 ops bin/*.sh) per-PR instead of only on
       # the release PR's heavy Package Artifact job.
       - run: npm run check:pack-policy
-      # Complexity + cognitive-complexity ratchets on the fast-path (PR→release) so
-      # cycle drift is rebaselined PER-PR instead of cascading onto the release PR's
-      # Quality Ratchet (v3.8.36: +30 complexity / +15 cognitive surfaced only post-merge).
-      - run: npm run check:complexity
-      - run: npm run check:cognitive-complexity
+      # Complexity + cognitive-complexity: ONE ESLint walk (both baselines still
+      # enforced separately by ruleId). Avoids two cold tree walks on fast-path.
+      - run: npm run check:complexity-ratchets
       - name: Typecheck (core)
         run: npm run typecheck:core
       # TIA: build the impact map at runtime (gitignored, ~21MB) and run only the
-      # unit tests impacted by this PR's changed files. Fail-safe runs the FULL
-      # unit suite on hub/unmapped changes — TIA accelerates, never replaces, the net.
+      # unit tests impacted by this PR's changed files. On hub/unmapped changes the
+      # selector returns __RUN_ALL__ — full-suite authority is the parallel
+      # `fast-unit` 4-shard job (test:unit:ci:shard; was 2-shard, #6781), NOT an
+      # unsharded re-run here. Stacking unsharded test:unit:ci on top of fast-unit
+      # doubled wall time (~16 min extra on ubuntu-latest) without extra coverage.
       #
-      # BLOCKING (flipped 2026-06-17). The pre-existing release unit test-debt that kept
-      # this advisory was cleared: #4030 (16 Zod/registry reds, lossless restore) and
-      # #4063 (the last red — the LiveWS boot test — root-caused as a real event-loop
-      # stall in the WS sidecar, fixed + relocated to the integration suite). A full
-      # ci.yml run on release/v3.8.28 then showed all 8 unit shards green, so PR->release
-      # now blocks on unit-test regressions in the impacted set (typecheck:core already
-      # blocked above). Fail-safe still runs the FULL unit suite on hub/unmapped changes.
-      - name: Impacted unit tests (TIA, fail-safe full; blocking)
+      # BLOCKING for the *impacted subset* (flipped 2026-06-17). Fail-safe full
+      # coverage remains required via `Unit Tests fast-path` (fast-unit).
+      - name: Impacted unit tests (TIA subset; blocking)
         env:
           GITHUB_BASE_REF: ${{ github.base_ref }}
         run: |
@@ -92,15 +166,39 @@ jobs:
           # which must not happen on a blocking gate. DATA_DIR isolation keeps the parallel
           # run race-free regardless of concurrency.
           if echo "$SEL" | grep -q "__RUN_ALL__"; then
-            echo "Fail-safe: running FULL unit suite (CI concurrency)"; npm run test:unit:ci; exit $?
+            echo "Fail-safe: __RUN_ALL__ — deferring FULL unit suite to fast-unit (4-shard)."
+            echo "Not re-running unsharded test:unit:ci here (duplicate of fast-unit coverage)."
+            exit 0
           fi
           echo "Running impacted tests:"; echo "$SEL"
           mapfile -t FILES <<< "$SEL"
-          node --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 "${FILES[@]}"
+          # Loader parity with test:unit:ci:shard (#6787): tests/unit/dashboard/** runs
+          # under `--import tsx` (CJS transform — required for ESM-only deep imports like
+          # @lobehub/icons/es/* reached via lobeProviderIcons.ts); everything else under
+          # `--import tsx/esm`. A single tsx/esm invocation false-reds every dashboard
+          # module-shape test the impact map selects ("Unexpected token 'export'").
+          DASH=(); REST=()
+          for f in "${FILES[@]}"; do
+            case "$f" in
+              tests/unit/dashboard/*) DASH+=("$f") ;;
+              *) REST+=("$f") ;;
+            esac
+          done
+          RC=0
+          if [ ${#REST[@]} -gt 0 ]; then
+            node --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 "${REST[@]}" || RC=$?
+          fi
+          if [ ${#DASH[@]} -gt 0 ]; then
+            node --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 "${DASH[@]}" || RC=$?
+          fi
+          exit $RC
 
   fast-vitest:
     name: Vitest (fast-path)
-    runs-on: ubuntu-latest
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
+    # Dynamic runner — see fast-gates (own-origin + flag; fork/unset → ubuntu-latest).
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     env:
       JWT_SECRET: ci-lint-secret-with-sufficient-length-for-validation
       API_KEY_SECRET: ci-lint-api-key-secret-long
@@ -117,12 +215,19 @@ jobs:
       - run: npm run test:vitest
 
   fast-unit:
-    name: Unit Tests fast-path (${{ matrix.shard }}/2)
-    runs-on: ubuntu-latest
+    name: Unit Tests fast-path (${{ matrix.shard }}/4)
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
+    # Dynamic runner — see fast-gates (own-origin + flag; fork/unset → ubuntu-latest).
+    # This is the heaviest fast-path job; 4-way sharding (was 2, #6781) halves the
+    # critical path again (~8.5min → ~4.5min on ubuntu-latest; ~2min on the 8-slot
+    # runner box). Node's native --test-shard=N/total takes any denominator — only
+    # this matrix and the TEST_SHARD env below encode the shard count.
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     strategy:
       fail-fast: false
       matrix:
-        shard: [1, 2]
+        shard: [1, 2, 3, 4]
     env:
       JWT_SECRET: ci-lint-secret-with-sufficient-length-for-validation
       API_KEY_SECRET: ci-lint-api-key-secret-long
@@ -136,9 +241,85 @@ jobs:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
       - run: npm ci
-      - run: >
-          node --max-old-space-size=4096 --import tsx
-          --import ./tests/_setup/isolateDataDir.ts
-          --test --test-force-exit --test-concurrency=4 --test-shard=${{ matrix.shard }}/2
-          tests/unit/*.test.ts
-          "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui}/**/*.test.ts"
+      # QW-d: fonte única — o mesmo npm script do CI pesado/local. Fecha dois drifts do
+      # comando inline antigo: os dirs `memory` e `usage` estavam FORA do glob (testes
+      # silenciosamente não rodavam no fast path) e o setupPolyfill não era importado.
+      - run: npm run test:unit:ci:shard
+        env:
+          TEST_SHARD: ${{ matrix.shard }}/4
+
+  # ── Pacote 4 (plano mestre testes+CI, aprovado 2026-07-04) ─────────────────────────
+  # No-new-warnings por PR via ESLint bulk suppressions nativo (>=9.24). O baseline
+  # config/quality/eslint-suppressions.json congela as violações EXISTENTES por
+  # arquivo+regra; qualquer warning NOVO aparece e o --max-warnings 0 falha o job — o
+  # drift de +41/+88 warnings por ciclo passa a morrer no PR que o introduz, em vez de
+  # ser rebaselinado às cegas na release. Aperto do baseline (na reconciliação da
+  # release): npx eslint . --prune-suppressions --suppressions-location config/quality/eslint-suppressions.json
+  #
+  # Princípio Zero: bloqueante SÓ para branches internas (as campanhas/sessões são a
+  # origem do drift). PR de FORK roda em modo report (continue-on-error → o job fica
+  # verde com anotação; a campanha /green-prs aplica o fix via co-autoria — o
+  # contribuidor NUNCA é bloqueado nem cobrado).
+  lint-guard:
+    name: No new ESLint warnings
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
+    runs-on: ubuntu-latest
+    continue-on-error: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.CI_NODE_VERSION }}
+          cache: npm
+      - run: npm ci
+      - name: Restore ESLint file cache
+        uses: actions/cache@v6
+        with:
+          path: |
+            .eslintcache
+            .eslintcache-complexity
+          key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'eslint.complexity-ratchets.config.mjs', 'config/quality/eslint-suppressions.json', 'package-lock.json') }}
+          restore-keys: |
+            eslint-${{ runner.os }}-
+      - name: ESLint (baseline congelado — warning novo = vermelho)
+        # lint:json writes the report; --max-warnings 0 keeps no-new-warnings policy.
+        run: npm run lint:json -- --max-warnings 0
+
+  # Merge-integrity: pega no PR os dois vazamentos crônicos de merge que hoje só
+  # explodem na release-PR. (1) CHANGELOG-eat — o auto-resolve do merge come
+  # bullets vizinhos/seções inteiras (incidente #6193, 2026-07-05: 212 linhas /
+  # 130 bullets); o checkout de PR é refs/pull/N/merge, então comparar contra a
+  # base detecta o eat ANTES do merge. (2) SKILL.md gerado stale vs o catálogo de
+  # agent-skills (#6186 mergeou um id de catálogo sem rodar o gerador → 8 reds de
+  # integration invisíveis até a release).
+  #
+  # Princípio Zero: bloqueante SÓ para branches internas; PR de FORK roda em modo
+  # report (continue-on-error) — a campanha corrige via co-autoria, o contribuidor
+  # nunca é bloqueado.
+  merge-integrity:
+    name: Merge integrity (changelog + generated skills)
+    # Always on non-draft PRs — CHANGELOG/skills can break on docs-only merges too.
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
+    runs-on: ubuntu-latest
+    continue-on-error: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true }}
+    env:
+      JWT_SECRET: ci-lint-secret-with-sufficient-length-for-validation
+      API_KEY_SECRET: ci-lint-api-key-secret-long
+      DISABLE_SQLITE_AUTO_BACKUP: "true"
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: ${{ env.CI_NODE_VERSION }}
+          cache: npm
+      - run: npm ci
+      - name: CHANGELOG integrity (nenhum bullet da base pode sumir no merge-result)
+        run: npm run check:changelog-integrity
+      - name: Agent-skills generator sync (SKILL.md gerado ≡ catálogo)
+        run: npm run check:agent-skills-sync

.github/workflows/wiki-sync.yml

@@ -9,7 +9,7 @@ name: Wiki Sync
 # It does NOT overwrite existing wiki pages by default: several docs sources still carry
 # stale counts (e.g. ARCHITECTURE.md says "177 providers" while the wiki cover is 226),
 # so blind overwrite would regress the wiki. Full content parity (--update-existing) is
-# gated on regenerating those sources — see docs/ops/DOCUMENTATION_AUDIT_REPORT.md.
+# gated on regenerating those sources first.
 
 on:
   push:

.gitignore

@@ -229,3 +229,16 @@ docs/prompts/AGENT-OWNERSHIP-PROTOCOL.md
 docs/prompts/AGENT-OWNERSHIP-PROTOCOL.omniroute-mim.md
 docs/prompts/AGENT-OWNERSHIP-PROTOCOL.omniroute-mid.md
 omniroute.md
+
+# mise configuration
+mise.toml
+_artifacts/
+.claude-flow/
+
+# ESLint file cache (npm run lint --cache / complexity ratchets)
+.eslintcache
+.eslintcache-complexity
+
+
+# CI/local quality artifacts (eslint-results.json, etc.)
+.artifacts/

.husky/pre-push

@@ -1,7 +1,9 @@
 #!/usr/bin/env sh
-# .husky/pre-push — fast deterministic gates (<10s total)
-# Intentionally excludes test:unit (slow; covered by CI pre-push remote run).
-# Activated: 2026-06-13 (6A.12 — replaced commented-out test:unit stub)
+# .husky/pre-push — intentionally light.
+# any-budget + tracked-artifacts already run on pre-commit; re-running them on
+# every push only doubles local wall time for the same existence reason (CI still
+# enforces both). Keep this hook as a PATH/npm sanity check + reminder.
+# Intentionally excludes test:unit / typecheck (slow; covered by CI).
 
 if ! command -v npm >/dev/null 2>&1; then
   echo "⚠️  npm not found in PATH — skipping pre-push hooks"
@@ -9,4 +11,5 @@ if ! command -v npm >/dev/null 2>&1; then
   exit 0
 fi
 
-npm run check:any-budget:t11 && npm run check:tracked-artifacts
+# No-op success: real local gates live in pre-commit; CI owns the rest.
+exit 0

.mcp.json.example

@@ -1,17 +0,0 @@
-{
-  "$comment_purpose": "OPT-IN agent-lsp / LSP-in-the-loop (Quality Gates Fase 7 Task 15). Copy this file to `.mcp.json` to enable. It exposes a TypeScript language server to coding agents (Claude Code, etc.) so they get diagnostics / hover / go-to-definition / blast-radius BEFORE writing code — turning 'invented symbol' review-catches into impossible-at-edit-time. Pairs with `npm run typecheck:core` as a compile-before-claim check.",
-  "$comment_safety": "Shipped as `.example` (NOT `.mcp.json`) on purpose so it never auto-loads an unvetted server into everyone's session. Pick an MCP<->LSP bridge you trust and have verified locally, then drop in its package + args below. A broken MCP entry only logs a connection error; it does not break agent sessions. The underlying language server is `typescript-language-server` (npm, mature) — install via `npm i -g typescript-language-server typescript` or rely on npx.",
-  "mcpServers": {
-    "typescript-lsp": {
-      "command": "npx",
-      "args": [
-        "-y",
-        "<your-mcp-lsp-bridge>",
-        "--lsp",
-        "typescript-language-server",
-        "--stdio"
-      ],
-      "$note": "Replace <your-mcp-lsp-bridge> with the concrete MCP<->LSP adapter you chose. It must speak MCP on stdio and proxy to `typescript-language-server --stdio`. Scope it to this repo's tsconfig (open-sse/tsconfig.json / tsconfig.json) for accurate diagnostics."
-    }
-  }
-}

.npmrc

@@ -2,3 +2,13 @@
 # Keeping peer auto-install disabled prevents npm from pulling @lobehub/ui/mermaid
 # back into the tree and reopening npm audit findings for unused packages.
 legacy-peer-deps=true
+
+# Network resilience: enlarge npm's fetch retry budget so a transient registry
+# socket reset (ECONNRESET) mid-download retries instead of failing the job.
+# npm defaults to only 2 retries with short timeouts; `npm ci` in
+# electron-release.yml hit ECONNRESET during v3.8.41 publish. Applies to every
+# CI workflow (electron / docker / unit) and local installs.
+fetch-retries=5
+fetch-retry-factor=4
+fetch-retry-mintimeout=20000
+fetch-retry-maxtimeout=120000

.prettierignore

@@ -0,0 +1,5 @@
+# Long reference tables are manually aligned; formatting the whole file causes noisy diffs.
+docs/reference/ENVIRONMENT.md
+
+# Dense auto-generated free-tier budget rows (one object per line) — prettier multi-line expand blows past file-size cap 800.
+open-sse/config/freeModelCatalog.data.ts

.trivyignore

@@ -0,0 +1,22 @@
+# .trivyignore — accepted-risk suppressions for the container image scan
+#
+# Policy (see docs/security/SUPPLY_CHAIN.md):
+#   - The Trivy steps in .github/workflows/docker-publish.yml run with
+#     `ignore-unfixed: true`, so vulnerabilities WITHOUT a published fix are
+#     already excluded from both the blocking CRITICAL gate and the advisory
+#     Security-tab upload. You do NOT need an entry here for an unfixable
+#     base-image OS CVE — it will not be reported.
+#   - This file is the single auditable home for the rare case where a *fixable*
+#     CVE must be temporarily accepted (e.g. the upstream fix is not yet in the
+#     pinned base tag, or the affected package/binary is provably unreachable
+#     from the proxy request surface and rebuilding now is not justified).
+#
+# Format — one CVE id per line, each with a justification comment and, where
+# possible, an expiry, e.g.:
+#   # CVE-XXXX-YYYY — <why accepted>; revisit on next base-image bump (YYYY-MM-DD)
+#   CVE-XXXX-YYYY
+#
+# Keep this list SHORT and reviewed every release. Prefer fixing (rebuild on a
+# patched base / bump the dep) over suppressing. Stale entries are debt.
+#
+# (No accepted-risk suppressions at present — ignore-unfixed covers the noise.)

.vscode/settings.json

@@ -48,11 +48,19 @@
       "**/.build",
       "**/dist",
       "**/coverage",
-      "**/.worktrees"
+      "**/.worktrees",
+      "**/.claude/worktrees",
+      "**/electron",
+      "**/_references",
+      "**/_mono_repo",
+      "**/_tasks"
     ]
   },
 
   // Para esconder os diretórios gerados da árvore do Explorer, descomente:
+  // (MANTIDO comentado — o dono precisa ver _references/_mono_repo/_tasks na árvore.
+  //  A performance é resolvida por watcherExclude + search.exclude + tsserver, sem
+  //  precisar escondê-los do Explorer.)
   // "files.exclude": {
   //   "**/.worktrees": true,
   //   "**/coverage": true,

@omniroute/opencode-plugin/README.md

@@ -196,7 +196,7 @@ Every field is optional. Defaults mirror v0.1.0 behaviour so existing `opencode.
 | `combos`              | `boolean` | `true`  | Discover `/api/combos` and surface them as pseudo-models with LCD capabilities. Combos are keyed under the `combo/<slug>` namespace and labelled `Combo: <name>` in the model picker so they're distinguishable from raw provider/model pairs.                                                                                                                                                                                                                                                                                                                               |
 | `enrichment`          | `boolean` | `true`  | Pull display names from `/api/pricing/models` AND per-million-token pricing (`input`, `output`, `cached` → `cacheRead`, `cache_creation` → `cacheWrite`) from `/api/pricing`, then overlay both onto the live catalog (so the UI shows `Claude 4.7 Opus` with `cost.input: 5`, `cost.output: 25` instead of raw IDs and zeroed cost).                                                                                                                                                                                                                                        |
 | `compressionMetadata` | `boolean` | `false` | Pull `/api/context/combos` so combo names get tagged with their compression pipeline, e.g. `Combo: claude-primary [rtk🟡 → caveman🟠]`. Intensity tokens render as traffic-light emoji (🟢 lite/minimal · 🟡 standard · 🟠 aggressive/full · 🔴 ultra) so the picker advertises "how compressed" each combo is at a glance.                                                                                                                                                                                                                                                  |
-| `providerTag`         | `boolean` | `true`  | Prepend a short upstream-provider label to the enriched display name with `" - "` separator, so `cc/claude-opus-4-7 → Claude - Claude Opus 4.7` differs visibly from `kr/claude-opus-4-7 → Kiro - Claude Opus 4.7` in the OC TUI model picker. Label resolution: use `/api/pricing/models[<alias>].name` verbatim when ≤8 chars (e.g. `Claude`, `Kiro`, `Codex`, `Qwen`), otherwise fall back to `UPPER(alias)` (e.g. `GitHub Models` → `GHM`, `Gemini-cli` → `GEMINI-CLI`). Idempotent. Combos intentionally skipped (the `Combo: ` prefix already conveys multi-upstream). |
+| `providerTag`         | `boolean` | `true`  | Prepend a short upstream-provider label to the enriched display name with `" - "` separator, so `cc/claude-opus-4-7 → Claude - Claude Opus 4.7` differs visibly from `kr/claude-opus-4-7 → Kiro - Claude Opus 4.7` in the OC TUI model picker. Label resolution: use `/api/pricing/models[<alias>].name` verbatim when ≤8 chars (e.g. `Claude`, `Kiro`, `Codex`, `Qwen`), otherwise fall back to `UPPER(alias)` (e.g. `GitHub Models` → `GHM`, `Gemini` → `GEMINI`). Idempotent. Combos intentionally skipped (the `Combo: ` prefix already conveys multi-upstream). |
 | `usableOnly`          | `boolean` | `false` | Read `/api/providers` and filter the catalog to providers that have at least one connection with `isActive: true` AND `testStatus: 'active'`. Subtract-filter semantics: providers unknown to BOTH the pricing-models catalog AND the connection table pass through (so synthetic prefixes like `agentrouter/*` survive). On fetch failure the filter is disabled for the refresh — never hides the whole catalog.                                                                                                                                                           |
 | `diskCache`           | `boolean` | `true`  | Persist the last successful `/v1/models` + `/api/combos` + enrichment + connections + compression snapshot to `${OPENCODE_DATA_DIR ?? ~/.local/share/opencode}/plugins/omniroute-<providerId>.json`. On a subsequent cold start where `/v1/models` throws (network down / IP whitelist drop / 5xx) the static block hydrates from the snapshot so OC's model picker survives offline. Soft-fail on read/write — never blocks publishing.                                                                                                                                     |
 | `geminiSanitization`  | `boolean` | `true`  | Strip `$schema`/`$ref`/`additionalProperties` from tool params when the model id matches `gemini`                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |

@omniroute/opencode-plugin/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@omniroute/opencode-plugin",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@omniroute/opencode-plugin",
-      "version": "0.1.0",
+      "version": "0.2.0",
       "license": "MIT",
       "dependencies": {
         "zod": "^4.4.3"

@omniroute/opencode-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@omniroute/opencode-plugin",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "OpenCode plugin for the OmniRoute AI Gateway. Drives dynamic model discovery, /connect auth flow, and multi-instance OmniRoute providers via the official @opencode-ai/plugin contract.",
   "type": "module",
   "main": "./dist/index.js",
@@ -23,7 +23,7 @@
   "scripts": {
     "build": "tsup",
     "clean": "rm -rf dist",
-    "test": "node --import tsx/esm --test tests/scaffold.test.ts tests/auth.test.ts tests/options-schema.test.ts tests/multi-instance.test.ts tests/fetch-interceptor.test.ts tests/provider.test.ts tests/gemini-sanitize.test.ts tests/combos.test.ts tests/config-shim.test.ts tests/features.test.ts tests/usable-combo.test.ts tests/disk-snapshot-perms.test.ts tests/fork-features.test.ts tests/auto-combo-context.test.ts",
+    "test": "node --import tsx/esm --test tests/scaffold.test.ts tests/auth.test.ts tests/options-schema.test.ts tests/multi-instance.test.ts tests/fetch-interceptor.test.ts tests/provider.test.ts tests/gemini-sanitize.test.ts tests/combos.test.ts tests/config-shim.test.ts tests/features.test.ts tests/usable-combo.test.ts tests/disk-snapshot-perms.test.ts tests/fork-features.test.ts tests/auto-combo-context.test.ts tests/provider-id-routing.test.ts",
     "prepublishOnly": "npm run clean && npm run build && npm test"
   },
   "keywords": [

@omniroute/opencode-plugin/src/index.ts

@@ -238,9 +238,26 @@ function trimLeadingDashes(value: string): string {
  */
 export function resolveOmniRoutePluginOptions(
   opts?: OmniRoutePluginOptions
-): Required<Pick<OmniRoutePluginOptions, "providerId" | "displayName" | "modelCacheTtl">> &
-  Pick<OmniRoutePluginOptions, "baseURL" | "features"> {
+): Required<
+  Pick<OmniRoutePluginOptions, "providerId" | "displayName" | "modelCacheTtl">
+> & {
+  /**
+   * #6859: the UNPREFIXED provider id ("omniroute", "omniroute-preprod", …).
+   * `providerId` above is auto-prefixed with "opencode-" ONLY to satisfy OC
+   * 1.17.8+'s native-adapter gate ({openai, anthropic, opencode*}) — that
+   * prefixed value is OC-internal and must be used ONLY for AuthHook.provider
+   * and provider-registration keys (the OC config-hook top-level
+   * `provider.<id>` block). `omnirouteProviderId` MUST be used everywhere an
+   * identifier reaches or represents something OmniRoute's own server parses
+   * (model `id` prefix, `ModelV2.providerID`, combo catalog keys in the
+   * dynamic provider hook) — OmniRoute's `parseModel()` has no alias for
+   * "opencode-<x>", so a prefixed id there is unrecoverable and credential
+   * lookup fails with "No credentials for opencode-<x>".
+   */
+  omnirouteProviderId: string;
+} & Pick<OmniRoutePluginOptions, "baseURL" | "features"> {
   const rawProviderId = opts?.providerId ?? OMNIROUTE_PROVIDER_KEY;
+  const omnirouteProviderId = trimLeadingOpencodePrefix(rawProviderId);
   // OC 1.17.8+ native-adapter gate rejects providerID not in
   // {openai, anthropic, opencode*}. Silently prefix so existing
   // configs (providerId: "omniroute") keep working.
@@ -258,6 +275,7 @@ export function resolveOmniRoutePluginOptions(
       : DEFAULT_MODEL_CACHE_TTL_MS;
   return {
     providerId,
+    omnirouteProviderId,
     displayName,
     modelCacheTtl,
     baseURL: opts?.baseURL,
@@ -265,6 +283,18 @@ export function resolveOmniRoutePluginOptions(
   };
 }
 
+/**
+ * Strip a leading "opencode-" prefix (added only for the OC native-adapter
+ * gate — see `resolveOmniRoutePluginOptions`) so the returned id is safe to
+ * embed in anything OmniRoute's own server parses. A user-supplied
+ * `providerId: "opencode-omniroute"` (already prefixed) resolves to the same
+ * unprefixed "omniroute" as the default, matching `providerId`'s own
+ * idempotent-prefix handling above.
+ */
+function trimLeadingOpencodePrefix(rawProviderId: string): string {
+  return rawProviderId.startsWith("opencode-") ? rawProviderId.slice("opencode-".length) : rawProviderId;
+}
+
 /**
  * Strict parse of raw plugin options (as received from opencode.json or a
  * direct factory call) into the validated `OmniRoutePluginOptions` shape.
@@ -1225,7 +1255,7 @@ export interface OmniRouteEnrichmentEntry {
     cacheWrite?: number;
   };
   /**
-   * Provider alias prefix seen in `/v1/models` ids (e.g. `cc`, `gemini-cli`).
+   * Provider alias prefix seen in `/v1/models` ids (e.g. `cc`, `gemini`).
    * Populated by `defaultOmniRouteEnrichmentFetcher` from
    * `/api/pricing/models` keys. Drives the `usableOnly` alias↔canonical
    * resolution.
@@ -1233,7 +1263,7 @@ export interface OmniRouteEnrichmentEntry {
   providerAlias?: string;
   /**
    * Canonical provider id used by `/api/providers` connections (e.g.
-   * `claude`, `gemini-cli`, `kiro`). Populated from the per-provider
+   * `claude`, `gemini`, `kiro`). Populated from the per-provider
    * `entry.id` field inside `/api/pricing/models`.
    */
   providerCanonical?: string;
@@ -2046,7 +2076,7 @@ export function formatCompressionPipeline(pipeline: OmniRouteCompressionStep[]):
 export interface OmniRouteProviderConnection {
   /** Connection UUID. */
   id: string;
-  /** Canonical provider id, e.g. `claude`, `gemini-cli`, `kiro`. Matches `entry.id` in `/api/pricing/models`. */
+  /** Canonical provider id, e.g. `claude`, `gemini`, `kiro`. Matches `entry.id` in `/api/pricing/models`. */
   provider: string;
   /** Connection auth flavor, e.g. `apikey`, `oauth`, `cookie`. */
   authType?: string;
@@ -2125,7 +2155,7 @@ export const defaultOmniRouteProvidersFetcher: OmniRouteProvidersFetcher = async
  * walk only the namespaced keys to derive the alias↔canonical mapping).
  *
  * Returns:
- *   - `aliases`: set of alias prefixes safe to keep (e.g. `cc`, `gemini-cli`).
+ *   - `aliases`: set of alias prefixes safe to keep (e.g. `cc`, `gemini`).
  *   - `canonicals`: set of canonical provider ids (e.g. `claude`, `kiro`).
  *
  * Callers should treat membership in EITHER set as "usable" — raw model
@@ -2174,7 +2204,7 @@ export function usableProviderAliasSet(
   }
   // Always include every usable canonical as an alias too — handles the
   // common case where `/v1/models` ids use the canonical id directly
-  // (e.g. `gemini-cli/gemini-1.5-pro`).
+  // (e.g. `gemini/gemini-1.5-pro`).
   for (const canonical of usableCanonicals) aliases.add(canonical);
   return { aliases, canonicals: usableCanonicals, knownAliases };
 }
@@ -2661,7 +2691,8 @@ export function createOmniRouteProviderHook(
         if (canonicalDedup.has(entry.id)) continue;
         if (usable && !isUsableRawModelId(entry.id, usable, rawEnrichment)) continue;
         const model = mapRawModelToModelV2(entry, {
-          providerId: resolved.providerId,
+          // #6859: server-facing id — NOT the OC-gate-prefixed `resolved.providerId`.
+          providerId: resolved.omnirouteProviderId,
           baseURL,
           apiFormat: resolved.features?.apiFormat,
         });
@@ -2826,7 +2857,8 @@ export function createOmniRouteProviderHook(
           const mapped = mapComboToModelV2(
             combo,
             memberEntries,
-            resolved.providerId,
+            // #6859: server-facing id — NOT the OC-gate-prefixed `resolved.providerId`.
+            resolved.omnirouteProviderId,
             baseURL,
             features.apiFormat
           );
@@ -2845,7 +2877,8 @@ export function createOmniRouteProviderHook(
             }
           }
 
-          const comboKey = buildComboKey(combo, usedComboKeys, resolved.providerId);
+          // #6859: server-facing key — NOT the OC-gate-prefixed `resolved.providerId`.
+          const comboKey = buildComboKey(combo, usedComboKeys, resolved.omnirouteProviderId);
 
           // Collision policy: combos win. Warn ONCE per (cacheKey, comboKey)
           // when overwriting a same-key raw model so the operator can spot
@@ -2947,7 +2980,8 @@ export function createOmniRouteProviderHook(
             },
             status: "active",
             release_date: "",
-            providerID: resolved.providerId,
+            // #6859: server-facing id — NOT the OC-gate-prefixed `resolved.providerId`.
+            providerID: resolved.omnirouteProviderId,
             options: {},
             headers: {},
           };
@@ -3174,7 +3208,6 @@ export function sanitizeGeminiToolSchemas(payload: unknown): unknown {
  *     `gemini-2.5-flash`, etc.)
  *   - `models/gemini-…` (Google Generative AI canonical id form)
  *   - `google-vertex/gemini-…` (OpenCode + AI-SDK Vertex routing prefix)
- *   - `gemini-cli/…` (real OmniRoute alias surfaced on b35 prod `/v1/models`)
  *
  * Liberal by design: a false positive (cleaning a payload that didn't
  * need cleaning) costs only a structuredClone + one walk; a false negative

@omniroute/opencode-plugin/tests/combos.test.ts

@@ -447,14 +447,14 @@ test("models() returns combo entries merged into the map", async () => {
 
   // 3 raw models + 1 combo = 4 entries
   assert.equal(Object.keys(out).length, 4);
-  assert.ok(out["opencode-omniroute/claude-primary"]);
-  assert.ok(out["opencode-omniroute/claude-secondary"]);
-  assert.ok(out["opencode-omniroute/gemini-3-flash"]);
-  assert.ok(out["opencode-omniroute/claude-tier"]);
+  assert.ok(out["omniroute/claude-primary"]);
+  assert.ok(out["omniroute/claude-secondary"]);
+  assert.ok(out["omniroute/gemini-3-flash"]);
+  assert.ok(out["omniroute/claude-tier"]);
 
-  const combo = out["opencode-omniroute/claude-tier"];
+  const combo = out["omniroute/claude-tier"];
   assert.equal(combo.name, "Claude Tier");
-  assert.equal(combo.providerID, "opencode-omniroute");
+  assert.equal(combo.providerID, "omniroute");
   // LCD over claude-primary (200k, reasoning) + claude-secondary (100k, no reasoning)
   assert.equal(combo.limit.context, 100_000);
   assert.equal(combo.capabilities.reasoning, false);
@@ -478,11 +478,11 @@ test("models(): combo with unknown member ids degrades to all-false LCD posture"
     { fetcher: modelsFetcher, combosFetcher }
   );
   const out = await hook.models!({} as never, { auth: apiAuth("sk-z") as never });
-  assert.ok(out["opencode-omniroute/phantom-combo"]);
+  assert.ok(out["omniroute/phantom-combo"]);
   // With zero resolvable members, LCD = all-false (defensive posture).
-  assert.equal(out["opencode-omniroute/phantom-combo"].capabilities.toolcall, false);
-  assert.equal(out["opencode-omniroute/phantom-combo"].capabilities.reasoning, false);
-  assert.equal(out["opencode-omniroute/phantom-combo"].limit.context, 0);
+  assert.equal(out["omniroute/phantom-combo"].capabilities.toolcall, false);
+  assert.equal(out["omniroute/phantom-combo"].capabilities.reasoning, false);
+  assert.equal(out["omniroute/phantom-combo"].limit.context, 0);
 });
 
 test("models(): hidden combos are excluded from the map", async () => {
@@ -505,8 +505,8 @@ test("models(): hidden combos are excluded from the map", async () => {
     { fetcher: modelsFetcher, combosFetcher }
   );
   const out = await hook.models!({} as never, { auth: apiAuth("sk-z") as never });
-  assert.ok(out["opencode-omniroute/visible"]);
-  assert.ok(!out["opencode-omniroute/hidden"], "hidden combo must be omitted");
+  assert.ok(out["omniroute/visible"]);
+  assert.ok(!out["omniroute/hidden"], "hidden combo must be omitted");
 });
 
 test("models(): combo name exactly matches raw model id → raw deleted, raw deleted, no warn", async () => {
@@ -530,8 +530,8 @@ test("models(): combo name exactly matches raw model id → raw deleted, raw del
   });
 
   // Raw model replaced by combo of the same key; combo now lives at the bare slug.
-  assert.ok(out["opencode-omniroute/claude-primary"], "combo surfaces under prefixed key");
-  assert.equal(out["opencode-omniroute/claude-primary"].name, "claude-primary");
+  assert.ok(out["omniroute/claude-primary"], "combo surfaces under prefixed key");
+  assert.equal(out["omniroute/claude-primary"].name, "claude-primary");
 
   // No collision warning fires — dedup makes keys disjoint.
   const collisionWarns = warnings.filter((w) => {
@@ -565,8 +565,8 @@ test("models(): two combos with same slug → second gets disambiguator suffix",
 
   const out = await hook.models!({} as never, { auth: apiAuth("sk-z") as never });
   // First combo gets the bare slug; second gets disambiguated.
-  assert.ok(out["opencode-omniroute/claude"], "first combo at prefixed slug");
-  assert.ok(out["opencode-omniroute/claude-uuid"], "second combo disambiguated by id prefix");
+  assert.ok(out["omniroute/claude"], "first combo at prefixed slug");
+  assert.ok(out["omniroute/claude-uuid"], "second combo disambiguated by id prefix");
 });
 
 test("models(): combos fetch fails → falls back to models-only, warn emitted, no throw", async () => {
@@ -583,8 +583,8 @@ test("models(): combos fetch fails → falls back to models-only, warn emitted,
 
   // Catalog includes the models but NOT any combo entries.
   assert.equal(Object.keys(out).length, 2);
-  assert.ok(out["opencode-omniroute/claude-primary"]);
-  assert.ok(out["opencode-omniroute/claude-secondary"]);
+  assert.ok(out["omniroute/claude-primary"]);
+  assert.ok(out["omniroute/claude-secondary"]);
 
   // Soft-fail warning surfaced.
   const softFail = warnings.find((w) => {
@@ -609,7 +609,7 @@ test("models(): combos cached + reused within TTL (one combo fetch per TTL windo
   const second = await hook.models!({} as never, { auth: apiAuth("sk-z") as never });
   assert.equal(combosFetcher.callCount(), 1, "combos fetched only once within TTL");
   assert.equal(modelsFetcher.callCount(), 1, "models fetched only once within TTL");
-  assert.ok(second["opencode-omniroute/claude-tier"]);
+  assert.ok(second["omniroute/claude-tier"]);
 });
 
 test("models(): combos refetched after TTL expiry (same key as models)", async () => {
@@ -701,7 +701,7 @@ test("models(): nested combo-ref context is the min of nested + raw members", as
     { fetcher: modelsFetcher, combosFetcher }
   );
   const out = await hook.models!({} as never, { auth: apiAuth("sk-z") as never });
-  const masterLight = out["opencode-omniroute/master-light"];
+  const masterLight = out["omniroute/master-light"];
   assert.ok(masterLight, "MASTER-LIGHT entry must exist");
   assert.equal(
     masterLight.limit.context,

@omniroute/opencode-plugin/tests/config-shim.test.ts

@@ -1311,9 +1311,9 @@ test("config: providerTag (default-on) prepends '<provider> - ' to enriched raw-
         "gemini-3-flash",
         {
           name: "Gemini 3 Flash",
-          providerAlias: "gemini-cli",
-          providerCanonical: "gemini-cli",
-          providerDisplayName: "Gemini-cli",
+          providerAlias: "gemini",
+          providerCanonical: "gemini",
+          providerDisplayName: "Gemini",
         },
       ],
     ])
@@ -1335,10 +1335,7 @@ test("config: providerTag (default-on) prepends '<provider> - ' to enriched raw-
     entry.models["opencode-omniroute/claude-sonnet-4-6"].name,
     "Claude - Claude Sonnet 4.6"
   );
-  assert.equal(
-    entry.models["opencode-omniroute/gemini-3-flash"].name,
-    "Gemini-cli - Gemini 3 Flash"
-  );
+  assert.equal(entry.models["opencode-omniroute/gemini-3-flash"].name, "Gemini - Gemini 3 Flash");
   // Combos stay untouched — `Combo: ` prefix already conveys multi-upstream.
   assert.equal(entry.models["opencode-omniroute/claude-tier"].name, "Claude Tier");
 });

@omniroute/opencode-plugin/tests/features.test.ts

@@ -376,7 +376,8 @@ test("provider hook: enrichment fetcher called when features.enrichment !== fals
   );
   const out = await hook.models!({} as never, { auth: apiAuth("sk") as never });
   assert.equal(called, 1, "enrichment fetcher called once");
-  const m = out["opencode-omniroute/claude-sonnet-4-6"];
+  // #6859: dynamic-hook catalog keys use the unprefixed omnirouteProviderId.
+  const m = out["omniroute/claude-sonnet-4-6"];
   assert.equal(m.name, "Claude Sonnet 4.6", "enrichment name overlay applied");
   assert.equal(m.cost.input, 3, "enrichment pricing applied");
   assert.equal(m.cost.output, 15);
@@ -402,7 +403,7 @@ test("provider hook: enrichment fetcher NOT called when features.enrichment:fals
   const out = await hook.models!({} as never, { auth: apiAuth("sk") as never });
   assert.equal(called, 0, "enrichment fetcher NOT called when gated off");
   assert.equal(
-    out["opencode-omniroute/claude-sonnet-4-6"].name,
+    out["omniroute/claude-sonnet-4-6"].name,
     "claude-sonnet-4-6",
     "raw id preserved"
   );
@@ -463,7 +464,7 @@ test("provider hook: compression metadata fetcher called when opted in", async (
   );
   const out = await hook.models!({} as never, { auth: apiAuth("sk") as never });
   assert.equal(called, 1, "compression metadata fetcher called");
-  const combo = out["opencode-omniroute/claude-primary"];
+  const combo = out["omniroute/claude-primary"];
   assert.ok(combo, "combo entry present");
   assert.match(
     combo.name,

@omniroute/opencode-plugin/tests/gemini-sanitize.test.ts

@@ -212,8 +212,8 @@ test("shouldSanitizeForGemini: google-vertex/gemini-1.5-flash → true", () => {
   assert.equal(shouldSanitizeForGemini({ model: "google-vertex/gemini-1.5-flash" }), true);
 });
 
-test("shouldSanitizeForGemini: gemini-cli/gemini-2.5-pro → true (real OmniRoute alias)", () => {
-  assert.equal(shouldSanitizeForGemini({ model: "gemini-cli/gemini-2.5-pro" }), true);
+test("shouldSanitizeForGemini: gemini/gemini-2.5-pro → true", () => {
+  assert.equal(shouldSanitizeForGemini({ model: "gemini/gemini-2.5-pro" }), true);
 });
 
 test("shouldSanitizeForGemini: claude-sonnet-4 → false", () => {

@omniroute/opencode-plugin/tests/provider-id-routing.test.ts

@@ -0,0 +1,99 @@
+/**
+ * Regression test for #6859.
+ *
+ * `resolveOmniRoutePluginOptions()` auto-prefixes `providerId` with
+ * `"opencode-"` (commit 75b52e286) so OpenCode 1.17.8+'s native-adapter gate
+ * accepts it as an OC-registered provider id. That prefixed value must stay
+ * OC-internal (AuthHook.provider / provider registration keys) — it must
+ * NEVER leak into the identifiers OmniRoute's own server parses to resolve
+ * credentials (`mapRawModelToModelV2`'s `id`/`providerID`,
+ * `mapComboToModelV2`'s `providerID`, and the dynamic-hook catalog keys).
+ *
+ * OmniRoute's server-side `parseModel()` (open-sse/services/model.ts) splits
+ * a dispatched model string on `/` to recover the provider name and look up
+ * credentials. If the plugin embeds the OC-gate-prefixed id in that string,
+ * the server looks up credentials for a provider named "opencode-omniroute"
+ * (which never exists in `src/shared/constants/providers.ts`) instead of
+ * "omniroute" — producing the exact "No credentials for opencode-omniroute" /
+ * "No active credentials for provider: opencode-omniroute" errors reported
+ * in #6859.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import {
+  createOmniRouteProviderHook,
+  mapRawModelToModelV2,
+  resolveOmniRoutePluginOptions,
+} from "../src/index.js";
+
+/**
+ * Minimal stand-in for OmniRoute's own `parseModel()` (open-sse/services/
+ * model.ts), which splits a dispatched `<providerID>/<modelID>` string on the
+ * FIRST "/" to recover the provider name used for credential lookup. Kept
+ * local (rather than cross-importing the real module) so this package's
+ * self-contained test suite (`cd @omniroute/opencode-plugin && npm test`)
+ * doesn't depend on the root repo's `@/*` path-alias resolution.
+ */
+function splitProviderFromDispatchedModel(modelStr: string): string {
+  const idx = modelStr.indexOf("/");
+  return idx === -1 ? modelStr : modelStr.slice(0, idx);
+}
+
+const apiAuth = (key: string) => ({ type: "api" as const, key });
+
+test("#6859: server-facing model id/providerID must resolve to the unprefixed provider name", () => {
+  const resolved = resolveOmniRoutePluginOptions();
+
+  // The OC-gate-compatible id stays prefixed — it is legitimate for
+  // AuthHook.provider / provider registration.
+  assert.equal(resolved.providerId, "opencode-omniroute");
+
+  // A second, unprefixed id must be exposed for anything that reaches
+  // OmniRoute's own server (model id prefix, ModelV2.providerID, combo keys).
+  assert.equal(
+    resolved.omnirouteProviderId,
+    "omniroute",
+    "resolveOmniRoutePluginOptions() must expose an unprefixed omnirouteProviderId"
+  );
+
+  // A bare raw /v1/models entry (no existing "/" in its id — the common
+  // case for OmniRoute's catalog) mapped with the server-facing id.
+  const model = mapRawModelToModelV2(
+    { id: "claude-opus-4-7" },
+    { providerId: resolved.omnirouteProviderId, baseURL: "http://localhost:20128" }
+  );
+
+  assert.equal(model.providerID, "omniroute");
+  assert.equal(model.id, "omniroute/claude-opus-4-7");
+
+  // OpenCode dispatches back to OmniRoute using `providerID/modelKey`
+  // (matches the issue's own repro: `-m opencode-omniroute/oc/big-pickle`).
+  const dispatchedModelString = `${model.providerID}/claude-opus-4-7`;
+  const parsedProvider = splitProviderFromDispatchedModel(dispatchedModelString);
+
+  assert.equal(
+    parsedProvider,
+    "omniroute",
+    `server-side provider split resolved '${parsedProvider}', expected 'omniroute' — ` +
+      `credentials lookup would fail for an OC-gate-prefixed provider id`
+  );
+});
+
+test("#6859: createOmniRouteProviderHook end-to-end — catalog keys/providerID never carry the OC-gate prefix", async () => {
+  const hook = createOmniRouteProviderHook(
+    { baseURL: "https://or.example.com/v1" },
+    {
+      fetcher: async () => [{ id: "claude-opus-4-7" }],
+      combosFetcher: async () => [],
+    }
+  );
+  const out = await hook.models!({} as never, { auth: apiAuth("sk-test") as never });
+  const model = out["omniroute/claude-opus-4-7"];
+  assert.ok(model, "catalog keyed under the unprefixed provider name");
+  assert.equal(model.providerID, "omniroute");
+  assert.ok(
+    !model.providerID.startsWith("opencode-"),
+    "the OC-gate prefix must never leak into ModelV2.providerID"
+  );
+});

@omniroute/opencode-plugin/tests/provider.test.ts

@@ -101,7 +101,10 @@ test("models: extracts apiKey from ctx.auth (type=api) and calls fetcher with it
   assert.equal(fetcher.callCount(), 1);
   assert.deepEqual(fetcher.callsBy()[0], ["https://or.example.com/v1", "sk-abc"]);
   assert.equal(Object.keys(out).length, 3);
-  assert.ok(out["opencode-omniroute/claude-primary"]);
+  // #6859: dynamic-hook catalog keys use the unprefixed omnirouteProviderId
+  // ("omniroute"), not the OC-gate-prefixed hook.id ("opencode-omniroute") —
+  // that prefix must never leak into anything OmniRoute's server parses.
+  assert.ok(out["omniroute/claude-primary"]);
 });
 
 test("models: returns {} when ctx.auth is null/undefined/wrong-type/empty-key", async () => {
@@ -152,13 +155,17 @@ test("models: maps a sample /v1/models entry to ModelV2 (sanity)", async () => {
     { fetcher, combosFetcher: async () => [] }
   );
   const out = await hook.models!({} as never, { auth: apiAuth("sk-abc") as never });
-  const claude = out["opencode-omniroute/claude-primary"];
+  // #6859: dynamic-hook catalog keys/ids/providerID use the unprefixed
+  // omnirouteProviderId ("omniroute") — the OC-gate prefix ("opencode-")
+  // must stay OC-internal (hook.id / AuthHook.provider) and never leak into
+  // anything OmniRoute's own server parses for credential lookup.
+  const claude = out["omniroute/claude-primary"];
   assert.ok(claude, "claude-primary present");
   // `mapRawModelToModelV2` stamps the provider prefix on the id so OC's
   // static-catalog reader resolves `(providerID, modelID)` from the key.
-  assert.equal(claude.id, "opencode-omniroute/claude-primary");
+  assert.equal(claude.id, "omniroute/claude-primary");
   assert.equal(claude.name, "claude-primary");
-  assert.equal(claude.providerID, "opencode-omniroute");
+  assert.equal(claude.providerID, "omniroute");
   assert.equal(claude.api.id, "openai-compatible");
   assert.equal(claude.api.url, "https://or.example.com/v1");
   assert.equal(claude.api.npm, "@ai-sdk/openai-compatible");

AGENTS.md

@@ -3,14 +3,14 @@
 ## Project
 
 Unified AI proxy/router — route any LLM through one endpoint. Multi-provider support
-with **231 provider entries** (OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Fireworks,
+with **250 provider entries** (OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Fireworks,
 Cohere, NVIDIA, Cerebras, Pollinations, Puter, Cloudflare AI, HuggingFace, DeepInfra,
 SambaNova, Meta Llama API, Moonshot AI, AI21 Labs, Databricks, Snowflake, and many more)
-with **MCP Server** (87 tools), **A2A v0.3 Protocol**, and **Electron desktop app**.
+with **MCP Server** (94 tools), **A2A v0.3 Protocol**, and **Electron desktop app**.
 
-> **Live counts (v3.8.31)**: providers 231 · MCP tools 87 · MCP scopes 30 · A2A skills 6 ·
-> open-sse services 115 · routing strategies 15 · auto-combo scoring factors 9 ·
-> DB modules 83 · DB migrations 97 · base tables 17 · search providers 11 ·
+> **Live counts (v3.8.47)**: providers 250 · MCP tools 94 · MCP scopes 30 · A2A skills 6 ·
+> open-sse services 134 · routing strategies 17 · auto-combo scoring factors 12 ·
+> DB modules 95 · DB migrations 110 · base tables 17 · search providers 11 ·
 > i18n locales 42. **Refresh with `npm run check:docs-all`.**
 
 ## Doc Accuracy Discipline (read before writing any doc)
@@ -178,7 +178,7 @@ Always run `prettier --write` on changed files.
 
 ### Data Layer (`src/lib/db/`)
 
-All persistence uses SQLite through **83 domain-specific modules** in `src/lib/db/`. Top modules:
+All persistence uses SQLite through **95 domain-specific modules** in `src/lib/db/`. Top modules:
 
 - Core: `core.ts`, `migrationRunner.ts`, `encryption.ts`, `stateReset.ts`
 - Providers / catalog: `providers.ts`, `models.ts`, `providerLimits.ts`, `compressionAnalytics.ts`
@@ -188,8 +188,8 @@ All persistence uses SQLite through **83 domain-specific modules** in `src/lib/d
 - Storage: `backup.ts`, `cleanup.ts`, `jsonMigration.ts`, `healthCheck.ts`, `databaseSettings.ts`
 - Extension modules: `evals.ts`, `webhooks.ts`, `reasoningCache.ts`, `readCache.ts`, `tierConfig.ts`, `compressionCombos.ts`, `compressionScheduler.ts`, `batches.ts`, `files.ts`, `syncTokens.ts`, `proxies.ts`, `oneproxy.ts`, `upstreamProxy.ts`, `versionManager.ts`, `cliToolState.ts`, `prompts.ts`, `detailedLogs.ts`, `contextHandoffs.ts`, `compression.ts`, `stats.ts`
 
-Live count: `ls src/lib/db/*.ts | wc -l` (currently 83). Drift detection: `npm run check:docs-counts`.
-Schema migrations live in `db/migrations/` (**97 files** as of v3.8.24) and run via `migrationRunner.ts`.
+Live count: `ls src/lib/db/*.ts | wc -l` (currently 95). Drift detection: `npm run check:docs-counts`.
+Schema migrations live in `db/migrations/` (**110 files** as of v3.8.43) and run via `migrationRunner.ts`.
 `src/lib/localDb.ts` is a **re-export layer only** — never add logic there.
 
 #### DB Internals
@@ -198,7 +198,7 @@ Schema migrations live in `db/migrations/` (**97 files** as of v3.8.24) and run
   journaling. `SCHEMA_SQL` defines **17 base tables** (verify with `grep -c "CREATE TABLE" src/lib/db/core.ts` minus 1 for the bookkeeping `_omniroute_migrations` table). Helpers: `rowToCamel`, `encryptConnectionFields`.
 - **`migrationRunner.ts`**: Applies versioned SQL files from `db/migrations/` inside transactions.
   Tracks applied migrations in `_omniroute_migrations` table.
-- **Migrations**: 97 files (`001_initial_schema.sql` → `099_*.sql`).
+- **Migrations**: 110 files (`001_initial_schema.sql` → `110_*.sql`).
   Each migration is idempotent and runs in a transaction. Live count: `ls src/lib/db/migrations/*.sql | wc -l`.
 - **Domain modules** import `getDbInstance()` from `core.ts` for all CRUD operations.
   Each module owns a specific table/set of tables (e.g., `providers.ts` → `provider_connections`,
@@ -267,7 +267,7 @@ Zod schemas, and unit tests aligned when editing.
 
 ### Provider Categories
 
-- **Free** (4): Qoder AI, Qwen Code, Gemini CLI (deprecated), Kiro AI
+- **Free** (3): Qoder AI, Qwen Code, Kiro AI
 - **OAuth** (14): Claude Code, Antigravity, Codex, GitHub Copilot, Cursor, Kimi Coding, Kilo Code, Cline, Qwen (⚠️ free tier discontinued 2026-04-15), Kiro, Qoder, Gemini, Windsurf (v3.8), GitLab Duo (v3.8)
 - **API Key** (120+): OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Perplexity,
   Together, Fireworks, Cerebras, Cohere, NVIDIA, Nebius, SiliconFlow, Hyperbolic,
@@ -291,7 +291,7 @@ Providers are registered in `src/shared/constants/providers.ts` with Zod validat
 ### Executors (`open-sse/executors/`)
 
 Provider-specific request executors: `base.ts`, `default.ts`, `cursor.ts`, `codex.ts`,
-`antigravity.ts`, `github.ts`, `gemini-cli.ts`, `kiro.ts`, `qoder.ts`, `vertex.ts`,
+`antigravity.ts`, `github.ts`, `kiro.ts`, `qoder.ts`, `vertex.ts`,
 `cloudflare-ai.ts`, `opencode.ts`, `pollinations.ts`, `puter.ts`.
 
 #### Executor Internals
@@ -336,7 +336,7 @@ Includes request/response translators with helpers for image handling.
 
 ### Services (`open-sse/services/`)
 
-115 service modules in `open-sse/services/` (top-level only; 184 including sub-dirs like `autoCombo/` and `compression/`). Refresh: `ls open-sse/services/*.ts | wc -l`. Key modules:
+134 service modules in `open-sse/services/` (top-level only; more including sub-dirs like `autoCombo/` and `compression/`). Refresh: `ls open-sse/services/*.ts | wc -l`. Key modules:
 `combo.ts` (routing engine), `usage.ts`, `tokenRefresh.ts`,
 `rateLimitManager.ts`, `accountFallback.ts`, `sessionManager.ts`, `wildcardRouter.ts`,
 `autoCombo/`, `intentClassifier.ts`, `taskAwareRouter.ts`, `thinkingBudget.ts`,
@@ -378,8 +378,8 @@ Modular prompt compression that runs proactively before the existing reactive co
   and iterates through targets in order until one succeeds or all fail.
 - **`resolveComboTargets()`**: Expands a combo configuration into an ordered array of
   `ResolvedComboTarget[]`, each specifying provider + model + account + credentials.
-- **Strategies** (15): priority, weighted, fill-first, round-robin, P2C, random, least-used, reset-aware (v3.8),
-  reset-window, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay. Source: `ROUTING_STRATEGY_VALUES` in `src/shared/constants/routingStrategies.ts`.
+- **Strategies** (17): priority, weighted, fill-first, round-robin, P2C, random, least-used, reset-aware (v3.8),
+  reset-window, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, headroom, fusion. Source: `ROUTING_STRATEGY_VALUES` in `src/shared/constants/routingStrategies.ts`.
 - Each target calls **`handleSingleModel()`** which wraps `handleChatCore()` with
   per-target error handling and circuit breaker checks.
 
@@ -391,7 +391,7 @@ Policy engine modules: `policyEngine.ts`, `comboResolver.ts`, `costRules.ts`,
 
 ### MCP Server (`open-sse/mcp-server/`)
 
-**87 tools** total (`TOTAL_MCP_TOOL_COUNT`, `open-sse/mcp-server/server.ts`): a 33-entry base registry (`MCP_TOOLS` in `schemas/tools.ts`, bundling the core / cache / compression / 1proxy / advanced tools) **plus** standalone module sets — memory (3), skill (4), agentSkill (3), gamification (8), plugin (8), notion (6), obsidian (22). 3 transports (stdio / SSE / Streamable HTTP). Scoped auth (30 scopes — see `OMNIROUTE_MCP_SCOPES`), Zod schemas. See [`docs/frameworks/MCP-SERVER.md`](docs/frameworks/MCP-SERVER.md).
+**94 tools** total (`TOTAL_MCP_TOOL_COUNT`, `open-sse/mcp-server/server.ts`): a 34-entry base registry (`MCP_TOOLS` in `schemas/tools.ts`, bundling the core / cache / compression / 1proxy / advanced tools) **plus** standalone module sets — memory (3), skill (4), agentSkill (3), pool (6), gamification (8), plugin (8), notion (6), obsidian (22). 3 transports (stdio / SSE / Streamable HTTP). Scoped auth (30 scopes — see `OMNIROUTE_MCP_SCOPES`), Zod schemas. See [`docs/frameworks/MCP-SERVER.md`](docs/frameworks/MCP-SERVER.md).
 
 **Core tools** (20): get_health, list_combos, get_combo_metrics, switch_combo, check_quota,
 route_request, cost_report, list_models_catalog, web_search, simulate_route, set_budget_guard,
@@ -534,33 +534,33 @@ Cloudflare Quick/Named, ngrok, Tailscale Funnel. See [`docs/ops/TUNNELS_GUIDE.md
 
 For any non-trivial change, read the matching deep-dive first:
 
-| Area                                       | Doc                                                                                                                                 |
-| ------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------- |
-| Repo navigation                            | [`docs/architecture/REPOSITORY_MAP.md`](docs/architecture/REPOSITORY_MAP.md)                                                        |
-| Architecture                               | [`docs/architecture/ARCHITECTURE.md`](docs/architecture/ARCHITECTURE.md)                                                            |
-| Engineering reference                      | [`docs/architecture/CODEBASE_DOCUMENTATION.md`](docs/architecture/CODEBASE_DOCUMENTATION.md)                                        |
-| Auto-Combo (12-factor, 15 strategies)      | [`docs/routing/AUTO-COMBO.md`](docs/routing/AUTO-COMBO.md)                                                                          |
-| Resilience (3 layers)                      | [`docs/architecture/RESILIENCE_GUIDE.md`](docs/architecture/RESILIENCE_GUIDE.md)                                                    |
-| Skills                                     | [`docs/frameworks/SKILLS.md`](docs/frameworks/SKILLS.md)                                                                            |
-| Memory                                     | [`docs/frameworks/MEMORY.md`](docs/frameworks/MEMORY.md)                                                                            |
-| Cloud agents                               | [`docs/frameworks/CLOUD_AGENT.md`](docs/frameworks/CLOUD_AGENT.md)                                                                  |
-| Guardrails                                 | [`docs/security/GUARDRAILS.md`](docs/security/GUARDRAILS.md)                                                                        |
-| Evals                                      | [`docs/frameworks/EVALS.md`](docs/frameworks/EVALS.md)                                                                              |
-| Compliance                                 | [`docs/security/COMPLIANCE.md`](docs/security/COMPLIANCE.md)                                                                        |
-| Webhooks                                   | [`docs/frameworks/WEBHOOKS.md`](docs/frameworks/WEBHOOKS.md)                                                                        |
-| Authz                                      | [`docs/architecture/AUTHZ_GUIDE.md`](docs/architecture/AUTHZ_GUIDE.md)                                                              |
-| Stealth                                    | [`docs/security/STEALTH_GUIDE.md`](docs/security/STEALTH_GUIDE.md)                                                                  |
-| Reasoning replay                           | [`docs/routing/REASONING_REPLAY.md`](docs/routing/REASONING_REPLAY.md)                                                              |
-| Agent protocols (A2A / ACP / Cloud)        | [`docs/frameworks/AGENT_PROTOCOLS_GUIDE.md`](docs/frameworks/AGENT_PROTOCOLS_GUIDE.md)                                              |
-| MCP server                                 | [`docs/frameworks/MCP-SERVER.md`](docs/frameworks/MCP-SERVER.md)                                                                    |
-| A2A server                                 | [`docs/frameworks/A2A-SERVER.md`](docs/frameworks/A2A-SERVER.md)                                                                    |
+| Area                                       | Doc                                                                                                             |
+| ------------------------------------------ | --------------------------------------------------------------------------------------------------------------- |
+| Repo navigation                            | [`docs/architecture/REPOSITORY_MAP.md`](docs/architecture/REPOSITORY_MAP.md)                                    |
+| Architecture                               | [`docs/architecture/ARCHITECTURE.md`](docs/architecture/ARCHITECTURE.md)                                        |
+| Engineering reference                      | [`docs/architecture/CODEBASE_DOCUMENTATION.md`](docs/architecture/CODEBASE_DOCUMENTATION.md)                    |
+| Auto-Combo (12-factor, 18 strategies)      | [`docs/routing/AUTO-COMBO.md`](docs/routing/AUTO-COMBO.md)                                                      |
+| Resilience (3 layers)                      | [`docs/architecture/RESILIENCE_GUIDE.md`](docs/architecture/RESILIENCE_GUIDE.md)                                |
+| Skills                                     | [`docs/frameworks/SKILLS.md`](docs/frameworks/SKILLS.md)                                                        |
+| Memory                                     | [`docs/frameworks/MEMORY.md`](docs/frameworks/MEMORY.md)                                                        |
+| Cloud agents                               | [`docs/frameworks/CLOUD_AGENT.md`](docs/frameworks/CLOUD_AGENT.md)                                              |
+| Guardrails                                 | [`docs/security/GUARDRAILS.md`](docs/security/GUARDRAILS.md)                                                    |
+| Evals                                      | [`docs/frameworks/EVALS.md`](docs/frameworks/EVALS.md)                                                          |
+| Compliance                                 | [`docs/security/COMPLIANCE.md`](docs/security/COMPLIANCE.md)                                                    |
+| Webhooks                                   | [`docs/frameworks/WEBHOOKS.md`](docs/frameworks/WEBHOOKS.md)                                                    |
+| Authz                                      | [`docs/architecture/AUTHZ_GUIDE.md`](docs/architecture/AUTHZ_GUIDE.md)                                          |
+| Stealth                                    | [`docs/security/STEALTH_GUIDE.md`](docs/security/STEALTH_GUIDE.md)                                              |
+| Reasoning replay                           | [`docs/routing/REASONING_REPLAY.md`](docs/routing/REASONING_REPLAY.md)                                          |
+| Agent protocols (A2A / ACP / Cloud)        | [`docs/frameworks/AGENT_PROTOCOLS_GUIDE.md`](docs/frameworks/AGENT_PROTOCOLS_GUIDE.md)                          |
+| MCP server                                 | [`docs/frameworks/MCP-SERVER.md`](docs/frameworks/MCP-SERVER.md)                                                |
+| A2A server                                 | [`docs/frameworks/A2A-SERVER.md`](docs/frameworks/A2A-SERVER.md)                                                |
 | API reference                              | [`docs/reference/API_REFERENCE.md`](docs/reference/API_REFERENCE.md) + [`docs/openapi.yaml`](docs/openapi.yaml) |
-| Provider catalog (auto-generated)          | [`docs/reference/PROVIDER_REFERENCE.md`](docs/reference/PROVIDER_REFERENCE.md)                                                      |
-| Tunnels                                    | [`docs/ops/TUNNELS_GUIDE.md`](docs/ops/TUNNELS_GUIDE.md)                                                                            |
-| Electron desktop                           | [`docs/guides/ELECTRON_GUIDE.md`](docs/guides/ELECTRON_GUIDE.md)                                                                    |
-| Release flow                               | [`docs/ops/RELEASE_CHECKLIST.md`](docs/ops/RELEASE_CHECKLIST.md)                                                                    |
-| Quality gates (35 gates, allowlist policy) | [`docs/architecture/QUALITY_GATES.md`](docs/architecture/QUALITY_GATES.md)                                                          |
-| Cluster opt-in profiles (memory, bifrost)  | [`docs/architecture/cluster-decisions.md`](docs/architecture/cluster-decisions.md)                                                  |
+| Provider catalog (auto-generated)          | [`docs/reference/PROVIDER_REFERENCE.md`](docs/reference/PROVIDER_REFERENCE.md)                                  |
+| Tunnels                                    | [`docs/ops/TUNNELS_GUIDE.md`](docs/ops/TUNNELS_GUIDE.md)                                                        |
+| Electron desktop                           | [`docs/guides/ELECTRON_GUIDE.md`](docs/guides/ELECTRON_GUIDE.md)                                                |
+| Release flow                               | [`docs/ops/RELEASE_CHECKLIST.md`](docs/ops/RELEASE_CHECKLIST.md)                                                |
+| Quality gates (35 gates, allowlist policy) | [`docs/architecture/QUALITY_GATES.md`](docs/architecture/QUALITY_GATES.md)                                      |
+| Cluster opt-in profiles (memory, bifrost)  | [`docs/architecture/cluster-decisions.md`](docs/architecture/cluster-decisions.md)                              |
 
 ---
 

CLAUDE.md

@@ -35,22 +35,22 @@ For full test matrix, see `CONTRIBUTING.md` → "Running Tests". For deep archit
 
 ## Project at a Glance
 
-**OmniRoute** — unified AI proxy/router. One endpoint, 231 LLM providers, auto-fallback.
+**OmniRoute** — unified AI proxy/router. One endpoint, 250 LLM providers, auto-fallback.
 
-| Layer         | Location                | Purpose                                                                                                                                |
-| ------------- | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
-| API Routes    | `src/app/api/v1/`       | Next.js App Router — entry points                                                                                                      |
-| Handlers      | `open-sse/handlers/`    | Request processing (chat, embeddings, etc)                                                                                             |
-| Executors     | `open-sse/executors/`   | Provider-specific HTTP dispatch                                                                                                        |
-| Translators   | `open-sse/translator/`  | Format conversion (OpenAI↔Claude↔Gemini)                                                                                               |
-| Transformer   | `open-sse/transformer/` | Responses API ↔ Chat Completions                                                                                                       |
-| Services      | `open-sse/services/`    | Combo routing, rate limits, caching, etc                                                                                               |
-| Database      | `src/lib/db/`           | SQLite domain modules (83 files, 97 migrations)                                                                                        |
-| Domain/Policy | `src/domain/`           | Policy engine, cost rules, fallback logic                                                                                              |
-| MCP Server    | `open-sse/mcp-server/`  | 87 tools (33 base + memory/skill/notion/obsidian/gamification/plugin modules), 3 transports (stdio / SSE / Streamable HTTP), 30 scopes |
-| A2A Server    | `src/lib/a2a/`          | JSON-RPC 2.0 agent protocol                                                                                                            |
-| Skills        | `src/lib/skills/`       | Extensible skill framework                                                                                                             |
-| Memory        | `src/lib/memory/`       | Persistent conversational memory                                                                                                       |
+| Layer         | Location                | Purpose                                                                                                                                                |
+| ------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| API Routes    | `src/app/api/v1/`       | Next.js App Router — entry points                                                                                                                      |
+| Handlers      | `open-sse/handlers/`    | Request processing (chat, embeddings, etc)                                                                                                             |
+| Executors     | `open-sse/executors/`   | Provider-specific HTTP dispatch                                                                                                                        |
+| Translators   | `open-sse/translator/`  | Format conversion (OpenAI↔Claude↔Gemini)                                                                                                               |
+| Transformer   | `open-sse/transformer/` | Responses API ↔ Chat Completions                                                                                                                       |
+| Services      | `open-sse/services/`    | Combo routing, rate limits, caching, etc                                                                                                               |
+| Database      | `src/lib/db/`           | SQLite domain modules (95 files, 110 migrations)                                                                                                       |
+| Domain/Policy | `src/domain/`           | Policy engine, cost rules, fallback logic                                                                                                              |
+| MCP Server    | `open-sse/mcp-server/`  | 94 tools (34 base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules), 3 transports (stdio / SSE / Streamable HTTP), 30 scopes |
+| A2A Server    | `src/lib/a2a/`          | JSON-RPC 2.0 agent protocol                                                                                                                            |
+| Skills        | `src/lib/skills/`       | Extensible skill framework                                                                                                                             |
+| Memory        | `src/lib/memory/`       | Persistent conversational memory                                                                                                                       |
 
 Monorepo: `src/` (Next.js 16 app), `open-sse/` (streaming engine workspace), `electron/` (desktop app), `tests/`, `bin/` (CLI entry point).
 
@@ -72,7 +72,7 @@ Client → /v1/chat/completions (Next.js route)
 
 API routes follow a consistent pattern: `Route → CORS preflight → Zod body validation → Optional auth (extractApiKey/isValidApiKey) → API key policy enforcement → Handler delegation (open-sse)`. No global Next.js middleware — interception is route-specific.
 
-**Combo routing** (`open-sse/services/combo.ts`): 17 strategies (priority, weighted, fill-first, round-robin, P2C, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion). Each target calls `handleSingleModel()` which wraps `handleChatCore()` with per-target error handling and circuit breaker checks. The `fusion` strategy is the exception: it fans out to a panel of models in parallel, then a judge model synthesizes one final answer (`open-sse/services/fusion.ts`). See `docs/routing/AUTO-COMBO.md` for the 9-factor Auto-Combo scoring + the full strategy table and `docs/architecture/RESILIENCE_GUIDE.md` for the 3 resilience layers.
+**Combo routing** (`open-sse/services/combo.ts`): 18 strategies (priority, weighted, fill-first, round-robin, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline). Each target calls `handleSingleModel()` which wraps `handleChatCore()` with per-target error handling and circuit breaker checks. The `fusion` strategy is the exception: it fans out to a panel of models in parallel, then a judge model synthesizes one final answer (`open-sse/services/fusion.ts`). See `docs/routing/AUTO-COMBO.md` for the 12-factor Auto-Combo scoring + the full strategy table and `docs/architecture/RESILIENCE_GUIDE.md` for the 3 resilience layers.
 
 ---
 
@@ -221,7 +221,7 @@ connection continue serving other models.
 - **2 spaces**, semicolons, double quotes, 100 char width, es5 trailing commas (enforced by lint-staged via Prettier)
 - **Imports**: external → internal (`@/`, `@omniroute/open-sse`) → relative
 - **Naming**: files=camelCase/kebab, components=PascalCase, constants=UPPER_SNAKE
-- **ESLint**: `no-eval`, `no-implied-eval`, `no-new-func` = error everywhere; `no-explicit-any` = warn in `open-sse/` and `tests/`
+- **ESLint**: `no-eval`, `no-implied-eval`, `no-new-func` = error everywhere; `no-explicit-any` = **error** in `open-sse/` and `tests/` (since #6218 — pre-existing violations are frozen in `config/quality/eslint-suppressions.json`, new ones must be fixed; `npm run lint` applies the suppressions and is what CI runs)
 - **TypeScript**: `strict: false`, target ES2022, module esnext, resolution bundler. Prefer explicit types.
 
 ### Database
@@ -327,33 +327,33 @@ connection continue serving other models.
 
 For any non-trivial change, read the matching deep-dive first:
 
-| Area                                          | Doc                                                               |
-| --------------------------------------------- | ----------------------------------------------------------------- |
-| Repo navigation                               | `docs/architecture/REPOSITORY_MAP.md`                             |
-| Architecture                                  | `docs/architecture/ARCHITECTURE.md`                               |
-| Engineering reference                         | `docs/architecture/CODEBASE_DOCUMENTATION.md`                     |
-| Auto-Combo (9-factor scoring, 17 strategies)  | `docs/routing/AUTO-COMBO.md`                                      |
-| Resilience (3 mechanisms)                     | `docs/architecture/RESILIENCE_GUIDE.md`                           |
-| Reasoning replay                              | `docs/routing/REASONING_REPLAY.md`                                |
-| Skills framework                              | `docs/frameworks/SKILLS.md`                                       |
-| Memory system (FTS5 + Qdrant)                 | `docs/frameworks/MEMORY.md`                                       |
-| Cloud agents                                  | `docs/frameworks/CLOUD_AGENT.md`                                  |
-| Guardrails (PII / injection / vision)         | `docs/security/GUARDRAILS.md`                                     |
-| Public upstream credentials (Gemini/etc.)     | `docs/security/PUBLIC_CREDS.md`                                   |
-| Error message sanitization                    | `docs/security/ERROR_SANITIZATION.md`                             |
-| Evals                                         | `docs/frameworks/EVALS.md`                                        |
-| Compliance / audit                            | `docs/security/COMPLIANCE.md`                                     |
-| Webhooks                                      | `docs/frameworks/WEBHOOKS.md`                                     |
-| Authorization pipeline                        | `docs/architecture/AUTHZ_GUIDE.md`                                |
-| Stealth (TLS / fingerprint)                   | `docs/security/STEALTH_GUIDE.md`                                  |
-| Agent protocols (A2A / ACP / Cloud)           | `docs/frameworks/AGENT_PROTOCOLS_GUIDE.md`                        |
-| MCP server                                    | `docs/frameworks/MCP-SERVER.md`                                   |
-| A2A server                                    | `docs/frameworks/A2A-SERVER.md`                                   |
+| Area                                          | Doc                                                     |
+| --------------------------------------------- | ------------------------------------------------------- |
+| Repo navigation                               | `docs/architecture/REPOSITORY_MAP.md`                   |
+| Architecture                                  | `docs/architecture/ARCHITECTURE.md`                     |
+| Engineering reference                         | `docs/architecture/CODEBASE_DOCUMENTATION.md`           |
+| Auto-Combo (12-factor scoring, 18 strategies) | `docs/routing/AUTO-COMBO.md`                            |
+| Resilience (3 mechanisms)                     | `docs/architecture/RESILIENCE_GUIDE.md`                 |
+| Reasoning replay                              | `docs/routing/REASONING_REPLAY.md`                      |
+| Skills framework                              | `docs/frameworks/SKILLS.md`                             |
+| Memory system (FTS5 + Qdrant)                 | `docs/frameworks/MEMORY.md`                             |
+| Cloud agents                                  | `docs/frameworks/CLOUD_AGENT.md`                        |
+| Guardrails (PII / injection / vision)         | `docs/security/GUARDRAILS.md`                           |
+| Public upstream credentials (Gemini/etc.)     | `docs/security/PUBLIC_CREDS.md`                         |
+| Error message sanitization                    | `docs/security/ERROR_SANITIZATION.md`                   |
+| Evals                                         | `docs/frameworks/EVALS.md`                              |
+| Compliance / audit                            | `docs/security/COMPLIANCE.md`                           |
+| Webhooks                                      | `docs/frameworks/WEBHOOKS.md`                           |
+| Authorization pipeline                        | `docs/architecture/AUTHZ_GUIDE.md`                      |
+| Stealth (TLS / fingerprint)                   | `docs/security/STEALTH_GUIDE.md`                        |
+| Agent protocols (A2A / ACP / Cloud)           | `docs/frameworks/AGENT_PROTOCOLS_GUIDE.md`              |
+| MCP server                                    | `docs/frameworks/MCP-SERVER.md`                         |
+| A2A server                                    | `docs/frameworks/A2A-SERVER.md`                         |
 | API reference + OpenAPI                       | `docs/reference/API_REFERENCE.md` + `docs/openapi.yaml` |
-| Provider catalog (auto-generated)             | `docs/reference/PROVIDER_REFERENCE.md`                            |
-| Release flow                                  | `docs/ops/RELEASE_CHECKLIST.md`                                   |
-| Embedded services                             | `docs/frameworks/EMBEDDED-SERVICES.md`                            |
-| Quality gates (~48 scripts, allowlist policy) | `docs/architecture/QUALITY_GATES.md`                              |
+| Provider catalog (auto-generated)             | `docs/reference/PROVIDER_REFERENCE.md`                  |
+| Release flow                                  | `docs/ops/RELEASE_CHECKLIST.md`                         |
+| Embedded services                             | `docs/frameworks/EMBEDDED-SERVICES.md`                  |
+| Quality gates (~48 scripts, allowlist policy) | `docs/architecture/QUALITY_GATES.md`                    |
 
 ---
 
@@ -388,6 +388,31 @@ Why this matters: fixing bug A while opening bug B is worse than not fixing at a
 
 ---
 
+## Planning & Research Artifacts (superpowers, deep-research)
+
+`_tasks/` is a **separate, isolated git repository** that is gitignored by the main
+repo (`.gitignore` → `_tasks/`). It is the canonical home for working artifacts —
+plans, specs/designs, research, hand-offs — so they stay **versioned in their own
+repo** instead of polluting the main OmniRoute tree.
+
+**Hard rule — never write superpowers / planning / research output under `docs/` or
+the repo root.** The superpowers skills ship with defaults that point at `docs/…`
+(`writing-plans` → `docs/superpowers/plans/`, `brainstorming` → `docs/superpowers/specs/`).
+Those defaults are **overridden here**. Whenever you invoke superpowers (or any
+plan/spec/research generator) in this project, save to `_tasks/` instead, using the
+same filename convention:
+
+| Artifact (skill)                   | Default (do NOT use)      | Save here instead                                             |
+| ---------------------------------- | ------------------------- | ------------------------------------------------------------- |
+| Plans (`writing-plans`)            | `docs/superpowers/plans/` | `_tasks/superpowers/plans/YYYY-MM-DD-<feature>.md`            |
+| Specs / design (`brainstorming`)   | `docs/superpowers/specs/` | `_tasks/superpowers/specs/YYYY-MM-DD-<topic>-design.md`       |
+| Research (`deep-research`, ad-hoc) | `docs/research/`          | `_tasks/research/…`                                           |
+| Hand-offs (`/handoff`)             | —                         | `_tasks/hands-off/<YYYY-MM-DD>_<branch>_v<versão>_sess-<id>/` |
+
+When a superpowers skill announces a path like "saved to `docs/superpowers/plans/…`",
+rewrite it to the `_tasks/…` equivalent before writing. Commit those artifacts inside
+the `_tasks/` repo (`git -C _tasks …`), never in the main repo.
+
 ## Git Workflow
 
 ```bash
@@ -403,8 +428,10 @@ git push -u origin feat/your-feature
 
 **Husky hooks**:
 
-- **pre-commit**: lint-staged + `check-docs-sync` + `check:any-budget:t11`
-- **pre-push**: fast deterministic gates (`check:any-budget:t11` + `check:tracked-artifacts`); intentionally excludes `test:unit` (slow — covered by the CI `test-unit` job). Activated 2026-06-13 (Quality Gates Fase 6A.12).
+- **pre-commit**: lint-staged + `check-docs-sync` + `check:any-budget:t11` + `check:tracked-artifacts`
+- **pre-push**: intentionally light (PATH/npm sanity only). `any-budget` + `tracked-artifacts`
+  already run on pre-commit; re-running them on every push was pure double-pay. CI still
+  enforces both. (Was Fase 6A.12 full pre-push gate; folded into pre-commit in #6716.)
 
 ### Worktree isolation (MANDATORY for every development task)
 
@@ -455,7 +482,8 @@ list` shows worktrees you didn't create, leave them alone. End every session wit
 
 ## Environment
 
-- **Runtime**: Node.js ≥22.0.0 <23 || ≥24.0.0 <27, ES Modules
+- **Runtime**: Node.js ≥22.0.0 <23 || ≥24.0.0 <27, ES Modules. This is the **only** runtime for the published `omniroute` CLI, the server, and the test suites (`node:test` + vitest) — `engines.node` is authoritative and end users never need Bun.
+- **Bun (build/dev script runner only)**: Bun `1.3.10` is pinned as an **exact devDependency** (provisioned through the existing `npm ci` via the lockfile's `@oven/bun-*` platform binaries — no `setup-bun`/ad-hoc install). It is used **only** to execute a small, allow-listed set of TypeScript **gate/generator scripts** (replacing `node --import tsx` for startup speed): the CI checks `check:provider-consistency`, `check:compression-budget`, `check:known-symbols`, and the non-CI `gen:provider-reference`, `bench:compression`. **Do NOT** widen Bun to `npm install`, the build (`build:cli*`), `check:pack-artifact`, the published runtime, or the test runners — those stay on Node. Any new Bun-invoking script must be validated byte-identical against its `node --import tsx` output first. After pulling the lockfile change, run `npm install` so `bun` resolves locally (a stale `node_modules` will fail those 5 scripts with `bun: not found`).
 - **TypeScript**: 6.0+, target ES2022, module esnext, resolution bundler
 - **Path aliases**: `@/*` → `src/`, `@omniroute/open-sse` → `open-sse/`, `@omniroute/open-sse/*` → `open-sse/*`
 - **Default port**: 20128 (API + dashboard on same port)
@@ -514,6 +542,10 @@ the stale-enforcement added in Fase 6A.3.
 18. Every bug fix must be validated before shipping: a failing-then-passing unit/integration test (TDD) OR a documented live test on the production VPS (192.168.0.15). A fix without either is not merged. See Testing → "Bug fix / issue triage protocol" for the full decision tree.
 19. Never develop on the shared main checkout. Every development task runs in its own git worktree on its own dedicated branch, and you MUST confirm the base branch with the operator (e.g. via `AskUserQuestion`) before creating the worktree/branch — never assume `main` or the currently checked-out branch. A `git checkout` in the shared checkout silently destroys other sessions' uncommitted work. Tear down only the worktrees/branches you created (by name, never `fix/*`/`feat/*` wildcards), leave other sessions' worktrees untouched, and end on the branch you started on (the active `release/vX.Y.Z`, never `main`). See Git Workflow → "Worktree isolation".
 20. PII redaction/sanitization is **opt-in — never on by default**. OmniRoute proxies for self-hosted/local LLMs where the operator owns the data, so mutating request/response payloads by default would silently corrupt legitimate traffic. The two data-mutating PII feature flags **MUST** keep `defaultValue: "false"` in `src/shared/constants/featureFlagDefinitions.ts`: `PII_REDACTION_ENABLED` (request-side) and `PII_RESPONSE_SANITIZATION` (response + streaming). All three application points — `src/lib/guardrails/piiMasker.ts` (request guardrail), `src/lib/piiSanitizer.ts` (response), `src/lib/streamingPiiTransform.ts` (SSE) — are gated on these flags; with both off the `pii-masker` guardrail still runs but never mutates payloads (data passes through untouched). Flipping either default to `"true"` requires explicit operator approval. The regression guard is `tests/unit/pii-opt-in-default.test.ts` (asserts both definition defaults + behavioral pass-through). Opt-in is per-operator via env or the settings/DB override (`src/lib/db/featureFlags.ts`), never a silent default. See `docs/security/GUARDRAILS.md`.
+21. **Release-freeze — the FROZEN release branch belongs to the release captain; development does NOT stop (parallel-cycle model, 2026-07-04).** `/generate-release` opens a marker issue labeled `release-freeze` at the start of reconciliation (Phase 0a), **immediately cuts the next cycle's branch `release/vX+1` from the frozen tip (Phase 0a.0b — bump + living release PR + re-home of open PRs)**, and closes the freeze once the release PR squash-merges to `main`. Before merging **any** PR, every campaign workflow (`/review-prs`, `/review-group-prs`, `/merge-prs`, `/triage-fix-bugs`, `/implement-fix-bugs`, `/triage-features`, `/implement-features`, `/green-prs`, `/port-upstream-*`) **MUST** check `gh issue list --repo diegosouzapw/OmniRoute --label release-freeze --state open` — if a freeze is active: **NEVER merge into the frozen `release/vX.Y.Z` named in the freeze title**; instead resolve the ACTIVE development branch (the **highest** `release/v*` by semver — normally `release/vX+1`, announced in a freeze-issue comment) and **retarget the PR there** (`gh pr edit <N> --base release/vX+1`, then VERIFY with `gh pr view <N> --json baseRefName` — the edit fails silently) and merge normally. **HOLD only when the highest release/v\* branch IS the frozen one** (the short window before 0a.0b completes, or a pre-parallel-cycle release) — in that case leave the PR ready and open, tell the operator, and resume when the next branch appears or the freeze lifts. The just-shipped fixes reach `release/vX+1` via the Phase 5 sync-back (`scripts/release/sync-next-cycle.mjs`); do not try to sync mid-release. This is a **coordination signal, not a permission lock**: the release captain and the campaign sessions share the `diegosouzapw` identity, so a GitHub branch-protection lock cannot distinguish them — only this honored marker prevents the mid-release commit races that forced full CHANGELOG re-reconciliation in v3.8.40/v3.8.41 (a parallel campaign advanced `release/vX.Y.Z` by 34 commits mid-run). The release captain's own reconciliation/cycle-open pushes are exempt — they _are_ the release. Fixes that must land during a freeze (a homologation finding) follow the post-merge read-only rule: land on `main` first via `fix/release-vX.Y.Z-*`. **⛔ ONLY `/generate-release` may raise a release-freeze, and ONLY at its Phase 0a (start of generating a new version) — lifted at Phase 12c after the squash-merge to `main`.** No campaign, session, or agent may open a `release-freeze` marker at any other time — a freeze is **never** a mid-development coordination tool. If a session ever believes a freeze is genuinely, unavoidably necessary outside the `/generate-release` flow, it **MUST first ask the operator (`diegosouzapw`) in chat, explicitly alert "estou criando um freeze" and get an explicit yes** — never open, extend, or re-open a `release-freeze` autonomously. Conversely, do **not** close/lift an active `/generate-release` freeze to unblock campaign merges: it protects the captain's single clean CI run and auto-lifts at Phase 12c — closing it early re-triggers the exact commit race it prevents. Verify a freeze is legitimate before acting on it: an open `release-freeze` whose title/body references an **OPEN** release PR (`gh pr view <N> --json state`) is the authorized captain freeze — hold, don't touch.
+22. **Cross-session safety — this repo is worked by MANY parallel sessions/agents at once; never step on another's in-flight work.** Two absolute bans, both recurring incidents (this rule exists because they keep happening):
+    - **(a) Never `git stash` / `git stash pop` — ANYWHERE in this repo, including inside an isolated worktree, and including inside any subagent you dispatch.** `git stash` operates on the **shared repository object store**, not the per-worktree working tree — so a stash pushed or popped in one session can silently clobber or resurrect another parallel session's uncommitted changes. This is not hypothetical: 2026-07-02 a `#5923` quotaCache change leaked into the unrelated `#2296` worktree via a global `stash pop`, and the same class reincided through a **subagent**. To compare working changes against a base ref **without** stashing, use `git show <ref>:<path>` or `git diff <ref> -- <path>`; to confirm a typecheck/lint error is pre-existing on the base, inspect the base ref directly (`git show origin/release/vX.Y.Z:<path>`) — never stash your tree away to "get it clean". **Put this ban verbatim in the prompt of every subagent that touches git** (agents don't inherit this file's context — the recurrence was a subagent).
+    - **(b) Never merge, push, rebase, or force-push a PR / branch / worktree that another session is actively working.** An open PR whose head is a live fix worktree in `.claude/worktrees/` you did **not** create (e.g. `fix-5852`/`fix-5923` carrying fresh commits, even when they share your `diegosouzapw` identity), or any branch another session owns, is **off-limits — HOLD**, and let the owning session merge it. **Before** merging or pushing to any PR you did not create _this_ session, run `git worktree list` to check for a matching in-flight worktree and re-check `gh pr view <N> --json state,headRefOid`. Only the owning session merges its own in-flight PR; mid-flight merges race the owner and re-trigger the exact commit/CHANGELOG races Rule #19 and Rule #21 guard against. (Reinforces Rule #19.)
 
 ---
 

CONTRIBUTING.md

@@ -160,7 +160,7 @@ npm run test:protocols:e2e
 # Ecosystem compatibility tests
 npm run test:ecosystem
 
-# Coverage gate: 75% statements/lines/functions, 70% branches
+# Coverage gate: 60% statements/lines/functions/branches
 npm run test:coverage
 npm run coverage:report
 
@@ -184,7 +184,7 @@ npm run test:combo:live:vps:failover     # adds a real cross-provider failover s
 Coverage notes:
 
 - `npm run test:coverage` measures source coverage for the main unit test suite, excludes `tests/**`, and includes `open-sse/**`
-- Pull requests must keep the coverage gate at **75%+** statements/lines/functions and **70%+** branches
+- Pull requests must keep the coverage gate at **60%+** statements/lines/functions/branches
 - If a PR changes production code in `src/`, `open-sse/`, `electron/`, or `bin/`, it must add or update automated tests in the same PR
 - `npm run coverage:report` prints the detailed file-by-file report from the latest coverage run
 - `npm run test:coverage:legacy` preserves the older metric for historical comparison
@@ -196,7 +196,7 @@ Before opening or merging a PR:
 
 - Run `npm run test:unit`
 - Run `npm run test:coverage`
-- Ensure the coverage gate stays at **75%+** statements/lines/functions, **70%+** branches
+- Ensure the coverage gate stays at **60%+** statements/lines/functions/branches
 - Include the changed or added test files in the PR description when production code changed
 - Check the SonarQube result on the PR when the project secrets are configured in CI
 
@@ -341,7 +341,7 @@ Write unit tests in `tests/unit/` covering at minimum:
 - [ ] Error responses route through `buildErrorBody()` / `sanitizeErrorMessage()` — no raw stack traces in response bodies (see [`docs/security/ERROR_SANITIZATION.md`](./docs/security/ERROR_SANITIZATION.md))
 - [ ] Shell commands (`exec` / `spawn`) pass runtime values via `env`, not via string interpolation
 - [ ] All inputs validated with Zod schemas
-- [ ] CHANGELOG updated (if user-facing change)
+- [ ] Changelog **fragment** added under `changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md` for user-facing changes (see [`changelog.d/README.md`](./changelog.d/README.md)) — do **not** edit `CHANGELOG.md` directly; fragments are aggregated at release time and never conflict between PRs
 - [ ] Documentation updated (if applicable)
 - [ ] No new CodeQL / Secret-Scanning alerts opened, or each one dismissed with technical justification referencing the relevant `docs/security/` doc
 - [ ] Routes that spawn child processes (`/api/mcp/`, `/api/cli-tools/runtime/`) classified as `isLocalOnlyPath()` in `src/server/authz/routeGuard.ts` — see [Hard Rule #15](docs/security/ROUTE_GUARD_TIERS.md)

DESING.md

@@ -1,254 +0,0 @@
-# OmniRoute — Design System & Visual Identity
-
-> **Status:** analysis + standardization plan (no code applied yet — this doc is the spec to approve before implementation).
-> **Date:** 2026-06-16 · **Scope:** unify the OmniRoute dashboard (`src/`) with the marketing site (`_mono_repo/omnirouteSite/`) into **one visual identity** — same graph-paper grid background, same color tokens, standardized components.
-
----
-
-## 1. Purpose
-
-The marketing site (`viral.omniroute.online`, `why.omniroute.online`, `omniroute.online`) and the product dashboard should look like **one product**. The site already borrowed its palette from the dashboard — its `css/tokens.css` even says _"Palette mirrors the OmniRoute dashboard (src/app/globals.css)"_. So the two are already ~80% aligned at the color level. What's missing on the dashboard:
-
-1. The **graph-paper grid wallpaper** the site uses on every page.
-2. A handful of **shared design tokens** the site has but the dashboard lacks (radius scale, brand gradient, `surface-2`, mono font).
-3. **Component-level consistency** — a number of dashboard components bypass the theme tokens with hardcoded hex/rgba.
-
-This document is the analysis and the plan. **Nothing is changed until approved.**
-
----
-
-## 2. Principles
-
-- **Single source of truth = `src/app/globals.css`.** The site mirrors the dashboard, never the other way around. New tokens land in `globals.css` first.
-- **Tokens, never literals.** Components consume semantic tokens (`bg-surface`, `text-primary`, `border-border`), never raw `#hex`.
-- **Subtle, not loud.** The grid is a faint wallpaper that sits behind content — it must never reduce text contrast or fight the UI.
-- **Theme-aware.** Everything works in both `.dark` (default-ish, the product's signature look) and light.
-- **Surgical rollout.** Ship the grid + tokens first (low risk, high visibility), then component cleanups in waves.
-
----
-
-## 3. Current state — what's already aligned vs. what's not
-
-### 3.1 Colors — already unified ✅
-
-Every brand color and surface already matches the site **by value** (only the names differ — dashboard prefixes with `--color-`). Verified in `src/app/globals.css:30-128`:
-
-| Concept                    | Site token (`tokens.css`)                   | Dashboard token (`globals.css`) | Match        |
-| -------------------------- | ------------------------------------------- | ------------------------------- | ------------ |
-| primary                    | `--primary #e54d5e`                         | `--color-primary #e54d5e`       | ✅           |
-| primary-hover              | `--primary-hover #c93d4e`                   | `--color-primary-hover #c93d4e` | ✅           |
-| accent                     | `--accent #6366f1`                          | `--color-accent #6366f1`        | ✅           |
-| accent-2                   | `--accent-2 #8b5cf6`                        | `--color-accent-hover #8b5cf6`  | ✅ (renamed) |
-| accent-3                   | `--accent-3 #a855f7`                        | `--color-accent-light #a855f7`  | ✅ (renamed) |
-| success / warning / error  | `#22c55e / #f59e0b / #ef4444`               | identical                       | ✅           |
-| traffic lights             | `#ff5f56 / #ffbd2e / #27c93f`               | identical                       | ✅           |
-| dark bg / surface / border | `#0b0e14 / #161b22 / rgba(255,255,255,.08)` | identical                       | ✅           |
-| light bg / surface / text  | `#f9f9fb / #fff / #1a1a2e`                  | identical                       | ✅           |
-
-**Conclusion:** there is no color migration to do. The identity is already shared; we are _finishing_ it, not rebuilding it.
-
-### 3.2 Gaps — what the dashboard is missing
-
-| Gap                     | Site has                                                                       | Dashboard                                                  | Action                 |
-| ----------------------- | ------------------------------------------------------------------------------ | ---------------------------------------------------------- | ---------------------- |
-| **Grid wallpaper**      | `body::before` graph-paper, `--grid-line`, `--grid-size 46px`, `--section-alt` | none (flat `--color-bg`)                                   | **Part A**             |
-| **Radius scale**        | `--radius 14px`, `--radius-sm 9px`                                             | none — primitives use ad-hoc `rounded-md/lg/xl` (6/8/12px) | **Part B**             |
-| **Brand gradient**      | `--grad-brand 135deg primary→accent-3`                                         | none — only a one-off `.bg-hero-gradient`                  | **Part B**             |
-| **Nested surface**      | `--surface-2 #1c2230`                                                          | none                                                       | **Part B**             |
-| **Mono font**           | `--font-mono` (ui-monospace stack)                                             | none (code/terminal areas have no token)                   | **Part B**             |
-| **`text-muted` (dark)** | `#8b8b9e`                                                                      | `#a1a1aa` (zinc-400)                                       | reconcile — **Part B** |
-
-### 3.3 Theming mechanics (so we don't break anything)
-
-- **Tailwind v4, CSS-first** (no `tailwind.config.*`). Tokens are defined in `:root`/`.dark` and exposed to utilities via `@theme inline` (`globals.css:130-179`).
-- **Dark via `.dark` class** on `<html>` (`@custom-variant dark` at `globals.css:22`), toggled by a custom Zustand store (`src/store/themeStore.ts`), default theme = `system` (`src/shared/constants/appConfig.ts:11`). The site uses `html[data-theme="light"]` instead — **the mechanisms differ but never meet** (separate origins), so no conflict. We keep the dashboard's `.dark` mechanism.
-- **Runtime primary override** exists (`themeStore.ts:85-97`, presets in `COLOR_THEMES`) — users can swap `--color-primary`. Any new token (gradient, etc.) that references `--color-primary` will inherit those overrides for free. ✅
-
----
-
-## 4. Part A — The graph-paper grid background (headline ask)
-
-### 4.1 What it is
-
-The exact recipe from the site (`_mono_repo/omnirouteSite/css/base.css`): a **fixed, full-viewport pseudo-element** painting two 1px line gradients, sitting at `z-index:-1` behind all content.
-
-```css
-body::before {
-  content: "";
-  position: fixed;
-  inset: 0;
-  z-index: -1;
-  pointer-events: none;
-  background-image:
-    linear-gradient(to right, var(--grid-line) 1px, transparent 1px),
-    linear-gradient(to bottom, var(--grid-line) 1px, transparent 1px);
-  background-size: var(--grid-size) var(--grid-size);
-}
-```
-
-**Why this works even though `body` has an opaque `background-color`:** a `::before` with `z-index:-1` paints _above_ the element's own background but _below_ its in-flow content. So `--color-bg` is the base fill, the grid is layered on top of it, and the app renders above the grid.
-
-### 4.2 Precedent already in the codebase
-
-`src/app/landing/page.tsx:16-26` **already implements this same grid per-page** — but with **red** lines (`#E54D5E`, opacity `0.06`) at **50px**, plus animated orbs. So the pattern is proven in the product; we are promoting it to a **global, theme-aware** wallpaper and (optionally) retiring the duplicate.
-
-### 4.3 Tokens to add (in `globals.css`)
-
-```css
-:root {
-  /* light */
-  --grid-line: rgba(0, 0, 0, 0.045);
-  --grid-size: 46px;
-  --section-alt: rgba(0, 0, 0, 0.022);
-}
-.dark {
-  /* dark */
-  --grid-line: rgba(255, 255, 255, 0.035);
-  --section-alt: rgba(255, 255, 255, 0.018);
-}
-```
-
-### 4.4 The single blocker
-
-The grid is global by construction (it covers the panel, `auth`/`login`, error pages — every route — at once). Exactly **one** element hides it inside the panel:
-
-- `src/shared/components/layouts/DashboardLayout.tsx:62` — the outer wrapper paints an opaque `bg-bg`:
-
-  ```jsx
-  <div className="flex h-dvh min-h-0 w-full overflow-hidden bg-bg">
-  ```
-
-  Everything below it is already transparent — `<main>` (`:93`), the scroll container (`:102`), the `max-w-7xl` inner (`:103`). So **removing `bg-bg` from this one line** lets the body grid show through the entire content area (the body's `--color-bg` remains the base fill underneath the grid).
-
-  ```diff
-  - <div className="flex h-dvh min-h-0 w-full overflow-hidden bg-bg">
-  + <div className="flex h-dvh min-h-0 w-full overflow-hidden">
-  ```
-
-### 4.5 Chrome interaction (sidebar / header)
-
-- `Header` (`src/shared/components/Header.tsx:207`, `bg-bg`) and `Sidebar` (`src/shared/components/Sidebar.tsx:430`, `bg-sidebar`) stay **opaque** → the grid shows in the **content area only**, with solid chrome framing it. This is the recommended, calm default and matches how the site separates chrome from canvas.
-- _Optional vibrancy variant:_ make the header translucent (`bg-bg/80 backdrop-blur`) so the grid runs behind it. A `.bg-vibrancy` helper already exists (`globals.css:370`). **Decision D3 below.**
-
-### 4.6 Login / auth / error pages
-
-These render directly under `<body>` (no panel chrome) and their page wrappers are mostly transparent — the global grid appears behind them automatically. One exception: `src/app/login/page.tsx:124,139` uses opaque `bg-bg` wrappers; soften the same way if we want the grid there too (minor, **D4**).
-
-### 4.7 Landing page
-
-`landing/page.tsx` keeps its richer animated background (orbs + vignette). Options: (a) leave it as-is (its own splash identity), or (b) align its grid to the global tokens (46px, neutral lines) for consistency. **Recommend (a)** — it's a marketing splash, not a panel screen. **Decision D5.**
-
----
-
-## 5. Part B — Token unification
-
-Add to `globals.css` (`:root` + `@theme inline`) so the dashboard gains the site's missing tokens. None of these change existing colors; they add the _missing_ primitives.
-
-```css
-:root {
-  --surface-2: #f5f5fa; /* light: nested panels */
-  --radius: 14px;
-  --radius-sm: 9px;
-  --grad-brand: linear-gradient(135deg, var(--color-primary), var(--color-accent-light));
-  --font-mono: ui-monospace, "JetBrains Mono", "Fira Code", "SF Mono", monospace;
-}
-.dark {
-  --surface-2: #1c2230;
-}
-
-@theme inline {
-  --color-surface-2: var(--surface-2); /* enables bg-surface-2 */
-  --radius-lg: var(--radius); /* enables rounded-lg = 14px */
-  --radius-md: var(--radius-sm); /* enables rounded-md = 9px */
-  --font-mono: var(--font-mono); /* enables font-mono */
-}
-```
-
-| Token                      | Why                                                             | Consumers                                                   |
-| -------------------------- | --------------------------------------------------------------- | ----------------------------------------------------------- |
-| `--radius` / `--radius-sm` | One radius scale (14/9) instead of 6/8/12 ad-hoc                | Button, Card, Modal, Input, Select                          |
-| `--grad-brand`             | Brand gradient for primary CTAs (red→violet), matching the site | Button `primary`, hero/CTA surfaces                         |
-| `--surface-2`              | Nested panels / table headers / inset rows                      | Card.Section, DataTable header, inputs                      |
-| `--font-mono`              | Code blocks, terminal, IDs, endpoints                           | ConsoleLogViewer, code snippets, `localhost:20128/v1` chips |
-| `--text-muted` reconcile   | Pick one value site↔panel                                       | global                                                      |
-
-**Decision D2 (text-muted):** site `#8b8b9e` vs dashboard `#a1a1aa`. Recommend keeping the **dashboard's `#a1a1aa`** (it's the live product, slightly higher contrast) and updating the _site_ to match. Low priority, cosmetic.
-
----
-
-## 6. Part C — Component standardization
-
-The component layer is **custom** (no shadcn/Radix), Tailwind v4, semantic tokens **mostly** adopted (`bg-surface`, `border-white/10`, `ring-primary`) — good adoption (195 files import the shared barrel). The work is removing the **bypasses**. Home: `src/shared/components/`.
-
-Ranked by impact × reach:
-
-| #   | Item                                       | File(s)                                                                                                                                                                                       | Problem → Target                                                                                                                                                                                                                                 |
-| --- | ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| C1  | **Radius alignment**                       | `Button.tsx:14-18`, `Card.tsx:39`, `Modal.tsx`, `Input.tsx`, `Select.tsx`                                                                                                                     | mixed 6/8/12px → repoint to `--radius`/`--radius-sm` (14/9)                                                                                                                                                                                      |
-| C2  | **Button gradient + `accent` variant**     | `Button.tsx:5-12`                                                                                                                                                                             | primary is flat red→red (`from-primary to-primary-hover`); align to `--grad-brand` (red→violet) and add the missing `accent` variant (indigo `#6366f1` is unused by buttons) — **highest visibility, ~195 importers**. **Decision D1.**          |
-| C3  | **Tables**                                 | `DataTable.tsx:122-176`, `logTableStyles.ts`, `globals.css:405-414` (Ant remnants)                                                                                                            | `DataTable` is 100% inline hardcoded rgba + references non-existent vars (`--text-secondary`, `--bg-table-header`); migrate to tokens, retire the 2 divergent table styles. Tables are everywhere (providers/connections/logs) — worst offender. |
-| C4  | **Centralize status colors**               | `flow/edgeStyles.ts:7-12`, `TokenHealthBadge.tsx:14-19`, `DegradationBadge.tsx`, `ProviderCascadeNode.tsx`, `Badge.tsx`, +5 `statusColor` helpers                                             | 6+ copies of the same `#22c55e/#f59e0b/#ef4444` hex; create one `statusColors` module driven off `--color-success/warning/error`. Critical for circuit-breaker / cooldown / lockout badges to read consistently.                                 |
-| C5  | **Card border**                            | `Card.tsx:39`                                                                                                                                                                                 | uses `border-white/5`; brand border is `/8` → align                                                                                                                                                                                              |
-| C6  | **Focus ring reconcile**                   | `globals.css:183` vs component `ring-primary/30`                                                                                                                                              | global `:focus-visible` is indigo (`--color-accent`), components are red (`ring-primary`) — pick one (recommend **accent/indigo** globally, it reads as the "interactive" color)                                                                 |
-| C7  | **Add `Checkbox` + `Textarea` primitives** | currently raw `<input>`/`<textarea>` with inline `accentColor:#6366f1` (e.g. `ColumnToggle.tsx:91`)                                                                                           | create token-driven primitives                                                                                                                                                                                                                   |
-| C8  | **Hardcoded-hex sweep**                    | `ConsoleLogViewer.tsx:240` (`#161b22`/`#30363d`), `ComboLiveStudio.tsx:306` (`#6366f120`), Modal traffic dots `Modal.tsx:149-159`, ~14 chart/component files with literal `#6366f1`/`#a855f7` | replace literals with `bg-surface`/`border-border`/`text-accent` etc.                                                                                                                                                                            |
-| C9  | **`cn()` → clsx + tailwind-merge**         | `src/shared/utils/cn.ts`                                                                                                                                                                      | current `cn` just joins; conflicting classes stack (a `className="rounded-2xl"` override won't replace a primitive's `rounded-lg`). Needed for C1 overrides to behave.                                                                           |
-
-**Already on-brand (token-driven, only need radius):** `Badge`, `Toggle`, `SegmentedControl`, `Input`, `Select`.
-
----
-
-## 7. Rollout plan (phased, each phase shippable + testable)
-
-- **Phase 1 — Grid + tokens (low risk, high visibility).**
-  1. Add grid + identity tokens to `globals.css` (Part A §4.3, Part B §5).
-  2. Add `body::before` grid.
-  3. Remove `bg-bg` from `DashboardLayout.tsx:62`.
-  4. Verify across themes + key screens (dashboard, providers, logs, login, an error page). Confirm contrast unchanged.
-     → _Delivers the headline ask. Reversible in one commit._
-
-- **Phase 2 — Primitives radius + Button (C1, C2, C5, C9).** The visible "feel" pass. `cn()` upgrade first so overrides behave.
-
-- **Phase 3 — Tables + status colors (C3, C4).** The largest consistency win; touch the data-heavy screens.
-
-- **Phase 4 — Cleanup (C6, C7, C8).** Focus ring, new primitives, hardcoded-hex sweep.
-
-Each phase: `npm run lint` + `npm run typecheck:core` + a visual pass. Per repo rule, production-code changes ship with tests where applicable (token/CSS changes are visual — validated by screenshots; component API changes get unit coverage).
-
----
-
-## 8. Open decisions (need your call before/while implementing)
-
-- **D1 — Button primary look.** Keep the current **red→red** gradient, or switch the product's primary buttons to the **red→violet `--grad-brand`** (matches the site CTAs)? _(Affects every primary button.)_ Recommend: **red→violet**, with `--grad-brand`.
-- **D2 — Grid line color.** **Neutral** lines (site style: faint white/black, `rgba(255,255,255,0.035)`) — calm, content-first — **or** the landing's **brand-red** lines? Recommend: **neutral** (matches the site's interior pages; red is louder and can tint readability). Size **46px** (site) to retire the landing's 50px drift.
-- **D3 — Chrome vibrancy.** Sidebar/header stay **solid** (grid in content area only), or go **translucent** so the grid runs behind them? Recommend: **solid** (calmer; less risk).
-- **D4 — Auth/login grid.** Soften `login/page.tsx` wrappers so the grid shows there too? Recommend: **yes** (cheap, more cohesive).
-- **D5 — Landing page.** Leave its animated splash bg as-is, or align it to the global grid? Recommend: **leave as-is**.
-- **D6 — Radius value.** Adopt **14/9** everywhere (bigger, softer, site-matching) — confirm you want this product-wide shift. Recommend: **yes**, it's the single biggest "one identity" signal.
-- **D7 — Scope of first PR.** Ship **Phase 1 only** first (grid + tokens), then iterate? Recommend: **yes** — validate the wallpaper live before the component waves.
-
----
-
-## 9. Out of scope / risks
-
-- **No palette change** — colors already match; we only add missing tokens. Zero risk of recoloring the product.
-- **No theme-engine change** — keep `.dark` + Zustand store; don't migrate to `next-themes` or to the site's `data-theme`.
-- **Radius shift is broad** (D6) — it touches every card/button/input; that's the point, but it's the one change worth eyeballing on busy screens (tables, modals) before merge.
-- **Tables (C3)** carry the most hardcoded styling and the highest regression surface — isolate in its own PR with before/after screenshots.
-- **Worktree isolation (repo hard-rule #19):** implementation runs in a dedicated worktree on a branch cut from the confirmed base (likely `release/v3.8.28`), never on the shared checkout. This doc is the only artifact written to the working tree so far.
-
----
-
-## 10. Reference index
-
-| Area                       | Path                                                                                                                                     |
-| -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
-| Dashboard tokens           | `src/app/globals.css:30-179` (`:root`, `.dark`, `@theme inline`), `body` `:206`                                                          |
-| Theme store                | `src/store/themeStore.ts`, `src/shared/components/ThemeProvider.tsx`, `src/shared/constants/appConfig.ts:9-11`                           |
-| Panel shell (grid blocker) | `src/shared/components/layouts/DashboardLayout.tsx:62`                                                                                   |
-| Chrome                     | `src/shared/components/Header.tsx:207`, `src/shared/components/Sidebar.tsx:430`                                                          |
-| Grid precedent             | `src/app/landing/page.tsx:16-26`                                                                                                         |
-| Primitives                 | `src/shared/components/{Button,Card,Input,Select,Badge,Modal,Toggle,SegmentedControl,Loading,Tooltip,DataTable}.tsx`, barrel `index.tsx` |
-| Status-color sources       | `flow/edgeStyles.ts`, `TokenHealthBadge.tsx`, `DegradationBadge.tsx`, `logTableStyles.ts`                                                |
-| `cn` util                  | `src/shared/utils/cn.ts`                                                                                                                 |
-| Site reference             | `_mono_repo/omnirouteSite/css/tokens.css`, `css/base.css` (grid `body::before`)                                                          |

Dockerfile

@@ -2,24 +2,46 @@
 FROM node:24-trixie-slim AS base
 WORKDIR /app
 
-RUN --mount=type=cache,target=/var/cache/apt,sharing=shared \
-  --mount=type=cache,target=/var/lib/apt/lists,sharing=shared \
+# `apt-get upgrade` pulls the security-patched versions of the Debian (trixie)
+# base-image packages at build time — clears the subset of container-scan CVEs
+# (perl / util-linux / systemd / ncurses / zlib / tar / sqlite / shadow / pam …)
+# that already have a fix published in trixie. CVEs without an upstream fix yet
+# (local-only TOCTOU, etc.) remain until the distro patches them and the image
+# is rebuilt; none are reachable from the proxy's request surface at runtime.
+RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=shared \
+  --mount=type=cache,id=apt-lists,target=/var/lib/apt/lists,sharing=shared \
   apt-get update \
+  && apt-get upgrade -y \
   && apt-get install -y --no-install-recommends libsecret-1-0 ca-certificates \
   && rm -rf /var/lib/apt/lists/*
 
+# Refresh the globally-installed npm so its *bundled* node_modules (undici, tar)
+# ship the patched versions. These are npm's own internals — not application
+# dependencies (our app already resolves undici@8.5.0 / tar@7.5.16, both fixed) —
+# but the container scanner flags the stale copies under
+# /usr/local/lib/node_modules/npm/node_modules. npm is not invoked at runtime in
+# the runner stages, so this is hygiene, not an exploitable runtime path.
+RUN npm install -g npm@latest \
+  && npm cache clean --force
+
 # ── Builder ────────────────────────────────────────────────────────────────
 FROM base AS builder
 
 # Build tools for native module compilation
 # apt-get update needed here because base's rm -rf clears the shared cache
-RUN --mount=type=cache,target=/var/cache/apt,sharing=shared \
-  --mount=type=cache,target=/var/lib/apt/lists,sharing=shared \
+RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=shared \
+  --mount=type=cache,id=apt-lists,target=/var/lib/apt/lists,sharing=shared \
   apt-get update \
   && apt-get install -y --no-install-recommends python3 make g++ \
   && rm -rf /var/lib/apt/lists/*
 
 COPY package*.json ./
+# Workspace package manifests MUST be present before `npm ci` so npm materializes
+# the workspace and installs its *workspace-only* deps (e.g. safe-regex,
+# @toon-format/toon — declared in open-sse/package.json, not hoisted to root).
+# Without this, `npm ci` skips them and the application build fails with "Module not
+# found" (root cause of the v3.8.39 Docker build break). workspaces = ["open-sse"].
+COPY open-sse/package.json ./open-sse/package.json
 COPY scripts/build/postinstall.mjs ./scripts/build/postinstall.mjs
 COPY scripts/build/postinstallSupport.mjs ./scripts/build/postinstallSupport.mjs
 COPY scripts/build/native-binary-compat.mjs ./scripts/build/native-binary-compat.mjs
@@ -33,32 +55,47 @@ ENV NPM_CONFIG_LEGACY_PEER_DEPS=true
 # are reproducible.
 RUN test -f package-lock.json \
   || (echo "package-lock.json is required for reproducible Docker builds" >&2 && exit 1)
-RUN --mount=type=cache,target=/root/.npm \
+# `npm rebuild <pkg>` re-runs the package's own install script, so under npm 11 +
+# `--ignore-scripts` on the parent `npm ci` it depends on npm's script-allowlist
+# machinery correctly re-enabling that one package's script. Some self-hosted build
+# environments (e.g. Dokploy) hit a broken/incomplete better-sqlite3 native binding
+# from that indirection. Invoking `node-gyp rebuild` directly inside the package
+# directory bypasses npm's script-running layer entirely and is deterministic
+# regardless of npm version or ignore-scripts allowlist behavior.
+RUN --mount=type=cache,id=npm-cache,target=/root/.npm \
   npm ci --no-audit --no-fund --legacy-peer-deps --ignore-scripts \
-  && npm rebuild better-sqlite3 \
+  && (cd node_modules/better-sqlite3 && npx --yes node-gyp rebuild) \
   && node -e "require('better-sqlite3')(':memory:').close()"
 
-# Build with webpack (stable). Turbopack hit a non-recoverable internal panic on this
-# Next.js version during the v3.8.27 release build — TurbopackInternalError "entered
-# unreachable code: there must be a path to a root" in ImportTracer::get_traces, on both
-# linux/amd64 and linux/arm64. Webpack is the proven engine (build:release / VPS / CI Build
-# all green). Re-enable Turbopack (=1) once the upstream tracer bug is fixed.
+# Build with Turbopack (stable in Next 16, the repo default). The v3.8.27-era
+# TurbopackInternalError panic ("entered unreachable code: there must be a path to a
+# root" in ImportTracer::get_traces) no longer reproduces on Next 16.2.9 — validated
+# 2026-07-05 with clean amd64 (12min14s, image smoke-tested: /api/monitoring/health
+# 200) and arm64 (qemu, exit 0, zero panic strings) builds. Turbopack cut the bare
+# build from 17min to 9min on the same 32-core box. Webpack stays available as the
+# escape hatch: `--build-arg`/-e OMNIROUTE_USE_TURBOPACK=0.
 # See docs/ops/QUALITY_GATE_PLAYBOOK.md Parte 6.
-ENV OMNIROUTE_USE_TURBOPACK=0
+ENV OMNIROUTE_USE_TURBOPACK=1
+
+# Docker containers cannot run the MITM/Agent-Bridge stack (no host DNS/cert
+# access), so keep @/mitm/manager on the graceful stub (#3390). This flag is
+# Docker-only: npm/Electron/VPS builds must bundle the REAL manager (#6344).
+ENV OMNIROUTE_MITM_STUB=1
 
 # Raise the V8 heap ceiling for the build. The webpack production optimization
-# pass (forced above since Turbopack panics) needs more than V8's default ceiling
-# (~2 GB) for a codebase this size; a memory-constrained Docker build otherwise
-# dies with "FATAL ERROR: ... JavaScript heap out of memory" at `[builder] npm run
-# build` (#4076). NODE_OPTIONS propagates to the spawned `next build` child
-# (build-next-isolated.mjs → resolveNextBuildEnv spreads process.env). Build-only;
-# the runtime heap is set separately on the runner stage (OMNIROUTE_MEMORY_MB).
-# Override for hosts with more/less RAM: `--build-arg OMNIROUTE_BUILD_MEMORY_MB=6144`.
+# pass needs more than V8's default ceiling (~2 GB) for a codebase this size; a
+# memory-constrained Docker build otherwise dies with "FATAL ERROR: ... JavaScript
+# heap out of memory" during the builder stage (#4076). Turbopack's compile is
+# native (Rust) and less V8-heap-bound, but the prerender/export phase still runs
+# on V8, so keep the ceiling. NODE_OPTIONS propagates to the spawned `next build`
+# child (build-next-isolated.mjs → resolveNextBuildEnv spreads process.env).
+# Build-only; the runtime heap is set separately on the runner stage
+# (OMNIROUTE_MEMORY_MB). Override: `--build-arg OMNIROUTE_BUILD_MEMORY_MB=6144`.
 ARG OMNIROUTE_BUILD_MEMORY_MB=4096
 ENV NODE_OPTIONS="--max-old-space-size=${OMNIROUTE_BUILD_MEMORY_MB}"
 
 COPY . ./
-RUN --mount=type=cache,target=/app/.build/next/cache \
+RUN --mount=type=cache,id=next-cache,target=/app/.build/next/cache \
   mkdir -p /app/data && npm run build
 
 # ── Runner base ────────────────────────────────────────────────────────────
@@ -154,8 +191,8 @@ COPY --from=builder /app/node_modules/playwright ./node_modules/playwright
 # browsers land under /home/node which persists across image layers and is
 # accessible to the non-root runtime user.
 ENV PLAYWRIGHT_BROWSERS_PATH=/home/node/.cache/ms-playwright
-RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-  --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
+RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=locked \
+  --mount=type=cache,id=apt-lists,target=/var/lib/apt/lists,sharing=locked \
   apt-get update \
   && node node_modules/playwright/cli.js install chromium --with-deps \
   && chown -R node:node /home/node/.cache \
@@ -171,15 +208,15 @@ FROM runner-base AS runner-cli
 USER root
 
 # Install system dependencies required by openclaw (git+ssh references).
-RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-  --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
+RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=locked \
+  --mount=type=cache,id=apt-lists,target=/var/lib/apt/lists,sharing=locked \
   apt-get update \
   && apt-get install -y --no-install-recommends git ca-certificates docker.io docker-compose \
   && rm -rf /var/lib/apt/lists/* \
   && git config --system url."https://github.com/".insteadOf "ssh://git@github.com/"
 
 # Install CLI tools globally. Separate layer from apt for better cache reuse.
-RUN --mount=type=cache,target=/root/.npm \
+RUN --mount=type=cache,id=npm-cache,target=/root/.npm \
   npm install -g --no-audit --no-fund @openai/codex @anthropic-ai/claude-code droid openclaw@latest
 
 USER node

README.md

@@ -6,7 +6,7 @@
 
 # 🚀 OmniRoute — The Free AI Gateway
 
-### Never stop coding. Connect every AI tool to **231 providers** — **50+ free** — through one endpoint.
+### Never stop coding. Connect every AI tool to **250 providers** — **90+ free** — through one endpoint.
 
 **Plug Claude Code, Codex, Cursor, Cline, Copilot & Antigravity into FREE Claude / GPT / Gemini. Auto-fallback.**
 <br/>
@@ -19,11 +19,23 @@
 
 <br/>
 
-[![231 AI Providers](https://img.shields.io/badge/231-AI_Providers-6C5CE7?style=for-the-badge)](#-231-ai-providers--50-free)
-[![50+ Free](https://img.shields.io/badge/50%2B-Free_Tiers-00B894?style=for-the-badge)](#-231-ai-providers--50-free)
+<h3>
+
+⭐ Star the repo if OMNIROUTE helped you save money and make your work easier.
+
+</h3>
+
+[![Stars](https://img.shields.io/github/stars/diegosouzapw/OmniRoute?style=social)](https://github.com/diegosouzapw/OmniRoute)
+<a href="https://trendshift.io/repositories/23589" target="_blank"><img src="https://trendshift.io/api/badge/repositories/23589" alt="diegosouzapw%2FOmniRoute | Trendshift" style="width: 250px; height: 55px;" width="250" height="55"/></a>
+[![Star History Rank](https://api.star-history.com/badge?repo=diegosouzapw/OmniRoute&theme=dark)](https://www.star-history.com/diegosouzapw/omniroute)
+
+</br>
+
+[![250 AI Providers](https://img.shields.io/badge/250-AI_Providers-6C5CE7?style=for-the-badge)](#-250-ai-providers--90-free)
+[![90+ Free](https://img.shields.io/badge/90%2B-Free_Tiers-00B894?style=for-the-badge)](#-250-ai-providers--90-free)
 [![1.6B Free Tokens/mo](https://img.shields.io/badge/1.6B-Free_Tokens%2Fmo-00B894?style=for-the-badge)](docs/reference/FREE_TIERS.md)
 [![Token Savings](https://img.shields.io/badge/up_to_95%25-Token_Savings-E17055?style=for-the-badge)](#%EF%B8%8F-save-1595-tokens--automatically)
-[![17 Strategies](https://img.shields.io/badge/17-Routing_Strategies-0984E3?style=for-the-badge)](#-combos--the-flagship)
+[![18 Strategies](https://img.shields.io/badge/18-Routing_Strategies-0984E3?style=for-the-badge)](#-combos--the-flagship)
 [![$0 to start](https://img.shields.io/badge/%240-To_Start-FDCB6E?style=for-the-badge&logoColor=black)](#-quick-start)
 
 <br/>
@@ -34,79 +46,78 @@
 [![Telegram](https://img.shields.io/badge/Telegram-26A5E4?style=for-the-badge&logo=telegram&logoColor=white)](https://t.me/omnirouteOficial)
 [![WhatsApp Global](https://img.shields.io/badge/WhatsApp_Global-25D366?style=for-the-badge&logo=whatsapp&logoColor=white)](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)
 [![WhatsApp Brasil](https://img.shields.io/badge/WhatsApp_Brasil-25D366?style=for-the-badge&logo=whatsapp&logoColor=white)](https://chat.whatsapp.com/BTGJXIyjeNIIgExvTMGGhI)
+[![Website](https://img.shields.io/badge/Website-omniroute.online-blue?logo=google-chrome&logoColor=white)](https://omniroute.online)
 
 **Questions, provider tips, roadmap & support → [Discord](https://discord.gg/EkzRkpzKYt) · [Telegram](https://t.me/omnirouteOficial) · WhatsApp [🌍 Global](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t) / [🇧🇷 Brasil](https://chat.whatsapp.com/BTGJXIyjeNIIgExvTMGGhI)**
 
 <br/>
 
-<a href="https://trendshift.io/repositories/23589" target="_blank"><img src="https://trendshift.io/api/badge/repositories/23589" alt="diegosouzapw%2FOmniRoute | Trendshift" style="width: 250px; height: 55px;" width="250" height="55"/></a>
-
-[![npm](https://img.shields.io/npm/v/omniroute?logo=npm&style=flat-square)](https://www.npmjs.com/package/omniroute)
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg?style=flat-square)](LICENSE)
-[![Node](https://img.shields.io/badge/node-%E2%89%A522.0.0-brightgreen?style=flat-square)](package.json)
-[![Stars](https://img.shields.io/github/stars/diegosouzapw/OmniRoute?style=social)](https://github.com/diegosouzapw/OmniRoute)
-
-<div align="center">
+### 🧩 Available
 
 [![npm version](https://img.shields.io/npm/v/omniroute?color=cb3837&logo=npm)](https://www.npmjs.com/package/omniroute)
 ![NPM Monthly](https://img.shields.io/npm/dm/omniroute?label=npm/month&color=cb3837&logo=npm)
 [![Docker Hub](https://img.shields.io/docker/v/diegosouzapw/omniroute?label=Docker%20Hub&logo=docker&color=2496ED)](https://hub.docker.com/r/diegosouzapw/omniroute)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg?style=flat-square)](LICENSE)
 ![Docker Pulls](https://img.shields.io/docker/pulls/diegosouzapw/omniroute?label=docker%20pulls&logo=docker&color=2496ED)
 ![Electron Downloads](https://img.shields.io/github/downloads/diegosouzapw/omniroute/total?style=flat&label=electron%20downloads&logo=electron&color=47848F)
-[![Website](https://img.shields.io/badge/Website-omniroute.online-blue?logo=google-chrome&logoColor=white)](https://omniroute.online)
 
-</div>
-
-<br/>
-
-[**🚀 Quick Start**](#-quick-start) • [**🎯 Combos**](#-combos--the-flagship) • [**🌐 Providers**](#-231-ai-providers--50-free) • [**🔌 CLI & MCP**](#-full-cli--a2a--mcp) • [**🗜️ Compression**](#%EF%B8%8F-save-1595-tokens--automatically) • [**🌍 Website**](https://omniroute.online)
+[**🚀 Quick Start**](#-quick-start) • [**🎯 Combos**](#-combos--the-flagship) • [**🌐 Providers**](#-250-ai-providers--90-free) • [**🔌 CLI & MCP**](#-full-cli--a2a--mcp) • [**🗜️ Compression**](#%EF%B8%8F-save-1595-tokens--automatically) • [**🌍 Website**](https://omniroute.online)
 
 [💥 The Promise](#-the-promise) • [🤔 Why](#-why-omniroute) • [🏆 What Sets Apart](#-what-sets-omniroute-apart) • [🤖 Compatible CLIs](#-compatible-clis--coding-agents) • [🖥️ Where It Runs](#%EF%B8%8F-where-omniroute-runs--anywhere) • [🔒 Private](#-private--local-first) • [🎬 In Action](#-omniroute-in-action) • [📚 Explore More](#-explore-more) • [📧 Support](#-support--community)
 
 </div>
 
 <div align="center">
- <b>🌐 Available in 41+ languages</b>
+ <b>🌐 In 42+ languages</b>
  <table>
   <tr>
     <td align="center"><a href="README.md">🇺🇸</a></td>
     <td align="center"><a href="docs/i18n/pt-BR/README.md">🇧🇷</a></td>
+    <td align="center"><a href="docs/i18n/pt/README.md">🇵🇹</a></td>
     <td align="center"><a href="docs/i18n/es/README.md">🇪🇸</a></td>
     <td align="center"><a href="docs/i18n/fr/README.md">🇫🇷</a></td>
     <td align="center"><a href="docs/i18n/it/README.md">🇮🇹</a></td>
-    <td align="center"><a href="docs/i18n/ru/README.md">🇷🇺</a></td>
-    <td align="center"><a href="docs/i18n/zh-CN/README.md">🇨🇳</a></td>
-    <td align="center"><a href="docs/i18n/zh-TW/README.md">🇹🇼</a></td>
     <td align="center"><a href="docs/i18n/de/README.md">🇩🇪</a></td>
-    <td align="center"><a href="docs/i18n/ja/README.md">🇯🇵</a></td>
-    <td align="center"><a href="docs/i18n/ko/README.md">🇰🇷</a></td>
-    <td align="center"><a href="docs/i18n/in/README.md">🇮🇳</a></td>
-  </tr>
-  <tr>
-    <td align="center"><a href="docs/i18n/th/README.md">🇹🇭</a></td>
-    <td align="center"><a href="docs/i18n/vi/README.md">🇻🇳</a></td>
-    <td align="center"><a href="docs/i18n/id/README.md">🇮🇩</a></td>
-    <td align="center"><a href="docs/i18n/ms/README.md">🇲🇾</a></td>
-    <td align="center"><a href="docs/i18n/phi/README.md">🇵🇭</a></td>
-    <td align="center"><a href="docs/i18n/ar/README.md">🇸🇦</a></td>
-    <td align="center"><a href="docs/i18n/he/README.md">🇮🇱</a></td>
-    <td align="center"><a href="docs/i18n/az/README.md">🇦🇿</a></td>
+    <td align="center"><a href="docs/i18n/nl/README.md">🇳🇱</a></td>
+    <td align="center"><a href="docs/i18n/ru/README.md">🇷🇺</a></td>
     <td align="center"><a href="docs/i18n/uk-UA/README.md">🇺🇦</a></td>
     <td align="center"><a href="docs/i18n/pl/README.md">🇵🇱</a></td>
     <td align="center"><a href="docs/i18n/cs/README.md">🇨🇿</a></td>
+    <td align="center"><a href="docs/i18n/sk/README.md">🇸🇰</a></td>
+    <td align="center"><a href="docs/i18n/ro/README.md">🇷🇴</a></td>
+    <td align="center"><a href="docs/i18n/hu/README.md">🇭🇺</a></td>
   </tr>
   <tr>
-    <td align="center"><a href="docs/i18n/nl/README.md">🇳🇱</a></td>
     <td align="center"><a href="docs/i18n/bg/README.md">🇧🇬</a></td>
     <td align="center"><a href="docs/i18n/da/README.md">🇩🇰</a></td>
     <td align="center"><a href="docs/i18n/fi/README.md">🇫🇮</a></td>
     <td align="center"><a href="docs/i18n/no/README.md">🇳🇴</a></td>
     <td align="center"><a href="docs/i18n/sv/README.md">🇸🇪</a></td>
-    <td align="center"><a href="docs/i18n/hu/README.md">🇭🇺</a></td>
-    <td align="center"><a href="docs/i18n/ro/README.md">🇷🇴</a></td>
-    <td align="center"><a href="docs/i18n/sk/README.md">🇸🇰</a></td>
-    <td align="center"><a href="docs/i18n/pt/README.md">🇵🇹</a></td>
-    <td align="center"></td>
+    <td align="center"><a href="docs/i18n/zh-CN/README.md">🇨🇳</a></td>
+    <td align="center"><a href="docs/i18n/zh-TW/README.md">🇹🇼</a></td>
+    <td align="center"><a href="docs/i18n/ja/README.md">🇯🇵</a></td>
+    <td align="center"><a href="docs/i18n/ko/README.md">🇰🇷</a></td>
+    <td align="center"><a href="docs/i18n/th/README.md">🇹🇭</a></td>
+    <td align="center"><a href="docs/i18n/vi/README.md">🇻🇳</a></td>
+    <td align="center"><a href="docs/i18n/id/README.md">🇮🇩</a></td>
+    <td align="center"><a href="docs/i18n/ms/README.md">🇲🇾</a></td>
+    <td align="center"><a href="docs/i18n/phi/README.md">🇵🇭</a></td>
+  </tr>
+  <tr>
+    <td align="center"><a href="docs/i18n/in/README.md">🇮🇳</a></td>
+    <td align="center"><a href="docs/i18n/hi/README.md">🇮🇳</a></td>
+    <td align="center"><a href="docs/i18n/gu/README.md">🇮🇳</a></td>
+    <td align="center"><a href="docs/i18n/mr/README.md">🇮🇳</a></td>
+    <td align="center"><a href="docs/i18n/ta/README.md">🇮🇳</a></td>
+    <td align="center"><a href="docs/i18n/te/README.md">🇮🇳</a></td>
+    <td align="center"><a href="docs/i18n/bn/README.md">🇧🇩</a></td>
+    <td align="center"><a href="docs/i18n/ur/README.md">🇵🇰</a></td>
+    <td align="center"><a href="docs/i18n/fa/README.md">🇮🇷</a></td>
+    <td align="center"><a href="docs/i18n/ar/README.md">🇸🇦</a></td>
+    <td align="center"><a href="docs/i18n/he/README.md">🇮🇱</a></td>
+    <td align="center"><a href="docs/i18n/tr/README.md">🇹🇷</a></td>
+    <td align="center"><a href="docs/i18n/az/README.md">🇦🇿</a></td>
+    <td align="center"><a href="docs/i18n/sw/README.md">🇹🇿</a></td>
   </tr>
 </table>
 </div>
@@ -138,18 +149,18 @@
 
 </div>
 
-> One endpoint. **231 providers.** Never stop building — and let OmniRoute pick the cheapest one that works.
+> One endpoint. **250 providers.** Never stop building — and let OmniRoute pick the cheapest one that works.
 
 <table>
   <tr>
-    <td width="33%" valign="top"><b>🚫 Never hit limits</b><br/><sub>Auto-fallback across 231 providers in milliseconds. Quota out? Next provider takes over — zero downtime.</sub></td>
+    <td width="33%" valign="top"><b>🚫 Never hit limits</b><br/><sub>Auto-fallback across 250 providers in milliseconds. Quota out? Next provider takes over — zero downtime.</sub></td>
     <td width="33%" valign="top"><b>💸 Save up to 95% tokens</b><br/><sub>RTK + Caveman stacked compression cuts 15–95% of eligible tokens (~89% avg on tool-heavy sessions).</sub></td>
-    <td width="33%" valign="top"><b>🆓 $0 to start</b><br/><sub>50+ providers with a free tier, 11 free <i>forever</i> (Kiro, Qoder, Pollinations, LongCat…). No card needed.</sub></td>
+    <td width="33%" valign="top"><b>🆓 $0 to start</b><br/><sub>90+ providers with a free tier, 11 free <i>forever</i> (Kiro, Qoder, Pollinations, LongCat…). No card needed.</sub></td>
   </tr>
   <tr>
-    <td width="33%" valign="top"><b>🔌 Every tool works</b><br/><sub>16+ coding agents — Claude Code, Codex, Cursor, Cline, Copilot, Antigravity — through one config.</sub></td>
+    <td width="33%" valign="top"><b>🔌 Every tool works</b><br/><sub>24+ coding agents — Claude Code, Codex, Cursor, Cline, Copilot, Antigravity — through one config.</sub></td>
     <td width="33%" valign="top"><b>🧩 One endpoint</b><br/><sub>OpenAI ↔ Claude ↔ Gemini ↔ Responses API translation. Point any tool at <code>/v1</code> and it just works.</sub></td>
-    <td width="33%" valign="top"><b>🛡️ Production-grade</b><br/><sub>Circuit breakers, TLS stealth, MCP (87 tools), A2A, memory, guardrails, evals. 14,965 tests.</sub></td>
+    <td width="33%" valign="top"><b>🛡️ Production-grade</b><br/><sub>Circuit breakers, TLS stealth, MCP (94 tools), A2A, memory, guardrails, evals. 21,000+ tests.</sub></td>
   </tr>
 </table>
 
@@ -183,7 +194,7 @@
                           ▼
 ┌──────────────────────────────────────────────────────────┐
 │                  OmniRoute — Smart Router                  │
-│  RTK + Caveman compression · 17 routing strategies         │
+│  RTK + Caveman compression · 18 routing strategies         │
 │  Circuit breakers · TLS stealth · MCP · A2A · Guardrails   │
 └─────────────────────────┬──────────────────────────────────┘
         ┌─────────────┬────┴────────┬─────────────┐
@@ -221,20 +232,56 @@ No combo to create. Set your model to `auto` (or a variant) and OmniRoute builds
 
 ##
 
-### 🔀 Or build your own — 17 routing strategies
+### 🔀 Or build your own — 18 routing strategies
 
-| Goal                                    | Strategy / combo                                   |
-| --------------------------------------- | -------------------------------------------------- |
-| 🥇 Drain my subscription before paying  | `priority` / `fill-first`                          |
-| ⚖️ Spread load across accounts          | `round-robin` · `weighted` · `p2c` · `least-used`  |
-| 💸 Always cheapest viable model         | `cost-optimized` · `auto/cheap`                    |
-| 🧠 Hand off long context between models | `context-relay` · `context-optimized`              |
-| 🎲 Randomized / privacy routing         | `random` · `strict-random`                         |
-| 🧬 Fan out to a panel + judge synthesis | `fusion`                                           |
-| 📊 Route by remaining quota headroom    | `reset-window` · `headroom`                        |
-| 🤖 Just make it smart                   | `auto` (9-factor scoring) · `lkgp` · `reset-aware` |
+All **18** strategies — mix & match per combo step:
 
-<sub>The Auto-Combo engine scores every candidate on **9 factors** (health, quota, cost, latency, success rate, freshness…) — see [`docs/routing/AUTO-COMBO.md`](docs/routing/AUTO-COMBO.md).</sub>
+| #   | Strategy            | What it does                                                     |
+| --- | ------------------- | ---------------------------------------------------------------- |
+| 1   | `priority`          | First-target ordered list — drain each before the next 🥇        |
+| 2   | `fill-first`        | Fill each target's quota fully before moving on                  |
+| 3   | `weighted`          | Weighted random by per-target weight                             |
+| 4   | `round-robin`       | Cycle through targets in order                                   |
+| 5   | `p2c`               | Power-of-two-choices random load balancing                       |
+| 6   | `least-used`        | Pick the target with the lowest current load                     |
+| 7   | `random`            | Uniform random pick (deduplicated)                               |
+| 8   | `strict-random`     | Random without de-duplicating repeats 🎲                         |
+| 9   | `cost-optimized`    | Minimize $ per request from live catalog pricing 💸              |
+| 10  | `headroom`          | Pick the target with the most remaining quota                    |
+| 11  | `reset-window`      | Prefer the target whose quota window resets soonest              |
+| 12  | `reset-aware`       | Rank by quota reset time — short windows first 📊                |
+| 13  | `context-relay`     | Hand off context across targets for long conversations 🧠        |
+| 14  | `context-optimized` | Pick the best fit for the current context size                   |
+| 15  | `lkgp`              | Last-Known-Good Path — sticky to the last successful target      |
+| 16  | `auto`              | 12-factor live scoring across every connection 🤖                |
+| 17  | `fusion`            | Fan out to a panel of models + a judge synthesizes one answer 🧬 |
+| 18  | `pipeline`          | Chain steps — each target's output feeds the next one 🔗         |
+
+<sub>The Auto-Combo engine scores every candidate on **12 factors** (health, quota, cost, latency, success rate, freshness…) — see [`docs/routing/AUTO-COMBO.md`](docs/routing/AUTO-COMBO.md).</sub>
+
+##
+
+### ⚖️ Quota-Share — split one subscription across a team ✨ NEW
+
+> Running several keys against the **same upstream account** (one Codex Pro plan, one Kimi key, one GLM Coding seat)? A burst on one key can burn the whole 5-hour / hourly quota and lock everyone else out. **Quota-Share** distributes a provider's time-based quota **fairly** across the keys in a pool — and it's _work-conserving_, so an idle member's slice is lent out instead of wasted.
+
+| Knob                     | What it controls                                                                |
+| ------------------------ | ------------------------------------------------------------------------------- |
+| ⚖️ **Allocation weight** | each key's slice of the pool — e.g. `50 / 30 / 20`                              |
+| 📐 **Dimensions**        | track `%` · requests · tokens · `$`, per **5h / 7d / per-model** window         |
+| 🚦 **Policy**            | `hard` (block over share) · `soft` (deprioritize) · `burst` (use idle headroom) |
+| 🧱 **Cap**               | absolute ceiling per key, independent of mode                                   |
+
+```
+Pool "team-codex"   ·   1 Codex Pro account   ·   3 keys   ·   5-hour window
+  ├─ alice    weight 50  ██████████░░░░░░░░░░   ≤ 50% of the shared 5h quota
+  ├─ bob      weight 30  ██████░░░░░░░░░░░░░░   ≤ 30%
+  └─ ci-bot   weight 20  ████░░░░░░░░░░░░░░░░   ≤ 20%
+Generous mode (<50% pool used) → idle shares are lent out
+Strict mode  (≥50% pool used)  → each key held to its fair share
+```
+
+<sub>Enforced in the hot path **before** the request leaves OmniRoute, with per-(key, model) caps + session stickiness for prompt-cache integrity (now with a per-combo / global disable toggle). 📖 [Quota Sharing Engine](docs/routing/QUOTA_SHARE.md)</sub>
 
 ##
 
@@ -267,15 +314,15 @@ Result: 4 layers of fallback = zero downtime
 
 | Feature                                | OmniRoute                                                           | Other routers |
 | -------------------------------------- | ------------------------------------------------------------------- | ------------- |
-| 🌐 Providers                           | **231**                                                             | 20–100        |
-| 🆓 Free providers                      | **50+ (11 free forever)**                                           | 1–5           |
-| 🔀 Routing strategies                  | **17** (priority, weighted, cost-optimized, context-relay, fusion…) | 1–3           |
+| 🌐 Providers                           | **250**                                                             | 20–100        |
+| 🆓 Free providers                      | **90+ (11 free forever)**                                           | 1–5           |
+| 🔀 Routing strategies                  | **18** (priority, weighted, cost-optimized, context-relay, fusion…) | 1–3           |
 | 🗜️ Token compression                   | **RTK + Caveman stacked (15–95%)**                                  | None / 20–40% |
-| 🧰 Built-in MCP server                 | **87 tools, 3 transports, 30 scopes**                               | Rare          |
+| 🧰 Built-in MCP server                 | **94 tools, 3 transports, 30 scopes**                               | Rare          |
 | 🤝 A2A agent protocol                  | **6 skills, JSON-RPC 2.0**                                          | None          |
 | 🧠 Memory (FTS5 + vector)              | **Yes**                                                             | Rare          |
 | 🛡️ Guardrails (PII, injection, vision) | **Yes**                                                             | Rare          |
-| ☁️ Cloud agents                        | **Codex, Devin, Jules**                                             | None          |
+| ☁️ Cloud agents                        | **Codex, Cursor, Devin, Jules**                                     | None          |
 | 🥷 TLS fingerprint stealth             | **JA3/JA4 via wreq-js**                                             | None          |
 | 🖥️ Multi-platform                      | **Web · Desktop · Termux · PWA**                                    | Web only      |
 | 🌍 i18n                                | **42 locales**                                                      | 0–4           |
@@ -290,19 +337,23 @@ Result: 4 layers of fallback = zero downtime
 
 </div>
 
-> Recent highlights from **v3.8.20 → v3.8.39**. Full history in [`CHANGELOG.md`](CHANGELOG.md).
+> Recent highlights from **v3.8.20 → v3.8.47**. Full history in [`CHANGELOG.md`](CHANGELOG.md).
 
-- **⚖️ Quota-Share routing** — a dedicated combo strategy that spreads load across accounts by _available quota_: Deficit-Round-Robin scheduling, per-connection `max_concurrent` with cooldown-wait queueing, multi-window usage buckets (5h / 7d / per-model), per-(key,model) caps, session stickiness for prompt-cache integrity, and proactive saturation from upstream token-usage headers. → [Resilience Guide](docs/architecture/RESILIENCE_GUIDE.md)
-- **🤖 One-command CLI/agent setup** — a dedicated `setup-*` command configures each coding tool to route through OmniRoute (Claude Code, Codex, Cline, Continue, Cursor, Roo Code, Kilo Code, Crush, Goose, Qwen Code, Aider, OpenCode, Gemini CLI); `omniroute launch` / `omniroute launch-codex` are zero-config launchers. → [CLI Integrations](docs/guides/CLI-INTEGRATIONS.md)
+- **🗜️ Compression hardening** — a default-on **inflation guard** (discard the stacked result and send the verbatim original whenever compression would _grow_ the prompt), completed **Caveman rule packs** for German / French / Japanese (dedup + ultra) plus a new **Chinese (文言 / wényán) input pack** with zh-vs-ja auto-detection, and **RTK filters for Gradle & .NET (`dotnet`)** build output. → [Compression](docs/compression/COMPRESSION_ENGINES.md)
+- **💸 Honest flat-rate cost** — subscription / coding-plan providers (ChatGPT Web, grok-web, the Minimax / Kimi / GLM / Alibaba Coding plans, Xiaomi MiMo…) now read **$0** in cost analytics instead of an inflated per-token estimate, while budget / quota / routing keep estimating unchanged. → [API Reference](docs/reference/API_REFERENCE.md)
+- **⚖️ Quota-Share routing** — a dedicated combo strategy that spreads load across accounts by _available quota_: Deficit-Round-Robin scheduling, per-connection `max_concurrent` with cooldown-wait queueing, multi-window usage buckets (5h / 7d / per-model), per-(key, model) caps, session stickiness for prompt-cache integrity (now with a per-combo / global disable toggle), and proactive saturation from upstream token-usage headers. → [Resilience Guide](docs/architecture/RESILIENCE_GUIDE.md)
+- **🤖 One-command CLI/agent setup** — a dedicated `setup-*` command configures each coding tool to route through OmniRoute (Claude Code, Codex, Cline, Continue, Cursor, Roo Code, Kilo Code, Crush, Goose, Qwen Code, Aider, OpenCode); `omniroute launch` / `omniroute launch-codex` are zero-config launchers. → [CLI Integrations](docs/guides/CLI-INTEGRATIONS.md)
 - **🛰️ Remote mode** — drive a remote OmniRoute from any machine with scoped access tokens (`omniroute connect` / `omniroute contexts` / `omniroute tokens`), plus an `omniroute login antigravity` helper that runs Google "native/desktop" OAuth on your own machine and pastes a credential blob into a remote/VPS install (where the loopback redirect is unreachable). → [Remote Mode](docs/guides/REMOTE-MODE.md)
-- **🧭 Smarter auto-routing** — OpenRouter-style `auto/<category>:<tier>` combos (e.g. `auto/coding:fast`, `auto/reasoning:pro`), a **Fusion** strategy (fan out to a panel of models in parallel, then synthesize via a judge), **task-aware routing** (best-fit connection per task type), per-request `X-Route-Model` override, live Arena-ELO + models.dev model intelligence, per-step account allowlists, provider-wildcard combo steps, nested combo-ref execution, sticky weighted selection, and `web_search`-aware routing. → [Auto-Combo](docs/routing/AUTO-COMBO.md)
-- **🗜️ Pluggable compression** — an async pipeline of **9 composable engines** with Compression Studios, an LLMLingua-2 ONNX engine and a heuristic/SLM two-tier **Ultra**, RTK, delegated Anthropic Context Editing, **Output Styles** (output-axis steering: terse-prose / less-code / terse-CJK), an **adaptive context-budget dial** (escalate only as far as needed to fit the context window), per-request `x-omniroute-compression` control, an opt-in offline eval harness, one-click **Headroom** proxy lifecycle management from the dashboard (Docker sidecar supported), a synthetic **compression playground** (Play lanes + A/B Compare with USD-capped fidelity verdicts), an opt-in **per-step fidelity gate** that rejects a lossy engine before it degrades the prompt, a **best-of-N candidate encoder** (GCF vs TOON — keep whichever is shorter, with an A/B bytes/token table in the studio), **CCR ranged/grep/stats retrieval** (pull an exact byte/line slice or summary of a stored block instead of re-expanding it), and a unified panel with named profiles + an active-profile selector. → [Compression](docs/compression/COMPRESSION_ENGINES.md)
+- **🧭 Smarter auto-routing** — OpenRouter-style `auto/<category>:<tier>` combos (e.g. `auto/coding:fast`, `auto/reasoning:pro`), a **Fusion** strategy (fan out to a panel of models in parallel, then synthesize via a judge), **task-aware routing** (best-fit connection per task type), per-request `X-Route-Model` override, live Arena-ELO + models.dev model intelligence, per-step account allowlists, provider-wildcard combo steps, nested combo-ref execution, sticky weighted selection, `web_search`-aware routing (now with **per-model web-search/web-fetch interception rules**), native **xAI Grok `/v1/responses`** routing, and **per-request Auto-Combo controls** (`X-OmniRoute-Mode` mode-preset override + `X-OmniRoute-Budget` hard USD cost ceiling, scoped to a single request). Embeddings-only and rerank-only models (JinaAI, OpenRouter custom, reranker models…) no longer disappear from the combo builder's model picker. → [Auto-Combo](docs/routing/AUTO-COMBO.md)
+- **🗜️ Pluggable compression** — an async pipeline of **10 composable engines** with Compression Studios, an LLMLingua-2 ONNX engine and a heuristic/SLM two-tier **Ultra**, RTK, delegated Anthropic Context Editing, **Output Styles** (output-axis steering: terse-prose / less-code / terse-CJK), an **adaptive context-budget dial** (escalate only as far as needed to fit the context window), per-request `x-omniroute-compression` control, an opt-in offline eval harness, one-click **Headroom** proxy lifecycle management from the dashboard (Docker sidecar supported), a synthetic **compression playground** (Play lanes + A/B Compare with USD-capped fidelity verdicts), an opt-in **per-step fidelity gate** that rejects a lossy engine before it degrades the prompt, a **best-of-N candidate encoder** (GCF vs TOON — keep whichever is shorter, with an A/B bytes/token table in the studio), the vendored **GCF codec updated to spec v3.2** (nested flattening — deeply-nested payloads go from ~3% to ~32% compression vs JSON), a new **omniglyph** engine (context-as-image, ~10× fewer tokens on the converted block), **CCR ranged/grep/stats retrieval** (pull an exact byte/line slice or summary of a stored block instead of re-expanding it), a unified panel with named profiles + an active-profile selector, an opt-in **per-engine pipeline circuit-breaker**, an opt-in **LLM-tier engine** (a model pass for higher-ratio semantic compression), a **read-lifecycle engine** that collapses superseded file reads, **usage-observed prefix freeze**, a graduated **CCR retrieval-feedback ramp**, a `preserveSystemPrompt` mode enum, and a **drag-reorder pipeline editor** in the studio. → [Compression](docs/compression/COMPRESSION_ENGINES.md)
 - **🕵️ Transparent MITM decrypt (TPROXY)** — capture & translate traffic from CLIs that ignore proxy env vars, with a per-SNI certificate authority and a trust-store installer. → [MITM/TPROXY](docs/security/MITM-TPROXY-DECRYPT.md)
 - **💸 Cost telemetry everywhere** — `X-OmniRoute-*` cost/usage headers on every endpoint (including media), a non-token cost engine, a cache-HIT `X-OmniRoute-Cost-Saved` header, and per-key USD spend quotas. → [API Reference](docs/reference/API_REFERENCE.md)
-- **🧠 Memory you control** — opt-in int8 vector quantization (Qdrant + sqlite-vec), memory off by default, and a per-request `x-omniroute-no-memory` header. → [Memory](docs/frameworks/MEMORY.md)
+- **🧠 Memory you control** — opt-in int8 vector quantization (Qdrant + sqlite-vec), opt-in **typed memory decay** (aged low-value memories fade on a per-type schedule), memory off by default, and a per-request `x-omniroute-no-memory` header. → [Memory](docs/frameworks/MEMORY.md)
 - **🛡️ Security** — a prompt-injection guard across every LLM route (backed by a red-team suite), plus a free DuckDuckGo last-resort web search. → [Guardrails](docs/security/GUARDRAILS.md)
-- **🤝 More providers & agents** — Cursor Cloud Agent (a 4th cloud agent), CodeBuddy CN (`copilot.tencent.com`), a Google Flow video-generation provider, new gateways **DGrid** and **Pioneer AI** (Fastino Labs), inbound **xAI Grok** translators plus **Grok Build (xAI)** with an OAuth import-token flow, GPT-4 / GPT-4o-mini on the GitHub Copilot provider, multi-model **Factory Droid**, **ZenMux Free** (session-cookie free tier), **Alibaba DashScope** text-to-video (`wan2.7-t2v`), a refreshed 231-provider catalog (OrcaRouter, Wafer AI, OpenAdapter, dit.ai, TokenRouter, …), Vertex AI media generation (speech / transcription / music / video), and one-click account import from CLIProxyAPI (`~/.cli-proxy-api/`). → [Providers](docs/reference/PROVIDER_REFERENCE.md)
-- **⚡ Local performance & infra** — a one-click local Redis launcher (`omniroute redis up`, plus a dashboard Redis panel), one-click **Cloudflare Workers** and **Deno Deploy** relay deployers wired into the proxy pool, and an optional Bifrost Go sidecar that offloads the hottest relay path (`BIFROST_BASE_URL`, with automatic fallback to the TypeScript path on timeout). → [Environment](docs/reference/ENVIRONMENT.md)
+- **🖼️ New endpoints** — `/v1/ocr` (Mistral OCR) and `/v1/audio/translations` (Whisper-style audio translation) round out the media API surface. → [API Reference](docs/reference/API_REFERENCE.md)
+- **🌍 Deployment & ops** — reverse-proxy `basePath` deployment (`OMNIROUTE_BASE_PATH`, e.g. serving OmniRoute under `/omniroute/`), browser-language auto-detect on first visit, per-API-key device/connection tracking (IP+UA fingerprint, masked, in-memory only), root-less MITM cert trust for user-namespaced containers (`OMNIROUTE_NO_SUDO`), server-side configured-only / available-only filters on the Free Provider Rankings page, and **Traditional Chinese (zh-TW)** localization for the frontend + CLI. → [Environment](docs/reference/ENVIRONMENT.md)
+- **🤝 More providers & agents** — Cursor Cloud Agent (a 4th cloud agent), CodeBuddy CN (`copilot.tencent.com`), a Google Flow video-generation provider, new gateways **DGrid** and **Pioneer AI** (Fastino Labs), inbound **xAI Grok** translators plus **Grok Build (xAI)** with an OAuth import-token flow, GPT-4 / GPT-4o-mini on the GitHub Copilot provider, multi-model **Factory Droid**, **ZenMux Free** (session-cookie free tier), **Alibaba DashScope** text-to-video (`wan2.7-t2v`), a refreshed 250-provider catalog (OrcaRouter, Wafer AI, OpenAdapter, dit.ai, TokenRouter, …), Vertex AI media generation (speech/transcription/music/video), a first-class **Ollama** local-provider card, the **SenseNova** free Token Plan (chat + text-to-image), one-click account import from CLIProxyAPI (`~/.cli-proxy-api/`), **Claude Sonnet 5** wired end-to-end, a new provider wave (**Kenari**, **SumoPod**, **X5Lab**, **Charm Hyper**, **Nube.sh**, **b.ai**, **Qiniu**, **ModelScope**, **Augment/Auggie CLI**, **ClinePass**, NVIDIA NIM image generation), Codex account import from a raw ChatGPT access token, the **Requesty** gateway (BYOK, ~200 free req/day), **Yuanbao (web)** as a cookie-session provider (DeepSeek V3/R1 + Hunyuan), the **Zed** hosted LLM aggregator (OAuth), **Claude 5 Sonnet** on the Claude Web provider, Kiro **adaptive-thinking reasoning** surfaced as `reasoning_content`, **bulk API-key add for Cloudflare Workers AI**, and **OpenVecta** (AI inference gateway). → [Providers](docs/reference/PROVIDER_REFERENCE.md)
+- **⚡ Local performance & infra** — a one-click local Redis launcher (`omniroute redis up`, plus a dashboard Redis panel), one-click **Cloudflare Workers** and **Deno Deploy** relay deployers wired into the proxy pool, a relay-backend selector (`OMNIROUTE_RELAY_BACKEND=ts|bifrost|auto`) so `/v1/relay` stays the stable surface while choosing the fastest backend internally, **Bifrost** (Go AI-gateway) and **Mux** (agent-orchestration daemon) promoted to first-class embedded/supervised services alongside 9Router/CLIProxyAPI, **Webshare** added as a paid fourth source in the free-proxy provider framework, and **shorthand proxy formats + protocol header mode** for bulk proxy import. → [Embedded Services](docs/frameworks/EMBEDDED-SERVICES.md)
 
 <br/>
 
@@ -317,7 +368,6 @@ Result: 4 layers of fallback = zero downtime
   <tr>
     <td align="center" width="120"><a href="https://github.com/anthropics/claude-code"><img src="./public/providers/claude.svg" width="52" alt="Claude Code"/><br/><b>Claude Code</b></a></td>
     <td align="center" width="120"><a href="https://github.com/openai/codex"><img src="./public/providers/codex.svg" width="52" alt="Codex CLI"/><br/><b>Codex CLI</b></a></td>
-    <td align="center" width="120"><a href="https://github.com/google-gemini/gemini-cli"><img src="./public/providers/gemini-cli.svg" width="52" alt="Gemini CLI"/><br/><b>Gemini CLI</b></a></td>
     <td align="center" width="120"><img src="./public/providers/cursor.png" width="52" alt="Cursor"/><br/><b>Cursor</b></td>
     <td align="center" width="120"><img src="./public/providers/copilot.png" width="52" alt="Copilot"/><br/><b>Copilot</b></td>
     <td align="center" width="120"><img src="./public/providers/continue.png" width="52" alt="Continue"/><br/><b>Continue</b></td>
@@ -337,7 +387,7 @@ Result: 4 layers of fallback = zero downtime
 <b>＋ also works with</b> · Cline · Antigravity · Windsurf · AMP · Hermes · Qwen CLI · Roo · Continue · <b>any OpenAI-compatible tool</b>
 </div>
 
-<sub>📖 Per-tool setup for all 16+ tools → [`docs/reference/CLI-TOOLS.md`](docs/reference/CLI-TOOLS.md) · 🧩 OpenCode plugin → [`@omniroute/opencode-provider`](https://www.npmjs.com/package/@omniroute/opencode-provider)</sub>
+<sub>📖 Per-tool setup for all 24+ tools → [`docs/reference/CLI-TOOLS.md`](docs/reference/CLI-TOOLS.md) · 🧩 OpenCode plugin → [`@omniroute/opencode-provider`](https://www.npmjs.com/package/@omniroute/opencode-provider)</sub>
 
 </div>
 
@@ -345,28 +395,60 @@ Result: 4 layers of fallback = zero downtime
 
 <div align="center">
 
-# 🌐 231 AI Providers — 50+ Free
+# 🌐 250 AI Providers — 90+ Free
 
 </div>
 
-> The most complete catalog of any open-source router: **231 providers**, **50+ with a free tier**, **11 free forever**.
+> The most complete catalog of any open-source router: **250 providers**, **90+ with a free tier**, **11 free forever**.
 
 <div align="center">
 
+### 🏢 Every major lab — through one endpoint
+
+<table>
+  <tr>
+    <td align="center" width="92"><picture><source media="(prefers-color-scheme:dark)" srcset="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-png@1.91.0/dark/openai.png"/><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/openai.svg" width="40" alt="OpenAI"/></picture><br/><sub>OpenAI</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/claude-color.svg" width="40" alt="Anthropic"/><br/><sub>Anthropic</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/gemini-color.svg" width="40" alt="Gemini"/><br/><sub>Gemini</sub></td>
+    <td align="center" width="92"><picture><source media="(prefers-color-scheme:dark)" srcset="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-png@1.91.0/dark/grok.png"/><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/grok.svg" width="40" alt="xAI Grok"/></picture><br/><sub>xAI Grok</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/deepseek-color.svg" width="40" alt="DeepSeek"/><br/><sub>DeepSeek</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/mistral-color.svg" width="40" alt="Mistral"/><br/><sub>Mistral</sub></td>
+  </tr>
+  <tr>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/qwen-color.svg" width="40" alt="Qwen"/><br/><sub>Qwen</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/meta-color.svg" width="40" alt="Meta Llama"/><br/><sub>Meta Llama</sub></td>
+    <td align="center" width="92"><picture><source media="(prefers-color-scheme:dark)" srcset="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-png@1.91.0/dark/groq.png"/><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/groq.svg" width="40" alt="Groq"/></picture><br/><sub>Groq</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/nvidia-color.svg" width="40" alt="NVIDIA"/><br/><sub>NVIDIA</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/minimax-color.svg" width="40" alt="MiniMax"/><br/><sub>MiniMax</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/cohere-color.svg" width="40" alt="Cohere"/><br/><sub>Cohere</sub></td>
+  </tr>
+  <tr>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/perplexity-color.svg" width="40" alt="Perplexity"/><br/><sub>Perplexity</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/huggingface-color.svg" width="40" alt="Hugging Face"/><br/><sub>HuggingFace</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/together-color.svg" width="40" alt="Together"/><br/><sub>Together</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/fireworks-color.svg" width="40" alt="Fireworks"/><br/><sub>Fireworks</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/cloudflare-color.svg" width="40" alt="Cloudflare"/><br/><sub>Cloudflare</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/baidu-color.svg" width="40" alt="Baidu"/><br/><sub>Baidu</sub></td>
+  </tr>
+</table>
+
+<sub>…and 220+ more — every icon resolves live from the dashboard's provider catalog. 📖 [Provider Reference](docs/reference/PROVIDER_REFERENCE.md)</sub>
+
+<br/>
+
 ### 🆓 Free Forever — $0, no card
 
 <table>
   <tr>
-    <td align="center" width="150"><img src="https://img.shields.io/badge/AgentRouter-FF6600?style=flat-square" alt="AgentRouter"/><br/><sub>GPT-5, Claude, Gemini<br/>$100 free credits</sub></td>
-    <td align="center" width="150"><img src="https://img.shields.io/badge/Qoder_AI-6366F1?style=flat-square" alt="Qoder AI"/><br/><sub>Kimi-K2, DeepSeek-R1<br/>Unlimited FREE</sub></td>
-    <td align="center" width="150"><img src="https://img.shields.io/badge/Pollinations-10B981?style=flat-square" alt="Pollinations"/><br/><sub>GPT-5, Claude, Llama 4<br/>No key needed</sub></td>
-    <td align="center" width="150"><img src="https://img.shields.io/badge/LongCat-FF7A00?style=flat-square" alt="LongCat"/><br/><sub>Flash-Lite<br/>50M tokens/day 🔥</sub></td>
+    <td align="center" width="150"><img src="./public/providers/agentrouter.png" width="44" alt="AgentRouter"/><br/><b>AgentRouter</b><br/><sub>GPT-5, Claude, Gemini<br/>$100 free credits</sub></td>
+    <td align="center" width="150"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/qoder-color.svg" width="44" alt="Qoder AI"/><br/><b>Qoder AI</b><br/><sub>Kimi-K2, DeepSeek-R1<br/>Unlimited FREE</sub></td>
+    <td align="center" width="150"><picture><source media="(prefers-color-scheme:dark)" srcset="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-png@1.91.0/dark/pollinations.png"/><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/pollinations.svg" width="44" alt="Pollinations"/></picture><br/><b>Pollinations</b><br/><sub>GPT-5, Claude, Llama 4<br/>No key needed</sub></td>
+    <td align="center" width="150"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/longcat-color.svg" width="44" alt="LongCat"/><br/><b>LongCat</b><br/><sub>LongCat-2.0<br/>10M tokens one-time (KYC) 🔑</sub></td>
   </tr>
   <tr>
-    <td align="center" width="150"><img src="https://img.shields.io/badge/Cloudflare_AI-F38020?style=flat-square&logo=cloudflare&logoColor=white" alt="Cloudflare AI"/><br/><sub>50+ models<br/>10K neurons/day</sub></td>
-    <td align="center" width="150"><img src="https://img.shields.io/badge/Gemini_CLI-8E75B2?style=flat-square&logo=googlegemini&logoColor=white" alt="Gemini CLI"/><br/><sub>gemini-3-flash<br/>180K/mo free</sub></td>
-    <td align="center" width="150"><img src="https://img.shields.io/badge/NVIDIA_NIM-76B900?style=flat-square&logo=nvidia&logoColor=white" alt="NVIDIA NIM"/><br/><sub>129 models<br/>~40 RPM free</sub></td>
-    <td align="center" width="150"><img src="https://img.shields.io/badge/Cerebras-F15A29?style=flat-square" alt="Cerebras"/><br/><sub>Qwen3 235B<br/>1M tokens/day</sub></td>
+    <td align="center" width="150"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/cloudflare-color.svg" width="44" alt="Cloudflare AI"/><br/><b>Cloudflare AI</b><br/><sub>50+ models<br/>10K neurons/day</sub></td>
+    <td align="center" width="150"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/nvidia-color.svg" width="44" alt="NVIDIA NIM"/><br/><b>NVIDIA NIM</b><br/><sub>129 models<br/>~40 RPM free</sub></td>
+    <td align="center" width="150"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/cerebras-color.svg" width="44" alt="Cerebras"/><br/><b>Cerebras</b><br/><sub>Qwen3 235B<br/>1M tokens/day</sub></td>
   </tr>
 </table>
 
@@ -383,16 +465,16 @@ Result: 4 layers of fallback = zero downtime
 
 > Same app, your machine, your rules. From a global npm install to **your phone** via Termux.
 
-| Platform                  | Install                                      | Highlights                                                |
-| ------------------------- | -------------------------------------------- | --------------------------------------------------------- |
-| 📦 **npm (global)**       | `npm install -g omniroute`                   | One command, any OS                                       |
-| 🐳 **Docker**             | `docker run … diegosouzapw/omniroute`        | Multi-arch **AMD64 + ARM64**                              |
-| 🖥️ **Desktop (Electron)** | `npm run electron:build`                     | Native window + system tray — **Windows / macOS / Linux** |
-| 💪 **ARM**                | native `arm64`                               | Raspberry Pi, ARM servers, Apple Silicon                  |
-| 📱 **Android (Termux)**   | `pkg install nodejs-lts && npx -y omniroute` | Runs **on your phone**, 24/7, no root                     |
-| 📲 **PWA**                | "Add to Home Screen"                         | Fullscreen, offline, installable from browser             |
-| 🧩 **OpenCode plugin**    | `@omniroute/opencode-provider`               | Native OpenCode integration                               |
-| 🛠️ **From source**        | `npm install && npm run dev`                 | Hack on it, contribute                                    |
+| Platform                  | Install                                  | Highlights                                                |
+| ------------------------- | ---------------------------------------- | --------------------------------------------------------- |
+| 📦 **npm (global)**       | `npm install -g omniroute`               | One command, any OS                                       |
+| 🐳 **Docker**             | `docker run … diegosouzapw/omniroute`    | Multi-arch **AMD64 + ARM64**                              |
+| 🖥️ **Desktop (Electron)** | `npm run electron:build`                 | Native window + system tray — **Windows / macOS / Linux** |
+| 💪 **ARM**                | native `arm64`                           | Raspberry Pi, ARM servers, Apple Silicon                  |
+| 📱 **Android (Termux)**   | `pkg install nodejs && npx -y omniroute` | Runs **on your phone**, 24/7, no root                     |
+| 📲 **PWA**                | "Add to Home Screen"                     | Fullscreen, offline, installable from browser             |
+| 🧩 **OpenCode plugin**    | `@omniroute/opencode-provider`           | Native OpenCode integration                               |
+| 🛠️ **From source**        | `npm install && npm run dev`             | Hack on it, contribute                                    |
 
 <sub>📖 [Docker Guide](docs/guides/DOCKER_GUIDE.md) · [Desktop](electron/README.md) · [Termux](docs/guides/TERMUX_GUIDE.md) · [PWA](docs/guides/PWA_GUIDE.md) · [OpenCode](docs/frameworks/OPENCODE.md)</sub>
 
@@ -422,7 +504,7 @@ Result: 4 layers of fallback = zero downtime
 
 </div>
 
-> OmniRoute isn't just a server — it's a **full command-line cockpit** with **60+ commands**, plus open agent protocols so an AI agent can drive OmniRoute **by itself**.
+> OmniRoute isn't just a server — it's a **full command-line cockpit** with **80+ commands**, plus open agent protocols so an AI agent can drive OmniRoute **by itself**.
 
 ### ⌨️ A real CLI (not just `start`)
 
@@ -462,7 +544,7 @@ Expose OmniRoute over **MCP** or **A2A** and any capable agent gets the keys to
 | Protocol           | Endpoint                                        | Use it for                                             |
 | ------------------ | ----------------------------------------------- | ------------------------------------------------------ |
 | 🧰 **MCP (stdio)** | `omniroute --mcp`                               | Plug into Claude Desktop, Cursor, any MCP client       |
-| 🌊 **MCP (HTTP)**  | `http://localhost:20128/api/mcp/stream`         | Remote MCP — **87 tools**, 30 scopes, full audit trail |
+| 🌊 **MCP (HTTP)**  | `http://localhost:20128/api/mcp/stream`         | Remote MCP — **94 tools**, 30 scopes, full audit trail |
 | 📡 **MCP (SSE)**   | `http://localhost:20128/api/mcp/sse`            | Streaming MCP transport                                |
 | 🤝 **A2A**         | `http://localhost:20128/.well-known/agent.json` | Agent-to-agent, **JSON-RPC 2.0** + SSE, 6 skills       |
 
@@ -481,9 +563,9 @@ claude mcp add-server omniroute --type http --url http://localhost:20128/api/mcp
 
 </div>
 
-> **Why use many token when few token do trick?** Every request passes through OmniRoute's compression pipeline **transparently** — no client changes. It's now a **stack of 9 composable engines** that run in order and mix & match per routing combo — building on ideas from [RTK](https://github.com/rtk-ai/rtk), [Caveman](https://github.com/JuliusBrussee/caveman) (⭐ 51K+), [LLMLingua-2](https://github.com/microsoft/LLMLingua), and [Troglodita](https://github.com/leninejunior/troglodita) (PT-BR).
+> **Why use many tokens when few tokens do the trick?** Every request passes through OmniRoute's compression pipeline **transparently** — no client changes. It's now a **stack of 10 composable engines** that run in order and mix & match per routing combo — building on ideas from [RTK](https://github.com/rtk-ai/rtk), [Caveman](https://github.com/JuliusBrussee/caveman) (⭐ 78K+), [LLMLingua-2](https://github.com/microsoft/LLMLingua), and [Troglodita](https://github.com/leninejunior/troglodita) (PT-BR).
 
-### 🧱 The 9-engine stack
+### 🧱 The 10-engine stack
 
 Engines run in pipeline order; each is independently toggleable and configurable per combo:
 
@@ -492,12 +574,13 @@ Engines run in pipeline order; each is independently toggleable and configurable
 | 1   | **Session-Dedup** | Drops content repeated across turns (content-addressed, cross-turn) |
 | 2   | **CCR**           | Archives large blocks behind retrieve markers, fetched on demand    |
 | 3   | **RTK**           | Smart tool-result filtering, dedup & truncation (command-aware)     |
-| 4   | **Headroom**      | Lossless tabular compaction of homogeneous JSON arrays (~30%+)      |
-| 5   | **Caveman**       | Rule-based prose compression (~65–75% on output)                    |
-| 6   | **LLMLingua-2**   | ML semantic pruning via MobileBERT ONNX — code-safe, async          |
-| 7   | **Lite**          | Whitespace + image-URL trimming (latency-light baseline)            |
-| 8   | **Aggressive**    | Summarization + progressive aging of old turns                      |
-| 9   | **Ultra**         | Heuristic token pruning with an optional small-model (SLM) tier     |
+| 4   | **Headroom**      | Lossless tabular compaction of homogeneous JSON arrays, flat or nested (~30%), via a vendored **GCF** codec (spec v3.2) |
+| 5   | **Relevance**     | Extractive sentence scoring against the last user query             |
+| 6   | **Caveman**       | Rule-based prose compression (~65–75% on output)                    |
+| 7   | **LLMLingua-2**   | ML semantic pruning via MobileBERT ONNX — code-safe, async          |
+| 8   | **Lite**          | Whitespace + image-URL trimming (latency-light baseline)            |
+| 9   | **Aggressive**    | Summarization + progressive aging of old turns                      |
+| 10  | **Ultra**         | Heuristic token pruning with an optional small-model (SLM) tier     |
 
 Code blocks, URLs and structured data are **always preserved** byte-perfect. **One-click presets** combine the engines:
 
@@ -531,7 +614,7 @@ Code blocks, URLs and structured data are **always preserved** byte-perfect. **O
 ### 📖 How it works — pipeline, architecture & savings math
 
 ```
-Client (10,000 tok) ──▶ OmniRoute Compression (9 engines) ──▶ Provider (~1,080 tok, up to 95% saved)
+Client (10,000 tok) ──▶ OmniRoute Compression (10 engines) ──▶ Provider (~1,080 tok, up to 95% saved)
 ```
 
 Default stacked combo runs `RTK → Caveman`. When both act on the same tool/context payload, savings compound:
@@ -546,7 +629,7 @@ Code blocks, URLs, JSON and structured data are **always protected** by the pres
 
 ### 🎚️ Beyond the engines — output styles, the adaptive dial & per-request control
 
-The 9 engines above shrink what goes **in**. Three more layers shape **how**, **when**, and what comes **out**:
+The 10 engines above shrink what goes **in**. Three more layers shape **how**, **when**, and what comes **out**:
 
 - **🪄 Output Styles** _(output-axis steering)_ — inject deterministic, cache-safe response-shaping instructions; combinable, each at `lite` / `full` / `ultra` intensity. Adding a style is a one-line registry entry:
   - **Terse prose** — drop filler / articles / hedging; keep technical substance exact.
@@ -630,7 +713,7 @@ PORT=20128 npm run dev
 **📦 pnpm**
 
 ```bash
-pnpm install -g omniroute && pnpm approve-builds -g && omniroute
+pnpm add -g omniroute@latest --allow-build=better-sqlite3 --allow-build=@swc/core && omniroute
 ```
 
 **🐧 Arch Linux (AUR)**
@@ -668,6 +751,24 @@ podman compose --profile base up -d
 
 📖 [Podman Guide](contrib/podman/README.md) — Quadlet setup, podman-compose, Quadlet.
 
+**⚡ Faster / leaner install (skip the native build)**
+
+The native SQLite engine (`better-sqlite3`) is an **optional** dependency, so a global
+install never blocks on compiling from source: it uses a prebuilt binary when one matches
+your platform/Node, and otherwise falls back transparently to a pure-JS engine
+(`node:sqlite` on Node 22+, else the bundled `sql.js` WASM) — no build tools required.
+
+To skip the post-install native warm-up entirely (CI, headless, or slow machines):
+
+```bash
+OMNIROUTE_SKIP_POSTINSTALL=1 npm install -g omniroute   # CI=1 also skips it
+```
+
+For the fastest installs prefer **pnpm** (content-addressed store + hard links — see above).
+For a dashboard-free, headless runtime use the Docker `base` profile (above) or the
+[Termux guide](docs/guides/TERMUX_GUIDE.md). The CLI and the web dashboard are served by the
+same process on one port, so there is no separate CLI-only package today.
+
 <br/>
 
 <div align="center">
@@ -722,16 +823,16 @@ podman compose --profile base up -d
 
 **The $0 Free Stack — combine into one unbreakable combo:**
 
-| Provider          | Prefix      | Free models                                     | Quota             |
-| ----------------- | ----------- | ----------------------------------------------- | ----------------- |
-| **Kiro**          | `kr/`       | Claude Sonnet 4.5, Haiku 4.5, Opus 4.6          | 50 credits/mo     |
-| **Qoder**         | `if/`       | kimi-k2-thinking, qwen3-coder-plus, deepseek-r1 | ♾️ Unlimited      |
-| **Qwen**          | `qw/`       | qwen3-coder-plus/flash/next                     | ♾️ Unlimited      |
-| **Pollinations**  | `pol/`      | GPT-5, Claude, Gemini, DeepSeek, Llama 4        | No key needed     |
-| **LongCat**       | `lc/`       | LongCat-Flash-Lite                              | 50M tokens/day 🔥 |
-| **Cloudflare AI** | `cf/`       | 50+ models                                      | 10K neurons/day   |
-| **NVIDIA NIM**    | `nvidia/`   | 129 models                                      | ~40 RPM           |
-| **Cerebras**      | `cerebras/` | Qwen3 235B, GPT-OSS 120B                        | 1M tok/day        |
+| Provider          | Prefix      | Free models                                     | Quota              |
+| ----------------- | ----------- | ----------------------------------------------- | ------------------ |
+| **Kiro**          | `kr/`       | Claude Sonnet 4.5, Haiku 4.5, Opus 4.6          | 50 credits/mo      |
+| **Qoder**         | `if/`       | kimi-k2-thinking, qwen3-coder-plus, deepseek-r1 | ♾️ Unlimited       |
+| **Qwen**          | `qw/`       | qwen3-coder-plus/flash/next                     | ♾️ Unlimited       |
+| **Pollinations**  | `pol/`      | GPT-5, Claude, Gemini, DeepSeek, Llama 4        | No key needed      |
+| **LongCat**       | `lc/`       | LongCat-2.0                                     | 10M one-time (KYC) |
+| **Cloudflare AI** | `cf/`       | 50+ models                                      | 10K neurons/day    |
+| **NVIDIA NIM**    | `nvidia/`   | 129 models                                      | ~40 RPM            |
+| **Cerebras**      | `cerebras/` | Qwen3 235B, GPT-OSS 120B                        | 1M tok/day         |
 
 > 💡 The dashboard "cost" is a **savings tracker**, not a bill — OmniRoute never charges you. A "$290 total cost" using free models means **$290 saved**.
 
@@ -750,7 +851,7 @@ podman compose --profile base up -d
 1. kr/claude-sonnet-4.5   (Kiro — ~50 credits/mo per acct)
 2. if/kimi-k2-thinking    (Qoder — unlimited)
 3. pol/gpt-5              (Pollinations — no key)
-4. lc/longcat-flash-lite  (50M tok/day backup)
+4. lc/LongCat-2.0         (10M one-time backup, KYC)
 Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
 ```
 
@@ -780,9 +881,9 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
 
 <br/>
 
-**Routing:** 15 strategies · task-aware smart routing · thinking budget controls · wildcard routing · system prompt injection.
+**Routing:** 18 strategies · task-aware smart routing · thinking budget controls · wildcard routing · system prompt injection.
 **Compatibility:** OpenAI ↔ Claude ↔ Gemini ↔ Responses API · auto OAuth refresh (PKCE, 8 providers) · multi-account round-robin · Batch + Files API · live OpenAPI 3.0.
-**Protocols:** MCP (87 tools, 3 transports, 30 scopes) · A2A (JSON-RPC 2.0, SSE, 6 skills) · ACP · cloud agents (Codex, Devin, Jules).
+**Protocols:** MCP (94 tools, 3 transports, 30 scopes) · A2A (JSON-RPC 2.0, SSE, 6 skills) · ACP · cloud agents (Codex, Cursor, Devin, Jules).
 **Plugins:** custom plugin marketplace (system-configured registry URL with SSRF-guarded fetch) · install / enable / disable · Notion + Obsidian knowledge-base integrations (WebDAV file server, vault search, note CRUD).
 **Embedded services:** one-click install & lifecycle management of local sidecar services (CLIProxy, NineRouter).
 **Quality & Ops:** built-in **Evals** (golden-set: exact/contains/regex/custom) · guardrails (PII, injection, vision) · health dashboard · p50/p95/p99 telemetry · webhooks · compliance audit.
@@ -806,7 +907,7 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
 **Will I be charged by OmniRoute?** No — it's free, open-source software on your machine. You only pay paid providers directly. OmniRoute has no billing system.
 **Are FREE providers really unlimited?** Mostly — Qoder, Pollinations, LongCat, and Cloudflare are free with no per-account credit cap. Kiro is free too but capped at ~50 credits/month per account. Stack multiple free providers in a combo and auto-fallback keeps you serving for $0.
 **Will compression hurt quality?** No — it only compresses the **input**; code, URLs, JSON are always protected.
-**Does it work where AI is blocked?** Yes — 3-level proxy + 1proxy marketplace reach all 231 providers.
+**Does it work where AI is blocked?** Yes — 3-level proxy + 1proxy marketplace reach all 250 providers.
 
 📖 [User Guide](docs/guides/USER_GUIDE.md) · [API Reference](docs/reference/API_REFERENCE.md) · [Environment Config](docs/reference/ENVIRONMENT.md)
 
@@ -876,7 +977,7 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
 - **Protocols**: MCP (stdio/HTTP) + A2A v0.3 (JSON-RPC 2.0 + SSE)
 - **Streaming**: Server-Sent Events (SSE) + WebSocket bridge (`/v1/ws`)
 - **Auth**: OAuth 2.0 (PKCE) + JWT + API Keys + MCP Scoped Authorization
-- **Testing**: Node.js test runner + Vitest (**14,965 test cases** across 517 files — unit, integration, E2E, security, ecosystem)
+- **Testing**: Node.js test runner + Vitest (**21,000+ test cases** across 2,586 files — unit, integration, E2E, security, ecosystem)
 - **Platforms**: Desktop (Electron), Android (Termux), PWA (any browser)
 - **CI/CD**: GitHub Actions (auto npm publish + Docker Hub on release)
 - **Website**: [omniroute.online](https://omniroute.online)
@@ -927,7 +1028,7 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
 | [Compression Rules Format](docs/compression/COMPRESSION_RULES_FORMAT.md)     | JSON rule-pack schemas for Caveman and RTK filters                            |
 | [Compression Language Packs](docs/compression/COMPRESSION_LANGUAGE_PACKS.md) | Language detection and Caveman rule-pack authoring                            |
 | [Resilience Guide](docs/architecture/RESILIENCE_GUIDE.md)                    | Circuit breakers, cooldowns, queue, anti-thundering herd, TLS spoofing        |
-| [Auto-Combo Engine](docs/routing/AUTO-COMBO.md)                              | 9-factor scoring, mode packs, self-healing                                    |
+| [Auto-Combo Engine](docs/routing/AUTO-COMBO.md)                              | 12-factor scoring, mode packs, self-healing                                    |
 | [Proxy Guide](docs/ops/PROXY_GUIDE.md)                                       | 3-level proxy system, 1proxy marketplace, registry CRUD                       |
 | [Free Tiers](docs/reference/FREE_TIERS.md)                                   | 25+ free API providers consolidated directory                                 |
 | [Features Gallery](docs/guides/FEATURES.md)                                  | Visual dashboard tour with screenshots                                        |
@@ -939,7 +1040,7 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
 | ------------------------------------------------- | --------------------------------------------------- |
 | [API Reference](docs/reference/API_REFERENCE.md)  | All endpoints with examples                         |
 | [OpenAPI Spec](docs/openapi.yaml)                 | OpenAPI 3.0 specification                           |
-| [MCP Server](open-sse/mcp-server/README.md)       | 87 MCP tools, IDE configs, Python/TS/Go clients     |
+| [MCP Server](open-sse/mcp-server/README.md)       | 95 MCP tools, IDE configs, Python/TS/Go clients     |
 | [MCP Server Guide](docs/frameworks/MCP-SERVER.md) | MCP installation, transports, and tool reference    |
 | [A2A Server](src/lib/a2a/README.md)               | JSON-RPC 2.0 protocol, skills, streaming, task mgmt |
 | [A2A Server Guide](docs/frameworks/A2A-SERVER.md) | A2A agent card, tasks, skills, and streaming        |
@@ -953,7 +1054,7 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
 | [Security Policy](SECURITY.md)                     | Vulnerability reporting and security practices  |
 | [i18n Guide](docs/guides/I18N.md)                  | 40+ language support, translation workflow, RTL |
 | [Release Checklist](docs/ops/RELEASE_CHECKLIST.md) | Pre-release validation steps                    |
-| [Coverage Plan](docs/ops/COVERAGE_PLAN.md)         | Test coverage strategy and 14,965 test suite    |
+| [Coverage Plan](docs/ops/COVERAGE_PLAN.md)         | Test coverage strategy and 21,000+ test suite   |
 
 <br/>
 
@@ -967,23 +1068,23 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
   <tr>
     <td align="center" width="160">
       <a href="https://github.com/oyi77">
-        <img src="https://github.com/oyi77.png" width="80" style="border-radius:50%" alt="oyi77"/><br/>
+        <img src="https://github.com/oyi77.png" width="40" style="border-radius:50%" alt="oyi77"/><br/>
         <b>oyi77</b>
       </a><br/>
-      <sub>🥇 190 commits • +72K lines</sub><br/>
+      <sub>🥇 189 commits • +155K lines</sub><br/>
       <sub>Analytics engine, SQL aggregations,<br/>proxy marketplace, test coverage</sub>
     </td>
     <td align="center" width="160">
       <a href="https://github.com/christopher-s">
-        <img src="https://github.com/christopher-s.png" width="80" style="border-radius:50%" alt="Chris Staley"/><br/>
+        <img src="https://github.com/christopher-s.png" width="40" style="border-radius:50%" alt="Chris Staley"/><br/>
         <b>Chris Staley</b>
       </a><br/>
-      <sub>🥈 72 commits • +5.7K lines</sub><br/>
+      <sub>🥈 70 commits • +5.7K lines</sub><br/>
       <sub>SSE stream hardening, Responses API,<br/>Gemini pagination, test regression fixes</sub>
     </td>
     <td align="center" width="160">
       <a href="https://github.com/zenobit">
-        <img src="https://github.com/zenobit.png" width="80" style="border-radius:50%" alt="zenobit"/><br/>
+        <img src="https://github.com/zenobit.png" width="40" style="border-radius:50%" alt="zenobit"/><br/>
         <b>zenobit</b>
       </a><br/>
       <sub>🥉 62 commits • +24K lines</sub><br/>
@@ -991,20 +1092,28 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
     </td>
     <td align="center" width="160">
       <a href="https://github.com/rdself">
-        <img src="https://github.com/rdself.png" width="80" style="border-radius:50%" alt="R.D. & Randi"/><br/>
+        <img src="https://github.com/rdself.png" width="40" style="border-radius:50%" alt="R.D. & Randi"/><br/>
         <b>R.D. & Randi</b>
       </a><br/>
-      <sub>🏅 107 commits • +28K lines</sub><br/>
+      <sub>🏅 108 commits • +30K lines</sub><br/>
       <sub>Endpoints page, tunnel integrations,<br/>Docker workflows, A2A status, compression UI</sub>
     </td>
     <td align="center" width="160">
       <a href="https://github.com/benzntech">
-        <img src="https://github.com/benzntech.png" width="80" style="border-radius:50%" alt="benzntech"/><br/>
+        <img src="https://github.com/benzntech.png" width="40" style="border-radius:50%" alt="benzntech"/><br/>
         <b>benzntech</b>
       </a><br/>
-      <sub>🏅 20 commits • +7.5K lines</sub><br/>
+      <sub>🏅 22 commits • +7.5K lines</sub><br/>
       <sub>Electron desktop app, auto-updater,<br/>release build workflows, cross-platform CI</sub>
     </td>
+    <td align="center" width="160">
+      <a href="https://github.com/herjarsa">
+        <img src="https://github.com/herjarsa.png" width="40" style="border-radius:50%" alt="herjarsa"/><br/>
+        <b>herjarsa</b>
+      </a><br/>
+      <sub>🏅 21 commits • +6K lines</sub><br/>
+      <sub>Zero-latency combos, vision-bridge auto-routing,<br/>catalog context-length, resilience 429 hints</sub>
+    </td>
   </tr>
 </table>
 
@@ -1018,11 +1127,11 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
 
 <div align="center">
 
-## 👥 Contributors
+## 👥 280+ Contributors
 
 </div>
 
-[![Contributors](https://contrib.rocks/image?repo=diegosouzapw/OmniRoute&max=100&columns=20&anon=1)](https://github.com/diegosouzapw/OmniRoute/graphs/contributors)
+[![Contributors](https://contrib.rocks/image?repo=diegosouzapw/OmniRoute&max=200&columns=20&anon=1)](https://github.com/diegosouzapw/OmniRoute/graphs/contributors)
 
 ### How to Contribute
 
@@ -1047,14 +1156,13 @@ gh release create v3.8.2 --title "v3.8.2" --generate-notes
 
 ## 📊 Stars
 
-<a href="https://www.star-history.com/?repos=diegosouzapw%2Fomniroute&type=date&legend=top-left">
+<a href="https://www.star-history.com/?repos=diegosouzapw%2FOmniRoute&type=date&legend=top-left">
  <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=diegosouzapw/omniroute&type=date&theme=dark&legend=top-left" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=diegosouzapw/omniroute&type=date&legend=top-left" />
-   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=diegosouzapw/omniroute&type=date&legend=top-left" />
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=diegosouzapw/OmniRoute&type=date&theme=dark&legend=top-left&sealed_token=XP_ycEjv7s31p1edvhsMOXry51OWYsUjDRWjflSG7jQKRpO9hPGg7i_EHvwhI6QtrARTMH-YGjJhi8sumRYflEJD0DPlH_MMHjizhBYCX8fbHFrHEiNvVA" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=diegosouzapw/OmniRoute&type=date&legend=top-left&sealed_token=XP_ycEjv7s31p1edvhsMOXry51OWYsUjDRWjflSG7jQKRpO9hPGg7i_EHvwhI6QtrARTMH-YGjJhi8sumRYflEJD0DPlH_MMHjizhBYCX8fbHFrHEiNvVA" />
+   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=diegosouzapw/OmniRoute&type=date&legend=top-left&sealed_token=XP_ycEjv7s31p1edvhsMOXry51OWYsUjDRWjflSG7jQKRpO9hPGg7i_EHvwhI6QtrARTMH-YGjJhi8sumRYflEJD0DPlH_MMHjizhBYCX8fbHFrHEiNvVA" />
  </picture>
 </a>
-</div>
 
 <br/>
 
@@ -1087,36 +1195,36 @@ OmniRoute stands on the shoulders of giants. It started as a fork of **[9router]
 
 | Project                                                                         |    ⭐ | How it inspired OmniRoute                                                                                                             |
 | ------------------------------------------------------------------------------- | ----: | ------------------------------------------------------------------------------------------------------------------------------------- |
-| **[9router](https://github.com/decolua/9router)** · decolua                     | 17.9k | The original project this fork is built on — extended here with multi-modal APIs and a full TypeScript rewrite.                       |
-| **[CLIProxyAPI](https://github.com/router-for-me/CLIProxyAPI)** · router-for-me | 37.8k | The Go implementation that inspired this JavaScript / TypeScript port.                                                                |
-| **[LiteLLM](https://github.com/BerriAI/litellm)** · BerriAI                     | 50.8k | The AI gateway whose public pricing dataset feeds our cost-tracking sync and whose provider-normalization model informed our routing. |
+| **[9router](https://github.com/decolua/9router)** · decolua                     | 19.0k | The original project this fork is built on — extended here with multi-modal APIs and a full TypeScript rewrite.                       |
+| **[CLIProxyAPI](https://github.com/router-for-me/CLIProxyAPI)** · router-for-me | 38.8k | The Go implementation that inspired this JavaScript / TypeScript port.                                                                |
+| **[LiteLLM](https://github.com/BerriAI/litellm)** · BerriAI                     | 52.1k | The AI gateway whose public pricing dataset feeds our cost-tracking sync and whose provider-normalization model informed our routing. |
 
 ### 🗜️ Context & token compression — engines
 
-| Project                                                                      |    ⭐ | How it inspired OmniRoute                                                                                                                                                                                |
-| ---------------------------------------------------------------------------- | ----: | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **[Caveman](https://github.com/JuliusBrussee/caveman)** · JuliusBrussee      | 74.5k | The viral "why use many token when few token do trick" project — its caveman-speak philosophy powers our standard compression mode and 30+ filler/condensation rules.                                    |
-| **[RTK – Rust Token Killer](https://github.com/rtk-ai/rtk)** · rtk-ai        | 63.6k | High-performance command-output compression — inspired our RTK engine, JSON filter DSL, raw-output recovery and the stacked RTK → Caveman pipeline.                                                      |
-| **[headroom](https://github.com/chopratejas/headroom)** · chopratejas        | 33.6k | Reversible context-compression (SmartCrusher) — inspired our `headroom` engine and the `ccr` retrieve-marker pattern.                                                                                    |
-| **[LLMLingua](https://github.com/microsoft/LLMLingua)** · Microsoft          |  6.3k | Prompt-compression research (LLMLingua / LLMLingua-2) — inspired our async, code-safe, fail-open `llmlingua` engine.                                                                                     |
-| **[llmlingua-2-js](https://github.com/atjsh/llmlingua-2-js)** · atjsh        |    27 | The JS/ONNX port (MobileBERT / XLM-RoBERTa) used as the worker-thread backend for our LLMLingua engine.                                                                                                  |
-| **[Troglodita](https://github.com/leninejunior/troglodita)** · Lenine Júnior |    15 | PT-BR token compression — powers our pt-BR language pack: pleonasm reduction and filler removal tuned for Brazilian-Portuguese grammar.                                                                  |
-| **[ponytail](https://github.com/DietrichGebert/ponytail)** · DietrichGebert  | 51.4k | The viral "lazy senior dev" YAGNI-coder skill — inspired our **less-code** Output Style: smallest-working-change steering that cuts _generated_ code (the output-axis sibling to Caveman's terse prose). |
+| Project                                                                       |    ⭐ | How it inspired OmniRoute                                                                                                                                                                                |
+| ----------------------------------------------------------------------------- | ----: | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **[Caveman](https://github.com/JuliusBrussee/caveman)** · JuliusBrussee       | 78.2k | The viral "why use many token when few token do trick" project — its caveman-speak philosophy powers our standard compression mode and 30+ filler/condensation rules.                                    |
+| **[RTK – Rust Token Killer](https://github.com/rtk-ai/rtk)** · rtk-ai         | 67.3k | High-performance command-output compression — inspired our RTK engine, JSON filter DSL, raw-output recovery and the stacked RTK → Caveman pipeline.                                                      |
+| **[headroom](https://github.com/headroomlabs-ai/headroom)** · headroomlabs-ai | 54.5k | Reversible context-compression (SmartCrusher) — inspired our `headroom` engine and the `ccr` retrieve-marker pattern.                                                                                    |
+| **[LLMLingua](https://github.com/microsoft/LLMLingua)** · Microsoft           |  6.4k | Prompt-compression research (LLMLingua / LLMLingua-2) — inspired our async, code-safe, fail-open `llmlingua` engine.                                                                                     |
+| **[llmlingua-2-js](https://github.com/atjsh/llmlingua-2-js)** · atjsh         |    28 | The JS/ONNX port (MobileBERT / XLM-RoBERTa) used as the worker-thread backend for our LLMLingua engine.                                                                                                  |
+| **[Troglodita](https://github.com/leninejunior/troglodita)** · Lenine Júnior  |    16 | PT-BR token compression — powers our pt-BR language pack: pleonasm reduction and filler removal tuned for Brazilian-Portuguese grammar.                                                                  |
+| **[ponytail](https://github.com/DietrichGebert/ponytail)** · DietrichGebert   | 68.8k | The viral "lazy senior dev" YAGNI-coder skill — inspired our **less-code** Output Style: smallest-working-change steering that cuts _generated_ code (the output-axis sibling to Caveman's terse prose). |
 
 ### 🧩 Compact formats, token research & code-aware tooling
 
 | Project                                                                                        |    ⭐ | How it inspired OmniRoute                                                                                                                                                                                      |
 | ---------------------------------------------------------------------------------------------- | ----: | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **[TOON](https://github.com/toon-format/toon)** · toon-format                                  | 24.6k | Token-Oriented Object Notation — its columnar, header-plus-rows model shaped our tabular compaction stage.                                                                                                     |
-| **[GCF – Graph Compact Format](https://github.com/blackwell-systems/gcf)** · Blackwell Systems |    11 | Schema-aware "JSON for LLMs" notation — co-inspired our lossless homogeneous-array compaction with `[N rows]` markers.                                                                                         |
-| **[token-optimizer-mcp](https://github.com/ooples/token-optimizer-mcp)** · ooples              |   409 | Brotli/SQLite cache + per-session context-delta — inspired our `session-dedup` engine.                                                                                                                         |
-| **[token-savior](https://github.com/Mibayy/token-savior)** · Mibayy                            |   993 | Bash-output compaction + MCP profiles — inspired our compression bail-out discipline and MCP tool-manifest reduction.                                                                                          |
-| **[token-saver](https://github.com/ppgranger/token-saver)** · ppgranger                        |   103 | Content-aware, per-file-type output compression with failure-aware bail-out — validated our per-type dispatch and minimum-gain skip.                                                                           |
-| **[token-optimizer](https://github.com/alexgreensh/token-optimizer)** · alexgreensh            |  1.4k | "Find the ghost tokens" — its offload + recoverable-handle pattern informed our CCR offload thinking.                                                                                                          |
-| **[TokenMizer](https://github.com/Shweta-Mishra-ai/tokenmizer)** · Shweta-Mishra-ai            |     1 | A session-graph + cross-turn line-dedup blueprint that informed our session-dedup design.                                                                                                                      |
+| **[TOON](https://github.com/toon-format/toon)** · toon-format                                  | 24.7k | Token-Oriented Object Notation — its columnar, header-plus-rows model shaped our tabular compaction stage.                                                                                                     |
+| **[GCF – Graph Compact Format](https://github.com/blackwell-systems/gcf)** · Blackwell Systems |    14 | First inspired our tabular compaction stage; now its zero-dependency, lossless generic-profile encoder is **vendored directly** as the Headroom codec (MIT, SPDX-marked), current with GCF spec v3.2. |
+| **[token-optimizer-mcp](https://github.com/ooples/token-optimizer-mcp)** · ooples              |   421 | Brotli/SQLite cache + per-session context-delta — inspired our `session-dedup` engine.                                                                                                                         |
+| **[token-savior](https://github.com/Mibayy/token-savior)** · Mibayy                            |  1.0k | Bash-output compaction + MCP profiles — inspired our compression bail-out discipline and MCP tool-manifest reduction.                                                                                          |
+| **[token-saver](https://github.com/ppgranger/token-saver)** · ppgranger                        |   110 | Content-aware, per-file-type output compression with failure-aware bail-out — validated our per-type dispatch and minimum-gain skip.                                                                           |
+| **[token-optimizer](https://github.com/alexgreensh/token-optimizer)** · alexgreensh            |  1.5k | "Find the ghost tokens" — its offload + recoverable-handle pattern informed our CCR offload thinking.                                                                                                          |
+| **[TokenMizer](https://github.com/Shweta-Mishra-ai/tokenmizer)** · Shweta-Mishra-ai            |     2 | A session-graph + cross-turn line-dedup blueprint that informed our session-dedup design.                                                                                                                      |
 | **[OmniCompress](https://github.com/jessefreitas/OmniCompress)** · jessefreitas                |     2 | Rust columnar-JSON + content-addressed retrieve + cross-message dedup — validated our `headroom`/`ccr`/`session-dedup` engine design and the cache-stable "compressed form is position-independent" invariant. |
-| **[mcp-compressor](https://github.com/atlassian-labs/mcp-compressor)** · Atlassian Labs        |    80 | MCP tool-schema/description compression — informed our MCP tool-manifest cardinality reduction.                                                                                                                |
-| **[RepoMapper](https://github.com/pdavis68/RepoMapper)** · pdavis68                            |   182 | Aider-style repo-map ranking — informed our repo-map / retrieval-ranking exploration.                                                                                                                          |
+| **[mcp-compressor](https://github.com/atlassian-labs/mcp-compressor)** · Atlassian Labs        |    89 | MCP tool-schema/description compression — informed our MCP tool-manifest cardinality reduction.                                                                                                                |
+| **[RepoMapper](https://github.com/pdavis68/RepoMapper)** · pdavis68                            |   181 | Aider-style repo-map ranking — informed our repo-map / retrieval-ranking exploration.                                                                                                                          |
 | **[quiet-shell-mcp](https://github.com/mrsimpson/quiet-shell-mcp)** · mrsimpson                |     4 | Declarative shell-output reduction over MCP — validated our declarative bash-output compaction.                                                                                                                |
 | **[ts-morph](https://github.com/dsherret/ts-morph)** · David Sherret                           |  6.1k | TypeScript Compiler API toolkit — inspired our parser-based comment removal that preserves string, template and regex literals.                                                                                |
 
@@ -1124,27 +1232,27 @@ OmniRoute stands on the shoulders of giants. It started as a fork of **[9router]
 
 | Project                                                            |    ⭐ | How it inspired OmniRoute                                                                                           |
 | ------------------------------------------------------------------ | ----: | ------------------------------------------------------------------------------------------------------------------- |
-| **[Mem0](https://github.com/mem0ai/mem0)** · mem0ai                | 58.9k | Universal memory layer — its proxy-as-write/read-boundary model shaped our memory architecture.                     |
-| **[Letta (MemGPT)](https://github.com/letta-ai/letta)** · letta-ai | 23.4k | Stateful agents with tiered memory — inspired our Context Control & Recovery (CCR) tiered model.                    |
+| **[Mem0](https://github.com/mem0ai/mem0)** · mem0ai                | 59.8k | Universal memory layer — its proxy-as-write/read-boundary model shaped our memory architecture.                     |
+| **[Letta (MemGPT)](https://github.com/letta-ai/letta)** · letta-ai | 23.6k | Stateful agents with tiered memory — inspired our Context Control & Recovery (CCR) tiered model.                    |
 | **[WFGY](https://github.com/onestardao/WFGY)** · onestardao        |  1.8k | The ProblemMap taxonomy of 16 recurring RAG/LLM failure modes — the shared vocabulary in our troubleshooting guide. |
 
 ### 🛰️ Traffic inspection, MITM & transparent proxy
 
 | Project                                                                           |   ⭐ | How it inspired OmniRoute                                                                                                                                                        |
 | --------------------------------------------------------------------------------- | ---: | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **[llm-interceptor](https://github.com/chouzz/llm-interceptor)** · chouzz         |   46 | MITM interception/analysis of coding-assistant ↔ LLM traffic — our Traffic Inspector ports its SSE merge, conversation normalization, host passthrough and secret masking (MIT). |
-| **[ProxyBridge](https://github.com/InterceptSuite/ProxyBridge)** · InterceptSuite | 5.1k | Transparent per-process proxy routing — inspired our crash-safe MITM teardown, socket idle-timeouts, `/proc` process attribution and TPROXY capture.                             |
+| **[llm-interceptor](https://github.com/chouzz/llm-interceptor)** · chouzz         |   48 | MITM interception/analysis of coding-assistant ↔ LLM traffic — our Traffic Inspector ports its SSE merge, conversation normalization, host passthrough and secret masking (MIT). |
+| **[ProxyBridge](https://github.com/InterceptSuite/ProxyBridge)** · InterceptSuite | 5.3k | Transparent per-process proxy routing — inspired our crash-safe MITM teardown, socket idle-timeouts, `/proc` process attribution and TPROXY capture.                             |
 
 ### 📚 Model data, observability & UI
 
 | Project                                                                    |    ⭐ | How it inspired OmniRoute                                                                                                  |
 | -------------------------------------------------------------------------- | ----: | -------------------------------------------------------------------------------------------------------------------------- |
-| **[models.dev](https://github.com/anomalyco/models.dev)** · SST / OpenCode |  5.1k | Open database of AI model specs, pricing and capabilities — synced natively into our model catalog.                        |
-| **[React Flow / xyflow](https://github.com/xyflow/xyflow)** · xyflow       | 37.1k | The node-based graph library powering our real-time Compression Studio and Combo/Routing Studio.                           |
-| **[LangGraph](https://github.com/langchain-ai/langgraph)** · LangChain     | 35.1k | LangGraph Studio's live workflow-graph visualization inspired our Studios' real-time cascade view.                         |
-| **[Langfuse](https://github.com/langfuse/langfuse)** · Langfuse            | 29.3k | Its trace → span → generation observability model shaped our Compression Studio waterfall.                                 |
+| **[models.dev](https://github.com/anomalyco/models.dev)** · SST / OpenCode |  5.6k | Open database of AI model specs, pricing and capabilities — synced natively into our model catalog.                        |
+| **[React Flow / xyflow](https://github.com/xyflow/xyflow)** · xyflow       | 37.4k | The node-based graph library powering our real-time Compression Studio and Combo/Routing Studio.                           |
+| **[LangGraph](https://github.com/langchain-ai/langgraph)** · LangChain     | 36.1k | LangGraph Studio's live workflow-graph visualization inspired our Studios' real-time cascade view.                         |
+| **[Langfuse](https://github.com/langfuse/langfuse)** · Langfuse            | 30.1k | Its trace → span → generation observability model shaped our Compression Studio waterfall.                                 |
 | **[Kiali](https://github.com/kiali/kiali)** · Kiali                        |  3.6k | Istio service-mesh observability — inspired our circuit-breaker badges and error-edge visuals in the Routing/Combo Studio. |
-| **[lobe-icons](https://github.com/lobehub/lobe-icons)** · LobeHub          |  2.1k | AI/LLM brand logos that render the provider icons across our dashboard.                                                    |
+| **[lobe-icons](https://github.com/lobehub/lobe-icons)** · LobeHub          |  2.2k | AI/LLM brand logos that render the provider icons across our dashboard.                                                    |
 
 ### 🛡️ Security
 
@@ -1152,6 +1260,12 @@ OmniRoute stands on the shoulders of giants. It started as a fork of **[9router]
 | ------------------------------------------------------------------------------------------- | --: | ------------------------------------------------------------------------------------------------------------------------------------------------ |
 | **[awesome-secure-defaults](https://github.com/tldrsec/awesome-secure-defaults)** · tldrsec | 708 | A curated list of secure-by-default libraries that guides our security choices (Helmet.js, DOMPurify, ssrf-req-filter, safe-regex, Google Tink). |
 
+### 🧭 Complementary tools
+
+| Project                                                                       | How it composes with OmniRoute                                                                                                                                                                             |
+| ----------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **[CodeWebChat](https://github.com/robertpiosik/CodeWebChat)** · robertpiosik | Editor-side companion — VS Code + browser extension that autofills 15+ chatbot web UIs with editor context. Owns the free-web-UI rail alongside OmniRoute's API rail; can point its API mode at OmniRoute. |
+
 ## ❤️ Support
 
 OmniRoute is free and open source, built and maintained in the open. If it saves you time or money, consider supporting development:
@@ -1170,7 +1284,7 @@ MIT License - see [LICENSE](LICENSE) for details.
 
 **[⬆ Back to top](#-omniroute)** · Built with ❤️ for the open-source AI community.
 
-<sub>OmniRoute v3.8.24 · Node ≥22.0.0 · MIT License · <a href="https://omniroute.online">omniroute.online</a></sub>
+<sub>OmniRoute v3.8.43 · Node ≥22.0.0 · MIT License · <a href="https://omniroute.online">omniroute.online</a></sub>
 
 </div>
 <!-- GitHub Discussions enabled for community Q&A -->

SECURITY.md

@@ -113,14 +113,14 @@ PII_REDACTION_ENABLED=true
 
 ### 🌐 Network Security
 
-| Feature                  | Description                                                      |
-| ------------------------ | ---------------------------------------------------------------- |
-| **CORS**                 | Configurable origin control (`CORS_ORIGIN` env var, default `*`) |
-| **IP Filtering**         | Allowlist/blocklist IP ranges in dashboard                       |
-| **Rate Limiting**        | Per-provider rate limits with automatic backoff                  |
-| **Anti-Thundering Herd** | Mutex + per-connection locking prevents cascading 502s           |
-| **TLS Fingerprint**      | Browser-like TLS fingerprint spoofing to reduce bot detection    |
-| **CLI Fingerprint**      | Per-provider header/body ordering to match native CLI signatures |
+| Feature                  | Description                                                                    |
+| ------------------------ | ------------------------------------------------------------------------------ |
+| **CORS**                 | Explicit cross-origin allowlist (`CORS_ALLOWED_ORIGINS`; legacy `CORS_ORIGIN`) |
+| **IP Filtering**         | Allowlist/blocklist IP ranges in dashboard                                     |
+| **Rate Limiting**        | Per-provider rate limits with automatic backoff                                |
+| **Anti-Thundering Herd** | Mutex + per-connection locking prevents cascading 502s                         |
+| **TLS Fingerprint**      | Browser-like TLS fingerprint spoofing to reduce bot detection                  |
+| **CLI Fingerprint**      | Per-provider header/body ordering to match native CLI signatures               |
 
 ### 🔌 Resilience & Availability
 

bin/_ops-common.sh

@@ -1,8 +1,8 @@
 # bin/_ops-common.sh — shared helpers for the OmniRoute ops runbook scripts.
 #
 # Sourced (not executed) by rollback.sh / snapshot-data.sh / restore-data.sh /
-# restore-policies.sh / cold-start-bench.sh. The runbook context lives in
-# docs/INCIDENT_RESPONSE.md and docs/PERF_BUDGETS.md.
+# restore-policies.sh / cold-start-bench.sh — the self-hoster incident-recovery
+# and cold-start ops tooling. Each script documents its own contract via --help.
 #
 # Path resolution mirrors the app (src/lib/db/core.ts): the SQLite store is
 # $DATA_DIR/storage.sqlite and managed backups go to $DATA_DIR/db_backups

bin/cli/commands/completion.mjs

@@ -15,7 +15,11 @@ function readCache() {
   try {
     const raw = JSON.parse(readFileSync(cachePath(), "utf8"));
     if (raw && typeof raw.ts === "number" && Date.now() - raw.ts < CACHE_TTL_MS) return raw;
-  } catch {}
+  } catch (err) {
+    if (process.env.OMNIROUTE_DEBUG_COMPLETION) {
+      console.error("[omniroute completion] readCache failed:", err?.message ?? err);
+    }
+  }
   return null;
 }
 
@@ -41,12 +45,20 @@ async function refreshCache(opts = {}) {
       const j = await mr.value.json();
       models = (Array.isArray(j) ? j : j.data || []).map((m) => m.id).filter(Boolean);
     }
-  } catch {}
+  } catch (err) {
+    if (process.env.OMNIROUTE_DEBUG_COMPLETION) {
+      console.error("[omniroute completion] refreshCache failed:", err?.message ?? err);
+    }
+  }
   const data = { combos, providers, models, ts: Date.now() };
   try {
     mkdirSync(dirname(cachePath()), { recursive: true });
     writeFileSync(cachePath(), JSON.stringify(data));
-  } catch {}
+  } catch (err) {
+    if (process.env.OMNIROUTE_DEBUG_COMPLETION) {
+      console.error("[omniroute completion] writeCache failed:", err?.message ?? err);
+    }
+  }
   return data;
 }
 

bin/cli/commands/compression.mjs

@@ -24,7 +24,7 @@ async function restCompressionStatus() {
   const combosBody = combosRes.ok ? await combosRes.json() : { combos: [] };
   const analytics = analyticsRes && analyticsRes.ok ? await analyticsRes.json() : null;
   return {
-    engine: settings.engine ?? null,
+    strategy: settings.defaultMode || "standard",
     settings,
     combos: combosBody.combos ?? combosBody,
     analytics,
@@ -33,7 +33,10 @@ async function restCompressionStatus() {
 
 async function restCompressionConfigure(config) {
   const body = { ...config };
-  if (body.engine) body.engine = normalizeEngine(body.engine);
+  if (body.strategy) {
+    body.defaultMode = body.strategy === "caveman" ? "standard" : normalizeEngine(body.strategy);
+    delete body.strategy;
+  }
   const res = await apiFetch("/api/settings/compression", { method: "PUT", body });
   if (!res.ok) {
     process.stderr.write(`Error: ${res.status}\n`);
@@ -43,9 +46,10 @@ async function restCompressionConfigure(config) {
 }
 
 async function restSetEngine(name) {
+  const normalized = normalizeEngine(name);
   const res = await apiFetch("/api/settings/compression", {
     method: "PUT",
-    body: { engine: normalizeEngine(name) },
+    body: { defaultMode: normalized === "caveman" ? "standard" : normalized },
   });
   if (!res.ok) {
     process.stderr.write(`Error: ${res.status}\n`);
@@ -103,7 +107,11 @@ export async function runCompressionStatus(opts, cmd) {
 
 export async function runCompressionConfigure(opts, cmd) {
   const config = {};
-  if (opts.engine) config.engine = opts.engine;
+  // #6571 — both the MCP tool schema (compressionConfigureInput) and
+  // handleCompressionConfigure expect `strategy`, not `engine`; a non-strict
+  // MCP schema silently strips an unrecognized `engine` key on the primary
+  // (MCP-mounted) path, so this must be `strategy` on both paths.
+  if (opts.engine) config.strategy = normalizeEngine(opts.engine);
   if (opts.cavemanAggressiveness !== undefined)
     config.caveman = { aggressiveness: opts.cavemanAggressiveness };
   if (opts.rtkBudget !== undefined) config.rtk = { tokenBudget: opts.rtkBudget };
@@ -163,7 +171,7 @@ export function registerCompression(program) {
   engine.command("set <name>").action(runCompressionEngineSet);
   engine.command("get").action(async (opts, cmd) => {
     const data = await mcpCall("omniroute_compression_status", {}, restCompressionStatus);
-    process.stdout.write(`${data.engine ?? "(default)"}\n`);
+    process.stdout.write(`${data.strategy ?? "(default)"}\n`);
   });
 
   const combos = cmp.command("combos").description(t("compression.combos.description"));

bin/cli/commands/doctor.mjs

@@ -3,7 +3,7 @@ import net from "node:net";
 import os from "node:os";
 import path from "node:path";
 import { createDecipheriv, scryptSync } from "node:crypto";
-import { pathToFileURL } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { resolveDataDir, resolveStoragePath } from "../data-dir.mjs";
 import { printHeading } from "../io.mjs";
 import { t } from "../i18n.mjs";
@@ -380,24 +380,67 @@ function resolveLivenessUrl(options = {}) {
   return `http://${formatHostForUrl(host || "127.0.0.1")}:${dashboardPort}/api/health/degradation`;
 }
 
+async function probeUrl(url) {
+  try {
+    const response = await fetchWithTimeout(url);
+    return { ok: response.ok, status: response.status };
+  } catch {
+    return { ok: false, status: 0 };
+  }
+}
+
 async function checkServerLiveness(options = {}) {
   const url = resolveLivenessUrl(options);
 
-  try {
-    const response = await fetchWithTimeout(url);
-    if (!response.ok) {
-      return warn("Server liveness", `Server responded with HTTP ${response.status}`, { url });
-    }
-    return ok("Server liveness", "Server health endpoint is reachable", { url });
-  } catch {
-    return warn("Server liveness", "Server health endpoint is not reachable", { url });
+  // First attempt: configured health endpoint (may require auth token).
+  const primary = await probeUrl(url);
+  if (primary.ok) {
+    return ok("Server liveness", "Server health endpoint is reachable", { url, status: primary.status });
   }
+
+  // #6162: /api/health and /api/health/degradation require a management token.
+  // When unauthenticated, fall back to probing a publicly served static asset
+  // (favicon.ico) to confirm the Next.js server is alive and reachable.
+  // Derive the fallback URL from the primary URL (preserving protocol/host/port)
+  // so custom liveness URL configurations are honored. Fall back to defaults
+  // only if the primary URL can't be parsed.
+  let fallbackUrl;
+  try {
+    const parsed = new URL(url);
+    parsed.pathname = "/favicon.ico";
+    parsed.search = "";
+    parsed.hash = "";
+    fallbackUrl = parsed.toString();
+  } catch {
+    const port = parsePort(process.env.PORT || "20128", 20128);
+    const dashboardPort = parsePort(process.env.DASHBOARD_PORT || String(port), port);
+    const host = String(options.livenessHost || process.env.OMNIROUTE_DOCTOR_HOST || "127.0.0.1")
+      .trim()
+      .replace(/^https?:\/\//, "")
+      .replace(/\/.*$/, "");
+    fallbackUrl = `http://${formatHostForUrl(host || "127.0.0.1")}:${dashboardPort}/favicon.ico`;
+  }
+  const fallback = await probeUrl(fallbackUrl);
+
+  if (fallback.ok) {
+    return ok(
+      "Server liveness",
+      `Server reachable (health endpoint returned ${primary.status}, likely requires MANAGEMENT_TOKEN)`,
+      { primaryUrl: url, primaryStatus: primary.status, fallbackUrl, fallbackStatus: fallback.status }
+    );
+  }
+
+  return warn(
+    "Server liveness",
+    `Server health endpoint returned HTTP ${primary.status || "no-response"} and fallback probe failed`,
+    { primaryUrl: url, primaryStatus: primary.status, fallbackUrl, fallbackStatus: fallback.status }
+  );
 }
 
 export async function collectDoctorChecks(context = {}, options = {}) {
   const rootDir =
     context.rootDir ||
-    path.resolve(path.dirname(new URL(import.meta.url).pathname), "..", "..", "..");
+    path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
   const dataDir = resolveDataDir();
   const dbPath = resolveStoragePath(dataDir);
 

bin/cli/commands/health.mjs

@@ -48,7 +48,11 @@ export async function runHealthCommand(opts = {}) {
   }
 
   try {
-    const res = await apiFetch("/api/health", { retry: false, timeout: 5000, acceptNotOk: true });
+    const res = await apiFetch("/api/monitoring/health", {
+      retry: false,
+      timeout: 5000,
+      acceptNotOk: true,
+    });
     if (!res.ok) {
       console.error(t("common.error", { message: `HTTP ${res.status}` }));
       return 1;
@@ -66,29 +70,22 @@ export async function runHealthCommand(opts = {}) {
     if (health.uptime) console.log(t("health.uptime", { uptime: health.uptime }));
     if (health.version) console.log(`  Version: ${health.version}`);
 
-    if (health.requests !== undefined) {
-      console.log(t("health.requests", { count: health.requests }));
+    if (health.activeConnections !== undefined) {
+      console.log(t("health.requests", { count: health.activeConnections }));
     }
 
-    if (health.breakers && opts.verbose) {
+    if (health.circuitBreakers && opts.verbose) {
       console.log("\n  \x1b[1mCircuit Breakers\x1b[0m");
-      for (const [name, status] of Object.entries(health.breakers)) {
-        const state =
-          status.state === "closed" ? "\x1b[32m● closed\x1b[0m" : "\x1b[33m○ open\x1b[0m";
-        console.log(`    ${name.padEnd(20)} ${state}`);
-      }
+      const { open = 0, halfOpen = 0, closed = 0 } = health.circuitBreakers;
+      console.log(`    \x1b[32m● closed\x1b[0m     ${closed}`);
+      console.log(`    \x1b[33m○ half-open\x1b[0m  ${halfOpen}`);
+      console.log(`    \x1b[31m○ open\x1b[0m       ${open}`);
     }
 
-    if (health.cache && opts.verbose) {
-      console.log("\n  \x1b[1mCache\x1b[0m");
-      console.log(`    Semantic hits:   ${health.cache.semanticHits || 0}`);
-      console.log(`    Signature hits:  ${health.cache.signatureHits || 0}`);
-    }
-
-    if (opts.verbose && health.memory) {
+    if (opts.verbose && health.memoryUsage) {
       console.log("\n  \x1b[1mMemory\x1b[0m");
-      console.log(`    RSS:        ${health.memory.rss || "N/A"}`);
-      console.log(`    Heap used:  ${health.memory.heapUsed || "N/A"}`);
+      console.log(`    RSS:        ${health.memoryUsage.rss || "N/A"}`);
+      console.log(`    Heap used:  ${health.memoryUsage.heapUsed || "N/A"}`);
     }
 
     return 0;
@@ -100,13 +97,17 @@ export async function runHealthCommand(opts = {}) {
 
 export async function runHealthComponentsCommand(opts = {}) {
   try {
-    const res = await apiFetch("/api/health", { retry: false, timeout: 5000, acceptNotOk: true });
+    const res = await apiFetch("/api/monitoring/health", {
+      retry: false,
+      timeout: 5000,
+      acceptNotOk: true,
+    });
     if (!res.ok) {
       console.error(`HTTP ${res.status}`);
       return 1;
     }
     const health = await res.json();
-    const components = health.components || health.breakers || {};
+    const components = health.components || health.circuitBreakers || {};
     for (const [name, info] of Object.entries(components)) {
       const status =
         typeof info === "object" ? info.state || info.status || "unknown" : String(info);

bin/cli/commands/launch-codex.mjs

@@ -19,6 +19,16 @@ const STRIPPED_CODEX_ENV_KEYS = [
 /** Placeholder so codex's `env_key` is always satisfied when the backend is open. */
 const NO_AUTH_SENTINEL = "omniroute-no-auth";
 
+// On Windows the `codex` binary is an npm `.cmd` shim that `spawn` cannot resolve
+// without a shell (bare "codex" → ENOENT). Mirror the qodercli Windows fix (#6263):
+// spawn `codex.cmd` through a shell on win32, and the bare binary elsewhere.
+export function resolveCodexSpawn(platform) {
+  if (platform === "win32") {
+    return { command: "codex.cmd", shell: true };
+  }
+  return { command: "codex", shell: undefined };
+}
+
 function stripTrailingSlash(value) {
   let s = String(value);
   let end = s.length;
@@ -126,10 +136,10 @@ export async function runLaunchCodexCommand(opts = {}, codexArgs = []) {
 
   if (!(await healthCheck(baseUrl))) {
     console.error(
-      (t("launch.notRunning") || "OmniRoute is not reachable at {port}. Start it with 'omniroute serve'.").replace(
-        "{port}",
-        baseUrl
-      )
+      (
+        t("launch.notRunning") ||
+        "OmniRoute is not reachable at {port}. Start it with 'omniroute serve'."
+      ).replace("{port}", baseUrl)
     );
     return 1;
   }
@@ -142,7 +152,12 @@ export async function runLaunchCodexCommand(opts = {}, codexArgs = []) {
   const env = buildCodexEnv(process.env, authToken);
 
   return await new Promise((resolve) => {
-    const child = spawn("codex", extraArgs, { env, stdio: "inherit" });
+    const { command: codexLaunch, shell: shellValue } = resolveCodexSpawn(process.platform);
+    const child = spawn(codexLaunch, extraArgs, {
+      env,
+      stdio: "inherit",
+      shell: shellValue,
+    });
     child.on("error", (err) => {
       if (err?.code === "ENOENT") {
         console.error(
@@ -165,10 +180,16 @@ export function registerLaunchCodex(program) {
       t("launchCodex.description") || "Launch Codex CLI pointed at OmniRoute (local or remote VPS)"
     )
     .option("--port <port>", "Local OmniRoute port (ignored when --remote is set)", "20128")
-    .option("--remote <url>", "Remote OmniRoute base URL, e.g. http://192.168.0.15:20128 (overrides --port + context)")
+    .option(
+      "--remote <url>",
+      "Remote OmniRoute base URL, e.g. http://192.168.0.15:20128 (overrides --port + context)"
+    )
     .option("--profile <name>", "Codex profile to activate (passed as --profile <name>)")
     .option("-p, --p <name>", "Alias for --profile")
-    .option("--api-key <key>", "OmniRoute API key (overrides OMNIROUTE_API_KEY env var for this invocation)")
+    .option(
+      "--api-key <key>",
+      "OmniRoute API key (overrides OMNIROUTE_API_KEY env var for this invocation)"
+    )
     .allowUnknownOption(true)
     .allowExcessArguments(true)
     .argument("[codexArgs...]", "arguments passed through to the codex binary")

bin/cli/commands/registry.mjs

@@ -71,7 +71,6 @@ import { registerSetupCrush } from "./setup-crush.mjs";
 import { registerSetupGoose } from "./setup-goose.mjs";
 import { registerSetupQwen } from "./setup-qwen.mjs";
 import { registerSetupAider } from "./setup-aider.mjs";
-import { registerSetupGemini } from "./setup-gemini.mjs";
 import { registerConnect } from "./connect.mjs";
 import { registerContexts } from "./contexts.mjs";
 import { registerTokens } from "./tokens.mjs";
@@ -154,7 +153,6 @@ export function registerCommands(program) {
   registerSetupGoose(program);
   registerSetupQwen(program);
   registerSetupAider(program);
-  registerSetupGemini(program);
   registerConnect(program);
   registerContexts(program);
   registerTokens(program);

bin/cli/commands/serve.mjs

@@ -1,8 +1,8 @@
 import { spawn } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
-import { platform, totalmem } from "node:os";
+import { platform, totalmem, hostname as osHostname } from "node:os";
 import { t } from "../i18n.mjs";
 import { writePidFile, cleanupPidFile, waitForServer } from "../utils/pid.mjs";
 import { ServerSupervisor, detectMitmCrash } from "../runtime/processSupervisor.mjs";
@@ -10,9 +10,17 @@ import { isTermux } from "../../../scripts/build/postinstallSupport.mjs";
 import {
   resolveMaxOldSpaceMb,
   calibrateHeapFallbackMb,
+  buildServerNodeOptions,
+  buildNodeHeapArgs,
 } from "../../../scripts/build/runtime-env.mjs";
+import { resolveTlsOptions } from "../../../scripts/dev/tls-options.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
+const _pkg = JSON.parse(readFileSync(join(__dirname, "..", "..", "..", "package.json"), "utf8"));
+
+// URL scheme for the "OmniRoute is running" banner — flipped to https when
+// opt-in TLS (#5242) is active. Process-scoped: one `serve` run = one scheme.
+let urlScheme = "http";
 const ROOT = join(__dirname, "..", "..", "..");
 // The standalone bundle ships in `dist/` (since the build-output-isolation
 // refactor). Fall back to the legacy `app/` location so an upgrade over a
@@ -39,12 +47,24 @@ export function registerServe(program) {
     .option("--max-restarts <n>", t("serve.max_restarts"), parseInt, 2)
     .option("--tray", t("serve.tray") || "Show system tray icon (desktop only)")
     .option("--no-tray", t("serve.no_tray") || "Disable system tray icon")
+    .option(
+      "--tls-cert <path>",
+      t("serve.tls_cert") ||
+        "Path to a TLS certificate (PEM) to serve HTTPS (also OMNIROUTE_TLS_CERT)"
+    )
+    .option(
+      "--tls-key <path>",
+      t("serve.tls_key") ||
+        "Path to the TLS private key (PEM) to serve HTTPS (also OMNIROUTE_TLS_KEY)"
+    )
     .action(async (opts) => {
       await runServe(opts);
     });
 }
 
 export async function runServe(opts = {}) {
+  const startedAt = performance.now();
+
   const { isNativeBinaryCompatible } =
     await import("../../../scripts/build/native-binary-compat.mjs");
   const { getNodeRuntimeSupport, getNodeRuntimeWarning } =
@@ -63,6 +83,7 @@ export async function runServe(opts = {}) {
   | |__| | | | | | | | | | | | \\ \\ (_) | |_| | ||  __/
    \\____/|_| |_| |_|_| |_|_|_|  \\_\\___/ \\__,_|\\__\\___|
 \x1b[0m`);
+  console.log(`\x1b[2m  v${_pkg.version}\x1b[0m\n`);
 
   const nodeSupport = getNodeRuntimeSupport();
   if (!nodeSupport.nodeCompatible) {
@@ -138,17 +159,41 @@ export async function runServe(opts = {}) {
     calibrateHeapFallbackMb(totalmem())
   );
 
+  // #5242: opt-in native HTTPS. CLI flags take precedence over env; the child
+  // server (server-ws.mjs) reads these and terminates TLS on the same listener.
+  const tlsCert = opts.tlsCert ?? process.env.OMNIROUTE_TLS_CERT;
+  const tlsKey = opts.tlsKey ?? process.env.OMNIROUTE_TLS_KEY;
+
   const env = {
     ...process.env,
     OMNIROUTE_PORT: String(port),
     PORT: String(dashboardPort),
     DASHBOARD_PORT: String(dashboardPort),
     API_PORT: String(apiPort),
-    HOSTNAME: process.env.HOSTNAME || "0.0.0.0",
+    // #6194: POSIX shells (bash/zsh) auto-set HOSTNAME to the machine name — the
+    // .env loader (first-wins) can never override it. Ignore HOSTNAME when it
+    // matches the OS-reported hostname (the auto-set signature). OMNIROUTE_SERVER_HOST
+    // takes precedence; legacy HOSTNAME values that don't match os.hostname() are
+    // still honoured for backward compatibility (e.g. Windows CMD/PowerShell users
+    // who set HOSTNAME in .env where it is NOT auto-set).
+    HOSTNAME:
+      process.env.OMNIROUTE_SERVER_HOST ||
+      (process.env.HOSTNAME !== osHostname() ? process.env.HOSTNAME : undefined) ||
+      "0.0.0.0",
     NODE_ENV: "production",
-    NODE_OPTIONS: `--max-old-space-size=${memoryLimit}`,
+    // #5238: preserve a user-set NODE_OPTIONS (incl. their own
+    // `--max-old-space-size=…`) instead of clobbering it with the calibrated
+    // default — mirror the Electron/standalone launchers.
+    NODE_OPTIONS: buildServerNodeOptions(process.env, memoryLimit),
+    ...(tlsCert ? { OMNIROUTE_TLS_CERT: tlsCert } : {}),
+    ...(tlsKey ? { OMNIROUTE_TLS_KEY: tlsKey } : {}),
   };
 
+  // Validate the TLS pair up front so the operator sees a clear warning in the
+  // CLI (the child re-validates authoritatively). Drives the banner scheme;
+  // when null we fall through to identical plain-HTTP behavior as before.
+  urlScheme = resolveTlsOptions(env) ? "https" : "http";
+
   const isDaemon = opts.daemon === true;
   const useTray = opts.tray === true;
 
@@ -157,7 +202,15 @@ export async function runServe(opts = {}) {
   }
 
   if (opts.noRecovery) {
-    return runWithoutRecovery(serverJs, env, memoryLimit, dashboardPort, apiPort, noOpen);
+    return runWithoutRecovery(
+      serverJs,
+      env,
+      memoryLimit,
+      dashboardPort,
+      apiPort,
+      noOpen,
+      startedAt
+    );
   }
 
   return runWithSupervisor(
@@ -169,12 +222,15 @@ export async function runServe(opts = {}) {
     noOpen,
     opts.log === true,
     opts.maxRestarts ?? 2,
+    startedAt,
     useTray
   );
 }
 
 function runDaemon(serverJs, env, memoryLimit, dashboardPort, apiPort) {
-  const server = spawn("node", [`--max-old-space-size=${memoryLimit}`, serverJs], {
+  // #5238: skip the explicit CLI --max-old-space-size when the user pinned the
+  // heap via NODE_OPTIONS (a CLI arg would shadow/override their value).
+  const server = spawn("node", [...buildNodeHeapArgs(process.env, memoryLimit), serverJs], {
     cwd: APP_DIR,
     env,
     stdio: "ignore",
@@ -183,12 +239,14 @@ function runDaemon(serverJs, env, memoryLimit, dashboardPort, apiPort) {
   writePidFile("server", server.pid);
   server.unref();
   console.log(`\x1b[32m✔ OmniRoute started in background (PID: ${server.pid})\x1b[0m`);
-  console.log(`  \x1b[1mDashboard:\x1b[0m  http://localhost:${dashboardPort}`);
-  console.log(`  \x1b[1mAPI Base:\x1b[0m   http://localhost:${apiPort}/v1`);
+  console.log(`  \x1b[1mDashboard:\x1b[0m  ${urlScheme}://localhost:${dashboardPort}`);
+  console.log(`  \x1b[1mAPI Base:\x1b[0m   ${urlScheme}://localhost:${apiPort}/v1`);
 }
 
-function runWithoutRecovery(serverJs, env, memoryLimit, dashboardPort, apiPort, noOpen) {
-  const server = spawn("node", [`--max-old-space-size=${memoryLimit}`, serverJs], {
+function runWithoutRecovery(serverJs, env, memoryLimit, dashboardPort, apiPort, noOpen, startedAt) {
+  // #5238: skip the explicit CLI --max-old-space-size when the user pinned the
+  // heap via NODE_OPTIONS (a CLI arg would shadow/override their value).
+  const server = spawn("node", [...buildNodeHeapArgs(process.env, memoryLimit), serverJs], {
     cwd: APP_DIR,
     env,
     stdio: "pipe",
@@ -206,7 +264,7 @@ function runWithoutRecovery(serverJs, env, memoryLimit, dashboardPort, apiPort,
       (text.includes("Ready") || text.includes("started") || text.includes("listening"))
     ) {
       started = true;
-      onReady(dashboardPort, apiPort, noOpen);
+      onReady(dashboardPort, apiPort, noOpen, startedAt);
     }
   });
 
@@ -240,7 +298,7 @@ function runWithoutRecovery(serverJs, env, memoryLimit, dashboardPort, apiPort,
   setTimeout(() => {
     if (!started) {
       started = true;
-      onReady(dashboardPort, apiPort, noOpen);
+      onReady(dashboardPort, apiPort, noOpen, startedAt);
     }
   }, 15000);
 }
@@ -254,6 +312,7 @@ async function runWithSupervisor(
   noOpen,
   showLog,
   maxRestarts,
+  startedAt,
   useTray = false
 ) {
   if (showLog) process.env.OMNIROUTE_SHOW_LOG = "1";
@@ -291,12 +350,36 @@ async function runWithSupervisor(
     waitForServer(dashboardPort, 60000).then(async (up) => {
       if (up) {
         if (useTray) await maybeStartTray(dashboardPort, apiPort, supervisor);
-        onReady(dashboardPort, apiPort, noOpen);
+        onReady(dashboardPort, apiPort, noOpen, startedAt);
+      } else {
+        reportReadinessTimeout(dashboardPort, supervisor);
       }
     });
   }
 }
 
+// #6321: waitForServer resolving `false` used to fall through silently — the CLI
+// printed the banner + "⏳ Starting server..." and then produced ZERO further
+// output forever, even though the child process may well have crashed or be
+// stuck (issue reports show the server sometimes actually comes up later, or is
+// reachable directly while the CLI still looks hung). Surface a clear diagnostic
+// plus whatever stdout/stderr the child buffered instead of going silent.
+export function reportReadinessTimeout(dashboardPort, supervisor) {
+  console.error(
+    `\n\x1b[33m⚠ Server did not respond within 60s.\x1b[0m It may still be starting, or may` +
+      ` have failed silently.`
+  );
+  console.error(`  Try:  curl -I http://localhost:${dashboardPort}/api/monitoring/health`);
+  console.error(`  Or:   rerun with \x1b[36m--log\x1b[0m to see live server output.\n`);
+
+  const recentLog = supervisor?.getRecentLog?.() ?? [];
+  if (recentLog.length) {
+    console.error("--- Recent server output ---");
+    recentLog.forEach((l) => console.error(l));
+    console.error("--- End recent output ---\n");
+  }
+}
+
 let _killTray = null;
 function killTrayIfActive() {
   if (_killTray) {
@@ -312,8 +395,8 @@ async function maybeStartTray(port, apiPort, supervisor) {
     const { initTray, isTraySupported } = await import("../tray/index.mjs");
     if (!isTraySupported()) return;
     const { default: open } = await import("open").catch(() => ({ default: null }));
-    const dashboardUrl = `http://localhost:${port}`;
-    const tray = initTray({
+    const dashboardUrl = `${urlScheme}://localhost:${port}`;
+    const tray = await initTray({
       port,
       onQuit: () => {
         killTrayIfActive();
@@ -329,17 +412,23 @@ async function maybeStartTray(port, apiPort, supervisor) {
       const { killTray } = await import("../tray/index.mjs");
       _killTray = killTray;
     }
-  } catch {
-    // tray is optional — do not fail the server
+  } catch (err) {
+    // tray is optional — do not fail the server, but surface why it failed so
+    // "--tray shows nothing" is diagnosable instead of silent (#4605).
+    process.stderr.write(`[omniroute][tray] failed to start: ${err?.message ?? String(err)}\n`);
   }
 }
 
-async function onReady(dashboardPort, apiPort, noOpen) {
-  const dashboardUrl = `http://localhost:${dashboardPort}`;
-  const apiUrl = `http://localhost:${apiPort}`;
+async function onReady(dashboardPort, apiPort, noOpen, startedAt) {
+  const dashboardUrl = `${urlScheme}://localhost:${dashboardPort}`;
+  const apiUrl = `${urlScheme}://localhost:${apiPort}`;
+  const elapsed =
+    typeof startedAt === "number" && Number.isFinite(startedAt)
+      ? ((performance.now() - startedAt) / 1000).toFixed(1)
+      : "0.0";
 
   console.log(`
-  \x1b[32m✔ OmniRoute is running!\x1b[0m
+  \x1b[32m✔ OmniRoute is running!\x1b[0m \x1b[2m(started in ${elapsed}s)\x1b[0m
 
   \x1b[1m  Dashboard:\x1b[0m  ${dashboardUrl}
   \x1b[1m  API Base:\x1b[0m   ${apiUrl}/v1

bin/cli/commands/setup-claude.mjs

@@ -20,7 +20,11 @@ import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import os from "node:os";
 import { printHeading, printInfo, printSuccess, printError } from "../io.mjs";
-import { categoriseModel } from "./setup-codex.mjs";
+import {
+  categoriseModel,
+  isCodexCompatibleTextModel,
+  profileNameFromModelId,
+} from "./setup-codex.mjs";
 
 /** Map a Codex-style effort to a Claude Code settings.json effortLevel. */
 function effortLevelFor(cfg) {
@@ -29,6 +33,17 @@ function effortLevelFor(cfg) {
   return cfg.effort || undefined;
 }
 
+/**
+ * Generic profile for a live-catalog model that `categoriseModel()` doesn't
+ * recognize (e.g. any provider added after the hardcoded glm/kimi/mimo/…
+ * pattern list was written). Mirrors setup-codex.mjs's fallbackCodexProfile()
+ * so setup-claude never silently produces zero profiles for a fresh catalog.
+ */
+export function fallbackClaudeProfile(modelId, model) {
+  if (!isCodexCompatibleTextModel(model)) return null;
+  return { name: profileNameFromModelId(modelId) };
+}
+
 /** Build the settings.json content for one Claude Code profile. */
 export function buildProfileSettings(modelId, baseUrl, cfg) {
   const env = {
@@ -50,18 +65,84 @@ export function buildProfileSettings(modelId, baseUrl, cfg) {
   return JSON.stringify(settings, null, 2) + "\n";
 }
 
+/**
+ * Generate Claude Code profile files for a live model catalog. Shared by the
+ * `setup-claude` CLI command and the post-model-sync auto-sync so both stay
+ * behaviorally identical. Writes `<claudeHome>/profiles/<name>/settings.json`
+ * (directory-per-profile); never touches the active/default Claude config.
+ * @param {Array} models
+ * @param {{claudeHome?:string, baseUrl:string, dryRun?:boolean, only?:string, log?:(line:string)=>void}} opts
+ * @returns {Promise<{written:number, skipped:number, profiles:Array<{name:string, model:string, filePath:string}>}>}
+ */
+export async function syncClaudeProfilesFromModels(models, opts = {}) {
+  const claudeHome = opts.claudeHome || join(os.homedir(), ".claude");
+  const profilesRoot = join(claudeHome, "profiles");
+  const baseUrl = opts.baseUrl;
+  const dryRun = Boolean(opts.dryRun);
+  // Injectable dry-run printer (#5959): under the node:test runner, a child
+  // process writing multi-byte UTF-8 (the "──" box-drawing heading) to stdout
+  // corrupts the runner's V8-serialized event stream ~50% of the time
+  // ("Unable to deserialize cloned data due to invalid or unsupported
+  // version"). Tests inject a collector; the CLI default stays console.log.
+  const log = opts.log ?? console.log;
+  const onlyFilter = opts.only ? opts.only.split(",").map((s) => s.trim()) : null;
+
+  if (!dryRun && !existsSync(profilesRoot)) {
+    mkdirSync(profilesRoot, { recursive: true });
+  }
+
+  let written = 0;
+  let skipped = 0;
+  const profiles = [];
+
+  for (const m of models) {
+    const id = typeof m === "string" ? m : (m.id ?? "");
+    if (!id) {
+      skipped++;
+      continue;
+    }
+    if (onlyFilter && !onlyFilter.some((f) => id.includes(f))) {
+      skipped++;
+      continue;
+    }
+
+    const cfg = categoriseModel(id) ?? fallbackClaudeProfile(id, m);
+    if (!cfg) {
+      skipped++;
+      continue;
+    }
+
+    const dir = join(profilesRoot, cfg.name);
+    const filePath = join(dir, "settings.json");
+    const content = buildProfileSettings(id, baseUrl, cfg);
+
+    if (dryRun) {
+      log(`\n── [dry-run] ${filePath} ──`);
+      log(content);
+    } else {
+      mkdirSync(dir, { recursive: true });
+      writeFileSync(filePath, content, "utf8");
+    }
+    profiles.push({ name: cfg.name, model: id, filePath });
+    written++;
+  }
+
+  return { written, skipped, profiles };
+}
+
 /**
  * @param {{remote?:string, port?:string, apiKey?:string, claudeHome?:string, dryRun?:boolean, only?:string}} opts
  * @returns {Promise<number>}
  */
 export async function runSetupClaudeCommand(opts = {}) {
   const port = Number(opts.port ?? process.env.PORT ?? 20128) || 20128;
-  const baseUrl = (opts.remote ?? `http://localhost:${port}`).replace(/\/+$/, "").replace(/\/v1$/, "");
+  const baseUrl = (opts.remote ?? `http://localhost:${port}`)
+    .replace(/\/+$/, "")
+    .replace(/\/v1$/, "");
   const apiKey = opts.apiKey ?? opts["api-key"] ?? process.env.OMNIROUTE_API_KEY ?? "";
   const claudeHome = opts.claudeHome ?? opts["claude-home"] ?? join(os.homedir(), ".claude");
   const profilesRoot = join(claudeHome, "profiles");
   const dryRun = Boolean(opts.dryRun ?? opts["dry-run"]);
-  const onlyFilter = opts.only ? opts.only.split(",").map((s) => s.trim()) : null;
 
   printHeading("OmniRoute → Claude Code profile generator");
   printInfo(`Connecting to ${baseUrl} …`);
@@ -89,42 +170,25 @@ export async function runSetupClaudeCommand(opts = {}) {
 
   printInfo(`Received ${models.length} models from ${baseUrl}`);
 
-  if (!dryRun && !existsSync(profilesRoot)) {
-    mkdirSync(profilesRoot, { recursive: true });
-  }
+  const { written, skipped, profiles } = await syncClaudeProfilesFromModels(models, {
+    claudeHome,
+    baseUrl,
+    dryRun,
+    only: opts.only,
+  });
 
-  let written = 0;
-  for (const m of models) {
-    const id = typeof m === "string" ? m : m.id ?? "";
-    if (!id) continue;
-    if (onlyFilter && !onlyFilter.some((f) => id.includes(f))) continue;
-
-    const cfg = categoriseModel(id);
-    if (!cfg) continue;
-
-    const dir = join(profilesRoot, cfg.name);
-    const filePath = join(dir, "settings.json");
-    const content = buildProfileSettings(id, baseUrl, cfg);
-
-    if (dryRun) {
-      console.log(`\n── [dry-run] ${filePath} ──`);
-      console.log(content);
-    } else {
-      mkdirSync(dir, { recursive: true });
-      writeFileSync(filePath, content, "utf8");
-      printSuccess(`  ✓ profiles/${cfg.name}/settings.json  (${id})`);
-    }
-    written++;
-  }
-
-  const skipped = models.length - written;
   if (!dryRun) {
+    for (const profile of profiles) {
+      printSuccess(`  ✓ profiles/${profile.name}/settings.json  (${profile.model})`);
+    }
     console.log("");
     printSuccess(`${written} Claude Code profiles written to ${profilesRoot}`);
     if (skipped > 0) printInfo(`${skipped} models skipped (no matching profile pattern)`);
     console.log("\nTo use a profile:");
     console.log("  omniroute launch --profile <name>     # e.g. omniroute launch --profile glm52");
-    console.log("  # or: CLAUDE_CONFIG_DIR=~/.claude/profiles/<name> claude  (export ANTHROPIC_AUTH_TOKEN first)");
+    console.log(
+      "  # or: CLAUDE_CONFIG_DIR=~/.claude/profiles/<name> claude  (export ANTHROPIC_AUTH_TOKEN first)"
+    );
   } else {
     console.log(`\n[dry-run] ${written} profiles would be written (${skipped} skipped)`);
   }
@@ -143,7 +207,10 @@ export function registerSetupClaude(program) {
     .option("--remote <url>", "Remote OmniRoute URL, e.g. http://192.168.0.15:20128")
     .option("--api-key <key>", "OmniRoute API key (defaults to OMNIROUTE_API_KEY env var)")
     .option("--claude-home <dir>", "Claude home dir (default: ~/.claude)")
-    .option("--only <patterns>", "Comma-separated substrings — only matching model IDs (e.g. glm,kimi)")
+    .option(
+      "--only <patterns>",
+      "Comma-separated substrings — only matching model IDs (e.g. glm,kimi)"
+    )
     .option("--dry-run", "Print what would be written without touching the filesystem")
     .action(async (opts) => {
       const exitCode = await runSetupClaudeCommand(opts);

bin/cli/commands/setup-codex.mjs

@@ -39,29 +39,83 @@ export function categoriseModel(modelId) {
     { re: /kmc\/kimi-k2\.6/, name: "kimi-k26", ctx: 131072, compact: 112000, toolLimit: 32768 },
     { re: /glm\/glm-5\.2-max/, name: "glm52max", ctx: 131072, compact: 112000, toolLimit: 32768 },
     { re: /glm\/glm-5\.2$/, name: "glm52", ctx: 131072, compact: 112000, toolLimit: 32768 },
-    { re: /opencode-go\/mimo-v2\.5-pro/, name: "mimo-pro", ctx: 131072, compact: 112000, toolLimit: 32768 },
-    { re: /opencode-go\/qwen3\.7-plus/, name: "qwen37plus", ctx: 32768, compact: 28000, toolLimit: 16384 },
+    {
+      re: /opencode-go\/mimo-v2\.5-pro/,
+      name: "mimo-pro",
+      ctx: 131072,
+      compact: 112000,
+      toolLimit: 32768,
+    },
+    {
+      re: /opencode-go\/qwen3\.7-plus/,
+      name: "qwen37plus",
+      ctx: 32768,
+      compact: 28000,
+      toolLimit: 16384,
+    },
   ];
 
   // ── Good models (high effort) ─────────────────────────────────────────────
   const goodPatterns = [
-    { re: /ollamacloud\/deepseek-v4-pro/, name: "deepseek-pro", ctx: 131072, compact: 112000, toolLimit: 32768 },
-    { re: /opencode-go\/mimo-v2\.5$/, name: "mimo", ctx: 131072, compact: 112000, toolLimit: 32768 },
+    {
+      re: /ollamacloud\/deepseek-v4-pro/,
+      name: "deepseek-pro",
+      ctx: 131072,
+      compact: 112000,
+      toolLimit: 32768,
+    },
+    {
+      re: /opencode-go\/mimo-v2\.5$/,
+      name: "mimo",
+      ctx: 131072,
+      compact: 112000,
+      toolLimit: 32768,
+    },
   ];
 
   // ── Simple models (no effort) ─────────────────────────────────────────────
   const simplePatterns = [
     { re: /ollamacloud\/gemma4:31b/, name: "gemma4", ctx: 32768, compact: 28000, toolLimit: 16384 },
-    { re: /ollamacloud\/nemotron-3-super/, name: "nemotron", ctx: 32768, compact: 28000, toolLimit: 16384 },
-    { re: /ollamacloud\/gpt-oss:20b/, name: "gptoss", ctx: 32768, compact: 28000, toolLimit: 16384 },
+    {
+      re: /ollamacloud\/nemotron-3-super/,
+      name: "nemotron",
+      ctx: 32768,
+      compact: 28000,
+      toolLimit: 16384,
+    },
+    {
+      re: /ollamacloud\/gpt-oss:20b/,
+      name: "gptoss",
+      ctx: 32768,
+      compact: 28000,
+      toolLimit: 16384,
+    },
   ];
 
   // ── Fast models (low effort) ──────────────────────────────────────────────
   const fastPatterns = [
-    { re: /ollamacloud\/deepseek-v4-flash/, name: "deepseek-flash", ctx: 65536, compact: 56000, toolLimit: 16384 },
-    { re: /ollamacloud\/gemini-3-flash/, name: "gemini-flash", ctx: 1000000, compact: 850000, toolLimit: 32768 },
+    {
+      re: /ollamacloud\/deepseek-v4-flash/,
+      name: "deepseek-flash",
+      ctx: 65536,
+      compact: 56000,
+      toolLimit: 16384,
+    },
+    {
+      re: /ollamacloud\/gemini-3-flash/,
+      name: "gemini-flash",
+      ctx: 1000000,
+      compact: 850000,
+      toolLimit: 32768,
+    },
     { re: /glm\/glm-5-turbo/, name: "glm5turbo", ctx: 131072, compact: 112000, toolLimit: 16384 },
-    { re: /glm\/glm-4\.7-flash/, name: "glm47flash", ctx: 131072, compact: 112000, toolLimit: 16384 },
+    {
+      re: /glm\/glm-4\.7-flash/,
+      name: "glm47flash",
+      ctx: 131072,
+      compact: 112000,
+      toolLimit: 16384,
+    },
   ];
 
   for (const p of thinkingPatterns) {
@@ -80,6 +134,92 @@ export function categoriseModel(modelId) {
   return null;
 }
 
+function firstPositiveNumber(...values) {
+  for (const value of values) {
+    if (typeof value === "number" && Number.isFinite(value) && value > 0) {
+      return value;
+    }
+  }
+  return null;
+}
+
+function shortHash(value) {
+  let hash = 5381;
+  for (let i = 0; i < value.length; i++) {
+    hash = ((hash << 5) + hash) ^ value.charCodeAt(i);
+  }
+  return (hash >>> 0).toString(36);
+}
+
+export function profileNameFromModelId(modelId) {
+  const normalized = String(modelId)
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+  const base = normalized || "model";
+  if (base.length <= 96) return base;
+  return `${base.slice(0, 84).replace(/-+$/g, "")}-${shortHash(base)}`;
+}
+
+function hasAnyValue(values, patterns) {
+  return values.some((value) => patterns.some((pattern) => pattern.test(value)));
+}
+
+export function isCodexCompatibleTextModel(model) {
+  if (typeof model === "string") return true;
+
+  const id = String(model?.id ?? "").toLowerCase();
+  const type = String(model?.type ?? "").toLowerCase();
+  const outputModalities = Array.isArray(model?.output_modalities)
+    ? model.output_modalities.map((value) => String(value).toLowerCase())
+    : [];
+
+  if (type && !["chat", "text", "language", "llm", "model"].includes(type)) {
+    return false;
+  }
+
+  const unsupportedPatterns = [
+    /(^|[/_-])(image|img|video|veo|seedance|audio|speech|voice|tts|stt|whisper)([/_-]|$)/,
+    /(^|[/_-])(embedding|embeddings|embed|rerank|moderation|transcription)([/_-]|$)/,
+  ];
+  if (hasAnyValue([id, type], unsupportedPatterns)) return false;
+
+  const nonTextModalities = [/^(image|video|audio)$/];
+  if (hasAnyValue(outputModalities, nonTextModalities)) return false;
+
+  if (outputModalities.length > 0 && !outputModalities.includes("text")) {
+    return false;
+  }
+
+  return true;
+}
+
+export function fallbackCodexProfile(modelId, model) {
+  if (!isCodexCompatibleTextModel(model)) return null;
+
+  const ctx =
+    typeof model === "string"
+      ? 128000
+      : (firstPositiveNumber(
+          model.context_length,
+          model.max_context_window_tokens,
+          model.max_input_tokens
+        ) ?? 128000);
+  const maxOutput =
+    typeof model === "string"
+      ? null
+      : firstPositiveNumber(model.max_output_tokens, model.output_token_limit);
+  const toolLimit = Math.min(Math.max(maxOutput ?? 16384, 8192), 32768);
+
+  return {
+    name: profileNameFromModelId(modelId),
+    ctx,
+    compact: Math.floor(ctx * 0.85),
+    summary: false,
+    toolLimit,
+  };
+}
+
 /** Build the TOML content for a single profile. */
 function buildProfileToml(modelId, cfg) {
   const lines = [
@@ -105,6 +245,52 @@ function buildProfileToml(modelId, cfg) {
   return lines.join("\n") + "\n";
 }
 
+export async function syncCodexProfilesFromModels(models, opts = {}) {
+  const codexHome = opts.codexHome || join(os.homedir(), ".codex");
+  const dryRun = Boolean(opts.dryRun);
+  const onlyFilter = opts.only ? opts.only.split(",").map((s) => s.trim()) : null;
+
+  if (!dryRun && !existsSync(codexHome)) {
+    mkdirSync(codexHome, { recursive: true });
+  }
+
+  let written = 0;
+  let skipped = 0;
+  const profiles = [];
+
+  for (const m of models) {
+    const id = typeof m === "string" ? m : (m.id ?? "");
+    if (!id) {
+      skipped++;
+      continue;
+    }
+    if (onlyFilter && !onlyFilter.some((f) => id.includes(f))) {
+      skipped++;
+      continue;
+    }
+
+    const cfg = categoriseModel(id) ?? fallbackCodexProfile(id, m);
+    if (!cfg) {
+      skipped++;
+      continue;
+    }
+
+    const filePath = join(codexHome, `${cfg.name}.config.toml`);
+    const content = buildProfileToml(id, cfg);
+
+    if (dryRun) {
+      console.log(`\n── [dry-run] ${filePath} ──`);
+      console.log(content);
+    } else {
+      writeFileSync(filePath, content, "utf8");
+    }
+    profiles.push({ name: cfg.name, model: id, filePath });
+    written++;
+  }
+
+  return { written, skipped, profiles };
+}
+
 // ── Command ───────────────────────────────────────────────────────────────────
 
 /**
@@ -146,39 +332,17 @@ export async function runSetupCodexCommand(opts = {}) {
 
   printInfo(`Received ${models.length} models from ${baseUrl}`);
 
-  // ── Ensure codex home exists ──────────────────────────────────────────────
-  if (!dryRun && !existsSync(codexHome)) {
-    mkdirSync(codexHome, { recursive: true });
-  }
-
   // ── Generate profiles ─────────────────────────────────────────────────────
-  let written = 0;
-  let skipped = 0;
-
-  for (const m of models) {
-    const id = typeof m === "string" ? m : (m.id ?? "");
-    if (!id) continue;
-    if (onlyFilter && !onlyFilter.some((f) => id.includes(f))) continue;
-
-    const cfg = categoriseModel(id);
-    if (!cfg) continue;
-
-    const filePath = join(codexHome, `${cfg.name}.config.toml`);
-    const content = buildProfileToml(id, cfg);
-
-    if (dryRun) {
-      console.log(`\n── [dry-run] ${filePath} ──`);
-      console.log(content);
-    } else {
-      writeFileSync(filePath, content, "utf8");
-      printSuccess(`  ✓ ${cfg.name}.config.toml  (${id})`);
-    }
-    written++;
-  }
-
-  skipped = models.length - written;
+  const { written, skipped, profiles } = await syncCodexProfilesFromModels(models, {
+    codexHome,
+    dryRun,
+    only: opts.only,
+  });
 
   if (!dryRun) {
+    for (const profile of profiles) {
+      printSuccess(`  ✓ ${profile.name}.config.toml  (${profile.model})`);
+    }
     console.log("");
     printSuccess(`${written} profiles written to ${codexHome}`);
     if (skipped > 0) {
@@ -210,10 +374,7 @@ export function registerSetupCodex(program) {
       "--api-key <key>",
       "OmniRoute API key for the remote instance (defaults to OMNIROUTE_API_KEY env var)"
     )
-    .option(
-      "--codex-home <dir>",
-      "Directory where profile files are written (default: ~/.codex)"
-    )
+    .option("--codex-home <dir>", "Directory where profile files are written (default: ~/.codex)")
     .option(
       "--only <patterns>",
       "Comma-separated substrings — only generate profiles for matching model IDs (e.g. glm,kimi)"

bin/cli/commands/setup-gemini.mjs

@@ -1,148 +0,0 @@
-/**
- * omniroute setup-gemini — point the Gemini CLI at OmniRoute's Gemini endpoint.
- *
- * The Gemini CLI is NOT OpenAI-compatible — it speaks the native Gemini API.
- * OmniRoute exposes a Gemini-native surface at /v1beta (e.g.
- * /v1beta/models/<model>:generateContent), so the CLI can target it via the
- * @google/genai SDK env `GOOGLE_GEMINI_BASE_URL` (ROOT — the SDK appends /v1beta)
- * + `GEMINI_API_KEY`. There is no settings.json key for the base URL, so this is
- * primarily an env recipe; we optionally write ~/.gemini/settings.json `model`.
- *
- * ⚠ Known Gemini CLI caveat: it may ignore GOOGLE_GEMINI_BASE_URL if a cached
- * Google login exists — run `gemini` logged-out / API-key-only for it to take.
- */
-
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import os from "node:os";
-import { printHeading, printInfo, printSuccess, printError, createPrompt } from "../io.mjs";
-import { resolveActiveContext } from "../contexts.mjs";
-
-function stripToRoot(url) {
-  const s = String(url || "").replace(/\/+$/, "");
-  return s.endsWith("/v1beta") ? s.slice(0, -7) : s.endsWith("/v1") ? s.slice(0, -3) : s;
-}
-
-/** Resolve GOOGLE_GEMINI_BASE_URL (ROOT — SDK appends /v1beta) + apiKey. */
-export function resolveGeminiTarget(opts = {}) {
-  let root;
-  if (opts.remote) root = stripToRoot(opts.remote);
-  else {
-    try {
-      root = stripToRoot(resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT)?.baseUrl);
-    } catch {
-      /* none */
-    }
-    if (!root) root = `http://localhost:${Number(opts.port ?? process.env.PORT ?? 20128) || 20128}`;
-  }
-  let apiKey = opts.apiKey ?? opts["api-key"];
-  if (!apiKey) {
-    try {
-      const c = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT);
-      apiKey = c?.accessToken || c?.apiKey;
-    } catch {
-      /* none */
-    }
-  }
-  if (!apiKey) apiKey = process.env.OMNIROUTE_API_KEY || "";
-  return { baseUrl: root, apiKey };
-}
-
-/** The guaranteed env recipe (pure → testable). */
-export function buildGeminiRecipe({ baseUrl, model }) {
-  return [
-    `export GOOGLE_GEMINI_BASE_URL=${baseUrl}`,
-    "export GEMINI_API_KEY=$OMNIROUTE_API_KEY",
-    `export GEMINI_MODEL=${model}`,
-    `gemini -p "reply OK"      # or: gemini  (interactive)`,
-  ].join("\n");
-}
-
-/** Merge the model into ~/.gemini/settings.json (base URL is env-only). */
-export function buildGeminiSettings(existing, { model }) {
-  const s = existing && typeof existing === "object" ? { ...existing } : {};
-  if (model) s.model = model;
-  return s;
-}
-
-function readJson(path) {
-  try {
-    if (existsSync(path)) return JSON.parse(readFileSync(path, "utf8"));
-  } catch {
-    /* corrupt/missing */
-  }
-  return {};
-}
-
-async function fetchGeminiModelIds(baseUrl, apiKey) {
-  try {
-    const res = await fetch(`${baseUrl}/v1beta/models`, {
-      headers: { "x-goog-api-key": apiKey || "" },
-      signal: AbortSignal.timeout(8000),
-    });
-    if (!res.ok) return [];
-    const body = await res.json();
-    return (body.models || []).map((m) => String(m.name || "").replace(/^models\//, "")).filter(Boolean);
-  } catch {
-    return [];
-  }
-}
-
-export async function runSetupGeminiCommand(opts = {}) {
-  const { baseUrl, apiKey } = resolveGeminiTarget(opts);
-  const dryRun = Boolean(opts.dryRun ?? opts["dry-run"]);
-  const configPath = opts.configPath ?? opts["config-path"] ?? join(os.homedir(), ".gemini", "settings.json");
-
-  printHeading("OmniRoute → Gemini CLI (native Gemini /v1beta endpoint)");
-  printInfo(`GOOGLE_GEMINI_BASE_URL: ${baseUrl}   (root — SDK appends /v1beta)`);
-
-  let model = opts.model;
-  if (!model) {
-    const ids = await fetchGeminiModelIds(baseUrl, apiKey);
-    if (ids.length && !opts.yes) {
-      printInfo(`Examples: ${ids.slice(0, 20).join(", ")}${ids.length > 20 ? " …" : ""}`);
-      const prompt = createPrompt();
-      try {
-        model = await prompt.ask("Model id for Gemini CLI");
-      } finally {
-        prompt.close();
-      }
-    }
-  }
-  if (!model) {
-    printError("A model is required. Pass --model <id>.");
-    return 2;
-  }
-
-  if (dryRun) {
-    console.log(`\n── [dry-run] ${configPath} ── { "model": "${model}" }`);
-  } else {
-    const merged = buildGeminiSettings(readJson(configPath), { model });
-    mkdirSync(join(configPath, ".."), { recursive: true });
-    writeFileSync(configPath, JSON.stringify(merged, null, 2) + "\n", "utf8");
-    printSuccess(`Wrote ${configPath} (model)`);
-  }
-
-  printInfo("\nThe base URL is env-only for Gemini CLI — export these:");
-  console.log(buildGeminiRecipe({ baseUrl, model }));
-  printInfo("\n⚠  If Gemini CLI ignores the base URL, you have a cached Google login —");
-  printInfo("   run logged-out (API-key only) so GOOGLE_GEMINI_BASE_URL takes effect.");
-  return 0;
-}
-
-export function registerSetupGemini(program) {
-  program
-    .command("setup-gemini")
-    .description("Point the Gemini CLI at OmniRoute's native Gemini /v1beta endpoint (env recipe + settings model)")
-    .option("--port <port>", "Local OmniRoute port (ignored when --remote is set)", "20128")
-    .option("--remote <url>", "Remote OmniRoute URL, e.g. http://192.168.0.15:20128")
-    .option("--api-key <key>", "OmniRoute API key (defaults to OMNIROUTE_API_KEY env var)")
-    .option("--model <id>", "Model id for Gemini CLI (required unless picked interactively)")
-    .option("--config-path <path>", "settings.json path (default: ~/.gemini/settings.json)")
-    .option("--yes", "Non-interactive: do not prompt (requires --model)")
-    .option("--dry-run", "Print what would be written without touching the filesystem")
-    .action(async (opts) => {
-      const code = await runSetupGeminiCommand(opts);
-      if (code !== 0) process.exit(code);
-    });
-}

bin/cli/commands/setup-qwen.mjs

@@ -1,7 +1,7 @@
 /**
  * omniroute setup-qwen — configure Qwen Code (QwenLM/qwen-code) for OmniRoute.
  *
- * Qwen Code is a terminal AI agent (gemini-cli fork) with a file-based config at
+ * Qwen Code is a terminal AI agent with a file-based config at
  * ~/.qwen/settings.json. For a custom OpenAI-compatible endpoint it uses a
  * `modelProviders` entry with authType "openai", baseUrl WITH /v1, and an
  * `envKey` naming the env var holding the key (secret stays in the env, never the
@@ -47,7 +47,9 @@ export function resolveQwenTarget(opts = {}) {
 /** Merge the OmniRoute modelProvider into Qwen's settings.json (preserve rest). */
 export function buildQwenSettings(existing, { baseUrl, model }) {
   const s = existing && typeof existing === "object" ? { ...existing } : {};
-  const providers = Array.isArray(s.modelProviders) ? s.modelProviders.filter((p) => p?.id !== "omniroute") : [];
+  const providers = Array.isArray(s.modelProviders)
+    ? s.modelProviders.filter((p) => p?.id !== "omniroute")
+    : [];
   providers.push({
     id: "omniroute",
     name: "OmniRoute",
@@ -82,7 +84,7 @@ async function fetchModelIds(baseUrl, apiKey) {
     });
     if (!res.ok) return [];
     const body = await res.json();
-    const list = Array.isArray(body) ? body : body.data ?? body.models ?? [];
+    const list = Array.isArray(body) ? body : (body.data ?? body.models ?? []);
     return list.map((m) => (typeof m === "string" ? m : m?.id)).filter(Boolean);
   } catch {
     return [];
@@ -92,7 +94,8 @@ async function fetchModelIds(baseUrl, apiKey) {
 export async function runSetupQwenCommand(opts = {}) {
   const { baseUrl, apiKey } = resolveQwenTarget(opts);
   const dryRun = Boolean(opts.dryRun ?? opts["dry-run"]);
-  const configPath = opts.configPath ?? opts["config-path"] ?? join(os.homedir(), ".qwen", "settings.json");
+  const configPath =
+    opts.configPath ?? opts["config-path"] ?? join(os.homedir(), ".qwen", "settings.json");
 
   printHeading("OmniRoute → Qwen Code (openai-compatible)");
   printInfo(`baseUrl: ${baseUrl}`);
@@ -126,7 +129,9 @@ export async function runSetupQwenCommand(opts = {}) {
     writeFileSync(configPath, out, "utf8");
     printSuccess(`Wrote ${configPath}`);
   }
-  printInfo("\nProvide the key (settings reference OMNIROUTE_API_KEY):  export OMNIROUTE_API_KEY=...");
+  printInfo(
+    "\nProvide the key (settings reference OMNIROUTE_API_KEY):  export OMNIROUTE_API_KEY=..."
+  );
   printInfo('Then run:  qwen        (or headless: qwen -p "reply OK")');
   return 0;
 }
@@ -134,7 +139,9 @@ export async function runSetupQwenCommand(opts = {}) {
 export function registerSetupQwen(program) {
   program
     .command("setup-qwen")
-    .description("Configure Qwen Code for OmniRoute: write ~/.qwen/settings.json (openai modelProvider)")
+    .description(
+      "Configure Qwen Code for OmniRoute: write ~/.qwen/settings.json (openai modelProvider)"
+    )
     .option("--port <port>", "Local OmniRoute port (ignored when --remote is set)", "20128")
     .option("--remote <url>", "Remote OmniRoute URL, e.g. http://192.168.0.15:20128")
     .option("--api-key <key>", "OmniRoute API key (defaults to OMNIROUTE_API_KEY env var)")

bin/cli/locales/en.json

@@ -241,7 +241,9 @@
     "no_recovery": "Disable auto-restart on crash (debugging mode)",
     "max_restarts": "Max crash restarts within 30s before giving up (default: 2)",
     "tray": "Show system tray icon (desktop only, opt-in)",
-    "no_tray": "Disable system tray icon"
+    "no_tray": "Disable system tray icon",
+    "tls_cert": "Path to a TLS certificate (PEM) to serve HTTPS (also OMNIROUTE_TLS_CERT)",
+    "tls_key": "Path to the TLS private key (PEM) to serve HTTPS (also OMNIROUTE_TLS_KEY)"
   },
   "backup": {
     "title": "Backup",

bin/cli/output.mjs

@@ -37,6 +37,7 @@ function inferSchema(sample) {
 function formatCell(v, col) {
   if (v == null) return "";
   if (col.formatter) return col.formatter(v);
+  if (typeof v === "object") return JSON.stringify(v);
   return String(v);
 }
 

bin/cli/runtime/processSupervisor.mjs

@@ -8,6 +8,7 @@ import {
   computeRestartDelayMs,
   waitUntilPortFree,
 } from "./supervisorPolicy.mjs";
+import { buildNodeHeapArgs } from "../../../scripts/build/runtime-env.mjs";
 
 const CRASH_LOG_LINES = 50;
 
@@ -30,22 +31,36 @@ export class ServerSupervisor {
     this.crashLog = [];
 
     const showLog = process.env.OMNIROUTE_SHOW_LOG === "1";
-    this.child = spawn("node", [`--max-old-space-size=${this.memoryLimit}`, this.serverPath], {
+    // #5238: skip the explicit CLI --max-old-space-size when the user pinned the
+    // heap via NODE_OPTIONS (a CLI arg would shadow/override their value). The
+    // calibrated heap is already carried by env.NODE_OPTIONS either way.
+    const heapArgs = buildNodeHeapArgs(process.env, this.memoryLimit);
+    // #6321: stdout used to be discarded (`"ignore"`) whenever `--log`/OMNIROUTE_SHOW_LOG
+    // wasn't set (the default) — any debug/pino output written to stdout vanished
+    // silently, so a boot that never becomes ready looked like a dead hang with zero
+    // output even at APP_LOG_LEVEL=debug. Pipe stdout too and buffer it alongside
+    // stderr so a readiness timeout can surface what the child actually printed.
+    this.child = spawn("node", [...heapArgs, this.serverPath], {
       cwd: dirname(this.serverPath),
       env: this.env,
-      stdio: showLog ? "inherit" : ["ignore", "ignore", "pipe"],
+      stdio: showLog ? "inherit" : ["ignore", "pipe", "pipe"],
     });
 
     writePidFile("server", this.child.pid);
 
+    const bufferOutput = (data) => {
+      const lines = data.toString().split("\n").filter(Boolean);
+      this.crashLog.push(...lines);
+      if (this.crashLog.length > CRASH_LOG_LINES) {
+        this.crashLog = this.crashLog.slice(-CRASH_LOG_LINES);
+      }
+    };
+
+    if (this.child.stdout) {
+      this.child.stdout.on("data", bufferOutput);
+    }
     if (this.child.stderr) {
-      this.child.stderr.on("data", (data) => {
-        const lines = data.toString().split("\n").filter(Boolean);
-        this.crashLog.push(...lines);
-        if (this.crashLog.length > CRASH_LOG_LINES) {
-          this.crashLog = this.crashLog.slice(-CRASH_LOG_LINES);
-        }
-      });
+      this.child.stderr.on("data", bufferOutput);
     }
 
     this.child.on("error", (err) => this.handleExit(-1, err));
@@ -102,6 +117,12 @@ export class ServerSupervisor {
     }, delay);
   }
 
+  // #6321: exposes the buffered stdout+stderr lines so a caller (e.g. a readiness
+  // timeout) can print what the child actually said instead of silence.
+  getRecentLog() {
+    return [...this.crashLog];
+  }
+
   dumpCrashLog() {
     console.error("\n--- Server crash log ---");
     this.crashLog.forEach((l) => console.error(l));

bin/cli/tray/index.mjs

@@ -5,10 +5,12 @@ let active = null;
 
 export { isTraySupported };
 
-export function initTray({ port, onQuit, onOpenDashboard, onShowLogs }) {
+export async function initTray({ port, onQuit, onOpenDashboard, onShowLogs }) {
   if (!isTraySupported()) return null;
   const ctx = { port, onQuit, onOpenDashboard, onShowLogs };
-  active = process.platform === "win32" ? initWinTray(ctx) : initSystrayUnix(ctx);
+  // initSystrayUnix is async: it lazily installs/loads systray2 from the runtime
+  // dir (trayRuntime.ts) rather than from node_modules. (#4605)
+  active = process.platform === "win32" ? initWinTray(ctx) : await initSystrayUnix(ctx);
   return active;
 }
 

bin/cli/tray/traySystray.mjs

@@ -14,30 +14,31 @@ export function isTraySupported() {
   return true;
 }
 
-function loadSystray2() {
-  const candidates = [
-    () => {
-      const { createRequire } = require("module");
-      const req = createRequire(import.meta.url);
-      return req("systray2").default;
-    },
-  ];
-  for (const attempt of candidates) {
-    try {
-      return attempt();
-    } catch {}
-  }
-  return null;
+// systray2 is NOT a static dependency — it is lazily installed into
+// ~/.omniroute/runtime by trayRuntime.ts (loadSystray). The previous inline
+// loader called `require("module")`, which throws `ReferenceError: require is
+// not defined` in this ESM file (package "type":"module"); the throw was
+// silently swallowed, so the tray never appeared on macOS/Linux with no error
+// printed (#4605, regressed in v3.8.34). Delegate to the runtime loader, which
+// resolves systray2 from the runtime dir and surfaces install/import failures.
+async function loadSystray2() {
+  const { loadSystray } = await import("../runtime/trayRuntime.ts");
+  return loadSystray();
 }
 
 function getIconBase64() {
-  const iconPath = join(__dirname, "icons", "icon.png");
+  // Icon ships at bin/cli/tray/icon.png — the previous "icons/icon.png" path
+  // never existed, so the tray was created with an empty icon (#4605).
+  const iconPath = join(__dirname, "icon.png");
   if (existsSync(iconPath)) return readFileSync(iconPath).toString("base64");
   return "";
 }
 
-export function initSystrayUnix({ port, onQuit, onOpenDashboard, onShowLogs }) {
-  const SysTray = loadSystray2();
+export async function initSystrayUnix(
+  { port, onQuit, onOpenDashboard, onShowLogs },
+  loadCtor = loadSystray2
+) {
+  const SysTray = await loadCtor();
   if (!SysTray) return null;
 
   const autostartEnabled = isAutostartEnabled();
@@ -57,7 +58,10 @@ export function initSystrayUnix({ port, onQuit, onOpenDashboard, onShowLogs }) {
     tray = new SysTray({
       menu: {
         icon: getIconBase64(),
-        isTemplateIcon: process.platform === "darwin",
+        // isTemplateIcon must be false: icon.png is a full-color RGBA logo, and
+        // macOS template mode uses only the alpha channel → a solid white square
+        // (the icon looked "missing" even when the tray loaded). (PR #1080)
+        isTemplateIcon: false,
         title: "",
         tooltip: `OmniRoute — port ${port}`,
         items,

bin/cli/utils/pid.mjs

@@ -65,34 +65,52 @@ export function sleep(ms) {
 // cold start due to filesystem watchers, antivirus, etc.) get a working
 // "server ready" signal instead of a phantom timeout while the server is
 // still booting. TCP fallback marks the server as ready when the port
-// has been listening for >= 3s consecutively but /api/monitoring/health
-// has not yet been mounted — common during dev cold start.
+// has been listening for >= 3s consecutively AND the health route is
+// actively rejecting/resetting connections fast (route not mounted yet,
+// but the HTTP server is clearly alive and responsive) — never for a
+// socket that merely accepts TCP and then hangs without ever completing
+// a single request (#6800: that's a still-booting/CPU-bound process, not
+// a "route not mounted" gap, and must NOT be reported as ready).
 export async function waitForServer(port, timeout = 60000) {
   const start = Date.now();
   let tcpListeningSince = null;
   while (Date.now() - start < timeout) {
-    try {
-      const res = await fetch(`http://localhost:${port}/api/monitoring/health`, {
-        signal: AbortSignal.timeout(2000),
-      });
-      if (res.ok) return true;
-      // Server responded but health endpoint is not ready yet — keep
-      // polling, but the fact that we got a response means TCP is open.
+    const outcome = await pollHealthOnce(port);
+    if (outcome === "ready") return true;
+    if (outcome === "fast-reject") {
       if (tcpListeningSince === null) tcpListeningSince = Date.now();
-    } catch {
-      const listening = await isPortListening(port).catch(() => false);
-      if (listening) {
-        if (tcpListeningSince === null) tcpListeningSince = Date.now();
-        if (Date.now() - tcpListeningSince >= 3000) return true;
-      } else {
-        tcpListeningSince = null;
-      }
+      if (Date.now() - tcpListeningSince >= 3000) return true;
+    } else {
+      // "hanging" (request timed out with no response at all) or
+      // "not-listening" — neither counts toward the grace window.
+      tcpListeningSince = null;
     }
     await sleep(500);
   }
   return false;
 }
 
+// Polls /api/monitoring/health once and classifies the outcome:
+// - "ready": got a 2xx HTTP response.
+// - "fast-reject": got a non-2xx HTTP response, or the connection was
+//   actively refused/reset (not a timeout) — the HTTP server is alive and
+//   answering quickly, just not routing this endpoint yet (#2460).
+// - "hanging": the request timed out waiting for any response — the
+//   process accepted the TCP connection but never answered (#6800).
+// - "not-listening": nothing is accepting connections on the port at all.
+async function pollHealthOnce(port) {
+  try {
+    const res = await fetch(`http://localhost:${port}/api/monitoring/health`, {
+      signal: AbortSignal.timeout(2000),
+    });
+    return res.ok ? "ready" : "fast-reject";
+  } catch (err) {
+    if (err?.name === "TimeoutError") return "hanging";
+    const listening = await isPortListening(port).catch(() => false);
+    return listening ? "fast-reject" : "not-listening";
+  }
+}
+
 async function isPortListening(port) {
   const net = await import("node:net");
   return new Promise((resolve) => {

bin/cold-start-bench.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
-# bin/cold-start-bench.sh — measure OmniRoute cold-start against the budgets in
-# docs/PERF_BUDGETS.md §5 (container start → HTTP listening ≤ 800 ms; first warm
+# bin/cold-start-bench.sh — measure OmniRoute cold-start against the target
+# budgets (container start → HTTP listening ≤ 800 ms; first warm
 # TTFB ≤ 200 ms). Boots the server on a throwaway port, times until
 # /api/health/ping answers 200, measures a warm request, and reports PASS/FAIL.
 set -euo pipefail
@@ -13,7 +13,7 @@ Usage: bin/cold-start-bench.sh [--port <n>] [--start-cmd "<cmd>"] [--url <base>]
                                [--listen-budget-ms <n>] [--ttfb-budget-ms <n>] [-h|--help]
 
 Boots OmniRoute, times cold-start to the first /api/health/ping 200, measures
-warm TTFB, and compares against the PERF_BUDGETS.md §5 budgets
+warm TTFB, and compares against the cold-start budgets
 (listen ≤ 800 ms, TTFB ≤ 200 ms). Exits non-zero if a budget is exceeded.
 
 --url benches an already-running server instead of booting one (skips the boot

bin/nodeRuntimeSupport.mjs

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 
 export const SECURE_NODE_LINES = Object.freeze([
-  Object.freeze({ major: 20, minor: 20, patch: 2 }),
   Object.freeze({ major: 22, minor: 22, patch: 2 }),
   Object.freeze({ major: 24, minor: 0, patch: 0 }),
   Object.freeze({ major: 25, minor: 0, patch: 0 }),
@@ -9,9 +8,9 @@ export const SECURE_NODE_LINES = Object.freeze([
 ]);
 
 export const RECOMMENDED_NODE_VERSION = "24.14.1";
-export const SUPPORTED_NODE_RANGE = ">=20.20.2 <21 || >=22.22.2 <23 || >=24.0.0 <27";
+export const SUPPORTED_NODE_RANGE = ">=22.22.2 <23 || >=24.0.0 <27";
 export const SUPPORTED_NODE_DISPLAY =
-  "Node.js 20.20.2+ (20.x LTS), 22.22.2+ (22.x LTS), 24.0.0+ (24.x LTS), 25.0.0+ (25.x), or 26.0.0+ (26.x)";
+  "Node.js 22.22.2+ (22.x LTS), 24.0.0+ (24.x LTS), 25.0.0+ (25.x), or 26.0.0+ (26.x)";
 
 function formatVersion(version) {
   return `${version.major}.${version.minor}.${version.patch}`;
@@ -78,7 +77,7 @@ export function getNodeRuntimeWarning(version = process.versions.node) {
   }
 
   if (support.reason === "unreleased-major") {
-    return `Node.js ${support.nodeVersion} is outside the supported LTS lines. OmniRoute currently supports Node.js 20.x, 22.x, 24.x, 25.x, and 26.x.`;
+    return `Node.js ${support.nodeVersion} is outside the supported LTS lines. OmniRoute currently supports Node.js 22.x, 24.x, 25.x, and 26.x.`;
   }
 
   return `Node.js ${support.nodeVersion} is outside OmniRoute's approved secure runtime policy.`;

bin/omniroute.mjs

@@ -6,6 +6,7 @@
  * Special bypasses (handled before Commander):
  *   --mcp                     Start MCP server over stdio
  *   reset-encrypted-columns   Recovery tool for broken encrypted credentials
+ *   reset-password            Reset the admin/management password
  *
  * All other commands are routed through Commander (bin/cli/program.mjs).
  */
@@ -210,6 +211,15 @@ if (process.argv.includes("reset-encrypted-columns")) {
   process.exit(exitCode ?? 0);
 }
 
+if (process.argv.includes("reset-password")) {
+  // bin/reset-password.mjs self-executes its `main()` on import and calls
+  // process.exit() on completion/error. Await a never-resolving promise so
+  // control never falls through to Commander (which would then reject
+  // `reset-password` as an unknown command). See #6261.
+  await import(pathToFileURL(join(ROOT, "bin", "reset-password.mjs")).href);
+  await new Promise(() => {});
+}
+
 try {
   const { createProgram } = await import(
     pathToFileURL(join(ROOT, "bin", "cli", "program.mjs")).href

bin/reset-password.mjs

@@ -5,10 +5,15 @@
  *
  * Usage:
  *   node bin/reset-password.mjs
- *   npx omniroute reset-password
+ *   omniroute reset-password
+ *
+ * Non-interactive / scripted usage (piped stdin, e.g. CI or Docker):
+ *   printf 'NewPass123\nNewPass123\n' | omniroute reset-password
+ *   printf 'NewPass123' | omniroute reset-password --password-stdin
  *
  * Resets the admin password for OmniRoute.
- * Prompts for a new password and updates the database directly.
+ * Prompts for a new password (interactive TTY) or reads it from stdin
+ * (non-TTY) and updates the database directly.
  *
  * @module bin/reset-password
  */
@@ -21,19 +26,61 @@ import { readManagementPasswordState, resetManagementPassword } from "./cli/sqli
 const DATA_DIR = resolveDataDir();
 const DB_PATH = resolveStoragePath(DATA_DIR);
 
-const rl = createInterface({
-  input: process.stdin,
-  output: process.stdout,
-});
+const MIN_PASSWORD_LENGTH = 8;
 
-function ask(question) {
-  return new Promise((resolve) => rl.question(question, resolve));
+/** Read the entire stdin stream as a UTF-8 string (used for non-TTY input). */
+function readAllStdin() {
+  return new Promise((resolve) => {
+    let data = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => {
+      data += chunk;
+    });
+    process.stdin.on("end", () => resolve(data));
+    process.stdin.on("error", () => resolve(data));
+    // Resuming is implied by attaching a 'data' listener, but be explicit so a
+    // paused stream (some spawn setups) still flows to EOF.
+    process.stdin.resume();
+  });
 }
 
-function exitWithError(message) {
-  console.error(message);
-  rl.close();
-  process.exit(1);
+/**
+ * Obtain the new password (and its confirmation).
+ *
+ * - `--password-stdin`: the ENTIRE stdin is the password, no confirmation.
+ * - non-TTY stdin (piped): read all of stdin once; first line is the password,
+ *   second line — when present — is the confirmation, else the first line is
+ *   reused (a single-line pipe means "no separate confirmation").
+ * - interactive TTY: two sequential prompts (unchanged behavior).
+ *
+ * The non-TTY path exists because two sequential `rl.question` promises never
+ * settle under a piped EOF — the second read blocks forever, so the reset was
+ * silently never applied (#6258).
+ */
+async function collectPassword() {
+  if (process.argv.includes("--password-stdin")) {
+    const raw = await readAllStdin();
+    const password = raw.replace(/[\r\n]+$/, "");
+    return { password, confirm: password };
+  }
+
+  if (!process.stdin.isTTY) {
+    const raw = await readAllStdin();
+    const lines = raw.split(/\r?\n/);
+    const password = lines[0] ?? "";
+    const confirm = lines[1] ? lines[1] : password;
+    return { password, confirm };
+  }
+
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const ask = (question) => new Promise((resolve) => rl.question(question, resolve));
+    const password = await ask("Enter new password (min 8 chars): ");
+    const confirm = await ask("Confirm new password: ");
+    return { password, confirm };
+  } finally {
+    rl.close();
+  }
 }
 
 console.log("\n🔑 OmniRoute — Password Reset\n");
@@ -54,27 +101,34 @@ async function main() {
     console.log("ℹ️  No password is currently set.");
   }
 
-  const password = await ask("Enter new password (min 8 chars): ");
+  const { password, confirm } = await collectPassword();
 
-  if (!password || password.length < 8) {
-    exitWithError("\n❌ Password must be at least 8 characters.\n");
+  if (!password || password.length < MIN_PASSWORD_LENGTH) {
+    console.error(`\n❌ Password must be at least ${MIN_PASSWORD_LENGTH} characters.\n`);
+    process.exit(1);
   }
 
-  const confirm = await ask("Confirm new password: ");
-
   if (password !== confirm) {
-    exitWithError("\n❌ Passwords do not match.\n");
+    console.error("\n❌ Passwords do not match.\n");
+    process.exit(1);
   }
 
   await resetManagementPassword(password, DB_PATH);
-  rl.close();
 
   console.log("\n✅ Password reset successfully!");
   console.log("   Restart OmniRoute for changes to take effect.\n");
 }
 
-main().catch((err) => {
-  console.error(`\n❌ Error: ${err.message}\n`);
-  rl.close();
-  process.exit(1);
-});
+main()
+  .then(() => {
+    // Explicit exit(0) so a caller that imports this module (bin/omniroute.mjs
+    // routes `omniroute reset-password` here) terminates cleanly instead of
+    // hanging / exiting with code 13 on an unsettled wrapper await. On POSIX,
+    // console.log to a pipe is synchronous, so the success line is already
+    // flushed by the time we exit.
+    process.exit(0);
+  })
+  .catch((err) => {
+    console.error(`\n❌ Error: ${err.message}\n`);
+    process.exit(1);
+  });

bin/restore-data.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # bin/restore-data.sh — restore the OmniRoute SQLite data volume from a snapshot
-# created by bin/snapshot-data.sh. Used by the data-layer incident runbook
-# (docs/INCIDENT_RESPONSE.md §4.4) after stopping writers.
+# created by bin/snapshot-data.sh. Used by the data-layer incident-recovery
+# flow after stopping writers.
 #
 # Safety: takes a pre-restore snapshot of the CURRENT data, refuses to run
 # unattended without --yes, and verifies the snapshot before overwriting.

bin/restore-policies.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # bin/restore-policies.sh — restore ONLY the API-key policy tables from a
 # snapshot, leaving request/audit/runtime state intact. Used by the auth-layer
-# incident runbook (docs/INCIDENT_RESPONSE.md §4.3) when policies_active is empty
+# incident-recovery flow when policies_active is empty
 # but the rest of the database is healthy (so a full restore-data is overkill).
 #
 # "Policy" tables = api_key* definition tables (the key + its limits/allowed

bin/rollback.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # bin/rollback.sh — roll OmniRoute back to a previous release to mitigate a bad
-# deploy. Used by the incident runbook (docs/INCIDENT_RESPONSE.md §3 / §4).
+# deploy. Part of the deploy-rollback incident-recovery flow.
 #
 # Methods (auto-detected; override with --method):
 #   • npm    — `npm install -g omniroute@<version>` and, if PM2 manages it,

bin/snapshot-data.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # bin/snapshot-data.sh — consistent point-in-time snapshot of the OmniRoute data
-# volume (the SQLite store under $DATA_DIR). Used by the data-layer incident
-# runbook (docs/INCIDENT_RESPONSE.md §4.4) before any restore.
+# volume (the SQLite store under $DATA_DIR). Used by the data-layer
+# incident-recovery flow before any restore.
 #
 # Output: a directory $DB_BACKUPS_DIR/snapshot_<UTC>[_<label>] holding a
 # `VACUUM INTO` copy of storage.sqlite (consistent even with WAL writers active)

changelog.d/README.md

@@ -0,0 +1,42 @@
+# changelog.d/ — changelog fragments
+
+**A PR never edits `CHANGELOG.md` directly during the cycle.** Instead it adds ONE new
+file here — its changelog entry as a *fragment*. Two PRs never touch the same file, so
+changelog merge conflicts (the "CHANGELOG-eat" cascade that forced a re-sync push + full
+CI re-run after every sibling merge) are structurally impossible.
+
+## Convention
+
+| Directory      | Aggregates under        |
+| -------------- | ----------------------- |
+| `features/`    | `### ✨ New Features`   |
+| `fixes/`       | `### 🐛 Bug Fixes`      |
+| `maintenance/` | `### 📝 Maintenance`    |
+
+- **Filename**: `<PR-number>-<short-slug>.md` (e.g. `fixes/6700-dockerfile-better-sqlite3.md`).
+  The PR number prefix keeps aggregation order deterministic.
+- **Content**: the exact bullet line(s) that should land in `CHANGELOG.md`, starting with
+  `- `. Multi-line (continuation) bullets are fine. Keep the repo's credit format:
+  `(#PR — thanks @user)`.
+- One fragment per PR (rarely more, e.g. a PR that both fixes and adds).
+
+## Example
+
+`changelog.d/fixes/6496-cloudflare-relay-worker-syntax.md`:
+
+```markdown
+- **fix(providers):** Cloudflare relay Worker deploys use Service Worker syntax with `body_part` metadata ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)) — thanks @SeaXen
+```
+
+## Aggregation
+
+The release captain (or `/generate-release`) folds all fragments into `CHANGELOG.md` and
+deletes them:
+
+```bash
+node scripts/release/aggregate-changelog.mjs            # write + delete fragments
+node scripts/release/aggregate-changelog.mjs --dry-run  # preview only
+```
+
+Fragment well-formedness is enforced by `npm run check:changelog-integrity` (the same
+gate that guards against CHANGELOG-eat for legacy direct edits).

config/i18n.json

@@ -340,6 +340,14 @@
       "native": "中文 (简体)",
       "english": "Chinese (Simplified)",
       "flag": "🇨🇳"
+    },
+    {
+      "code": "zh-TW",
+      "label": "ZH-TW",
+      "name": "中文 (繁體)",
+      "native": "中文 (繁體)",
+      "english": "Chinese (Traditional)",
+      "flag": "🇹🇼"
     }
   ]
 }

config/quality/complexity-baseline.json

@@ -1,6 +1,19 @@
 {
   "_comment": "Catraca de complexidade (check-complexity.mjs, ESLint core rules complexity>=15 e max-lines-per-function>80 sobre src+open-sse+electron+bin via eslint.complexity.config.mjs). Conta total de violacoes; so pode cair. --update ratcheta.",
-  "count": 1980,
+  "count": 2056,
+  "_rebaseline_2026_07_10_v3847_merge_burst": "2053->2054 (+1). Drift herdado do merge burst do dia em release/v3.8.47 (campanha /implement-prs: ~36 PRs mergeados — órfãos, features do dono, ports). O check:complexity NÃO roda no fast-path PR->release, então o ramo acumulou o +1 sem rebaselinar (mesma família de todos os rebaselines abaixo). Trust-but-verify: medido 2054 no tip da release pós-burst; a única função flagada nova é pré-existente (getResolvedModelCapabilities em modelCapabilities.ts, já >teto antes de #6714). Nenhum PR órfão/feature introduz violação NOVA — os fixes deste ciclo são complexity-net-zero. Rebaseline aprovado pelo dono (2026-07-10) para destravar o FQG dos ~7 órfãos verdes-exceto-complexity. Tighten via --update next cycle.",
+  "_rebaseline_2026_07_10_gcf_v3_2": "2054->2056 (+2). PR feat/headroom-gcf-v3.2-nested-flattening: own growth from re-vendoring the GCF (Headroom) codec to spec v3.2 (nested flattening). The 2 new over-threshold functions are the v3.2 `>`-path flatten/unflatten walk in the vendored generic-profile encode/decode paths (open-sse/services/compression/engines/headroom/gcf/{generic,decode_generic}.ts). This is imported third-party code kept byte-faithful to upstream gcf-typescript, not extractable without diverging from the vendored source; local measures 2055 on the merged tree; frozen at 2056 = the base's CI-observed 2054 + this PR's 2 new functions, matching the documented local-vs-CI off-by-one convention (see _rebaseline_2026_07_02_v3844_ci_observed) so the GitHub runner stays green. Round-trip guarded by tests/unit/compression/headroom-smartcrusher.test.ts (deep-nested case). Structural shrink belongs upstream in gcf, not here.",
+  "_rebaseline_2026_07_08_6556_inherited_drift": "2052->2053 (+1). PR #6556 (omniglyph engine): drift herdado do merge burst da base (a catraca nao roda no fast-path PR->release, mesmo padrao dos rebaselines v3.8.44/46). Trust-but-verify: o proprio codigo do PR e complexity-net-zero — as 2 violacoes que ele introduzia (runCompressionAsync complexity 17 apos o branch do modo omniglyph; OmniglyphContextPageClient 161 linhas) foram CORRIGIDAS por extracao real (engines/omniglyphSingleMode.ts + split do componente em section components), medido: 2055->2053 local; base pura origin/release/v3.8.47 mede 2053 identico. Tighten via --update next cycle.",
+  "_rebaseline_2026_07_07_v3846_release_close": "2035->2050 (+15). v3.8.46 release close (generate-release Phase 0 pre-flight): drift herdado do merge burst do ciclo (39 commits do dia + campanha /review-*). Trust-but-verify: os fixes de base-red do captain (agentSkills path.resolve #6366, catalogo cache #6408, tipagem de teste no-explicit-any, MitmProxyTab suppression) sao complexity-net-zero — check:complexity mede 2050 identico com e sem os fixes (a catraca NAO roda no fast-path PR->release, entao o ramo acumulou sem rebaselinar). Tighten via --update next cycle.",
+  "_rebaseline_2026_07_04_v3844_release_close": "2026->2028 (+2). v3.8.44 release close (generate-release Phase 0/1): drift residual do fim do ciclo medido no tip pos-#6155 (merge burst final: #6155 cooling-panel + #6104 Kenari + #6139/#6128 provider-limits). Trust-but-verify: os 2 fixes de codigo do release-captain (model.ts alias boundary, auggie.ts stdin error handlers) adicionam 0 violacoes NOVAS — eslint.complexity direto nos 2 arquivos flagra apenas funcoes que ja estouravam o limite antes (runStreaming/start ja >80 linhas; resolveModelByProviderInference/getModelInfoCore pre-existentes de #5918), e resolveProviderAlias segue abaixo de 15. Logo o +2 e drift herdado do burst. Tighten via --update next cycle.",
+  "_rebaseline_2026_07_03_v3844_ipfilter_release_green": "2015->2026 (+11). v3.8.44 cycle drift measured on release tip 32e4c906e during the #6131/#5975 release-green rebaseline. Inherited from the merge burst (Quality Ratchet does not run on PR->release fast-gates). route-edge-coverage +7 is my #5975 test comment; the rest is parallel-session drift. Tighten via --update next cycle.",
+  "_rebaseline_2026_07_03_6007_sidecar_manifest": "2007->2015. PR #6007 (re-cut) adds sidecar/provider-manifest header wiring and the public manifest URL helper; the feature files themselves introduce 0 new complexity violations (check-complexity flags none in providerPluginManifestUrl.ts). The +8 vs the 2007 release baseline is inherited release/v3.8.44 drift absorbed at merge (check:complexity measures 2015 on the current release tip). Tighten via --update next cycle / at /generate-release Phase 0.",
+  "_rebaseline_2026_07_02_v3844_ci_observed": "2006->2007 (+1). Local Ubuntu measures 2006 on this tree; the GitHub fast-gates runner measures 2007 (same local-vs-CI off-by-one already documented in _rebaseline_2026_06_26_v3838_release_fast_gate). Use the CI-observed value so the gate is deterministic where it actually runs.",
+  "_rebaseline_2026_07_02_v3844_post_5939": "2003->2006 (+3). Inherited drift from the release/v3.8.44 merges after 3a3d618fe (#5809 audio translations et al.), surfaced by PR fix#5959: check:complexity measures 2006 on the pristine base (cbd08ef78) WITH AND WITHOUT this PR's one-line CLI change (verified by reverting the file and re-measuring) — the PR is complexity-net-zero. Tighten via --update next cycle.",
+  "_rebaseline_2026_07_02_v3844_merge_burst": "1995->2003 (+8). Inherited v3.8.44 cycle drift surfaced by PR #5939: check:complexity measures 2003 on BOTH the pristine release tip (3a3d618fe) and this PR's merged HEAD — identical, so all +8 came from the 2026-07-02 merge burst into release/v3.8.44 (#5933 codex schema, #5950 OCR, #5904/#5920 combo, #6000/#6008 executor refactors, etc.) merged while the fast-gates queue was base-red (file-size #5933). PR #5939 itself was verified complexity-net-zero during its own CI cycle (DiscoveryPageClient refactored into hooks/sub-components to stay under max-lines-per-function). Tighten via --update next cycle.",
+  "_rebaseline_2026_07_02_5798_release_green": "1982->1995 (+13). Inherited v3.8.43 cycle drift surfaced by the release-green unblock #5798 / PR #5896: check:complexity measures 1995 on BOTH the pristine release tip (0d3875a98) and this PR's HEAD — identical, so all +13 came from the 2026-07-01/02 merge burst (providers/usage/dashboard fixes merged via --admin while the fast-gates queue was base-red). This PR touches only gate scripts, docs, baselines and test files — 0 production logic. Tighten via --update next cycle.",
+  "_rebaseline_2026_07_01_v3843_release": "1981->1982 (+1). v3.8.43 cycle drift, surfaced after check:mutation-test-coverage was fixed (it was masked behind that earlier step in the Fast Quality Gates chain). 1982 = the value measured by check:complexity on BOTH fce85136c (release tip) and 6d7060e21 (release + the 5 CI fixes) — identical, so all +1 is inherited cycle drift; the fixes touch only test files + linkify.ts safeHttpHref (cyclomatic ~4, well under the >=15 threshold, 0 new violations) + config JSON. Tighten via --update next cycle.",
+  "_rebaseline_2026_06_28_v3840_5237_reconcile": "1980->1981 (+1). Inherited release/v3.8.40 drift surfaced while merging PR #5237 (impersonation-UA refresh) — the +1 is present on the pristine release tip (d8a392a47) WITHOUT #5237's changes, so it is #5222 (antigravity fallback-LRU retry) / #5221 (command-code) growth that merged via --admin without ratcheting complexity (the PR->release fast-gates do not run check:complexity). #5237 itself is complexity-net-zero: its only edits are a single UA constant, a regenerated golden snapshot, and baseline JSONs. Structural reduction tracked in #3501.",
   "_rebaseline_2026_06_27_v3838_release": "1978->1980 (+2). v3.8.38 cycle-close drift surfaced by the release-green pre-flight (check:complexity does NOT run on PR->release fast-gates). +2 from late-cycle feature/fix merges (compression fidelity-gate steps #5143, SSE hardening). Release-finalize working tree touches ONLY CHANGELOG.md + i18n mirrors + the 2 baseline JSONs — 0 production-code change. Structural reduction tracked in #3501.",
   "_rebaseline_2026_06_26_v3838_ownerprs_batch": "1972->1978 (+6). Drift do lote de merges de PRs do dono + contribuidores em release/v3.8.38 (sessao /review-prs): #4845 (antigravity convertGeminiToOpenAI), #5105 (executor zenmux-free), #5020 (executor grok-cli), #4940 (usage dedupe guard), #5093 (resilience: quota cutoff/gemini mime/model-lockout cooldown), #5015 (quota hydration + auto-combo scoping). Cada um e crescimento de feature/fix legitimo recem-TDD'd, nao regressao; o gate check:complexity NAO roda no fast-path PR->release, entao o ramo acumula sem rebaselinar (mesma familia dos rebaselines anteriores). #5121 cookie-dedup foi mantido complexity-NEUTRO via extracao do helper findExistingCookieConnection. Reducao estrutural fica como debt (#3501).",
   "_rebaseline_2026_06_26_v3838_release_fast_gate": "1963->1972 (+9). Reconciles inherited release/v3.8.38 drift surfaced by PR #5124. Local origin/release/v3.8.38 measured 1971 and this PR also measured 1971 after refactoring the new JSON-body SSE sniffing path, while the GitHub Ubuntu fast gate measured 1972; use the CI-observed value so the release branch gate is deterministic. The streaming fix is complexity-net-zero relative to the local release base. The release fast-path does not consistently ratchet complexity between release-cycle merges; keep structural reductions as separate debt.",
@@ -24,5 +37,7 @@
   "_rebaseline_2026_06_13_v3825": "Re-baseline consciente: drift 1794->1800 (+6) do ciclo v3.8.24->v3.8.25 (features #3799-#3806). Mesma familia dos re-baselines anteriores — crescimento de feature legitima, nao regressao. Reducao fica como debt de refactor dedicado.",
   "_rebaseline_2026_06_10": "Re-baseline consciente: 1739 foi medido na branch das Fases 0-6 (base ~v3.8.17); a v3.8.18 publicada ja carrega 1746 (provado: o commit-base 5f2722bd6, anterior a qualquer commit do ciclo v3.8.19, mede 1746 — funcoes complexas dos reworks RequestLoggerV2/stream/combo). Mesma familia dos re-baselines de eslintWarnings/file-size. Reducao = Fase 6A (2026-06-16).",
   "_rebaseline_2026_06_13_6a11": "Re-baseline consciente Task 6A.11: escopo ampliado para src+open-sse+electron+bin (electron/bin contribuem 0 violacoes novas — todos os 4 arquivos .ts em bin/ estao abaixo dos thresholds). Drift 1746→1794 pre-existente de features mergeadas nos ciclos v3.8.22/v3.8.23 (nao causado por esta task). Congelado no valor real medido para destrancar o gate.",
-  "_rebaseline_2026_06_26_v3837_release": "1950->1963 (+13). v3.8.37 cycle drift surfaced by the release-green pre-flight (the Quality Ratchet does NOT run on PR->release fast-gates, so warnings/complexity accrued unmeasured across this cycle's 76 commits — provider adds DGrid/Pioneer/xAI, headroom proxy lifecycle #4649, ~50 SSE/translator fixes, Engine Combos #5062). Trust-but-verify: this release-finalize working tree touches ONLY CHANGELOG.md, docs/i18n/*/CHANGELOG.md mirrors, and these baselines — 0 production-code change, so all drift is inherited cycle drift (`any` warn-allowed in open-sse/ + tests/). Tighten via --require-tighten next cycle."
+  "_rebaseline_2026_06_26_v3837_release": "1950->1963 (+13). v3.8.37 cycle drift surfaced by the release-green pre-flight (the Quality Ratchet does NOT run on PR->release fast-gates, so warnings/complexity accrued unmeasured across this cycle's 76 commits — provider adds DGrid/Pioneer/xAI, headroom proxy lifecycle #4649, ~50 SSE/translator fixes, Engine Combos #5062). Trust-but-verify: this release-finalize working tree touches ONLY CHANGELOG.md, docs/i18n/*/CHANGELOG.md mirrors, and these baselines — 0 production-code change, so all drift is inherited cycle drift (`any` warn-allowed in open-sse/ + tests/). Tighten via --require-tighten next cycle.",
+  "_rebaseline_2026_07_06_v3845_release_close": "2028->2035 (+7). v3.8.45 release close (generate-release Phase 0): drift herdado do merge burst final do ciclo (#6216 streaming fixes, #6251/#6253 dashboard UX, #6292 zero-width, fixes do pre-flight ce897453 — todos test/config/workflow-neutros em complexidade nova, verificado pelo validador no tip 5ecca12aa5). Tighten via --update next cycle.",
+  "_rebaseline_2026_07_07_6552_chirag_api_models_filter": "2050->2052 (+2). PR #6552 (@chirag127, #6328): hidePaidModels filter across the 4 dashboard /api/models endpoints adds 2 functions over the complexity threshold. Owner-approved rebaseline (contributor own-growth). Tighten via --update next cycle."
 }

config/quality/dependency-allowlist.json

@@ -24,10 +24,8 @@
     "@testing-library/jest-dom",
     "@testing-library/react",
     "@toon-format/toon",
-    "@types/bcryptjs",
     "@types/better-sqlite3",
     "@types/bun",
-    "@types/keytar",
     "@types/mdx",
     "@types/node",
     "@types/react",
@@ -40,12 +38,14 @@
     "bcryptjs",
     "better-sqlite3",
     "bottleneck",
+    "bun",
     "c8",
     "clsx",
     "commander",
     "concurrently",
     "cross-env",
     "csv-stringify",
+    "dompurify",
     "dpdm",
     "electron",
     "electron-builder",
@@ -91,6 +91,7 @@
     "next-themes",
     "node-loader",
     "node-machine-id",
+    "omniglyph",
     "open",
     "ora",
     "parse5",

config/quality/file-size-baseline.json

@@ -1,5 +1,17 @@
 {
+  "_rebaseline_2026_07_07_v3846_proxy_insecure_random": "PR #6580 (v3.8.46 post-release closing fix): proxies.ts 1173->1177 (+4) — o fix de segurança CodeQL #698/#699 troca Math.random por crypto.randomInt no random rotation strategy (#6365) e adiciona 4 linhas de comentário explicando por que (a seleção flui para credenciais do proxy). Crescimento irreducivel do proprio fix; frozen so encolhe daqui.",
+  "_rebaseline_2026_07_07_v3846_release_close": "Release v3.8.46 Phase 0 (generate-release) — drift de ciclo absorvido no fechamento (fast-gates PR->release nao rodam check:file-size). PROD god-files crescidos por merges do ciclo (nao meus; DECOMPOR idealmente, debt #3501): proxies.ts 1060->1173, chat.ts 1681->1751, ApiManagerPageClient.tsx 3058->3120, ProxyRegistryManager.tsx 1125->1437 (feature de proxy). TEST frozen: models-catalog-route.test.ts 1600->1605 (+5 do fix#2 do captain, #6408 catalogo cache), vscode-token-routes.test.ts 1212->1285 (cycle drift + os asserts effort_tiers/supportsThinking do #6241 alinhados no release-PR-CI base-red), que adiciona o import + 2 chamadas do hook __resetCatalogBuilderRunsForTest existente no setup (harness, sem asserts). Shrink estrutural rastreado no roadmap #3501.",
+  "_rebaseline_2026_07_04_v3844_release_close": "Release v3.8.44 Phase 0 (generate-release): drift de ciclo absorvido no fechamento, medido no tip 415d159c8 (fast-gates PR->release nao rodam check:file-size). oauth/[provider]/[action]/route.ts 924->960 (#6054 zed keychain-import 400 gracioso; PR #6158 aberto extrai o guard e restaura o freeze — quando mergear, o frozen so encolhe), providerLimits.ts 982->998 (#6139 TOCTOU quota recovery + #6128), chat.ts 1647->1662 (#6057 per-request Auto-Combo X-OmniRoute-Mode/Budget + #6097), auth.ts 2405->2426 (#6139 + #6090 quota preflight lockouts + #5943 codex session affinity). Crescimento irreducivel em chokepoints existentes, coberto por testes por-PR; shrink estrutural rastreado no roadmap #3501.",
+  "_rebaseline_2026_07_03_v3844_ipfilter_release_green": "testFrozen bumps: models-catalog-route 1507->1600, perplexity-web 959->999, route-edge-coverage 1234->1241 (last is my #5975 comment +7). v3.8.44 cycle drift measured on release tip 32e4c906e during the #6131/#5975 release-green rebaseline. Inherited from the merge burst (Quality Ratchet does not run on PR->release fast-gates). route-edge-coverage +7 is my #5975 test comment; the rest is parallel-session drift. Tighten via --update next cycle.",
+  "_rebaseline_2026_07_03_v3844_residual_release_green": "Residual file-size drift on tip 716041223: providerLimits.ts 955->982 + accountFallback.ts 1790->1864 (production god-files grown by parallel-session merges e.g. #6128; ideally DECOMPOSE not rebaseline, tracked as debt) + sse-auth.test.ts 1553->1600. None mine.",
   "_comment": "Catraca de tamanho (check-file-size.mjs). frozen so pode encolher; arquivos novos <= cap. --update ratcheta.",
+  "_rebaseline_2026_07_09_pr6647_winget_claude_detect": "PR #6647 (enjoyer-hub, /implement-prs sync): cliRuntime.ts 1100->1110 (split('\\n').length metric; +10, was already exactly at the 1100 frozen cap). Adds the WinGet-installed Claude Code fallback path (%LOCALAPPDATA%\\Microsoft\\WinGet\\Packages\\Anthropic.ClaudeCode_Microsoft.Winget.Source_8wekyb3d8bbwe\\claude.exe) to getKnownToolPaths() alongside the two sibling Claude Code paths, so WinGet installs are auto-detected without CLI_CLAUDE_BIN. The package folder name (62 chars) forces Prettier's 100-char width to break the path.join call across the full 10-line multi-arg form used elsewhere in this same function for long paths; irreducible without changing the shared getKnownToolPaths() structure. Covered by the PR's own regression test (tests/unit/cli-runtime-detection.test.ts, win32-gated).",
+  "_rebaseline_2026_07_03_review_prs_release_green": "Release-green unblock (2026-07-03, /review-prs): the quality.yml fast-gates job was base-red for EVERY PR->release from growth inherited via already-merged PRs on the release tip — no offending PR branch left to fix in-place. Prod frozen raised: ApiManagerPageClient.tsx 3017->3058, OAuthModal.tsx 969->989, cliRuntime.ts 1090->1100, webProvidersA.ts 805->809. Test frozen raised: deepseek-web.test.ts 1081->1092. Real sizes (check-file-size.mjs reported). These stay frozen (cannot grow further); structural shrink tracked under decomposition roadmap #3501; the release captain's rebaseline-at-release supersedes this note. Bundled with the #5695 quick-start test regex fix (multi-line <Link> tolerance) in the same release-green PR.",
+  "_rebaseline_2026_07_02_5798_release_green": "Release-green unblock #5798 / PR #5896 (2026-07-02): the quality.yml fast-gates job was base-red for EVERY PR->release (whole queue failing), from growth inherited via already-merged PRs — no offending PR branch left to fix. Prod frozen raised: AddApiKeyModal.tsx 869->905, providerPageHelpers.ts 996->1021, RequestLoggerV2.tsx 1316->1553, src/sse/services/auth.ts 2403->2405, antigravity.ts 1806->1813, base.ts 1502->1536 (1533 inherited + 3 lines from this PR's own typecheck:core fix in resolveBaseUrl), advancedTools.ts 1118->1120, accountFallback.ts 1783->1790, openai-to-kiro.ts 842->853, openai-responses.ts 1035->1092, stream.ts 2710->2727; new-above-cap frozen: webProvidersA.ts 805, tokenHealthCheck.ts 830. Test frozen raised: cc-compatible-provider 1179->1217, translator-openai-to-kiro 999->1088, web-cookie-providers-new 827->845; new-above-cap: response-sanitizer.test.ts 906. These files remain frozen (cannot grow further); the release captain's rebaseline-at-release supersedes this note.",
+  "_rebaseline_2026_06_30_5552_flat_rate_cost": "Issue #5552 own growth: src/app/api/usage/analytics/route.ts 941->942 (+1 = the `flatRateAsZero: true` cost option at the existing computeUsageRowCost chokepoint, so subscription/cookie-web providers show $0 instead of an inflated per-token estimate in analytics). The flat-rate classifier (isFlatRateProvider + the provider-id set) lives in a new leaf src/lib/usage/flatRateProviders.ts (61 LOC, <cap) and the guard in computeCostFromPricing (src/lib/usage/costCalculator.ts, not baselined). Irreducible 1-line wiring at the analytics chokepoint; covered by tests/unit/flat-rate-cost-5552.test.ts.",
+  "_rebaseline_2026_06_30_5483_force_responses_upstream": "PR #5637 (@KooshaPari, #5483) own growth: open-sse/executors/base.ts 1500->1502 (+2 = import + the single `requestCredentials = withForcedResponsesUpstream(...)` const threaded through buildUrl/buildHeaders/applyConfiguredUserAgent/ccRequestDefaults/transformRequest at the existing fetch-loop chokepoint), open-sse/executors/default.ts 876->877 (+1 = the `_omnirouteForceResponsesUpstream` short-circuit in the buildUrl `/responses` vs `/chat/completions` decision), tests/unit/executor-default-base.test.ts 1477->1523 (+46 = the new regression test that asserts a Responses-shaped MCP request routes to /responses for openai-compatible providers). The detection helpers (shouldForceResponsesUpstream/withForcedResponsesUpstream/isRecord, ~50 LOC) were EXTRACTED out of base.ts into a new leaf open-sse/executors/forceResponsesUpstream.ts (60 LOC, <cap) so the frozen god-file only takes the irreducible 2-line wiring. The contributor PR's incidental prettier reformats were reverted to keep the diff scoped to the fix. Covered by tests/unit/executor-default-base.test.ts.",
+  "_rebaseline_2026_06_30_5598_fusion_defaults": "PR #5598 own growth: ComboDefaultsTab.tsx 846->851 (+5 = import + the `strategy === \"fusion\"` conditional that mounts the new FusionDefaultsFields component). The bulk of the fusion-defaults UI (judgeModel + fusionTuning inputs) was EXTRACTED to a new src/app/(dashboard)/dashboard/settings/components/FusionDefaultsFields.tsx (92 LOC, <cap) to keep the frozen god-file's growth to the minimal wiring. Mirrors the per-combo Fusion editor already rebaselined under #5074 (combos/page.tsx +109). Covered by tests/unit/ui/combo-defaults-fusion-5598.test.tsx.",
+  "_rebaseline_2026_06_29_v3841_release": "callLogs 985->997 + chat 1632->1635 + chatHelpers 811->842 (#5351 opencode visible-rotation-logs/ProxyEgress/SQL-vars), base.ts 1475->1497 + openai-to-claude 805->823 (#5352 thinking hydrate/redacted-replay + #5342 empty-messages guard), accountFallback 1777->1783 (#5346 402 auto-disable depleted key) + account-fallback-service.test 1569->1572 (#5346 test), provider-validation-specialty.test 2801->2843 (#5358 grok cf_clearance + #5337 gemini catalog). Cycle-close drift from merged campaign PRs absorbed at release close per generate-release Phase 0 (the PR->release fast-gates do NOT run check:file-size); all irreducible chokepoint/feature growth next to existing branches, covered by per-PR tests. Structural shrink tracked under decomposition roadmap #3501.",
   "_rebaseline_2026_06_26_v3838_ownerprs_batch": "Lote /review-prs v3.8.38 (PRs do dono + contribuidores): src/lib/db/providers.ts 1093->1107 (+14 = #5121 cookie-dedup branch extraido para o helper findExistingCookieConnection — a extracao reduz a complexidade ciclomatica de createProviderConnection mas adiciona ~14 linhas ao arquivo; trade-off consciente complexity-vs-file-size) e src/lib/usage/usageHistory.ts 934->983 (+49 = #4940 dedup guard SELECT-before-INSERT + endpoint backfill + scheduleStatsEvent debounce). Crescimento de feature/fix legitimo recem-TDD'd; o fast-path PR->release nao roda check:file-size, entao o ramo acumula sem rebaselinar. Reducao estrutural fica como debt (#3501).",
   "_rebaseline_2026_06_26_relgreen_db_test": "Release-green follow-up: tests/unit/db-core-init.test.ts 867->877 (+10 = the invalid-DATA_DIR test now captures the rejection and asserts both Error type AND message — restores net-neutral assert count after #5117's consolidation, satisfying check:test-masking — instead of a single assert.rejects).",
   "_rebaseline_2026_06_26_5074_fusion_editor": "PR #5074 own growth: src/app/(dashboard)/dashboard/combos/page.tsx 4485->4594 (+109 = the Fusion judgeModel + fusionTuning editor block — text/number inputs wired through updateFusionTuning, schema-validated) and tests/unit/combo-config.test.ts 800->881 (testFrozen add: 5 new Fusion-config schema tests). Cohesive UI block at the strategy-conditional editor; combos/page.tsx structural shrink tracked in #3501. Covered by combo-config.test.ts.",
@@ -30,6 +42,8 @@
   "_rebaseline_2026_06_21_4489_sticky_weighted_limit": "PR #4489 (adivekar-utexas) own growth: src/app/(dashboard)/dashboard/combos/page.tsx 4385->4386 (+1 = the new Sticky Weighted Limit input in the weighted advanced section, a single FieldLabelWithHelp + number <input> block gated to strategy===weighted, analogous to the existing stickyRoundRobinLimit field for round-robin) and open-sse/services/combo.ts ->2761 (sticky-weighted feature: weightedStickyTargets state wiring + the isTargetSelectableForWeighted availability pre-filter + exhaustion-aware sticky clearing/migration in handleComboChat + the round-robin sticky pre-filter in handleRoundRobinCombo + the 4 gemini-review fixes — provider guard, startsWith-separator key match, stepGroups dedup, stale-sticky cleanup). Frozen to the merge-tree measurement (release/v3.8.33 base 2649 + the feature) since CI measures the merged tree, not the v3.8.32-based branch tip. Cohesive routing logic at the existing combo dispatch chokepoints; not a movable block. Structural shrink of combo.ts tracked in #3501. Covered by tests/unit/combo-strategy-fallbacks.test.ts (sticky-weighted batching/fallback-migration/stale-clear/nested-availability + RR sticky-clear) and tests/unit/combo-config.test.ts (stickyWeightedLimit schema).",
   "_rebaseline_2026_06_20_reviewprs_mine_r2_filesize": "Reconciliacao file-size pos-lote /review-prs 'apenas minhas' r2: dois frozen cresceram cumulativamente sem bump (cada PR media OK na sua base, mas o crescimento empilhou acima do frozen no tip de merge; o fast-path do release nao roda check:file-size, so release->main). (1) src/shared/constants/pricing.ts 1620->1623 (+3 = linhas de pricing Claude Code (cc) do #4440, sobre o 1620 que o #4447 ja setara para gpt-4.1-mini/nano + o3/o4-mini). (2) open-sse/executors/base.ts 1399->1407 (+8 = handling granular de reasoning_effort para Claude no Copilot do #4443). Ambos dados/wiring coesos nos chokepoints existentes; nao extraiveis. Cobertos por tests/unit (claude-code pricing / base-executor-sanitize-effort + github-claude-reasoning-effort-granular).",
   "_rebaseline_2026_06_22_4647_opencode_go_deepseek": "PR #4647 (DevEstacion/opencode-go DeepSeek V4 Pro effort variants) review feedback: open-sse/executors/base.ts 1407->1414 (+7 = supportsMaxEffortForProvider now opt-ins opencode-go+deepseek so the literal 'max' effort survives the post-transformReasoningEffortForProvider pass — without this, max was silently rewritten to xhigh (OmniRoute's internal top tier) and the opencode-go upstream rejected it. The check is scoped to opencode-go deliberately to preserve the OpenRouter-DeepSeek inverse invariant (pi#4055, asserted by base-executor-sanitize-effort test:OpenRouter DeepSeek normalizes max -> xhigh). The +5 explanatory comment is required: a naive maintainer could otherwise broaden the check to all deepseek models and break the OpenRouter contract. Cohesive at the existing supportsMaxEffortForProvider chokepoint, next to the Claude/CC-compatible check; not extractable. Covered by tests/unit/base-executor-sanitize-effort.test.ts (3 new opencode-go deepseek cases).",
+  "_rebaseline_2026_06_30_v3842_release_basetsl_5480": "v3.8.42 cycle-close file-size reconciliation: open-sse/executors/base.ts 1497->1500 (+3 net = #5480 'gate claude adaptive thinking defaults' — the adaptive-thinking injection is now gated behind the operator's thinking-budget config at the existing transform chokepoint, so default/passthrough no longer force-injects). Cohesive at the existing reasoning/thinking transform site; not extractable. The fast-path release gate (PR->release/**) does not run check:file-size, so this surfaced only on the release PR (PR->main). Covered by tests/unit/base-thinking-budget-config-5312.test.ts + the #5480 gate test.",
+  "_rebaseline_2026_06_30_v3842_release_chatgptweb_compression": "v3.8.42 cycle-close file-size reconciliation (DRIFT measured OK on each PR's base, stacked above frozen at the merge tip; fast-path PR->release/** does not run check:file-size). (1) open-sse/executors/chatgpt-web.ts 2870->3206 (+336 = #5531 portable SHA3-512 sentinel-PoW wiring with the native-vs-fallback digest path + #5536 GPT-5.5 Pro handoff branch; the pure Keccak-f[1600] fallback itself already lives in the separate leaf open-sse/utils/sha3-512.ts — the executor growth is the cohesive call-site/handoff logic, not extractable without hiding the sentinel chokepoint). (2) tests/unit/chatgpt-web.test.ts 2855->3159 (+304 = #5536 GPT-5.5 Pro handoff coverage; pair-file with its executor). (3) open-sse/services/compression/strategySelector.ts 997->1022 (+25 = #5527 T02 honest default-on pipeline inflation guard wiring at the existing finalizeStackedResult choke). All cohesive at existing chokepoints; covered by tests/unit/chatgpt-web-sha3-boringssl-5531.test.ts, chatgpt-web.test.ts (GPT-5.5 Pro), compression-pipeline-inflation-guard.test.ts.",
   "_rebaseline_2026_06_20_4023_web_cookie_noauth_validation": "PR #4023 (oyi77) own growth: src/lib/providers/validation.ts 4450->4518 (+68 = a new validateWebCookieProvider that probes the provider's /models endpoint — 401/403 => AUTH_007 SESSION_EXPIRED, any other status => valid session, empty cookie => invalid, provider-not-in-registry => unsupported — plus a local STANDARD_USER_AGENT const for the probe). Cohesive validator at the validateProviderApiKey dispatch; not extractable. Covered by tests/unit/provider-validation-web-cookie-auth007.test.ts. Heavily curated on merge — the PR's branch was badly stale-based (squash-base-stale), so its tree was DESTRUCTIVE: providers/index.ts deleted live providers openadapter/dit/tokenrouter (added by #4313) and the executor/base.ts edits reverted release fixes (#4037 duckduckgo host, theoldllm gpt5 models, base.ts fetch-start-timeout). Only the purely-additive validation feature was kept (validation.ts validateWebCookieProvider + errorCodes AUTH_007 + the test). Dropped: 5 malformed new registry entries (used non-RegistryEntry fields defaultModel/auth + referenced non-existent executors -> tsc TS2353), the destructive providers/index.ts + executor reverts, the unrelated pr-*.sh automation scripts, and evals/types.ts (belongs to the deferred evals modularization #4422). Also removed the PR's fragile 'Phase 2' executor probe (ran a live upstream chat during validation + classified any 'auth'-containing error as SESSION_EXPIRED) and rewrote the test to install its fetch mock before module load (the original mocked too late and silently hit live chatgpt.com).",
   "_rebaseline_2026_06_20_1308_model_lockout_honors_reset": "port from 9router#1308 own growth: open-sse/services/accountFallback.ts 1731->1752 (+21 = the new exported pure helper selectLockoutCooldownMs + its doc comment — picks the parsed upstream reset as the model-lockout exactCooldownMs when it exceeds the base cooldown, e.g. Antigravity \"Resets in 160h\", else preserves the existing 0/base behavior) and open-sse/executors/antigravity.ts 1680->1686 (this PR +1 = parseRetryFromErrorMessage regex `reset` -> `resets?` so plural \"Resets in 160h27m24s\" matches, plus a comment line; frozen set to the SUM 1686 with the concurrent #1944 which adds +5 at the disjoint passthroughFields region of the same file, so either merge order passes — pair-file rule). The combo lockout call sites in combo.ts now pass selectLockoutCooldownMs(cooldownMs, mlSettings) instead of always base/exponential, so an exhausted model honors the real upstream reset instead of being retried within minutes. Both edits are cohesive at the existing lockout/parse chokepoints; the helper is its own pure function (not extractable further). Covered by tests/unit/combo-model-lockout-honors-reset-1308.test.ts.",
   "_rebaseline_2026_06_20_1944_antigravity_strip_output_config": "port from 9router#1944: open-sse/executors/antigravity.ts frozen set to the measured cumulative 1687 of two concurrent PRs that touch disjoint regions of this file, so either merge order passes (pair-file rule). #1944 adds +6 at the envelope passthroughFields destructuring (~line 759: drop output_config/output_format — Anthropic/Claude-Code-only fields that Google's Cloud Code envelope rejects with `400 Unknown name \"output_config\"`, which broke every Claude model on Antigravity); #1308 adds +1 at parseRetryFromErrorMessage (~line 889: regex reset->resets?). Base 1680 + 6 + 1 = 1687 (re-measured on the real merge tip — the earlier 1686 estimate was off by one). Both edits are cohesive at their chokepoints; not extractable. Covered by tests/unit/antigravity-strip-output-config-1944.test.ts.",
@@ -43,8 +57,8 @@
   "_rebaseline_2026_06_20_4380_parse_once": "PR #4380 own growth: src/sse/handlers/chat.ts 1486->1491 (+5 = thread the once-parsed request body from the route guard into handleChat, replacing the duplicate re-parse). The reusable body accessor lives in the new src/sse/handlers/requestBody.ts (<cap). Thin wiring at the single entry chokepoint; not extractable. Covered by tests/unit/chat-request-body-parse-once-4380.test.ts.",
   "_rebaseline_2026_06_20_escalated_api_airforce_live_discovery": "escalated cmqlvxg4o (WhatsApp): providers/[id]/models/route.ts 2586->2590 (+4 = one NAMED_OPENAI_STYLE_PROVIDERS Set entry `api-airforce` + a 3-line comment). Same fix shape as the provider-sweep rows (#4249/#4202/#3976): api-airforce carries a real live `https://api.airforce/v1/models` catalog but was left out of the sweep, so import served its stale hardcoded seed (grok-3/grok-2-1212/claude-3.7-sonnet …) — models that no longer exist upstream, so chat failed though the connection test still passed. The `<baseUrl>/models` probe (after stripping /chat/completions and a trailing /v1) resolves to https://api.airforce/v1/models; the registry seed stays as the offline fallback so import never breaks. Pure additive Set membership; not extractable (it IS the list). Covered by tests/unit/provider-sweep-live-discovery.test.ts. Structural shrink of this route tracked in #3789.",
   "_rebaseline_2026_06_19_4313_harvest_x_sweep_reconcile": "RECONCILIACAO ao mergear #4313 (5 harvested features) APOS o provider-sweep #4324: valores MEDIDOS na arvore combinada release(com #4324)+#4313. route.ts 2580->2586 (sweep +19 NAMED_OPENAI_STYLE + #4313 +3 openadapter/dit/tokenrouter = uniao no Set, regioes disjuntas). providers.ts 3198->3242 (sweep 6 dead-provider marks + #4313 3 novas entries APIKEY_PROVIDERS). combos/page.tsx 4350->4385 (#4313 #3266 allowlist UI) e providers/page.tsx 1925->1927 (#4313 #4240 serviceKind state) — intocados pelo sweep, crescimento puro do #4313. Mesmo padrao release-volatil de medir-no-merge dos baselines de complexity/zizmor deste lote.",
-  "_rebaseline_2026_06_19_provider_sweep_merge_reconcile": "provider-model-sweep PR merge into release/v3.8.30: the sweep's route.ts growth (NAMED_OPENAI_STYLE_PROVIDERS +19 entries, base 2538->2564) and #4259's cloudflare parseResponse (2538->2554) are disjoint regions that both land, so the merged route.ts frozen value is reconciled to its measured size here. constants/providers.ts carries the sweep's 6 dead-provider deprecation marks on top of release. chatCore.ts stays at #4266's 5128 (sweep does not touch it).",
-  "_rebaseline_2026_06_19_provider_sweep_dead_providers": "provider-model-sweep Track C: src/shared/constants/providers.ts 3169->3198 (+29 = deprecated:true + riskNoticeVariant:\"deprecated\" + a deprecationReason for six providers the sweep confirmed dead — kluster/glhf/predibase/inclusionai/galadriel (DNS no longer resolves) + phind (API shut down 2026-01). Mirrors the existing qwen deprecation-flag pattern; pure additive metadata so the UI surfaces a deprecation notice instead of silently offering a non-working provider. Not extractable (it IS the per-provider constant data).",
+  "_rebaseline_2026_06_19_provider_sweep_merge_reconcile": "provider-model-sweep PR merge into release/v3.8.30: the sweep's route.ts growth (NAMED_OPENAI_STYLE_PROVIDERS +19 entries, base 2538->2564) and #4259's cloudflare parseResponse (2538->2554) are disjoint regions that both land, so the merged route.ts frozen value is reconciled to its measured size here. constants/providers.ts carries the sweep's dead-provider deprecation marks on top of release. chatCore.ts stays at #4266's 5128 (sweep does not touch it).",
+  "_rebaseline_2026_06_19_provider_sweep_dead_providers": "provider-model-sweep Track C: src/shared/constants/providers.ts 3169->3198 (+29 = deprecated:true + riskNoticeVariant:\"deprecated\" + a deprecationReason for providers the sweep confirmed dead — kluster/predibase/inclusionai/galadriel (DNS no longer resolves) + phind (API shut down 2026-01). Mirrors the existing qwen deprecation-flag pattern; pure additive metadata so the UI surfaces a deprecation notice instead of silently offering a non-working provider. Not extractable (it IS the per-provider constant data).",
   "_rebaseline_2026_06_19_provider_sweep_live_discovery_2": "provider-model-sweep cont.: providers/[id]/models/route.ts 2548->2564 (+16 = twelve more NAMED_OPENAI_STYLE_PROVIDERS Set entries `crof`/`featherless-ai`/`ovhcloud`/`sambanova`/`orcarouter`/`uncloseai`/`opencode-go`/`baseten`/`hyperbolic`/`nebius`/`scaleway`/`together` + a 4-line comment). Same fix shape: GPU-cloud / aggregator marketplaces hosting large volatile OSS catalogs, each with a live `<baseUrl>/v1/models` endpoint the sweep probed (200 public or 401/403 = exists+keyed); live fetch keeps the catalog fresh, the registry seed stays as the offline fallback. Pure additive Set membership; not extractable. Covered by tests/unit/provider-sweep-live-discovery.test.ts.",
   "_rebaseline_2026_06_19_provider_sweep_live_discovery": "provider-model-sweep own growth: providers/[id]/models/route.ts 2538->2548 (+10 = seven NAMED_OPENAI_STYLE_PROVIDERS Set entries `venice`/`deepinfra`/`wandb`/`pollinations`/`nscale`/`inference-net`/`moonshot` + a 3-line comment). Same fix shape as #4249 (vercel-ai-gateway) / #4202 (zenmux) / #3976 (llm7/byteplus): each is a keyed format-openai provider that exposes a real live `<baseUrl>/models` catalog (the sweep probed each: venice/deepinfra/pollinations/inference-net public 200, wandb/nscale/moonshot 401 = exists+keyed) but was unclassified by every live-fetch branch, so import served its small hardcoded seed instead of the upstream list, re-staling the catalog the sweep set out to fix. The `<baseUrl>/models` probe (after stripping /chat/completions and a trailing /v1) resolves to the endpoints pinned in tests/unit/provider-sweep-live-discovery.test.ts; the small registry seed stays as the offline fallback so import never breaks. Pure additive Set membership; not extractable (it IS the list). Structural shrink of this route tracked in #3789.",
   "_rebaseline_2026_06_19_4266_pollinations_auth": "PR #4266 own growth: chatCore.ts 5125->5128 (+3 net, +4/-1 at the existing error-classify chokepoint ~line 3514 — preserve numeric HTTP status from executor-thrown errors and set authentication_error type for 401s instead of mapping all to 502). The reusable guard lives at the existing catch chokepoint; not extractable without hiding the error boundary. (Rebased onto release tip 5125 from the PR's original 5111 base.)",
@@ -124,21 +138,24 @@
   "_rebaseline_2026_06_20_4389_thinking_toolchoice": "Re-baseline base.ts 1387->1399 (#4389): tool_choice-forced thinking guard at the existing Claude wire-image injection chokepoint (effThinking gate avoids the Anthropic 400 when tool_choice forces a tool). Cohesive guard; structural shrink tracked in #3501.",
   "cap": 800,
   "frozen": {
+    "_rebaseline_2026_07_02_5816_qoder": "PR #5816 (@AgentKiller45, qoder PAT via qodercli): qoderCli.ts 666->989, new-above-cap frozen (owner-approved baseline freeze). The growth is the legitimate PAT job-token exchange + quota parsing CLI transport (the pure-JS Cosy path 500'd on every PAT request); extracting the spawn/parse helpers now would just add indirection to a contributor PR mid-merge. Test frozen also raised for this PR's coverage growth: providers-page-utils.test.ts 1052->1092. Additionally clears an inherited base-red from the already-merged #5933 (codex json_schema->text.format): translator-openai-responses-req.test.ts 1097->1172 (+75 regression tests, no offending branch left). All remain frozen (cannot grow further); release captain's rebaseline-at-release supersedes.",
+    "open-sse/services/qoderCli.ts": 989,
     "_rebaseline_pr1043_minimax_tts": "Upstream port decolua/9router#1043 (toanalien) own growth: audioSpeech.ts 965->1061 (+96). Adds MiniMax T2A v2 TTS dispatch (handleMinimaxSpeech + hexToBytes helper) — provider entry was already in audioRegistry (format: minimax-tts) but no handler existed, falling through to the OpenAI-compatible default that fails (T2A has custom shape + hex-encoded audio + base_resp envelope). New branch sits next to the other inline provider branches (xiaomi-mimo, coqui, tortoise, aws-polly) — extracting would just create indirection. Covered by tests/unit/minimax-tts-1043.test.ts (3 tests, GREEN: success, base_resp error, invalid-hex).",
     "open-sse/config/providerRegistry.ts": 4731,
-    "open-sse/executors/antigravity.ts": 1806,
-    "open-sse/executors/base.ts": 1475,
-    "open-sse/executors/chatgpt-web.ts": 2870,
+    "open-sse/executors/antigravity.ts": 1813,
+    "open-sse/executors/base.ts": 1540,
+    "open-sse/executors/chatgpt-web.ts": 3206,
     "open-sse/executors/claude-web.ts": 1057,
     "open-sse/executors/codex.ts": 1541,
     "open-sse/executors/cursor.ts": 1577,
     "open-sse/executors/deepseek-web.ts": 1148,
     "_rebaseline_2026_06_22_4644_deepseek_web_tools": "PR #4644 (BugsBag/robust deepseek-web tool-call parsing): open-sse/executors/deepseek-web.ts 1117->1125 (+8). The new agentic tool-call path emits surrounding text + reasoning before tool_calls and swaps to the dedicated deepseekWebTools.ts parser; the +8 lines are cohesive wiring at the existing transformSSE chokepoint (the parser itself lives in the new deepseekWebTools.ts file, already under cap). The PR's own fast-gate (PR->release) does not run check:file-size, so this surfaced only at release reconcile. Covered by tests/unit/deepseek-web-tools-variants.test.ts + deepseek-web-tools-execute.test.ts.",
     "_rebaseline_2026_06_23_4712_deepseek_web_tool_results": "PR for #4712 (deepseek-web drops role:tool): open-sse/executors/deepseek-web.ts 1125->1148 (+23). messagesToPrompt() now folds role:\"tool\" results into the single-prompt transcript (recovering the tool name from the preceding assistant tool_calls by tool_call_id) instead of silently dropping them; the lines are cohesive wiring inside the existing function. Covered by tests/unit/deepseek-web-tool-result-prompt-4712.test.ts.",
+    "_rebaseline_2026_06_28_5237_impersonation_ua_refresh": "PR #5237 (refresh impersonation UAs): grok-web.ts 1871->1873 (+2), muse-spark-web.ts 1284->1302 (+18), perplexity-web.ts 1013->1032 (+19). Net semantic change in each file is a single User-Agent constant (Chrome 147->149 for grok/muse; perplexity kept at Firefox 148 to stay matched with the firefox_148 TLS profile — the contributor's 152 bump was reverted to avoid a UA-vs-JA3 mismatch, #2459). The growth is Prettier reflow that lint-staged unavoidably applies to these grandfathered long-line files the moment they are touched; not extractable. src/sse/services/auth.ts 2336->2401 in the same reconcile is #5222's antigravity-LRU-retry growth that merged via --admin without a baseline bump.",
     "open-sse/executors/duckduckgo-web.ts": 925,
-    "open-sse/executors/grok-web.ts": 1871,
-    "open-sse/executors/muse-spark-web.ts": 1284,
-    "open-sse/executors/perplexity-web.ts": 1013,
+    "open-sse/executors/grok-web.ts": 1873,
+    "open-sse/executors/muse-spark-web.ts": 1302,
+    "open-sse/executors/perplexity-web.ts": 1032,
     "open-sse/handlers/audioSpeech.ts": 1061,
     "open-sse/handlers/chatCore.ts": 5125,
     "open-sse/handlers/imageGeneration.ts": 3777,
@@ -148,67 +165,74 @@
     "open-sse/handlers/videoGeneration.ts": 1265,
     "open-sse/mcp-server/schemas/tools.ts": 1497,
     "open-sse/mcp-server/server.ts": 1555,
-    "open-sse/mcp-server/tools/advancedTools.ts": 1118,
+    "open-sse/mcp-server/tools/advancedTools.ts": 1120,
     "_rebaseline_2026_06_27_5193_antigravity_basered": "Base-red (pre-existing release drift, fast-gate PR->release skips check:file-size): accountFallback.ts 1773->1777 and src/app/api/providers/[id]/test/route.ts 924->940 were already over their frozen caps on release/v3.8.39 independent of any antigravity change. Owner chose to rebaseline (keep the documented issue-reference comments #1846/#1449/#347 etc.) rather than accept the contributor comment-stripping in #5200/#5198. Reverted #5200 to restore the comments; bumped these two frozen caps to the actual base sizes. No logic change.",
-    "open-sse/services/accountFallback.ts": 1777,
-    "open-sse/services/batchProcessor.ts": 828,
+    "open-sse/services/accountFallback.ts": 1864,
+    "open-sse/services/batchProcessor.ts": 915,
     "open-sse/services/browserBackedChat.ts": 850,
     "open-sse/services/claudeCodeCompatible.ts": 1202,
     "_rebaseline_pr4592_exclude_exhausted_auto": "Reconcile #4592 already-merged growth: combo.ts 2991->3036 (+45, terminal-status quota-cutoff exclusion in buildAutoCandidates + opt-in gate). Fast-gate PR->release does not run check:file-size.",
     "_rebaseline_2026_06_24_headroom_strategy": "Headroom-aware connection selection (dario technique): combo.ts 3168->3180 (+12 = a new `else if (strategy === \"headroom\")` dispatch branch in handleComboChat that delegates to orderTargetsByHeadroom + its log line, plus the import). The actual logic lives OUT of the god-file: the pure ranker rankByHeadroom/computeHeadroom is the new leaf open-sse/services/combo/headroomRanking.ts (91 LOC, <cap) and the async orderer orderTargetsByHeadroom is appended to the existing open-sse/services/combo/quotaStrategies.ts (<cap) next to its sibling reset-aware/reset-window orderers (reuses their connection-expansion machinery). headroom = 1 - max(util_5h, util_7d) from getSaturation (src/lib/quota/saturationSignals.ts), prefers the connection with the most free capacity. Only the dispatch wiring is irreducible at the existing combo strategy chokepoint (mirrors the reset-aware/reset-window/context-optimized branches); not extractable without hiding the call site. fill-first stays default; all existing strategies untouched. Covered by tests/unit/combo-headroom-ranking.test.ts (pure helper) + tests/unit/combo-headroom-strategy.test.ts (orderer, saturation injected). Structural shrink of combo.ts tracked in #3501.",
     "_rebaseline_2026_06_24_quota_share_strategy": "Dedicated quota-share strategy (Phase 3 #9): combo.ts 3180->3190 (+10 = one new `else if (strategy === \"quota-share\")` dispatch branch in handleComboChat that delegates 100% to selectQuotaShareTarget + its log line, plus the import). All the new logic lives OUT of the god-file in two new leaves under open-sse/services/combo/: quotaShareInflight.ts (in-flight counter with TTL/lease, ~150 LOC <cap) and quotaShareStrategy.ts (per-model bucket gating via isBucketSaturated + DRR proportional to weight + P2C over in-flight, ~240 LOC <cap). Only the dispatch wiring is irreducible at the existing combo strategy chokepoint (mirrors the headroom/reset-aware/reset-window/context-optimized branches); not extractable without hiding the call site. ZERO existing strategy cases were modified — only this branch was added, and the qtSd/ combos switched from fill-first to quota-share in src/lib/quota/quotaCombos.ts. Covered by tests/unit/quota-share-strategy.test.ts (gating, DRR fairness, P2C in-flight, fail-open, activation). Structural shrink of combo.ts tracked in #3501.",
     "_rebaseline_2026_06_24_task_aware_routing": "Task-aware routing strategy (port PR #2045, OmniRoute #4945): combo.ts 3190->3225 (+35) = one new `else if (strategy === \"task-aware\")` dispatch branch delegating 100% to selectTaskAwareTarget + its imports/log lines. All scoring/classification logic lives OUT of the god-file in the new leaf open-sse/services/taskAwareRouting.ts (553 LOC <cap). Only the dispatch wiring is irreducible at the existing combo strategy chokepoint (mirrors quota-share/headroom/reset-aware branches). ZERO existing strategy cases modified. Covered by tests/unit/combo-task-aware.test.ts (35 tests). Structural shrink of combo.ts tracked in #3501.",
-    "open-sse/services/combo.ts": 3368,
+    "open-sse/services/combo.ts": 3387,
     "_rebaseline_2026_06_26_fidelity_gate_extraction": "Milestone-B fidelity-gate wiring residual: bodyToText+gateAdvance extracted to fidelityGateStep.ts (889->854, -35), but the StackOptions.fidelityGate field, the `const fidelityGate` reads at the two stacked-loop dispatch chokepoints, and the import of FidelityGateConfig are irreducible wiring that cannot leave strategySelector without an architectural refactor of the pre-existing stacked pipeline. Net: 889->854 (+6 vs the pre-Milestone-B frozen 848). Covered by tests/unit/compression/*.test.ts (940 pass).",
-    "open-sse/services/compression/strategySelector.ts": 854,
+    "_rebaseline_2026_06_28_5243_risk_gate_prepass": "PR #5243 (compression risk-gate pre-pass) own growth: open-sse/services/compression/strategySelector.ts 854->899 (+45). The three exported entry points (applyCompression/applyStackedCompression/applyStackedCompressionAsync) become thin wrappers over pure-extracted private bodies (runCompression/runStackedCompression/runStackedCompressionAsync) so the risk-gate mask->run->restore wrapper sits strictly OUTSIDE the per-step loop — a single universal integration point. The wrapper logic itself (resolveRiskGate/withRiskGate) lives in the new riskGate/strategyWrap.ts (<cap); the residual growth is the duplicated thin-wrapper signatures + the extracted bodies' dispatch boundary, guarded by a byte-identical parity test (riskGateIntegration). Default off (DEFAULT_COMPRESSION_CONFIG unchanged). Not extractable without hiding the dispatch boundary, mirroring prior compression rebaselines. Structural shrink tracked in #3501.",
+    "_rebaseline_2026_06_29_5286_memoization": "PR #5286 own growth: strategySelector.ts 899->960 (+61 = the opt-in result-memoization branches in applyCompression/applyCompressionAsync — principal+determinism gate, makeMemoKey lookup/store with model+supportsVision folded into the key, recompute-with-memo-off). Default off (memoizeCompressionResults), so zero behavior change. The memo helpers live in the leaf resultMemo.ts (<cap); the chokepoint wiring here is not extractable. Structural shrink of this hot-path file tracked in #3501.",
+    "open-sse/services/compression/strategySelector.ts": 1043,
+    "_rebaseline_2026_07_10_gcf_v3_2_decode": "PR #6838 own growth: new vendored file open-sse/services/compression/engines/headroom/gcf/decode_generic.ts frozen at 880 (> 800 cap). It is the vendored GCF generic-profile decoder (spec v3.2 nested flattening plus the prototype-pollution / hasOwnProperty hardening added in this PR's Gemini review). Kept as one file faithful to upstream gcf-typescript so re-vendoring stays a clean copy rather than a re-split each cycle (sibling generic.ts/scalar.ts stay < cap; extraction would also fragment the file's frozen eslint no-explicit-any suppressions). Round-trip + prototype-pollution regression coverage in tests/unit/compression/headroom-smartcrusher.test.ts. Frozen: only shrinks from here.",
+    "open-sse/services/compression/engines/headroom/gcf/decode_generic.ts": 880,
     "open-sse/services/rateLimitManager.ts": 1035,
-    "open-sse/services/tokenRefresh.ts": 2103,
+    "_rebaseline_2026_06_29_4038_cas_guard": "PR (#4038) own growth: tokenRefresh.ts 2103->2181 (+78 = the compare-and-swap guard on the refresh persist — runWithCasGuard/getActiveCasGuard AsyncLocalStorage pair mirroring runWithOnPersist, casGuardShouldSkipPersist that rereads the row right before persisting and skips the write when a concurrent writer already rotated the refresh_token past the one presented, plus getCasGuardStats counters). Fixes the sibling-rotation-revert → token-family-revocation storm. Gated behind an active guard (opt-in; no guard => byte-identical). Wiring lives at the two persist chokepoints inside getAccessToken; the comparison reuses wasRefreshTokenRotated from refreshSerializer. Not extractable without splitting the refresh hot path.",
+    "_rebaseline_2026_07_09_6126_clinepass_dual_auth": "PR #6126 (@hajilok, dual-auth ClinePass) own growth: tokenRefresh.ts 2181->2182 (+1 = a single `case \"clinepass\":` fallthrough label added to the existing `case \"cline\":` in _getAccessTokenInternal's provider switch, so clinepass token refresh dispatches to the already-shared refreshClineToken() instead of silently falling through to the generic OAuth refresh). Irreducible 1-line switch-case wiring at the existing chokepoint; the header-building logic for the same feature was extracted to a new leaf src/shared/utils/clineAuth.ts::buildClinepassHeaders() (well under cap) to avoid growing open-sse/executors/default.ts. Covered by tests/unit/clinepass-provider.test.ts.",
+    "_rebaseline_2026_07_09_6363_kiro_external_idp": "PR #6363 (@artickc, Kiro external IdP) own growth: tokenRefresh.ts 2182->2249 (+67 = the external_idp refresh branch inside refreshKiroToken — standard public-client OAuth2 refresh_token grant against the org IdP tokenEndpoint via buildExternalIdpRefreshParams/isExternalIdpAuthMethod from the new leaf open-sse/services/kiroExternalIdp.ts, with invalid_grant/invalid_client -> unrecoverable_refresh_error mapping). Cohesive addition at the existing refreshKiroToken chokepoint. Covered by tests/unit/kiro-external-idp.test.ts.",
+    "open-sse/services/tokenRefresh.ts": 2249,
     "open-sse/services/usage.ts": 3454,
     "open-sse/translator/request/openai-to-gemini.ts": 906,
-    "open-sse/translator/request/openai-to-kiro.ts": 842,
-    "open-sse/translator/response/openai-responses.ts": 1035,
+    "open-sse/translator/request/openai-to-kiro.ts": 912,
+    "open-sse/translator/response/openai-responses.ts": 1092,
     "open-sse/utils/cursorAgentProtobuf.ts": 1521,
-    "open-sse/utils/stream.ts": 2710,
+    "open-sse/utils/stream.ts": 2796,
     "src/app/(dashboard)/dashboard/HomePageClient.tsx": 1385,
     "src/app/(dashboard)/dashboard/analytics/ComboHealthTab.tsx": 1028,
-    "src/app/(dashboard)/dashboard/api-manager/ApiManagerPageClient.tsx": 2983,
+    "src/app/(dashboard)/dashboard/api-manager/ApiManagerPageClient.tsx": 3120,
     "src/app/(dashboard)/dashboard/cache/media/MediaPageClient.tsx": 1105,
     "src/app/(dashboard)/dashboard/cache/page.tsx": 845,
     "src/app/(dashboard)/dashboard/cli-code/components/CodexToolCard.tsx": 900,
     "src/app/(dashboard)/dashboard/cloud-agents/page.tsx": 922,
-    "src/app/(dashboard)/dashboard/combos/page.tsx": 4594,
+    "src/app/(dashboard)/dashboard/combos/page.tsx": 4655,
     "src/app/(dashboard)/dashboard/costs/CostOverviewTab.tsx": 1495,
     "src/app/(dashboard)/dashboard/costs/quota-share/components/PoolWizard.tsx": 1007,
     "src/app/(dashboard)/dashboard/endpoint/EndpointPageClient.tsx": 2612,
     "src/app/(dashboard)/dashboard/health/page.tsx": 1091,
     "src/app/(dashboard)/dashboard/playground/components/tabs/ApiTab.tsx": 847,
-    "src/app/(dashboard)/dashboard/providers/[id]/ProviderDetailPageClient.tsx": 784,
+    "src/app/(dashboard)/dashboard/providers/[id]/ProviderDetailPageClient.tsx": 786,
     "src/app/(dashboard)/dashboard/providers/[id]/components/ConnectionRow.tsx": 942,
-    "src/app/(dashboard)/dashboard/providers/[id]/components/modals/AddApiKeyModal.tsx": 868,
-    "src/app/(dashboard)/dashboard/providers/[id]/components/modals/EditConnectionModal.tsx": 1204,
+    "src/app/(dashboard)/dashboard/providers/[id]/components/modals/AddApiKeyModal.tsx": 961,
+    "src/app/(dashboard)/dashboard/providers/[id]/components/modals/EditConnectionModal.tsx": 1278,
     "src/app/(dashboard)/dashboard/providers/[id]/hooks/useProviderConnections.ts": 954,
     "src/app/(dashboard)/dashboard/providers/[id]/hooks/useProviderModels.ts": 155,
     "src/app/(dashboard)/dashboard/providers/[id]/hooks/useProviderSettings.ts": 264,
-    "src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts": 974,
-    "src/app/(dashboard)/dashboard/providers/components/onboarding/ProviderOnboardingWizard.tsx": 906,
+    "src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts": 1053,
+    "src/app/(dashboard)/dashboard/providers/components/onboarding/ProviderOnboardingWizard.tsx": 912,
     "src/app/(dashboard)/dashboard/providers/page.tsx": 1927,
     "src/app/(dashboard)/dashboard/runtime/RuntimePageClient.tsx": 1201,
     "src/app/(dashboard)/dashboard/settings/components/AppearanceTab.tsx": 819,
-    "src/app/(dashboard)/dashboard/settings/components/ComboDefaultsTab.tsx": 846,
+    "src/app/(dashboard)/dashboard/settings/components/ComboDefaultsTab.tsx": 884,
     "src/app/(dashboard)/dashboard/settings/components/CompressionSettingsTab.tsx": 974,
     "src/app/(dashboard)/dashboard/settings/components/MemorySkillsTab.tsx": 898,
     "src/app/(dashboard)/dashboard/settings/components/PricingTab.tsx": 1012,
-    "src/app/(dashboard)/dashboard/settings/components/ProxyRegistryManager.tsx": 1089,
+    "src/app/(dashboard)/dashboard/settings/components/ProxyRegistryManager.tsx": 1461,
     "src/app/(dashboard)/dashboard/settings/components/ResilienceTab.tsx": 1183,
     "src/app/(dashboard)/dashboard/settings/components/RoutingTab.tsx": 1629,
     "src/app/(dashboard)/dashboard/settings/components/SystemStorageTab.tsx": 1924,
     "src/app/(dashboard)/dashboard/usage/components/BudgetTab.tsx": 1016,
     "src/app/(dashboard)/dashboard/usage/components/EvalsTab.tsx": 2148,
-    "src/app/(dashboard)/dashboard/usage/components/ProviderLimits/index.tsx": 1121,
-    "src/app/api/oauth/[provider]/[action]/route.ts": 924,
+    "src/app/(dashboard)/dashboard/usage/components/ProviderLimits/index.tsx": 1127,
+    "src/app/api/oauth/[provider]/[action]/route.ts": 960,
     "src/app/api/providers/[id]/models/route.ts": 2593,
     "src/app/api/providers/[id]/test/route.ts": 940,
-    "src/app/api/usage/analytics/route.ts": 941,
+    "src/app/api/usage/analytics/route.ts": 942,
     "src/app/api/v1/models/catalog.ts": 1615,
     "src/lib/cloudflaredTunnel.ts": 934,
     "src/lib/db/apiKeys.ts": 1662,
@@ -216,7 +240,7 @@
     "src/lib/db/migrationRunner.ts": 1125,
     "src/lib/db/models.ts": 1259,
     "src/lib/db/providers.ts": 1107,
-    "src/lib/db/proxies.ts": 1060,
+    "src/lib/db/proxies.ts": 1177,
     "src/lib/db/settings.ts": 1155,
     "src/lib/db/usageAnalytics.ts": 925,
     "src/lib/evals/evalRunner.ts": 961,
@@ -225,75 +249,93 @@
     "src/lib/providers/validation.ts": 4523,
     "src/lib/resilience/settings.ts": 841,
     "src/lib/tailscaleTunnel.ts": 1202,
-    "src/lib/usage/callLogs.ts": 975,
-    "src/lib/usage/providerLimits.ts": 955,
-    "src/lib/usage/usageHistory.ts": 983,
+    "src/lib/usage/callLogs.ts": 997,
+    "src/lib/usage/providerLimits.ts": 1000,
+    "src/lib/usage/usageHistory.ts": 988,
     "_rebaseline_2026_06_27_5193_5203_antigravity_oauthmodal": "Antigravity remote-login own growth: OAuthModal.tsx 960->969 (gate units). #5193 (+~4: remote paste instruction shown for all remote incl. Google + its rationale comment) and #5203 (+~5: handleManualSubmit credential-blob branch + button guard; submit logic extracted to oauthBlobSubmit.ts to minimize). Frozen set to the SUM so either merge order passes. Cohesive at the existing manual-submit chokepoint.",
-    "src/shared/components/OAuthModal.tsx": 969,
-    "src/shared/components/RequestLoggerV2.tsx": 1316,
+    "src/shared/components/OAuthModal.tsx": 993,
+    "src/shared/components/RequestLoggerV2.tsx": 1629,
     "src/shared/components/analytics/charts.tsx": 1558,
-    "src/shared/constants/cliTools.ts": 875,
+    "_rebaseline_2026_07_10_6318_omp_letta": "PR #6318 (@hamsa0x7, omp+letta CLI integrations) own growth: cliTools.ts (+53 = 2 registry entries incl. omp docsUrl) and cliRuntime.ts (+18 = runtime-detection wiring for the 2 new tools). Cohesive registry/wiring growth at the existing chokepoints; scope reduced from the original 5 tools (pi/codewhale/jcode shipped separately).",
+    "src/shared/constants/cliTools.ts": 916,
     "src/shared/constants/pricing.ts": 1662,
     "src/shared/constants/providers.ts": 3276,
     "src/shared/constants/sidebarVisibility.ts": 1198,
-    "src/shared/services/cliRuntime.ts": 1090,
+    "src/shared/services/cliRuntime.ts": 1128,
     "src/shared/validation/schemas.ts": 2523,
-    "src/sse/handlers/chat.ts": 1575,
-    "src/sse/services/auth.ts": 2336,
-    "open-sse/executors/default.ts": 876,
+    "_rebaseline_2026_06_28_5275_correlation_id_extract": "Extraction of the safe CorrelationId subset of #5275 (hartmark) — request correlation id stored in call_logs (migration 109) and returned via the X-Correlation-Id response header, WITHOUT the combo/resilience or build/lazy-loading changes (those stay in #5275). Own growth: callLogs.ts 975->985 (correlation_id column on CallLogSummaryRow + read/map), usageHistory.ts 983->988 (correlationId metadata normalize), chat.ts 1575->1632 (withCorrelationId response wiring + combo-failure log carrying correlationId), chatHelpers.ts new 811 (withCorrelationId helper + reqId threading; was 791<cap pre-feature). Cohesive request/logging chokepoint wiring; structural shrink of chat.ts tracked in #3501.",
+    "_rebaseline_2026_07_09_6678_routing_strategy_9router": "#6678 (SeaXen) — 9router-parity Routing Strategy settings card + per-provider/combo sticky-round-robin override. Own growth: ProviderDetailPageClient.tsx 784->786 (single ProviderAccountRoutingCard mount + import), auth.ts 2448->2458 (providerStrategies override resolution: fallbackStrategy/stickyRoundRobinLimit per-provider cascade in getProviderCredentials). Both additive, zero unrelated refactor; new UI/logic lives in new files (ProviderAccountRoutingCard.tsx, RoutingStrategyCard.tsx, rrState.ts::resolveComboStickyRoundRobinLimit). chat.ts value below reflects the current release tip (grown by other concurrent PRs, e.g. #6640), not this PR own change.",
+    "src/sse/handlers/chat.ts": 1796,
+    "src/sse/handlers/chatHelpers.ts": 876,
+    "src/sse/services/auth.ts": 2458,
+    "open-sse/executors/default.ts": 877,
     "open-sse/translator/request/openai-responses.ts": 902,
     "open-sse/executors/kiro.ts": 944,
-    "open-sse/translator/request/openai-to-claude.ts": 805
+    "open-sse/translator/request/openai-to-claude.ts": 823,
+    "tests/unit/account-fallback-service.test.ts": 1572,
+    "tests/unit/provider-validation-specialty.test.ts": 2980,
+    "open-sse/executors/huggingchat.ts": 813,
+    "_rebaseline_2026_07_01_v3843_release_5609": "Rebaseline v3.8.43 (PR #5609 release reconciliation). DRIFT dos 109 commits do ciclo: 8 god-files existentes cresceram (ApiManagerPageClient 2983->3017, combos/page 4594->4608, AddApiKeyModal 868->869, providerPageHelpers 974->996, chat.ts 1635->1647, auth.ts 2401->2403, batchProcessor 828->915, combo.ts 3368->3387) + 2 novos acima do cap (huggingchat.ts 813, tests web-cookie-providers-new 827) + 4 test files cresceram. Modularizacao deferida (blast-radius mid-release); congelado no estado atual p/ o proximo ciclo ratchetar daqui.",
+    "src/lib/providers/validation/webProvidersA.ts": 809,
+    "src/lib/tokenHealthCheck.ts": 832,
+    "_rebaseline_2026_07_09_6587_kiro_api_key_auth": "PR #6587 (@strangersp) own growth for Kiro long-lived API-key auth, merged onto v3.8.47 tip: openai-to-kiro.ts 890->912 (+22, auth-header selection for API-key-vs-OAuth-token connections), providerLimits.ts 998->1000 (+2, API-key auth-type branch), translator-openai-to-kiro.test.ts 1234->1257 (+23), providers-page-utils.test.ts 1109->1107 (net -2 after merging with parallel release drift; connectionMatchesProviderCard api_key coverage added), provider-validation-specialty.test.ts 2856->2980 (+124 net after merge with parallel release drift; this PR also removed the file's `@typescript-eslint/no-explicit-any` eslint-suppression entry by fixing all `any` usages, adding typed replacements). Cohesive additive feature growth, well tested; not extractable without splitting the existing chokepoints mid-merge.",
+    "src/lib/localDb.ts": 805,
+    "_rebaseline_2026_07_12_v3847_mergeprs_tail": "v3.8.47 /merge-prs tail (owner-approved): src/lib/localDb.ts NEW>800 (799->805, +6 re-exports countFreeProxies + recordFreeProxySyncErrors/clearFreeProxySyncErrors/getFreeProxySyncErrors + FreeProxySyncErrors type for #6909 free-pool relay-repair; re-export-only per Hard Rule #2, not extractable)."
   },
   "testCap": 800,
   "testFrozen": {
-    "tests/integration/chat-pipeline.test.ts": 1671,
+    "_rebaseline_2026_07_09_6126_clinepass_dualauth": "#6126 (ClinePass dual-auth) own test growth: oauth-providers-config.test.ts 842->845 (+3: clinepass key/config/required-fields entries reusing the Cline WorkOS flow config, needed after registering clinepass in the oauth.ts PROVIDERS enum).",
+    "_rebaseline_2026_06_27_5193_antigravity_test": "#5193 own test growth: oauth-providers-config.test.ts 870->873 (+3: antigravity projectId assertion + 50ms tick for the now fire-and-forget onboarding, matching the no-PKCE/no-openid flow).",
+    "_rebaseline_2026_07_02_5928_base_red": "web-cookie-providers-new.test.ts 845->850: #5928 (test(security) Kimi Web URL host parse, CodeQL #689) grew the file +5 lines and merged into release/v3.8.44 WITHOUT rebaselining, leaving a fast-gates base-red that blocked every subsequent PR->release. Test growth is legitimate (a security regression test); maintainer absorbs the drift here. Frozen at 850.",
+    "_rebaseline_basered_codebuddy_cn": "Base-red fix (#4664 CodeBuddy CN): oauth-providers-config.test.ts 867->870 (+3) to align the EXPECTED provider list/config with the codebuddy-cn provider that #4664 added to the registry without updating this test (it asserts 'exactly once').",
+    "_rebaseline_pr4561_qwen_oauth_url": "Reconcile #4561 (port decolua/9router#683) already-merged growth: oauth-providers-config.test.ts 855->867 (+12, qwen.ai URL regression-pin test). Fast-gate PR->release does not run check:file-size, so this surfaced post-merge.",
+    "_rebaseline_pr4613_compatible_provider_groups": "Reconcile #4613 already-merged growth: providers-page-utils.test.ts 1004->1052 (+48, buildCompatibleProviderGroups partition unit test). Fast-gate PR->release does not run check:file-size, so this surfaced post-merge.",
+    "tests/integration/chat-pipeline.test.ts": 1601,
     "tests/integration/chatcore-compression-integration.test.ts": 1111,
     "tests/integration/skills-pipeline.test.ts": 918,
-    "tests/unit/account-fallback-service.test.ts": 1569,
+    "tests/unit/account-fallback-service.test.ts": 1572,
     "tests/unit/arena-elo-sync.test.ts": 830,
-    "tests/unit/batch_api.test.ts": 1303,
-    "tests/unit/cc-compatible-provider.test.ts": 1179,
-    "tests/unit/chatcore-sanitization.test.ts": 829,
+    "tests/unit/batch_api.test.ts": 1324,
+    "tests/unit/cc-compatible-provider.test.ts": 1217,
+    "tests/unit/chatcore-sanitization.test.ts": 831,
     "tests/unit/chatcore-translation-paths.test.ts": 2810,
-    "tests/unit/chatgpt-web.test.ts": 2855,
-    "tests/unit/combo-routing-engine.test.ts": 3213,
+    "tests/unit/chatgpt-web.test.ts": 3170,
+    "tests/unit/combo-config.test.ts": 881,
+    "tests/unit/combo-routing-engine.test.ts": 3209,
     "tests/unit/combo-strategy-fallbacks.test.ts": 880,
     "tests/unit/db-core-init.test.ts": 877,
     "tests/unit/db-migration-runner.test.ts": 1491,
     "tests/unit/db-settings-crud.test.ts": 941,
-    "tests/unit/deepseek-web.test.ts": 1081,
+    "tests/unit/deepseek-web.test.ts": 1092,
     "tests/unit/executor-antigravity.test.ts": 942,
     "tests/unit/executor-codex.test.ts": 1340,
-    "tests/unit/executor-default-base.test.ts": 1477,
+    "tests/unit/executor-default-base.test.ts": 1523,
     "tests/unit/grok-web.test.ts": 2437,
     "tests/unit/image-generation-handler.test.ts": 2019,
     "tests/unit/model-sync-route.test.ts": 1016,
-    "tests/unit/models-catalog-route.test.ts": 1507,
-    "_rebaseline_pr4561_qwen_oauth_url": "Reconcile #4561 (port decolua/9router#683) already-merged growth: oauth-providers-config.test.ts 855->867 (+12, qwen.ai URL regression-pin test). Fast-gate PR->release does not run check:file-size, so this surfaced post-merge.",
-    "_rebaseline_basered_codebuddy_cn": "Base-red fix (#4664 CodeBuddy CN): oauth-providers-config.test.ts 867->870 (+3) to align the EXPECTED provider list/config with the codebuddy-cn provider that #4664 added to the registry without updating this test (it asserts 'exactly once').",
-    "_rebaseline_2026_06_27_5193_antigravity_test": "#5193 own test growth: oauth-providers-config.test.ts 870->873 (+3: antigravity projectId assertion + 50ms tick for the now fire-and-forget onboarding, matching the no-PKCE/no-openid flow).",
-    "tests/unit/oauth-providers-config.test.ts": 873,
-    "tests/unit/perplexity-web.test.ts": 959,
-    "tests/unit/provider-models-route.test.ts": 1618,
-    "tests/unit/provider-validation-specialty.test.ts": 2801,
-    "_rebaseline_pr4613_compatible_provider_groups": "Reconcile #4613 already-merged growth: providers-page-utils.test.ts 1004->1052 (+48, buildCompatibleProviderGroups partition unit test). Fast-gate PR->release does not run check:file-size, so this surfaced post-merge.",
-    "tests/unit/providers-page-utils.test.ts": 1052,
+    "tests/unit/models-catalog-route.test.ts": 1605,
+    "tests/unit/oauth-providers-config.test.ts": 845,
+    "tests/unit/perplexity-web.test.ts": 999,
+    "tests/unit/provider-models-route.test.ts": 1752,
+    "tests/unit/provider-validation-specialty.test.ts": 2980,
+    "tests/unit/providers-page-utils.test.ts": 1107,
     "tests/unit/reasoning-cache.test.ts": 980,
-    "tests/unit/route-edge-coverage.test.ts": 1234,
+    "tests/unit/response-sanitizer.test.ts": 1063,
+    "tests/unit/route-edge-coverage.test.ts": 1241,
     "tests/unit/search-handler-extended.test.ts": 1124,
-    "tests/unit/sse-auth.test.ts": 1553,
-    "tests/unit/stream-utils.test.ts": 2435,
+    "tests/unit/sse-auth.test.ts": 1600,
+    "tests/unit/stream-utils.test.ts": 2445,
     "tests/unit/token-refresh-service.test.ts": 1353,
     "tests/unit/translator-friendly-test-bench.test.tsx": 848,
     "tests/unit/translator-helper-branches.test.ts": 870,
-    "tests/unit/translator-openai-responses-req.test.ts": 1097,
-    "tests/unit/translator-openai-to-gemini.test.ts": 1579,
-    "tests/unit/translator-openai-to-kiro.test.ts": 999,
+    "tests/unit/translator-openai-responses-req.test.ts": 1195,
+    "tests/unit/translator-openai-to-gemini.test.ts": 1553,
+    "tests/unit/translator-openai-to-kiro.test.ts": 1257,
     "tests/unit/translator-resp-gemini-to-openai.test.ts": 1234,
-    "tests/unit/usage-service-hardening.test.ts": 1633,
-    "tests/unit/vscode-token-routes.test.ts": 1212,
-    "tests/unit/combo-config.test.ts": 881
+    "tests/unit/usage-service-hardening.test.ts": 1503,
+    "tests/unit/vscode-token-routes.test.ts": 1285,
+    "tests/unit/web-cookie-providers-new.test.ts": 890,
+    "_rebaseline_2026_07_12_v3847_mergeprs_tail": "v3.8.47 /merge-prs tail: translator-openai-responses-req.test.ts 1172->1195 (+23 = #6807 reasoning-summary-for-effort-only regression tests). Frozen only shrinks."
   },
   "_rebaseline_2026_06_09": "Re-baseline consciente pre-release v3.8.19: 9 arquivos cresceram durante o ciclo (features mergeadas: RequestLoggerV2 +281 request-logger rework, stream +101, combo +73, chatCore +45, catalog +32 fable-5/catalog-flag, callLogs +4, accountFallback +2, usageHistory novo 840) + core.ts +7 (fix resetAllDbModuleState, PR 3536). A catraca segue valendo destes valores — proximo crescimento falha. Decisao: encolher (esp. RequestLoggerV2/chatCore) e a issue #3501 ficam para o ciclo seguinte.",
   "_rebaseline_2026_06_11_phase1f": "Phase 1f (#3501): ProviderDetailPageClient.tsx 4948→4062 (-886 LOC); 3 novos hooks extraídos. useProviderConnections.ts=954 acima do cap=800 — justificado: extração direta do god-component (zero lógica nova), própria redução do cliente supera o custo. useProviderSettings.ts=263 e useProviderModels.ts=154 já abaixo do cap.",
@@ -317,6 +359,7 @@
   "_rebaseline_2026_06_13_2743d_skipbreaker": "Re-baseline #2743 gap-d (testar consumer do skipProviderBreaker): combo.ts 5131→5162 (+31). Crescimento = extração do boolean inline da decisão de circuit-breaker para o predicado puro EXPORTADO shouldRecordProviderBreakerFailure() (byte-idêntico) + JSDoc, para torná-lo unit-testável sem o harness completo de combo. Shrink estrutural segue com #3501.",
   "_rebaseline_2026_06_13_v3825_prettier_reconcile": "Reconciliação tardia: o prettier do pre-commit reformatou 3 arquivos DEPOIS da medição de file-size dos PRs, inflando linhas além do baseline setado — OAuthModal.tsx 956→960 e providers.ts 3146→3147 (#3324), combo.ts 5162→5164 (#2743d). Bumps de reformatação automática (sem lógica nova). LIÇÃO: medir file-size pós-commit (pós-prettier), não antes.",
   "_rebaseline_2026_06_14_3826_release_drift": "Re-baseline release/v3.8.25 drift already documented from #3809 owner changes: ProxyRegistryManager.tsx 1072→1089, sidebarVisibility.ts 990→1006, schemas.ts 2519→2522. This PR does not touch those source files; updating the frozen values restores Fast Quality Gates on the current release branch.",
+  "_rebaseline_2026_07_03_5918_proxy_batch": "PR #5918 own growth: ProxyRegistryManager.tsx 1089→1117 (+28 = wiring the new batch-select/Test-All proxy management components — checkboxes, batch actions bar, health cells). Cohesive UI wiring for the batch-delete/auto-test feature; the reusable pieces already live in separate leaf components (ProxyBatchActions/ProxyCheckboxCell/ProxyHealthCell/useProxyBatchOperations). Legitimate feature growth, not a quality regression.",
   "_rebaseline_2026_06_14_3825_combo_stickiness": "Re-baseline #3825 (sessionless combo stickiness + reasoning-aware readiness): combo.ts 5164→5198 (+34, pós-prettier). Crescimento = deriveComboSessionKey() + effectiveSessionId threading nos sites de read/write do pin server-side. streamReadinessPolicy.ts não-frozen (sob cap). Lógica coesa no handler de combo; não-extraível.",
   "_rebaseline_2026_06_14_r3_3835_kiro_pricing": "PR #3835 own growth: pricing.ts 1470→1508 (+38 = missing Kiro pricing rows, claude-sonnet-4.6 etc., pure data). Also carries inherited release/v3.8.25 drift not yet frozen by prior r2 merges: RequestLoggerV2.tsx 1276→1282 (#3820 resizable log table) and combo.ts 5198→5203 (#3811 round-robin replay-response fix). This PR does not touch RequestLoggerV2/combo.ts source; updating the frozen values restores Fast Quality Gates on the current release branch.",
   "_rebaseline_2026_06_14_r3_3849_transient_hide": "PR #3849 own growth: providerPageHelpers.ts 939→955 (+16 = expanded JSDoc on the auto-hide policy + transient-failure guard in evaluateTestAllEntry). Cohesive helper logic; not extractable.",
@@ -334,6 +377,7 @@
   "_rebaseline_2026_06_17_4107_pending_reaper": "PR #4107 own growth: usageHistory.ts 854->934 (+80 = orphaned-pending-request reaper — sweepStalePendingRequests() evicts pending details older than 15min + a hard 5000 cap, plus an unref'd 5min sweep timer wired lazily into trackPendingRequest). Fixes an unbounded memory leak where abnormally-terminated requests left payload previews in pendingById forever. Cohesive with the existing pending-request bookkeeping (mirrors the normal removal path: decrement counters + cleanup buckets); not extractable.",
   "_rebaseline_2026_06_17_4116_combo_hedge_listener": "combo.ts: +9 lines from #4116 (detach per-target listener from shared hedge abort signal to fix a listener leak). Behavior-preserving cleanup; 5289 -> 5298.",
   "_rebaseline_2026_06_20_4355_gpt5x_pro_pricing": "PR #4355 own growth: pricing.ts 1581->1592 (+11 = pure-data pricing rows for openai gpt-5.5-pro + gpt-5.4-pro, closing the $0 gap that tripped the catalog pricing gate after the #4324 sweep added them to the registry; -pro mirrors its base family tier). provider-models-route.test.ts 1616->1618 (+2 = test-only alignment to the intentional opencode-go discovery behavior: owned_by stamp + T39 two-endpoint fail-path fetchCalls). Both are data/test-only; not extractable.",
+  "_rebaseline_2026_07_02_5899_airforce_v1_discovery": "PR #5904 own growth: provider-models-route.test.ts 1628->1752 (+124 = test-only Rule #18 regression guards for the Api Airforce /v1/v1/models discovery bug (#5899): (a) a baseUrl ending in /v1/chat/completions must probe .../v1/models not the doubled .../v1/v1/models, and the host-guard case http://v1; (b) a REDIRECT_BLOCKED on one candidate must continue to the next endpoint instead of aborting the probe loop. Both guards fail on the pre-fix code. Test-only additions cohesive with the existing provider-models discovery suite (shared seedConnection/callRoute harness); not separately extractable without duplicating the harness.",
   "_rebaseline_2026_06_19_4293_codex_spark_scope": "PR #4293 (isolate Codex Spark quota scope) own growth, MEASURED on the actual merged tree (release/v3.8.30 + #4293). Production: auth.ts 2219->2279 (+60) threads requestedModel into Codex quota-policy/headroom/preflight/P2C scoring so normal Codex and GPT-5.3-Codex-Spark windows are evaluated independently; chatCore.ts 5116->5125 (+9) passes the failing model scope into Codex 429 failover (markCodexScopeRateLimited) instead of a connection-wide rateLimitedUntil write; accountFallback.ts 1727->1731 (+4) scopes Codex model-lock keys to codex vs spark. Heavy parsing/display logic lives in new leaf helpers under the cap (codexQuotaScopes.ts, codexUsageQuotas.ts, codexFailover.ts). Tests: account-fallback-service 1544->1569, executor-codex 1336->1339, sse-auth 1527->1553, usage-service-hardening 1612->1633 (added Spark-scope regression coverage). Cohesive wiring at existing selection/failover lockout boundaries; not extractable.",
   "_rebaseline_2026_06_20_4447_openai_gpt41mini_o_mini_pricing": "PR #4447 own growth: pricing.ts 1592->1620 (+28 = pure-data pricing rows closing the null/$0 gap for registry-exposed OpenAI ids gpt-4.1-mini, gpt-4.1-nano, o3-mini, o4-mini that tripped the catalog pricing gate; getPricingForModel does an exact lookup, so a missing key resolves to null. Official OpenAI per-1M prices + the table's derived-field convention (reasoning=output*1.5, cache_creation=input, cached=official). Restore-green for a pre-existing release/v3.8.32 red surfaced by #4432's __RUN_ALL__ run. Cohesive data; not extractable.",
   "_rebaseline_2026_06_20_web_cookie_validator_shadow_fix": "validation.ts 4518->4522 (+4 = move the generic web-cookie validateWebCookieProvider dispatch from the TOP of validateProviderApiKey to a FALLBACK after SPECIALTY_VALIDATORS, plus a comment, so #4023's generic AUTH_007 ping no longer shadows the rich per-provider validators (grok-web #3474 IP-reputation/Cloudflare, chatgpt-web cf-mitigated, claude/gemini/copilot/qwen/t3-web). Restores provider-validation-specialty.test.ts (112/112) while keeping web-cookie-auth007 (5/5). Behavior fix at an existing dispatch boundary; not extractable.",
@@ -341,5 +385,21 @@
   "_rebaseline_2026_06_22_phase4c_adaptive_context_budget": "Compression Phase 4 (C) adaptive context-budget wiring own growth: open-sse/services/compression/strategySelector.ts 818->848 (+30 at the existing selectCompressionPlan dispatch chokepoint). selectCompressionPlan gains an 8th optional `adaptiveOptions` param (modelContextLimit/requestMaxTokens/onAdaptive sink) and, after resolveBasePlan and before the caching-aware pass, runs the PURE resolveAdaptivePlan when config.contextBudget.mode is floor|replace-autotrigger; the new adaptiveEnabled(config) helper also gates the legacy shouldAutoTrigger branch inside resolveBasePlan off when adaptive owns automatic-by-size escalation (D-C4). The escalation ladder, target computation, and the resolver itself live in open-sse/services/compression/adaptiveCompression/{computeTarget,ladder,resolveAdaptivePlan,types}.ts (all <cap, fully unit-tested by Tasks 1-4). strategySelector.ts is cohesive dispatch wiring at the existing compression chokepoint, not extractable without hiding the dispatch boundary, mirroring the prior compression rebaselines (#4217/#4210/phase4b). Covered by tests/unit/compression/adaptive-select-plan-wiring.test.ts (4 tests) + adaptive-chatcore-source-guard.test.ts (2). chatCore.ts also grows ~30 lines at the same call site (threads getTokenLimit(provider,effectiveModel) + request max_tokens into adaptiveOptions and records the adaptive telemetry block onto compression.completed) but stays under its frozen cap. Structural shrink of this file tracked in #3501.",
   "_rebaseline_2026_06_25_rc17_pr_batch": "rc17 PR batch own growth (cohesive, not extractable): responseSanitizer.ts 1103->1122 (+19 = SanitizeOpenAIResponseOptions interface + stripReasoning option, #4678); tokenRefresh.ts 2070->2090 (+20 = codex 401 defense-in-depth unrecoverable-refresh guard, #4686); token-refresh-service.test.ts 1322->1353 (+31 = 401-unfamiliar-payload regression case, #4686); translator-openai-responses-req.test.ts 1047->1050 (+3 = reasoning_effort non-Copilot assertion update, #4688). All are the merged PRs own surgical additions at existing chokepoints.",
   "_rebaseline_2026_06_25_rc17b_leva2": "rc17 leva2 PR batch own growth (cohesive, not extractable): providerLimits.ts 950->955 (#4786 generalized accesstoken fallback); default.ts NEW frozen entry at 828 (#4729 anthropic-compatible Bearer + #4766 json_schema fallback + #4787 cline workos headers — three provider-specific header branches); openai-to-kiro.ts 807->814 (#4763 Claude-capability image gate); openai-responses.ts 923->937 (#4764 computeFinishReason guard); executor-default-base.test.ts 1339->1440 (#4766 json_schema fallback tests); translator-openai-to-kiro.test.ts 918->980 (#4763 non-Claude image gate tests).",
-  "_rebaseline_2026_06_27_v3838_filesize_drift": "Mid-cycle drift on release/v3.8.38 — feature/fix growth from already-merged PRs that the fast-path (PR->release skips check:file-size) let accumulate without a bump. src/shared/constants/sidebarVisibility.ts 1100->1198 (+98 = #3812 colored menu-icon support, per-item accent map across the sidebar entries; #5142 then dropped one orphan settings entry, net still above the frozen). src/sse/handlers/chat.ts 1560->1575 (+15 = #5064 self-inflicted-timeout cooldown skip + #5124 long OpenAI-compatible SSE hardening + #5110 embed-WS LIVE_WS_HOST honour / early empty-message reject). Localized feature/fix code next to existing branches, each covered by its own PR tests; not extractable without hiding the chokepoint. Structural shrink of chat.ts tracked in #3501."
+  "_rebaseline_2026_06_27_v3838_filesize_drift": "Mid-cycle drift on release/v3.8.38 — feature/fix growth from already-merged PRs that the fast-path (PR->release skips check:file-size) let accumulate without a bump. src/shared/constants/sidebarVisibility.ts 1100->1198 (+98 = #3812 colored menu-icon support, per-item accent map across the sidebar entries; #5142 then dropped one orphan settings entry, net still above the frozen). src/sse/handlers/chat.ts 1560->1575 (+15 = #5064 self-inflicted-timeout cooldown skip + #5124 long OpenAI-compatible SSE hardening + #5110 embed-WS LIVE_WS_HOST honour / early empty-message reject). Localized feature/fix code next to existing branches, each covered by its own PR tests; not extractable without hiding the chokepoint. Structural shrink of chat.ts tracked in #3501.",
+  "_rebaseline_2026_07_05_6211_providerlimits_fetch_timeout": "PR #6211 own growth: src/app/(dashboard)/dashboard/usage/components/ProviderLimits/index.tsx 1121->1127 (+6 = data-timeout guard for the quota page's two first-paint fetches — a PROVIDER_LIMITS_FETCH_TIMEOUT_MS const + fetchWithTimeout at the /api/providers/client and /api/usage/provider-limits call sites — so a never-settling connection can no longer wedge initialLoading on the skeleton, same infinite-skeleton class the PR also fixes on the providers page). Cohesive fix code at the existing fetch chokepoints (the 5-line rationale comment explains why a timeout/abort is needed where a try/catch only rescues a rejection); not extractable. Covered by tests/unit/providers-page-data-timeout.test.ts. Fast-path PR->release skips check:file-size, so this bump lands with the PR. Structural shrink of this file tracked in #3501.",
+  "_rebaseline_2026_07_05_6154_copilot_catalog_helpers": "PR #6154 own growth: src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts 1021->1034 (+13 = GitHub Copilot catalog refresh — model-section helper wiring for the refreshed passthrough/compatible model lists). Cohesive UI-helper growth alongside the registry/modelSpecs catalog refresh; not extractable. Covered by the PR's provider-registry-github-copilot-* unit tests. Fast-path PR->release skips check:file-size, so this bump lands with the PR (contributor backryun).",
+  "_rebaseline_2026_07_05_6213_kiro_thinking_filesize": "PR #6213 own growth (kiro adaptive-thinking -> reasoning_content, +384): open-sse/translator/request/openai-to-kiro.ts 853->890 (+37 = additionalModelRequestFields builder for adaptive thinking: output_config.effort + thinking:{type:adaptive} + max_tokens, only when the request asked for thinking) and tests/unit/translator-openai-to-kiro.test.ts 1093->1234 (+141 = adaptive-thinking request/frame regression cases). The fast-path PR->release does NOT gate check:file-size on the merge, so this cohesive feature growth accumulated on the release tip (see the 2026-07-02 #5798 note for the same pattern). Superseded by the release captain's rebaseline-at-release.",
+  "_rebaseline_2026_07_05_6235_doubao_dola": "PR #6235 own growth: tests/unit/web-cookie-providers-new.test.ts 850->890 (+40 = doubao-web -> Dola global provider switch regression cases: new host/cookie-domain/token-source assertions for www.dola.com). Cohesive test growth alongside the provider switch; contributor backryun. Fast-path PR->release skips check:file-size, so this bump lands with the PR.",
+  "_rebaseline_2026_07_06_v3845_release_close": "Release v3.8.45 cycle-close rebaseline (captain, sess ce897453): 13 files grown by the cycle's merged fix/feature PRs (#6216 streaming fixes + request-logger UI grew RequestLoggerV2/chat/chatHelpers/auth/stream/response-sanitizer.test; #6251/#6253 dashboard UX grew combos page/modals/wizard/ComboDefaultsTab/ProxyRegistryManager/providerPageHelpers). Growth is legitimate merged-feature code, absorbed at release per Phase 0 drift policy; all remain frozen (cannot grow further).",
+  "_rebaseline_2026_07_06_6118_zed_oauthmodal": "PR #6118 own growth: OAuthModal.tsx 989->993 (+4 = Zed hosted native-app sign-in modal branch). Cohesive UI growth for the zed-hosted OAuth provider; not extractable. The prior 6118 comment set the note but left the frozen value at 989.",
+  "_rebaseline_2026_07_06_6351_glm_team_quota": "PR #6351 own growth (GLM team-plan quota fields threaded through the connection modals; new GlmTeamQuotaFields.tsx extracted): AddApiKeyModal.tsx ->951 (+9), EditConnectionModal.tsx ->1277 (+18). Absorbs the pre-existing session base-red on these frozen modals; release captain rebaseline-at-release supersedes.",
+  "_rebaseline_2026_07_06_6499_unique_default_name": "PR #6499 own growth: AddApiKeyModal.tsx 952->959 (+7 = a unique default connection name so a second API key for the same provider does not reuse 'main' and trigger the backend name-based upsert that silently overwrote the first connection). The pure name derivation was extracted to computeConnectionDefaultName.ts (unit-tested) to keep the growth minimal; the contributor's original full-form-reset rewrite was trimmed to a spread reset to avoid dropping the GLM team-quota fields #6351 added and to hold the frozen god-file growth down. Release captain rebaseline-at-release supersedes.",
+  "_rebaseline_2026_07_08_vb_reroute": "PR #6640 (Vision Bridge reroute) own growth, re-measured post-merge with origin/release/v3.8.47 + /implement-prs mandatory pre-merge fixes (wc -l + 1): chat.ts 1778->1796 (+18, stacking on #6515/#6525 chirag growth already frozen at 1778) = the original +3 guardrail modelStr sync block PLUS +15 for the policy re-validation added during review (a guardrail-driven model change is now re-checked against isModelAllowedForKey before being honored, closing an allowlist-bypass gap; see tests/unit/vision-bridge-policy-reroute-6640.test.ts). Irreducible wiring at the guardrail post-execution/policy chokepoint; covered by tests/unit/guardrails/visionBridge.test.ts (22 tests) + the 3 new policy-reroute regression tests.",
+  "_rebaseline_2026_07_07_6523_chirag_cooldown_body": "PR #6523 (@chirag127, #6460) own growth: chatHelpers.ts 860->866 (+6 = retryAfterAt/credentialsCoolingCount fields on modelCooldownResponse) and auth.ts 2447->2448 (+1 = connectionsCount threaded through no-credentials fallback). Owner-approved rebaseline (file-size cap for contributor PR). Frozen (cannot grow further); release captain's rebaseline-at-release supersedes.",
+  "_rebaseline_2026_07_07_6526_chirag_modal_1080p": "PR #6526 (@chirag127, #6265): AddApiKeyModal.tsx ->961 (1080p sizing). Owner-approved. Frozen.",
+  "_rebaseline_2026_07_07_6515_chirag": "PR #6515 (@chirag127) own growth: src/sse/handlers/chat.ts ->1763. Owner-approved rebaseline. Frozen.",
+  "_rebaseline_2026_07_07_6534_chirag": "PR #6534 (@chirag127) own growth: open-sse/services/compression/strategySelector.ts ->1025. Owner-approved rebaseline. Frozen.",
+  "_rebaseline_2026_07_08_6556_omniglyph_mode": "PR #6556 (omniglyph engine) own growth: open-sse/services/compression/strategySelector.ts 1025->1043 (+18 at the existing mode-dispatch chokepoints). Two single-mode branches (sync no-op + async resolve via the engine registry, mirroring the rtk single-mode pattern, B-MODE-ENGINE-DECOUPLE) plus the optional providerTransport field threaded through the three options types (gates transport-sensitive engines). The engine itself lives in engines/omniglyphAdapter.ts (<cap); the residual is cohesive dispatch/type wiring not extractable without hiding the dispatch boundary, mirroring the prior compression rebaselines (#5243/#5286/phase4b/#6534). Covered by tests/unit/compression/omniglyph-*.test.ts (22). Structural shrink of this file tracked in #3501.",
+  "_rebaseline_2026_07_07_6546_chirag": "PR #6546 (@chirag127) own growth: src/sse/handlers/chatHelpers.ts ->876. Owner-approved rebaseline. Frozen.",
+  "_rebaseline_2026_07_07_6525_chirag_image_guard": "PR #6525 (@chirag127, #6457) own growth: chat.ts ->1778 (reject image-only models on /v1/chat/completions; stacks on #6515). Owner-approved. Frozen."
 }

config/quality/quality-baseline.json

@@ -2,15 +2,24 @@
   "_comment": "Catraca de qualidade. 'down' = nao pode aumentar; 'up' = nao pode cair. Atualize via 'npm run quality:ratchet -- --update' (somente quando melhora). Cada valor e um numero REAL medido, nunca um chute. Cobertura entra na Fase 4 a partir de um run de cobertura mergeada no CI.",
   "metrics": {
     "eslintWarnings": {
-      "value": 4090,
+      "value": 0,
+      "_rebaseline_2026_07_03_v3844_residual_release_green": "4270->4279 (+9). v3.8.44 residual drift on release tip 716041223 (moving target: eslint 4270->4279 as the branch advanced past the prior rebaseline). Inherited from parallel-session merges (Quality Ratchet not on PR->release fast-gates).",
+      "_rebaseline_2026_07_03_v3844_ipfilter_release_green": "4256->4270 (+14). v3.8.44 cycle drift measured on release tip 32e4c906e during the #6131/#5975 release-green rebaseline. Inherited from the merge burst (Quality Ratchet does not run on PR->release fast-gates). route-edge-coverage +7 is my #5975 test comment; the rest is parallel-session drift. Tighten via --update next cycle.",
+      "_rebaseline_2026_07_03_v3844_review_prs_fix_batch": "4199->4256 (+57). Inherited v3.8.44 cycle drift surfaced by the release-green pre-flight (the Quality Ratchet does NOT run on PR->release fast-gates, so warnings accrue unmeasured across the cycle). 4256 = measured by `node scripts/quality/collect-metrics.mjs` on the release tip 72ee80649 during the /review-prs fix-batch round. The round's own merges (#5958 SSE-accept, #5988 deepseek-web, #6013/#5974 retry-after-json, #5975 embeddings-proxy, #5973 non-json-guard) plus the parallel-session merge burst into release/v3.8.44 account for the delta; all `any`-warn-allowed in open-sse/ + tests/. Cyclomatic is already green (2012 < baseline 2015) and needs no bump. Tighten via --require-tighten next cycle.",
+      "_rebaseline_2026_07_02_v3843_release_close": "4158->4199 (+41). v3.8.43 release-close drift measured by the release-green pre-flight (the Quality Ratchet does NOT run on PR->release fast-gates, so warnings accrued unmeasured across the ~120 commits merged after the mid-cycle 4158 rebaseline — the compression T02/T05/T06/T07/T08/T10 engine families, memory typed decay, provider adds Ollama/SenseNova, ~55 SSE/translator/kiro/oauth/dashboard fixes, and the god-file decomposition wave). Trust-but-verify: measured 4199 via `npm run lint` on the release-finalize working tree INCLUDING my changes (CHANGELOG/i18n/README docs + kiro pricing data entry + the 3 base-red CODE fixes: opencode fabrication removal, resolveEffectiveKey type-widen, openai-to-claude claudeFinishEmitted flag + 4 test-alignment files + golden snapshot regen) — the code fixes NET-REMOVE lines and add no `any`/unused, and lint reported 4199 both before and after them, so all +41 is inherited cycle drift (`any` warn-allowed in open-sse/ + tests/). Tighten via --require-tighten next cycle.",
       "direction": "down",
+      "_rebaseline_2026_07_01_v3843_release": "4121->4158 (+37). v3.8.43 cycle drift surfaced by the release-green pre-flight; the Quality Ratchet does NOT run on PR->release fast-gates, so warnings accrued unmeasured across this cycle. 4158 = the value measured by the CI Quality Ratchet on the release tip fce85136c (release PR #5609). Trust-but-verify: the fix/release-v3843-ci-reds branch touches only test files (rtk-mcp-tools de-flake, compression-studio e2e anchor, oauth-error-linkify hardening test) + src/shared/utils/linkify.ts (eslint-clean, 0 warnings) + stryker.conf.json + this baseline -> 0 new warnings, so all +37 is inherited cycle drift (any warn-allowed in open-sse/ + tests/). Tighten via --require-tighten next cycle.",
+      "_rebaseline_2026_06_30_v3842_release": "4116->4121 (+5). v3.8.42 cycle drift surfaced by the release-green pre-flight (the Quality Ratchet does NOT run on PR->release fast-gates, so warnings accrued unmeasured across this cycle's 90 commits — chatgpt-web PoW sha3-512 BoringSSL fix #5540, provider baseUrl/i18n umbrella #5511, proxy union proxyUrlMap+acct.proxy #5521, dead-code + duplication waves #5468-#5495, tls-options packaging #5503, release-freeze + .npmrc fetch-retries #5506, dast-smoke spawn-prefix client-safe extraction #5546, plus ~30 SSE/translator/combo/dashboard fixes). Trust-but-verify: measured 4121 via `npm run check:release-green` on the working tree INCLUDING my reconciliation (CHANGELOG/i18n/golden snapshot + file-size baseline) — those touch only config JSON + a provider snapshot (eslint-ignored) and contribute 0 warnings; all +5 is inherited cycle drift (`any` warn-allowed in open-sse/ + tests/). Tighten via --require-tighten next cycle.",
+      "_rebaseline_2026_06_29_v3841_release": "4103->4116 (+13). v3.8.41 cycle drift surfaced by the release-green collect (the Quality Ratchet does NOT run on PR->release fast-gates, so warnings accrued unmeasured across this cycle's 52 commits — relay backend #5315, gemini catalog #5337, services dashboard #5299, empty-Claude-messages guard #5342, thinking-budget/redacted-replay + marker opt-out #5312/#5352/#5367, opencode proxy-pool + observability #5217/#5370/#5351, cors + HTTPS-serve #5242/#5360/#5361, grok cf_clearance #5350/#5358, oauth/chatgpt-web/routing/cli/dashboard/rerank #5326/#5240/#5239/#5238/#5264/#5332, partially offset by the dead-code sweep #5321-#5371). Trust-but-verify: measured 4116 via `npm run quality:collect` on the working tree INCLUDING my reconciliation (CHANGELOG/i18n/README/env docs + baselines) AND the lint-fix in useServiceLogs.ts — that fix REMOVES a setState-in-effect ERROR (eslintErrors stays 0) and adds an `open` listener with no `any`/unused, contributing 0 warnings; all +13 is inherited cycle drift (`any` warn-allowed in open-sse/ + tests/). Tighten via --require-tighten next cycle.",
+      "_rebaseline_2026_06_29_v3840_release": "4090->4103 (+13). v3.8.40 cycle drift surfaced by the release-green pre-flight + the release PR Quality Ratchet (the ratchet does NOT run on PR->release fast-gates, so warnings accrued unmeasured across this cycle's ~57 commits — compression roadmap relevance/hard-budget/memoization/transparency/saliency/splitter/tool_search/RTK/QuantumLock #5289/#5288/#5286/#5284/#5285/#5283/#5269/#5268/#5260, ~20 SSE/translator/combo fixes #5248/#5250/#5254/#5261/#5255/#5273/#5258, M365 Copilot provider #5302, public-origin centralization #5278). Trust-but-verify: measured 4103 locally via `npm run quality:collect` on the release tip INCLUDING my reconciliation commits (CHANGELOG + main merge + the 2 regression test fixes 165c823f5) — the test fixes add 0 `any`/warnings (health-autopilot added a NextRequest import + asserts; chat-pipeline changed one Accept string + a comment), so all +13 is inherited cycle drift (`any` warn-allowed in open-sse/ + tests/). Tighten via --require-tighten next cycle.",
       "_rebaseline_2026_06_28_v3839_release": "4002->4090 (+88). v3.8.39 cycle drift surfaced by the release-green pre-flight (the Quality Ratchet does NOT run on PR->release fast-gates, so warnings accrued unmeasured across this cycle's 40 commits — antigravity remote-login + quota-family #5203/#5180/#5193, compression CCR-retrieve + TOON encoder #5187/#5163, ~20 SSE/translator/responses fixes #5156/#5154/#5197/#5204/#5158/#5123/#5166, proxy/health hardening #5202/#5208/#5209/#5201 from @KooshaPari, combo quota-share/context-relay E2E tests #5179/#5168/#5195). Trust-but-verify: this release-finalize working tree touches ONLY CHANGELOG.md, docs/i18n/*/CHANGELOG.md mirrors, README.md and these baselines — 0 production-code change, so all +88 is inherited cycle drift (`any` warn-allowed in open-sse/ + tests/). Tighten via --require-tighten next cycle.",
       "_rebaseline_2026_06_27_v3838_release": "3987->4002 (+15). v3.8.38 cycle drift surfaced by the release-green pre-flight (the Quality Ratchet does NOT run on PR->release fast-gates, so warnings accrued unmeasured across this cycle's ~78 commits — provider adds Factory/Grok-Build/ZenMux-Free/Alibaba-video, ~30 SSE/translator/diagnostics fixes, compression fidelity-gate + playground #5080/#5143, Fusion editor #5074, salvage batches #5138/#5141). Trust-but-verify: this release-finalize working tree touches ONLY CHANGELOG.md, docs/i18n/*/CHANGELOG.md mirrors, README.md and these baselines — 0 production-code change, so all +15 is inherited cycle drift (`any` warn-allowed in open-sse/ + tests/). Tighten via --require-tighten next cycle.",
       "_rebaseline_2026_06_25_v3836_release": "v3.8.36 cycle drift surfaced by the post-merge fix PR #5029 (the Quality Ratchet was SKIPPED on the release PR #4854 itself, and does NOT run on the PR→release fast-gates, so warnings accrued unmeasured across this cycle's 137 commits — Quota-Share Fase 2/3 features, god-file decomposition #3501/#4811-#4956, 14 external contributor PRs). 3912→3970 (+58), the exact value measured by the CI Quality Ratchet on #5029. Trust-but-verify: this fix PR touches ONLY scripts/build/pack-artifact-policy.ts (a string-literal allowlist array, scripts/ is eslint-light) and tests/integration/resilience-http-e2e.test.ts (2 string keys, no `any`) — 0 new warnings, so all +58 is inherited cycle drift (`any` warn-allowed in open-sse/ + tests/). Same precedent as _rebaseline_2026_06_23_v3835_release. Tighten via --require-tighten next cycle.",
       "_rebaseline_2026_06_23_v3835_release": "v3.8.35 cycle drift surfaced by the release-green pre-flight (the Quality Ratchet does NOT run on PR→release fast-gates, so warnings accrued across this cycle's parallel-session merges — Compression Phase 4 #4694/#4707/#4716/#4720, chatCore #3501 leaf extractions, contributor PRs #4726/#4753/#4774/#4781/#4783/#4793, etc.). 3907→3912 (+5). Verified my release-finalize working tree touches ONLY docs/*.md (THREAT_MODEL), CHANGELOG.md, baselines, and 1 string line in scripts/check/check-fabricated-docs.mjs — 0 production-code change, so all +5 is inherited contributor drift. No coverage/openapi/i18n regressions.",
       "_rebaseline_2026_06_22_v3834_release": "v3.8.34 cycle drift surfaced by the release-green pre-flight (the Quality Ratchet does NOT run on PR→release fast-gates, so warnings accrued across this cycle's parallel-session merges — #4583-4586/#4588-4593/#4606-4621/#4644/#4647/#4696/etc.). 3900→3907 (+7). Verified my release-finalize working tree touches ONLY CHANGELOG.md (git status: 0 code changes), so all +7 is inherited contributor drift. No coverage/openapi/i18n regressions.",
       "_rebaseline_2026_06_22_v3833_release": "Cumulative cycle drift surfaced by the release PR full CI. 3867→3900 (+33).",
-      "_rebaseline_2026_06_26_v3837_release": "3970->3987. v3.8.37 cycle drift surfaced by the release-green pre-flight (the Quality Ratchet does NOT run on PR->release fast-gates, so warnings/complexity accrued unmeasured across this cycle's 76 commits — provider adds DGrid/Pioneer/xAI, headroom proxy lifecycle #4649, ~50 SSE/translator fixes, Engine Combos #5062). Trust-but-verify: this release-finalize working tree touches ONLY CHANGELOG.md, docs/i18n/*/CHANGELOG.md mirrors, and these baselines — 0 production-code change, so all drift is inherited cycle drift (`any` warn-allowed in open-sse/ + tests/). Tighten via --require-tighten next cycle."
+      "_rebaseline_2026_06_26_v3837_release": "3970->3987. v3.8.37 cycle drift surfaced by the release-green pre-flight (the Quality Ratchet does NOT run on PR->release fast-gates, so warnings/complexity accrued unmeasured across this cycle's 76 commits — provider adds DGrid/Pioneer/xAI, headroom proxy lifecycle #4649, ~50 SSE/translator fixes, Engine Combos #5062). Trust-but-verify: this release-finalize working tree touches ONLY CHANGELOG.md, docs/i18n/*/CHANGELOG.md mirrors, and these baselines — 0 production-code change, so all drift is inherited cycle drift (`any` warn-allowed in open-sse/ + tests/). Tighten via --require-tighten next cycle.",
+      "_rebaseline_2026_07_04_pacote4_no_new_warnings": "4279->0. Pacote 4 do plano mestre testes+CI: a divida pre-existente (4279 warnings + violacoes das 3 regras promovidas a error em src/**) foi CONGELADA em config/quality/eslint-suppressions.json (ESLint bulk suppressions nativo) e passa a ser bloqueada NO PR que a introduziria (job lint-guard no quality.yml + npm run lint + lint-staged, todos suppressions-aware; fork = report-only, Principio Zero). collect-metrics agora mede sob o baseline congelado -> a metrica vira 'divida liquida NOVA' (~0 em regime). O aperto do ESTOQUE congelado acontece via `npx eslint . --prune-suppressions --suppressions-location config/quality/eslint-suppressions.json` na reconciliacao da release. Fim das rebaselines-surpresa de +41/+88 por ciclo."
     },
     "eslintErrors": {
       "value": 0,
@@ -87,35 +96,55 @@
       "tightenSlack": 10
     },
     "openapiCoverage.pct": {
-      "value": 36.9,
+      "value": 38.0,
       "direction": "up",
       "eps": 0.5,
+      "_tighten_2026_07_04_v3844_release": "36.9 -> 39.3 (aperto exigido pelo --require-tighten no PR de release #5925). A cobertura OpenAPI melhorou no ciclo (9 rotas documentadas em 8fb020676 + as rotas novas de #5939/#5817/#6034/#5998 documentadas junto das features). 39.3 = valor medido pelo CI Quality Ratchet no run 28708141003 (tip 00c55afcb).",
       "_rebaseline_2026_06_28_v3839_release": "37.8 -> 36.9 (-0.9, beyond the 0.5 eps). v3.8.39 cycle drift surfaced ONLY on the release PR (the openapi-coverage ratchet does NOT run on PR->release fast-gates). The cycle added API/internal routes (antigravity paste-credentials onboarding, CCR ranged/grep/stats retrieve params, mcp 404 session handling) faster than docs/openapi.yaml coverage; documenting LOCAL_ONLY/internal onboarding routes in the PUBLIC spec would be gaming (same precedent as _rebaseline_2026_06_18_v3828_cycle_close). Measured by CI collect-metrics (run 28317145160) = 36.9. My release-finalize tree touches no routes (only the openapi.yaml version bump). Raising coverage by documenting public routes is tracked as follow-up doc debt.",
-      "_rebaseline_2026_06_23_v3834_release": "38.4 -> 37.8 (-0.6, beyond the 0.5 eps so it failed the ratchet). v3.8.34 cycle drift: contributor PRs added API routes (e.g. quota/usage/opencode-go endpoints) faster than openapi.yaml coverage; the openapi-coverage ratchet does NOT run on PR->release fast-gates so it surfaced only on the release PR. Verified my release-finalize working tree touches no routes / openapi paths (only version bump in openapi.yaml). Measured by CI quality:collect (run 28000387577) = 37.8. Raising coverage by documenting the new routes is tracked as follow-up doc debt."
+      "_rebaseline_2026_06_23_v3834_release": "38.4 -> 37.8 (-0.6, beyond the 0.5 eps so it failed the ratchet). v3.8.34 cycle drift: contributor PRs added API routes (e.g. quota/usage/opencode-go endpoints) faster than openapi.yaml coverage; the openapi-coverage ratchet does NOT run on PR->release fast-gates so it surfaced only on the release PR. Verified my release-finalize working tree touches no routes / openapi paths (only version bump in openapi.yaml). Measured by CI quality:collect (run 28000387577) = 37.8. Raising coverage by documenting the new routes is tracked as follow-up doc debt.",
+      "_rebaseline_2026_07_13_v3847_release": "39.3 -> 38.0 (-1.3, beyond the 0.5 eps). v3.8.47 cycle drift: the cycle merged ~45 PRs adding API routes (relay repair/free-pool #6909, backpressure #6590, combo context requirements #6907, services/usage endpoints) faster than openapi.yaml documentation; same class as the v3.8.34/v3.8.39 rebaselines. Documented follow-up: raise coverage next cycle via docs/openapi.yaml additions."
     },
     "i18nUiCoverage.pct": {
-      "value": 77.5,
+      "value": 75.5,
       "direction": "up",
       "eps": 0.5,
-      "_rebaseline_2026_06_28_v3839_release": "78.4 -> 77.5 (-0.9, beyond the 0.5 eps). v3.8.39 cycle drift surfaced ONLY on the release PR (i18n-ui-coverage does NOT run on PR->release fast-gates). The cycle added new UI strings (compression studio TOON A/B table, antigravity remote-login dashboard field, amber warning icon) to the en denominator faster than the 37 non-en locales were translated; those locales need `npm run i18n:run` with OMNIROUTE_TRANSLATION_API_KEY (unavailable locally) — same precedent as _rebaseline_2026_06_18_v3828_cycle_close + _quality_rebaseline_2026_06_20_ci_ratchet. Measured by CI collect-metrics (run 28317145160) = 77.5. My release-finalize tree changes no src/i18n/messages/*.json. Tightening is tracked as follow-up (run i18n:run with creds)."
+      "_rebaseline_2026_07_04_v3844_release": "77.5 -> 76.8 (-0.7, beyond the 0.5 eps). v3.8.44 cycle drift surfaced only on the release PR (i18n-ui-coverage does NOT run on PR->release fast-gates). The cycle added ~1352 new UI keys to the en.json denominator (Discovery dashboard tab #5939, Bifrost/Mux embedded-service tabs #5817/#6034, proxy batch-ops #5918, fusion defaults #5598, tool-source toggle #5978, quota-row collapse #5977, CodeWhale/Crush CLI cards #5996/#5970, etc.) that the async i18n translation workflow has not yet back-filled (worst locales measure 76.8; __MISSING__ placeholders count as uncovered by design). Same shape and remedy as _rebaseline_2026_06_28_v3839_release. Recover via the i18n workflow next cycle; tighten with --require-tighten once translations land.",
+      "_rebaseline_2026_06_28_v3839_release": "78.4 -> 77.5 (-0.9, beyond the 0.5 eps). v3.8.39 cycle drift surfaced ONLY on the release PR (i18n-ui-coverage does NOT run on PR->release fast-gates). The cycle added new UI strings (compression studio TOON A/B table, antigravity remote-login dashboard field, amber warning icon) to the en denominator faster than the 37 non-en locales were translated; those locales need `npm run i18n:run` with OMNIROUTE_TRANSLATION_API_KEY (unavailable locally) — same precedent as _rebaseline_2026_06_18_v3828_cycle_close + _quality_rebaseline_2026_06_20_ci_ratchet. Measured by CI collect-metrics (run 28317145160) = 77.5. My release-finalize tree changes no src/i18n/messages/*.json. Tightening is tracked as follow-up (run i18n:run with creds).",
+      "_rebaseline_2026_07_13_v3847_release": "76.8 -> 75.5 (-1.3, beyond the 0.5 eps). v3.8.47 cycle drift: merged UI features added EN strings (relay repair UI #6909, combo builder #6907/#6991, capability override UI #6727) ahead of the 42-locale mirrors; same class as the v3.8.39/v3.8.44 rebaselines."
     },
     "deadExports": {
-      "value": 346,
+      "value": 227,
       "direction": "down",
+      "_rebaseline_2026_07_01_v3843_release": "225->227 (+2). v3.8.43 cycle drift, surfaced in the Quality Ratchet job after eslintWarnings was rebaselined (check:dead-code runs there). 227 = measured by check:dead-code (knip) on the release tip 4635076eb. The 5 CI fixes add 0 dead exports: safeHttpHref in linkify.ts is module-local AND used (called by linkifyText); no new exports; test files are not scanned. Tighten via --update next cycle.",
       "dedicatedGate": true,
+      "_rebaseline_2026_06_30_v3842_deadcode_wave": "310 -> 225. Measured by `node scripts/check/check-dead-code.mjs` on the v3.8.42 tip after the JxnLexn dead-code (#5463/#5464/#5466) + duplication (#5471..#5500) wave landed: DEAD_EXPORTS=133 + DEAD_FILES=92 = 225. The stale 310 was the v3.8.38 release snapshot never ratcheted on PR->release fast-gates (check:dead-code runs only on ci.yml PR->main, not quality.yml). Tightening to the true measured value; release-time captain rebaselines up if parallel cycle merges add dead exports.",
       "_rebaseline_2026_06_27_v3838_release": "345->346 (+1). v3.8.38 cycle drift surfaced by the release-green pre-flight (Quality Ratchet does NOT run on PR->release fast-gates). Net +1 inherited from this cycle's feature/fix merges (new executors/providers, compression fidelity-gate module) minus #5138's removal of dead legacy store modules. Release-finalize working tree touches ONLY CHANGELOG.md + i18n mirrors + README + baselines — 0 production-code change. Structural cleanup tracked as debt.",
       "_rebaseline_2026_06_26_v3837_release": "343->345. v3.8.37 cycle drift surfaced by the release-green pre-flight (the Quality Ratchet does NOT run on PR->release fast-gates, so warnings/complexity accrued unmeasured across this cycle's 76 commits — provider adds DGrid/Pioneer/xAI, headroom proxy lifecycle #4649, ~50 SSE/translator fixes, Engine Combos #5062). Trust-but-verify: this release-finalize working tree touches ONLY CHANGELOG.md, docs/i18n/*/CHANGELOG.md mirrors, and these baselines — 0 production-code change, so all drift is inherited cycle drift (`any` warn-allowed in open-sse/ + tests/). Tighten via --require-tighten next cycle."
     },
     "cognitiveComplexity": {
-      "value": 841,
+      "value": 890,
+      "_rebaseline_2026_07_10_gcf_v3_2": "885->888 (+3). PR feat/headroom-gcf-v3.2-nested-flattening: own growth from re-vendoring the GCF (Headroom) codec to spec v3.2 (nested flattening). The new over-threshold functions are the vendored v3.2 flatten/unflatten walk in open-sse/services/compression/engines/headroom/gcf/{generic,decode_generic}.ts. Imported third-party code kept byte-faithful to upstream gcf-typescript; measured 888 with the update vs 885 on the pristine origin/release/v3.8.47 tip. Guarded by tests/unit/compression/headroom-smartcrusher.test.ts (deep-nested case). Structural shrink belongs upstream in gcf.",
+      "_rebaseline_2026_07_12_v3847_mergetrain_burst": "885->890 (+5). v3.8.47 /merge-prs merge-train batch (23 merge-ready PRs) inherited drift: cognitive-complexity does NOT run on PR->release fast-gates, so incidental growth accrued unmeasured across the batch. Measured 890 on the combined merge-train tip (5d980352d) vs 885 on the pristine release tip 1b7a9150e. #6838 (headroom gcf codec re-vendor) accounts for +3 (its own baseline bump to 888, superseded here by this later 890 rebaseline which already covers it); the remaining +2 is parallel-batch drift across the other 22 PRs. Owner-approved rebaseline (merge-burst reconciliation, same class as the v3.8.46/v3.8.44 notes below). Tighten via --update next cycle.",
+      "_rebaseline_2026_07_09_6587_kiro_api_key_auth": "884->885 (+1). PR #6587 (@strangersp) own growth: open-sse/services/usage/kiro.ts gains ONE new over-threshold function — getKiroUsage grew from a single fetch to a 3-endpoint fallback chain (codewhisperer-get / codewhisperer-post / q-get) with per-attempt auth-header selection (tokentype: API_KEY vs Bearer-only), needed so usage/quota lookups work for the new long-lived-API-key auth path in addition to the existing OAuth path (measured: 0 violations on release tip -> 1 violation, complexity 33, at open-sse/services/usage/kiro.ts). Covered by tests/unit/kiro-iam-profilearn-usage.test.ts (tokentype header selection, friendly auth-expired/rejected-token messages). Cohesive multi-endpoint-fallback logic at an existing usage chokepoint; not extractable without splitting the fallback loop mid-merge. Structural shrink tracked in #3501.",
+      "_rebaseline_2026_07_07_v3846_release_close": "877->882 (+5). v3.8.46 release close (generate-release Phase 0 pre-flight): drift herdado do merge burst do ciclo. Trust-but-verify: os fixes de base-red do captain (agentSkills path.resolve #6366, catalogo cache #6408, tipagem de teste, MitmProxyTab suppression) sao cognitive-net-zero — check:cognitive-complexity mede 882 identico com e sem os fixes (a catraca NAO roda no fast-path PR->release). Tighten via --update next cycle.",
+      "_rebaseline_2026_07_03_v3844_ipfilter_release_green": "861->867 (+6). v3.8.44 cycle drift measured on release tip 32e4c906e during the #6131/#5975 release-green rebaseline. Inherited from the merge burst (Quality Ratchet does not run on PR->release fast-gates). route-edge-coverage +7 is my #5975 test comment; the rest is parallel-session drift. Tighten via --update next cycle.",
+      "_rebaseline_2026_07_03_v3844_review_prs_fix_batch": "860->861 (+1). Inherited v3.8.44 cycle drift surfaced by the release-green pre-flight during the /review-prs fix-batch round; check:cognitive-complexity measures 861 on the release tip 72ee80649. Negligible +1 from the round's / parallel-session merge burst (cognitive-complexity does NOT run on PR->release fast-gates). Structural shrink tracked in #3501. Tighten via --update next cycle.",
+      "_rebaseline_2026_07_02_v3844_post_5939": "859->860 (+1). Same inherited post-3a3d618fe release drift as the complexity note of this date; this PR touches one CLI line (nullish default, no new function over the threshold) and one test file (not scanned). Tighten via --update next cycle.",
+      "_rebaseline_2026_07_02_v3844_merge_burst": "856->859 (+3). Inherited v3.8.44 cycle drift surfaced by PR #5939: check:cognitive-complexity measures 859 on BOTH the pristine release tip (3a3d618fe) and this PR's merged HEAD — identical, so the PR is cognitive-net-zero (its DiscoveryPageClient was refactored into hooks/sub-components during its own CI cycle). Drift from the 2026-07-02 merge burst into release/v3.8.44. Tighten via --update next cycle.",
+      "_rebaseline_2026_07_02_5798_release_green": "845->856 (+11). Inherited v3.8.43 cycle drift surfaced by the release-green unblock #5798 / PR #5896: check:cognitive-complexity measures 856 on BOTH the pristine release tip (0d3875a98) and this PR's HEAD — identical, so the PR is cognitive-net-zero (it touches only gate scripts, docs, baselines and test files). Drift from the 2026-07-01/02 merge burst. Tighten via --update next cycle.",
       "direction": "down",
+      "_rebaseline_2026_07_01_v3843_release": "842->845 (+3). v3.8.43 cycle drift, surfaced after check:mutation-test-coverage was fixed (masked behind it in the Fast Quality Gates chain). 845 = measured by check:cognitive-complexity on BOTH fce85136c and 6d7060e21 (identical) — all +3 is inherited cycle drift; the 5 CI fixes add 0 (safeHttpHref cognitive ~2, under the 15 threshold). Tighten via --update next cycle.",
       "dedicatedGate": true,
+      "_rebaseline_2026_06_29_v3841_release": "841->842 (+1). v3.8.41 cycle drift surfaced by the release-PR Quality Ratchet (cognitive-complexity does NOT run on PR->release fast-gates). The Phase-0 pre-flight measured 840 on the pre-campaign tip; the campaign's +34 later commits (thinking-budget/marker #5312/#5352/#5367, opencode proxy-pool/observability #5217/#5370/#5351, cors/HTTPS #5242/#5360/#5361, grok #5350/#5358, oauth/routing/cli #5326/#5239/#5238) added +2 net. My release-finalize changes are docs/baselines + a lint-fix (useServiceLogs open-listener), a test alignment (encryption.spec) and a pack-allowlist entry — all complexity-neutral. Structural shrink tracked in #3501.",
       "_rebaseline_2026_06_27_v3838_release": "833->841 (+8). v3.8.38 cycle drift surfaced by the release-green pre-flight (cognitive-complexity does NOT run on PR->release fast-gates). Inherited drift from this cycle's ~78 feature/fix merges (compression fidelity-gate #5143, SSE/streaming hardening #5124/#5108/#5085, resilience #5093, quota keepalive #5102, contributor provider/translator branches). god-file decomposition #3501 is complexity-neutral. Release-finalize working tree touches ONLY CHANGELOG.md + i18n mirrors + README + baselines — 0 production-code change. Structural shrink tracked in #3501.",
       "_rebaseline_2026_06_25_v3836_release": "801→816 (+15) — v3.8.36 cycle drift surfaced by the fix-PR #5029 CI (cognitive-complexity does NOT run on PR→release fast-gates, and the Quality Ratchet job was SKIPPED on the release PR #4854 itself, so the +15 from this cycle's 137 commits accrued unmeasured). Measured locally = 816 (identical to the CI Cognitive complexity ratchet). Drift from legit cycle features (Quota-Share Fase 2/3, task-aware/Fusion combo, contributor provider/translator branches); god-file decomposition #3501 is complexity-neutral. This fix-PR touches only pack-artifact-policy.ts + a test + the 2 baseline JSONs — contributes 0. Structural shrink tracked in #3501.",
       "_rebaseline_2026_06_22_v3834_release": "797→801 (+4) — v3.8.34 cycle drift surfaced by the release-green pre-flight (cognitive-complexity does NOT run on PR→release fast-gates). Verified my release-finalize working tree touches ONLY CHANGELOG.md (git status: 0 code changes), so all +4 is inherited contributor drift from this cycle's parallel-session merges. Structural shrink tracked in #3501.",
       "_rebaseline_2026_06_22_v3833_release": "793→797 (+4) — pre-existing cycle drift on origin/release/v3.8.33.",
       "_rebaseline_2026_06_26_v3837_release": "816->826. v3.8.37 cycle drift surfaced by the release-green pre-flight (the Quality Ratchet does NOT run on PR->release fast-gates, so warnings/complexity accrued unmeasured across this cycle's 76 commits — provider adds DGrid/Pioneer/xAI, headroom proxy lifecycle #4649, ~50 SSE/translator fixes, Engine Combos #5062). Trust-but-verify: this release-finalize working tree touches ONLY CHANGELOG.md, docs/i18n/*/CHANGELOG.md mirrors, and these baselines — 0 production-code change, so all drift is inherited cycle drift (`any` warn-allowed in open-sse/ + tests/). Tighten via --require-tighten next cycle.",
-      "_rebaseline_2026_06_26_v3838_release": "826->833. v3.8.38 release base measures 833 locally on origin/release/v3.8.38 (800b04ad6) while the committed baseline still says 826. This PR measures the same 833 after refactoring jsonToSse helpers back under the sonarjs/cognitive-complexity threshold, so it does not add a net cognitive-complexity violation. The baseline bump records inherited release-base drift only; structural shrink remains tracked by the existing chatCore decomposition work."
+      "_rebaseline_2026_06_26_v3838_release": "826->833. v3.8.38 release base measures 833 locally on origin/release/v3.8.38 (800b04ad6) while the committed baseline still says 826. This PR measures the same 833 after refactoring jsonToSse helpers back under the sonarjs/cognitive-complexity threshold, so it does not add a net cognitive-complexity violation. The baseline bump records inherited release-base drift only; structural shrink remains tracked by the existing chatCore decomposition work.",
+      "_rebaseline_2026_07_06_v3845_release_close": "867->877 (+10). v3.8.45 cycle drift measured by check:release-green (hermetic) on release tip 5ecca12aa5 during the /generate-release Phase 0 pre-flight. Inherited from the cycle's merge burst (cognitive-complexity does not run on PR->release fast-gates); the captain's pre-flight fixes are gate/test/workflow changes (complexity-neutral). Tighten via --update next cycle.",
+      "_rebaseline_2026_07_07_6519_chirag_fallback_reasons": "882->883 (+1). PR #6519 (@chirag127, #6461): the preview route's fallbackReasons dedup loop adds one function over the cognitive threshold. Owner-approved rebaseline (contributor own-growth). Tighten via --update next cycle.",
+      "_rebaseline_2026_07_08_6556_inherited_drift": "883->884 (+1). PR #6556 (omniglyph engine): drift herdado do merge burst da base (cognitive-complexity nao roda no fast-path PR->release). Trust-but-verify: check:cognitive-complexity mede 884 IDENTICO na base pura origin/release/v3.8.47 e neste HEAD — o PR e cognitive-net-zero (runCompressionAsync extraido para engines/omniglyphSingleMode.ts e o page client dividido em section components na mesma rodada). Tighten via --update next cycle."
     },
     "typeCoveragePct": {
       "value": 92.17,
@@ -134,11 +163,12 @@
       "dedicatedGate": true
     },
     "zizmorFindings": {
-      "value": 159,
+      "value": 169,
       "direction": "down",
       "dedicatedGate": true,
       "_rebaseline_2026_06_23_fastpath_gates": "155 -> 159 (+4). Two new jobs added to .github/workflows/quality.yml (fast-vitest, fast-unit) to run vitest + the full unit suite on the PR->release fast-path (release-acceleration plan, _tasks/release-bench/v3.8.35/PLANO-IMPLEMENTACAO.md). The +4 are unpinned-uses: actions/checkout@v7 + actions/setup-node@v6 in each of the 2 jobs — the SAME deliberate @vN convention as every other workflow (see _scanner_harden_workflows_2026_06_16). SHA-pinning only these would violate the convention. No new template-injection/artipacked/cache-poisoning. Measured locally via `npm run check:workflows -- --ratchet` = 159.",
-      "_rebaseline_2026_06_23_v3834_release": "152 -> 155 (+3). The 3 new unpinned-uses are in .github/workflows/nightly-release-green.yml (added by #4622 this cycle): actions/checkout@v7, actions/setup-node@v6, actions/upload-artifact@v4 — the SAME deliberate @vN convention as ci.yml's own checkout@v7/setup-node@v6 and every other workflow (see _scanner_harden_workflows_2026_06_16 + _zizmor_rebaseline_2026_06_20_ci_build_artifact_reuse). SHA-pinning only this workflow would violate the convention. The workflow-lint ratchet does NOT run on PR->release fast-gates, so it surfaced only on the release PR; measured locally via `npm run check:workflows -- --ratchet` = 155. No new template-injection/artipacked/cache-poisoning."
+      "_rebaseline_2026_06_23_v3834_release": "152 -> 155 (+3). The 3 new unpinned-uses are in .github/workflows/nightly-release-green.yml (added by #4622 this cycle): actions/checkout@v7, actions/setup-node@v6, actions/upload-artifact@v4 — the SAME deliberate @vN convention as ci.yml's own checkout@v7/setup-node@v6 and every other workflow (see _scanner_harden_workflows_2026_06_16 + _zizmor_rebaseline_2026_06_20_ci_build_artifact_reuse). SHA-pinning only this workflow would violate the convention. The workflow-lint ratchet does NOT run on PR->release fast-gates, so it surfaced only on the release PR; measured locally via `npm run check:workflows -- --ratchet` = 155. No new template-injection/artipacked/cache-poisoning.",
+      "_rebaseline_2026_07_13_v3847_release_preflight": "159 -> 169 (+10). Findings from cycle-merged workflow changes: #6716 (PR gate restructure), #6781 (unit fast-path shard 2->4), #6788 (TIA tsx loader split), #6881 (electron-updater latest.yml manifests in release assets) — same deliberate @vN unpinned-uses convention as prior rebaselines; no new template-injection/artipacked/cache-poisoning classes. Measured via `npm run check:workflows -- --ratchet` = 169 on the v3.8.47 release pre-flight."
     },
     "vulnCount": {
       "value": 10,
@@ -146,9 +176,10 @@
       "dedicatedGate": true
     },
     "bundleSize": {
-      "value": 5601,
+      "value": 6534,
       "direction": "down",
-      "dedicatedGate": true
+      "dedicatedGate": true,
+      "_rebaseline_2026_07_07_v3846_release_close": "5601->6534 (+933). v3.8.46 release close: gzip of the 4 bin/*.mjs entrypoints (size-limit + @size-limit/file) grew from this cycle's feature/fix merges pulled transitively into the CLI entrypoints (new providers, combo pipeline strategy #6396, effort/thinking standardization #6241, catalog cache-invalidation #6408). Measured 6534 locally via `check:bundle-size --ratchet` (deterministic gzip, matches CI). Legitimate cycle growth; shrink is separate debt."
     },
     "openapiBreaking": {
       "value": 0,

config/quality/test-masking-allowlist.json

@@ -7,5 +7,39 @@
   "tests/unit/compression/session-dedup.test.ts": "v3.8.29 #4226: the vestigial SessionDedup round-trip helper was removed from source; its 2 asserts were removed accordingly (32→30). Helper no longer exists. Verified legitimate, not masking. Prune after v3.8.29 merges to main.",
   "tests/unit/compression/ultra.test.ts": "v3.8.29 #4253: the vestigial SLM seam + dead deprecated alias were removed from the ultra compression engine; 6 asserts covering the removed seam were removed accordingly (49→43). Verified legitimate, not masking. Prune after v3.8.29 merges to main.",
   "tests/unit/db-backup-extended.test.ts": "v3.8.29 #4132: db-backup de-flake — 1 timing-sensitive assertion on fire-and-forget backup completion was removed in favor of awaiting actual completion (44→43). Verified legitimate, not masking. Prune after v3.8.29 merges to main.",
-  "@omniroute/opencode-plugin/tests/combos.test.ts": "v3.8.31 #4384: the plugin now prefixes every catalog key with the `omniroute` provider id and drops the legacy `combo/` namespace; the test asserting raw-deletion + a `combo/<slug>` key (a namespace that no longer exists) was removed and the remaining asserts switched to `omniroute/<slug>` keys (82→81). Asserts updated to the new key contract, not weakened. Verified legitimate. Prune after v3.8.31 merges to main."
+  "@omniroute/opencode-plugin/tests/combos.test.ts": "v3.8.31 #4384: the plugin now prefixes every catalog key with the `omniroute` provider id and drops the legacy `combo/` namespace; the test asserting raw-deletion + a `combo/<slug>` key (a namespace that no longer exists) was removed and the remaining asserts switched to `omniroute/<slug>` keys (82→81). Asserts updated to the new key contract, not weakened. Verified legitimate. Prune after v3.8.31 merges to main.",
+  "tests/unit/chatgpt-web.test.ts": "v3.8.43 #5549: fix(chatgpt-web) restore dot-form Pro model ids — dois assert.equal separados (base Pro slug + pass-through slug) consolidados num único assert.equal(body.model, expectedSlugById[omniId], ...) orientado por tabela de mapeamento (281→280). Asserts consolidados, não enfraquecidos. Verificado legítimo. Prune após v3.8.43 mergear para main.",
+  "tests/unit/chatcore-sanitization.test.ts": "v3.8.43 #5805: fix(translator) strip orphaned tool results — orphaned tool_result blocks (no matching tool_use) are now removed by stripOrphanedToolResults BEFORE content normalization, so the 3 positive `[Tool Result: …]`-text asserts were replaced by removal asserts (no tool_result block, no text), net 65→64. Behavior aligned to the merged #5805 contract; the sibling 'preserves Claude passthrough tool_result' assert (matching tool_use) is untouched. Verified legitimate, not masking. Prune after v3.8.43 merges to main.",
+  "src/app/(dashboard)/dashboard/providers/[id]/__tests__/useModelVisibilityHandlers.test.tsx": "v3.8.43 #5856: fix(dashboard) unify CSRF origin fallback — the model-visibility handler no longer issues a separate `/api/auth/csrf` fetch, so the two asserts pinning the 2nd fetch + its CSRF header were removed and the fetch-count assert updated 2→1 (7→5). Asserts follow the reduced fetch behavior, not weakened. Verified legitimate. Prune after v3.8.43 merges to main.",
+  "tests/unit/provider-validation-specialty.test.ts": "v3.8.43 #5855: fix(qwen-web) unblock validator (retired endpoint) — the old `chat.qwen.ai/api/v2/user` probe asserts (exact URL / Authorization / source / Cookie / WAF-error) no longer apply after the endpoint migration and were replaced by new chathub-path behavior asserts (valid/error/warning), net 406→400. Asserts migrated to the new API surface (#5855/#5432), not weakened. Verified legitimate. Prune after v3.8.43 merges to main.",
+  "tests/unit/chatcore-translation-paths.test.ts": "v3.8.44 #5958: fix(cc-compatible) send SSE accept for streamed requests — o assert do header Accept mudou de application/json para text/event-stream e dois asserts (stream + context_management) foram consolidados num único assert.deepEqual de tupla (297→296). Asserts consolidados/atualizados ao novo contrato, não enfraquecidos. Verificado legítimo. Prune após v3.8.44 mergear para main.",
+  "tests/unit/combo-context-window-filter.test.ts": "v3.8.44 #6088: fix(combo) prefer known context capacity over unknown — a semântica do filtro mudou (unknown-context só sobrevive como fallback), o arquivo foi reescrito: 18 asserts pequenos (length/didFallback/ok) viraram 4 assert.deepEqual na LISTA ORDENADA completa de sobreviventes por caso (mais forte por caso). Asserts migrados ao novo contrato, não enfraquecidos. Verificado legítimo. Prune após v3.8.44 mergear para main.",
+  "tests/unit/qoder-executor.test.ts": "v3.8.44 #5816: feat(qoder) drive PAT auth via qodercli — o executor migrou de chamadas HTTP diretas (api.qoder.com/api1.qoder.sh, headers Cosy-*) para o contrato stdio qodercli://; os asserts que pinavam URLs/headers da superfície aposentada foram substituídos por asserts do novo contrato (73→65). Asserts migrados à nova superfície, não enfraquecidos. Verificado legítimo. Prune após v3.8.44 mergear para main.",
+  "tests/unit/qoder-jobtoken-exchange-4683.test.ts": "v3.8.44 #5816: feat(qoder) drive PAT auth via qodercli — o exchange de job token deixou de fazer o POST personal_token direto (agora via qodercli); 2 asserts da superfície HTTP aposentada removidos, demais migrados (27→25). Verificado legítimo, não mascaramento. Prune após v3.8.44 mergear para main.",
+  "tests/integration/v1-contracts-behavior.test.ts": "v3.8.46 #6303: fix(api) filter specialty model catalogs — os 10 asserts inline de SHAPE das listas embedding/image (object=='model', type=='embedding'/'image', typeof id/owned_by) foram removidos porque #6303 unificou os catálogos de especialidade e moveu a cobertura de shape para tests/unit/models-catalog-route.test.ts (que asserta embedding.type/gpt-image-2.type=='image'/owned_by de forma mais abrangente, +audio/rerank/video/music) e o comportamento de credential-hiding para tests/unit/specialty-model-catalog-routes.test.ts; net 44→42. Cobertura migrada, não enfraquecida. Verificado legítimo. Prune após v3.8.46 mergear para main.",
+  "tests/unit/check-docs-symbols.test.ts": "v3.8.46 release-PR CI: o gate check:docs-symbols (stale-enforcement) flagou as 2 ultimas entradas de KNOWN_STALE_DOC_REFS (/api/chat, /api/settings/tunnels) como CORRIGIDAS e exigiu remove-las, esvaziando o allowlist. Os 2 asserts removidos eram `assert.ok(size > 0)` (guarda non-empty) que ficaram FALSOS — um allowlist vazio e o estado valido/ideal (todo ref stale foi corrigido). A invariante significativa (/api/-shape de cada entrada presente) foi mantida; net 28->26. Nao e enfraquecimento — a assuncao non-empty tornou-se obsoleta. Prune apos v3.8.46 mergear para main.",
+  "tests/unit/combo-quota-share-cooldown-wait.test.ts": "v3.8.47 #6897: de-flake redesign dos testes timing-sensitive de cooldown/breaker do combo (#6803) — asserts dependentes de timing real substituídos por asserts determinísticos com clock controlado, net 12→6. Asserts redesenhados, não enfraquecidos (a suíte prova o MESMO contrato sem flake). Verificado legítimo. Prune após v3.8.47 mergear para main.",
+  "tests/unit/combo-strategy-fallbacks.test.ts": "v3.8.47 #6897: mesmo de-flake redesign (#6803) — asserts timing-sensitive de fallback de estratégia consolidados em asserts determinísticos, net 58→52. Verificado legítimo, não mascaramento. Prune após v3.8.47 mergear para main.",
+  "tests/unit/provider-page-helpers-3501.test.ts": "v3.8.47 #6862: feat GPT-5.6 family — 2 assert.ok(values.includes(...)) substituídos por 1 assert.deepEqual(values, [lista completa ordenada de effort tiers]) — asserção estritamente MAIS FORTE, net 69→68. Verificado legítimo. Prune após v3.8.47 mergear para main.",
+  "tests/unit/vscode-token-routes.test.ts": "v3.8.47 #6862: feat GPT-5.6 family — a matriz de modelos do VS Code token route migrou de GPT-5.4/5.5 para a família 5.6 (tiers consolidados, context 200k→500k, novos slugs sol); os asserts da matriz aposentada foram substituídos pelos da nova (net 247→200). Asserts migrados ao novo catálogo, não enfraquecidos. Verificado legítimo. Prune após v3.8.47 mergear para main.",
+  "tests/unit/providers-page-utils.test.ts": "v3.8.47 #6675: remoção dos providers obsoletos glhf/kluster/cablyai/inclusionai — os 2 asserts que citavam providers removidos do catálogo foram removidos junto (net 276→274). Superfície aposentada, não mascaramento. Verificado legítimo. Prune após v3.8.47 mergear para main.",
+  "_deletedWithReplacement": {
+    "_comment": "Deleções de arquivo de teste com SUBSTITUTO verificado (o gate exige que o replacement exista no HEAD e seja arquivo de teste). Uso restrito ao caso 'reescrito em outro path sem rename detectável pelo -M do git'. Cada entrada precisa de reason com PR ref e passa por revisão humana no release PR. Prune após o release mergear para main.",
+    "open-sse/services/combo/__tests__/targetExhaustion.test.ts": {
+      "replacement": "tests/unit/combo/combo-target-exhaustion.test.ts",
+      "reason": "v3.8.44 #5976: os testes de exaustão eram flake-prone (delays Math.random, timeouts 30s, >3min no CI) e foram REESCRITOS como unit determinístico com MAIS cobertura (21 casos/52 asserts vs 13 casos/37 asserts). Documentado no commit 5fe225850. Revisão humana: apresentado ao operador no STOP #1 do release v3.8.44."
+    },
+    "src/shared/components/AutoRoutingBanner.test.tsx": {
+      "replacement": "tests/unit/home-no-autorouting-banner.test.ts",
+      "reason": "v3.8.45 #6164: fix(dashboard) remove the always-on Auto-Routing banner — o COMPONENTE foi deletado junto com o teste (feature removida pelo mantenedor, não mascaramento). O replacement guarda o novo contrato: a home NÃO renderiza o banner e o componente permanece deletado."
+    },
+    "tests/unit/free-provider-rankings-configured-filter.test.ts": {
+      "replacement": "tests/unit/freeProviderRankings-filters.test.ts",
+      "reason": "v3.8.45 #6251 supersede #6245: a página Free Provider Rankings migrou do toggle client-side 'Configured Only' (#6245, configuredProviderIds no cliente) para filtros server-side configuredOnly/availableOnly (#6251). O teste antigo pinava a implementação removida (7 asserts quebrados contra código que não existe); o replacement cobre o contrato novo com 11 casos (server-side, lib helper). Verificado legítimo — supersessão documentada no CHANGELOG do #6251."
+    }
+  },
+  "tests/unit/catalog-updates-v3x.test.ts": "v3.8.45 #6248: fix(providers) remove deprecated MiMo V2 entries — os 5 asserts removidos pinavam specs de modelos mimo-v2-* que deixaram de existir no catálogo (54→49). Asserts seguem a remoção dos modelos, não enfraquecimento. Verificado legítimo. Prune após v3.8.45 mergear para main.",
+  "tests/unit/xiaomi-mimo-provider.test.ts": "v3.8.45 #6248: fix(providers) remove deprecated MiMo V2 entries — 2 asserts sobre mimo-v2-pro/omni/flash removidos junto com os modelos (21→19). Verificado legítimo, não mascaramento. Prune após v3.8.45 mergear para main.",
+  "tests/unit/provider-models-route.test.ts": "v3.8.45 #6170: fix(providers) correct Kiro model catalog to real upstream ids — 3 assert.ok positivos de ids fabricados (claude-opus-4.7/sonnet-4.6) substituídos por 1 assert positivo de conjunto + 1 assert NEGATIVO garantindo que os ids fabricados sumiram (310→309). Asserts migrados ao catálogo real, não enfraquecidos. Verificado legítimo. Prune após v3.8.45 mergear para main.",
+  "tests/unit/copilot-gemini-claude-route-no-responses.test.ts": "v3.8.45 #6154: fix(providers) refresh GitHub Copilot catalog — 2 asserts combinados (registry-exists + par claude/gemini) reescritos como loop per-model com assert.ok individual por id do catálogo novo (7→6). Asserts reestruturados ao catálogo atualizado, não enfraquecidos. Verificado legítimo. Prune após v3.8.45 mergear para main."
 }

docker-compose.prod.yml

@@ -58,12 +58,16 @@ services:
       - PORT=${PORT:-20128}
       - DASHBOARD_PORT=${DASHBOARD_PORT:-${PORT:-20128}}
       - API_PORT=${API_PORT:-20129}
+      - LIVE_WS_PORT=${LIVE_WS_PORT:-20132}
+      - LIVE_WS_HOST=${LIVE_WS_HOST:-0.0.0.0}
+      - LIVE_WS_ALLOWED_ORIGINS=${LIVE_WS_ALLOWED_ORIGINS:-http://localhost:${PROD_DASHBOARD_PORT:-20130},http://127.0.0.1:${PROD_DASHBOARD_PORT:-20130}}
       - API_HOST=${API_HOST:-0.0.0.0}
       - HOSTNAME=0.0.0.0
       - DATA_DIR=/app/data
     ports:
       - "${PROD_DASHBOARD_PORT:-20130}:${DASHBOARD_PORT:-${PORT:-20128}}"
       - "${PROD_API_PORT:-20131}:${API_PORT:-20129}"
+      - "${PROD_LIVE_WS_PORT:-20132}:${LIVE_WS_PORT:-20132}"
     volumes:
       - omniroute-prod-data:/app/data
     healthcheck:

docker-compose.yml

@@ -37,6 +37,9 @@ x-common: &common
     - DASHBOARD_PORT=${DASHBOARD_PORT:-20128}
     - API_PORT=${API_PORT:-20129}
     - API_HOST=${API_HOST:-0.0.0.0}
+    - LIVE_WS_PORT=${LIVE_WS_PORT:-20132}
+    - LIVE_WS_HOST=${LIVE_WS_HOST:-0.0.0.0}
+    - LIVE_WS_ALLOWED_ORIGINS=${LIVE_WS_ALLOWED_ORIGINS:-http://localhost:20128,http://127.0.0.1:20128}
     - REDIS_URL=${REDIS_URL:-redis://redis:6379}
   volumes:
     - ./data:/app/data
@@ -75,6 +78,7 @@ services:
     ports:
       - "${DASHBOARD_PORT:-20128}:${DASHBOARD_PORT:-20128}"
       - "${API_PORT:-20129}:${API_PORT:-20129}"
+      - "${LIVE_WS_PORT:-20132}:${LIVE_WS_PORT:-20132}"
     profiles:
       - base
 
@@ -92,6 +96,7 @@ services:
     ports:
       - "${DASHBOARD_PORT:-20128}:${DASHBOARD_PORT:-20128}"
       - "${API_PORT:-20129}:${API_PORT:-20129}"
+      - "${LIVE_WS_PORT:-20132}:${LIVE_WS_PORT:-20132}"
     profiles:
       - web
 
@@ -106,6 +111,7 @@ services:
     ports:
       - "${DASHBOARD_PORT:-20128}:${DASHBOARD_PORT:-20128}"
       - "${API_PORT:-20129}:${API_PORT:-20129}"
+      - "${LIVE_WS_PORT:-20132}:${LIVE_WS_PORT:-20132}"
     volumes:
       - ./data:/app/data
       - /var/run/docker.sock:/var/run/docker.sock
@@ -125,12 +131,16 @@ services:
     ports:
       - "${DASHBOARD_PORT:-20128}:${DASHBOARD_PORT:-20128}"
       - "${API_PORT:-20129}:${API_PORT:-20129}"
+      - "${LIVE_WS_PORT:-20132}:${LIVE_WS_PORT:-20132}"
     environment:
       - DATA_DIR=/app/data
       - PORT=${PORT:-20128}
       - DASHBOARD_PORT=${DASHBOARD_PORT:-20128}
       - API_PORT=${API_PORT:-20129}
       - API_HOST=${API_HOST:-0.0.0.0}
+      - LIVE_WS_PORT=${LIVE_WS_PORT:-20132}
+      - LIVE_WS_HOST=${LIVE_WS_HOST:-0.0.0.0}
+      - LIVE_WS_ALLOWED_ORIGINS=${LIVE_WS_ALLOWED_ORIGINS:-http://localhost:20128,http://127.0.0.1:20128}
       - CLI_MODE=host
       - CLI_EXTRA_PATHS=/host-local/bin:/host-node/bin
       - CLI_CONFIG_HOME=/host-home

docs/DOCUMENTATION_OVERHAUL_PLAN.md

@@ -1,389 +0,0 @@
-# OmniRoute Documentation Overhaul Plan
-
-> Goal: Make all docs accessible to non-tech users while preserving technical depth for developers.
-> Strategy: Two-tier docs (User Guide + Technical Reference) with cross-links.
-
----
-
-## Design Principles
-
-1. **User Guide** (new files in `docs/guides/`)
-   - Plain language, no jargon
-   - "Why → What → How" structure
-   - Tables for comparisons
-   - Copy-paste examples
-   - "What's next?" at the end
-
-2. **Technical Reference** (existing files)
-   - Keep as-is (already well-written)
-   - Add "For Users" callout at top linking to user guide
-   - Add "Prerequisites" section
-   - Ensure consistent formatting
-
-3. **Cross-Links**
-   - User guides link to technical docs for "learn more"
-   - Technical docs link to user guides for "quick start"
-
----
-
-## Phase 1: User-Facing Quick Start Docs (Highest Impact)
-
-### 1.1 `docs/guides/QUICK-START.md` — NEW
-
-**Replaces**: Condensed version of README.md
-**Content**:
-
-- Install (npm, Docker, source)
-- Connect a free provider (3 steps)
-- Point your IDE to OmniRoute
-- Verify it works
-- "What's next?" → link to other guides
-
-### 1.2 `docs/guides/AUTO-COMBO-GUIDE.md` — NEW
-
-**Complements**: `docs/routing/AUTO-COMBO.md`
-**Content**:
-
-- What auto-combo does (30-second version)
-- Which `auto` should I use? (table)
-- How it picks providers (simple version)
-- Common questions (FAQ)
-- "Learn more" → link to technical reference
-
-### 1.3 `docs/guides/PROVIDERS-GUIDE.md` — NEW
-
-**Complements**: `docs/reference/PROVIDER_REFERENCE.md`
-**Content**:
-
-- What is a provider? (analogy)
-- How to connect a provider (step-by-step)
-- Free vs paid providers (table)
-- OAuth vs API key (which do I need?)
-- Troubleshooting connection issues
-- "Learn more" → link to provider reference
-
-### 1.4 `docs/guides/FREE-TIERS-GUIDE.md` — NEW
-
-**Complements**: `docs/reference/FREE_TIERS.md`
-**Content**:
-
-- What are free tiers? (analogy)
-- Best free providers (table with quotas)
-- How to stack free tiers for unlimited usage
-- Common questions (FAQ)
-- "Learn more" → link to free tiers reference
-
-### 1.5 `docs/guides/TROUBLESHOOTING.md` — REWRITE
-
-**Current**: Technical, code-heavy
-**New**: "I see X → Do Y" format
-**Content**:
-
-- Problem → Solution table
-- Common error messages (with screenshots)
-- "Still stuck?" → link to community
-
----
-
-## Phase 2: Refine Existing User Docs
-
-### 2.1 `docs/guides/USER_GUIDE.md` — UPDATE
-
-**Changes**:
-
-- Add "What you'll learn" section at top
-- Remove jargon, explain terms
-- Add step-by-step screenshots
-- Add "Common mistakes" section
-
-### 2.2 `docs/guides/SETUP_GUIDE.md` — UPDATE
-
-**Changes**:
-
-- Add "Prerequisites" section
-- Simplify commands (one-liners)
-- Add "Verify it works" step
-- Add "Troubleshooting" section
-
-### 2.3 `docs/guides/FEATURES.md` — UPDATE
-
-**Changes**:
-
-- Add "Why this matters" for each feature
-- Add use-case examples
-- Add "How to enable" for each feature
-- Add screenshots
-
-### 2.4 `docs/guides/DOCKER_GUIDE.md` — UPDATE
-
-**Changes**:
-
-- Add "Docker for beginners" section
-- Simplify commands
-- Add "Common Docker issues" section
-- Add "What's next?" section
-
-### 2.5 `docs/guides/ELECTRON_GUIDE.md` — UPDATE
-
-**Changes**:
-
-- Add "What is Electron?" explanation
-- Add screenshots
-- Add "Common issues" section
-
-### 2.6 `docs/guides/TERMUX_GUIDE.md` — UPDATE
-
-**Changes**:
-
-- Add "What is Termux?" explanation
-- Add step-by-step with screenshots
-- Add "Common issues" section
-
-### 2.7 `docs/guides/PWA_GUIDE.md` — UPDATE
-
-**Changes**:
-
-- Add "What is a PWA?" explanation
-- Add step-by-step with screenshots
-- Add "Common issues" section
-
-### 2.8 `docs/guides/I18N.md` — UPDATE
-
-**Changes**:
-
-- Add "How to change language" (user perspective)
-- Add "How to contribute translations" (contributor perspective)
-
-### 2.9 `docs/guides/KIRO_SETUP.md` — UPDATE
-
-**Changes**:
-
-- Add "What is Kiro?" explanation
-- Add step-by-step with screenshots
-- Add "Common issues" section
-
-### 2.10 `docs/guides/UNINSTALL.md` — UPDATE
-
-**Changes**:
-
-- Add "Why uninstall?" section (common reasons)
-- Add "Before you uninstall" checklist
-- Simplify commands
-
----
-
-## Phase 3: Technical Docs (Add Cross-Links, Keep As-Is)
-
-### 3.1 `docs/architecture/` (6 files)
-
-**Changes**: Add "For Users" callout at top → link to user guide
-
-- ARCHITECTURE.md
-- AUTHZ_GUIDE.md
-- CODEBASE_DOCUMENTATION.md
-- MONITORING_SECTIONS.md
-- REPOSITORY_MAP.md
-- RESILIENCE_GUIDE.md
-
-### 3.2 `docs/frameworks/` (16 files)
-
-**Changes**: Add "For Users" callout at top → link to user guide
-
-- A2A-SERVER.md
-- AGENT-SKILLS.md
-- AGENTBRIDGE.md
-- AGENT_PROTOCOLS_GUIDE.md
-- CLOUD_AGENT.md
-- EMBEDDED-SERVICES.md
-- EVALS.md
-- GAMIFICATION.md
-- MCP-SERVER.md
-- MEMORY.md
-- OPENCODE.md
-- PLAYGROUND_STUDIO.md
-- SEARCH_TOOLS_STUDIO.md
-- SKILLS.md
-- TRAFFIC_INSPECTOR.md
-- WEBHOOKS.md
-
-### 3.3 `docs/security/` (9 files)
-
-**Changes**: Add "For Users" callout at top → link to user guide
-
-- CLI_TOKEN.md
-- CLI_TOKEN_AUTH.md
-- COMPLIANCE.md
-- ERROR_SANITIZATION.md
-- GUARDRAILS.md
-- PUBLIC_CREDS.md
-- ROUTE_GUARD_TIERS.md
-- SOCKET_DEV_FINDINGS.md
-- STEALTH_GUIDE.md
-
-### 3.4 `docs/ops/` (8 files)
-
-**Changes**: Add "For Users" callout at top → link to user guide
-
-- COVERAGE_PLAN.md
-- E2E_DASHBOARD_SHAKEDOWN_v3.8.0.md
-- FLY_IO_DEPLOYMENT_GUIDE.md
-- PROXY_GUIDE.md
-- RELEASE_CHECKLIST.md
-- SQLITE_RUNTIME.md
-- TUNNELS_GUIDE.md
-- VM_DEPLOYMENT_GUIDE.md
-
-### 3.5 `docs/compression/` (5 files)
-
-**Changes**: Add "For Users" callout at top → link to user guide
-
-- COMPRESSION_ENGINES.md
-- COMPRESSION_GUIDE.md
-- COMPRESSION_LANGUAGE_PACKS.md
-- COMPRESSION_RULES_FORMAT.md
-- RTK_COMPRESSION.md
-
-### 3.6 `docs/routing/` (3 files)
-
-**Changes**: Add "For Users" callout at top → link to user guide
-
-- AUTO-COMBO.md (→ link to AUTO-COMBO-GUIDE.md)
-- QUOTA_SHARE.md
-- REASONING_REPLAY.md
-
-### 3.7 `docs/reference/` (5 files)
-
-**Changes**: Add "For Users" callout at top → link to user guide
-
-- API_REFERENCE.md
-- CLI-TOOLS.md
-- ENVIRONMENT.md
-- FREE_TIERS.md (→ link to FREE-TIERS-GUIDE.md)
-- PROVIDER_REFERENCE.md (→ link to PROVIDERS-GUIDE.md)
-
-### 3.8 Other Docs (keep as-is)
-
-- `docs/comparison/OMNIROUTE_VS_ALTERNATIVES.md` — Already user-friendly
-- `docs/marketing/TIERS.md` — Already user-friendly
-- `docs/diagrams/README.md` — Keep as-is
-- `docs/dev/plugins.md` — Developer-only
-- `docs/plugins/PLUGIN_SDK.md` — Developer-only
-- `docs/providers/ZED-DOCKER.md` — Provider-specific
-- `docs/AGENTROUTER.md` — Provider-specific
-- `docs/PROVIDERS.md` — Provider-specific
-- `docs/README.md` — Keep as-is
-- `docs/SUBMIT_PR.md` — Contributor-only
-- `docs/releases/v3.8.0.md` — Release notes
-- `docs/research/` — Internal research
-- `docs/specs/` — Internal specs
-- `docs/openspec/` — Internal specs
-- `docs/superpowers/` — Internal plans
-
----
-
-## Phase 4: Update Main README.md
-
-**Changes**:
-
-- Add "Quick Start" section (3 steps)
-- Add "Which `auto` should I use?" table
-- Add "Free providers" table
-- Add "Common questions" section
-- Link to user guides
-
----
-
-## Execution Order
-
-### Week 1: Phase 1 (User-Facing Quick Start Docs)
-
-1. `docs/guides/QUICK-START.md` — NEW
-2. `docs/guides/AUTO-COMBO-GUIDE.md` — NEW
-3. `docs/guides/PROVIDERS-GUIDE.md` — NEW
-4. `docs/guides/FREE-TIERS-GUIDE.md` — NEW
-5. `docs/guides/TROUBLESHOOTING.md` — REWRITE
-
-### Week 2: Phase 2 (Refine Existing User Docs)
-
-1. `docs/guides/USER_GUIDE.md` — UPDATE
-2. `docs/guides/SETUP_GUIDE.md` — UPDATE
-3. `docs/guides/FEATURES.md` — UPDATE
-4. `docs/guides/DOCKER_GUIDE.md` — UPDATE
-5. `docs/guides/ELECTRON_GUIDE.md` — UPDATE
-6. `docs/guides/TERMUX_GUIDE.md` — UPDATE
-7. `docs/guides/PWA_GUIDE.md` — UPDATE
-8. `docs/guides/I18N.md` — UPDATE
-9. `docs/guides/KIRO_SETUP.md` — UPDATE
-10. `docs/guides/UNINSTALL.md` — UPDATE
-
-### Week 3: Phase 3 (Technical Docs Cross-Links)
-
-1. `docs/architecture/` — Add cross-links
-2. `docs/frameworks/` — Add cross-links
-3. `docs/security/` — Add cross-links
-4. `docs/ops/` — Add cross-links
-5. `docs/compression/` — Add cross-links
-6. `docs/routing/` — Add cross-links
-7. `docs/reference/` — Add cross-links
-
-### Week 4: Phase 4 (Update Main README.md)
-
-1. Update README.md with user-friendly sections
-
----
-
-## Success Metrics
-
-- [ ] User can install OmniRoute in < 5 minutes (QUICK-START.md)
-- [ ] User can connect a provider in < 3 minutes (PROVIDERS-GUIDE.md)
-- [ ] User can use auto-combo in < 1 minute (AUTO-COMBO-GUIDE.md)
-- [ ] User can find free providers in < 2 minutes (FREE-TIERS-GUIDE.md)
-- [ ] User can troubleshoot common issues in < 5 minutes (TROUBLESHOOTING.md)
-- [ ] All technical docs link to user guides
-- [ ] All user guides link to technical docs
-
----
-
-## File Naming Convention
-
-- User guides: `docs/guides/[FEATURE]-GUIDE.md` (e.g., `AUTO-COMBO-GUIDE.md`)
-- Technical docs: Keep existing names (e.g., `docs/routing/AUTO-COMBO.md`)
-- Cross-links: "For Users" callout at top of technical docs
-
----
-
-## Template for User Guides
-
-```markdown
-# [Feature Name]: [One-Line Description]
-
-## What It Does
-
-[2-3 sentences explaining what the feature does in plain language]
-
-## Quick Start
-
-[Step-by-step instructions to get started]
-
-## [Main Section]
-
-[Detailed explanation with tables, examples, screenshots]
-
-## Common Questions
-
-[FAQ section with common questions and answers]
-
-## What's Next?
-
-[Links to related guides and technical docs]
-```
-
----
-
-## Template for Technical Doc Cross-Links
-
-```markdown
-> **For Users**: Looking for a quick start? See the [User Guide](../guides/[FEATURE]-GUIDE.md).
-
-> **Prerequisites**: [List prerequisites]
-```

docs/INCIDENT_RESPONSE.md

@@ -1,174 +0,0 @@
-# Incident Response Runbook — OmniRoute (2026-06-18)
-
-**Status**: Authoritative. The 71-pillar audit (L61) references this doc
-for the `Obs > 2.00` gate.
-**Owner**: observability-circle (lead: security-circle lead).
-**SLOs**: see `docs/PERF_BUDGETS.md` § 1 (top-level SLOs) and
-`ops/slos.yaml` (machine-readable form, generated by the Bifrost team).
-**Disclosure policy**: see `SECURITY.md` (vulnerability disclosure only,
-separate flow).
-
-This runbook is the operational playbook for **non-security** incidents:
-outages, latency regressions, error-budget burn, and provider-side
-failures. Vulnerability disclosure stays on `SECURITY.md`; do not route
-those through this runbook.
-
----
-
-## 1. Severity ladder
-
-| Sev | Definition | Examples | Page on | Resolve by |
-|---|---|---|---|---|
-| **SEV-1** | User-visible outage; > 50 % of requests failing or > 2x SLO breach for 5 min. | Cluster down; auth layer broken; 5xx flood. | On-call P0 (immediate) | 4 h |
-| **SEV-2** | Significant degradation; 1.5–2x SLO breach for 15 min, or single-tenant impact. | Single provider down; p95 > 1.5x budget; rate-limit runaway. | On-call P1 (15 min) | 24 h |
-| **SEV-3** | Latent bug or near-miss; no current user impact but error budget at risk. | Memory leak trending up; circuit breaker tripping on one provider. | Slack `#omniroute-ops` (next standup) | 7 d |
-| **SEV-4** | Cosmetic / informational. | Log line noise; non-binding UI glitch. | Next weekly review | Next refactor cycle |
-
-**Burn-rate escalation** (per `docs/PERF_BUDGETS.md` § 1): 6x for 5 min
-is SEV-1; 2x for 1 h is SEV-2; sustained < 1x for 7 d demotes to SEV-3.
-
----
-
-## 2. Detection sources
-
-| Source | Signal | Routing |
-|---|---|---|
-| Prometheus (`/metrics`) | Counter deltas (5xx, latency) | Alertmanager → PagerDuty |
-| Grafana SLO dashboards | SLO burn-rate panels | Slack `#omniroute-ops` |
-| Uptime probe (`/api/health/ping`) | 3 consecutive failures from 3 regions | Alertmanager → PagerDuty |
-| Dependabot | New CVE in dependency | GitHub issue + Slack `#security` |
-| User report (support@) | Manual triage | Slack `#omniroute-triage` |
-| Error budget burn alert | `slo_burn_rate > threshold` | Alertmanager |
-
-Prometheus and Alertmanager are configured in the deploy repo (see
-`docs/operations/DEPLOY.md` once published; currently inline in
-`docker-compose.prod.yml`).
-
----
-
-## 3. First-15-minutes checklist
-
-When paged, the on-call engineer runs this checklist verbatim. **Do
-not** skip steps; each is timed.
-
-1. **0:00** — Acknowledge the page in PagerDuty. Stops the escalation
-   timer and notifies the secondary.
-2. **0:02** — Open the [SLO dashboard][dash] and the [incident
-   channel][chan] (`#inc-YYYY-MM-DD-slug`). Post a single-line ack
-   with the alert name and the time.
-3. **0:05** — Classify severity per § 1. If SEV-1 or SEV-2, declare
-   the incident in the channel and tag `@incident-commander`.
-4. **0:08** — Capture the alert payload, the most recent deploy SHA,
-   and the top 5 slow / erroring endpoints. Post to the channel.
-5. **0:12** — Decide: **mitigate first, root-cause later**. Choose
-   one of:
-   - **Roll back** to the last green deploy (`bin/rollback.sh vX.Y.Z`).
-   - **Failover** to the healthy replicas (Caddy LB removes the bad
-     replica automatically; verify with `curl /api/health/ping`).
-   - **Disable** a broken provider connection via `PUT /api/providers/{id}`
-     with `{ "isActive": false }` (one-line toggle; safe by default).
-6. **0:15** — Post the chosen mitigation in the channel. If the page
-   is still firing after 5 more minutes, escalate to the secondary.
-
-[chan]: https://phenotype.slack.com/archives/incidents
-[dash]: https://grafana.phenotype.internal/d/omniroute-slos
-
----
-
-## 4. Mitigation runbooks (per failure mode)
-
-### 4.1 Provider outage (single provider down)
-
-1. `PUT /api/providers/{id}` with `{ "isActive": false }` — toggles the
-   connection off in the registry; all routes re-resolve on next request.
-2. Verify p95 returns to budget within 5 min.
-3. If all providers for a model are down, **disable the model** (see
-   `src/lib/a2a/skills/providerDiscovery.ts` for the disable path).
-4. Update the [status page][status] with a banner if the outage
-   exceeds 15 min.
-
-[status]: https://status.phenotype.dev
-
-### 4.2 Cluster-wide latency regression
-
-1. Check the most recent deploy (`/api/system/version` returns the running version).
-2. If p95 doubled vs the 7-day baseline, **roll back** to the prior
-   SHA via `bin/rollback.sh`.
-3. If the regression is provider-side, see § 4.1.
-
-### 4.3 Auth layer broken (5xx on /v1/responses for all keys)
-
-1. Check the authz-inventory endpoint:
-   `curl https://api.omniroute.dev/api/settings/authz-inventory | jq`.
-2. If `policies_active` is empty, restore from the last good backup
-   (`bin/restore-policies.sh <sha>`).
-3. Roll back if the cause is unclear.
-
-### 4.4 Data-layer incident (sqlite corruption, audit log gap)
-
-1. **Stop the cluster** (`docker compose -f docker-compose.prod.yml
-   stop`) — preventing further writes is more important than uptime.
-2. Snapshot the data volume (`bin/snapshot-data.sh`).
-3. Open a SEV-1; this is data-loss territory. Page the data-team.
-4. Restore from the last verified backup (see `docs/BACKUP.md` once
-   published; currently the runbook is `bin/restore-data.sh <sha>`).
-
-### 4.5 Security incident (vulnerability disclosure)
-
-**Stop.** This is the `SECURITY.md` path, not this runbook. Page the
-security on-call (`@security-team`); do not post details to
-`#omniroute-ops`.
-
----
-
-## 5. Communication
-
-| Audience | Channel | Cadence | Owner |
-|---|---|---|---|
-| Engineering | `#inc-YYYY-MM-DD-slug` | Real-time | Incident commander |
-| Status page | `status.phenotype.dev` | Every 30 min during SEV-1/2 | On-call |
-| Customers (email) | `announce@phenotype.dev` | At SEV-1 start + resolution | Comms lead |
-| Upstream providers | Direct contact | At SEV-1 start | Vendor mgmt |
-| Postmortem | `docs/postmortem/YYYY-MM-DD-slug.md` | Within 5 business days | Incident commander |
-
-Postmortem template is at `docs/postmortem/TEMPLATE.md` (forthcoming;
-see ADR-024 for the cadence and ADR-029 for the postmortem convention).
-
----
-
-## 6. On-call rotation
-
-| Role | Primary | Secondary | Rotation |
-|---|---|---|---|
-| Engineering on-call | security-circle lead | @open-sse | Weekly, Mon 09:00 PDT |
-| Security on-call | @security-team | — | Weekly |
-| Data on-call | @db-team | — | Weekly |
-| Comms lead | @comms | — | As needed |
-
-**Handoff**: every Monday 09:00 PDT, the outgoing on-call posts a
-written handoff to the incoming in `#omnirouse-ops-handoff` covering:
-open SEV-3/4 items, scheduled maintenance windows, and any
-in-flight mitigations.
-
----
-
-## 7. Postmortem expectations
-
-- **Blameless**. People did the best they could with the information
-  they had. Focus on systems, signals, and decision points.
-- **Within 5 business days** of resolution. File via
-  `gh issue create --label postmortem --label SEV-1` (or `--label SEV-2`).
-- **Action items** must be assigned, dated, and tracked in
-  `docs/TECH_DEBT.md` (P0 < 30 d, P1 < 90 d per that doc's SLA).
-- **Mandatory attendees**: incident commander, on-call, any engineer
-  who touched the mitigation, and one person who was *not* involved
-  (fresh-eyes review).
-
----
-
-## 8. Review log
-
-| Date | Reviewer | Change |
-|---|---|---|
-| 2026-06-18 | security-circle lead | Initial runbook; severity ladder + 15-min checklist + 4.1–4.5 mitigation runbooks. Closes 71-pillar audit L61 (1/3 → 2/3). |
-| 2026-07-18 (planned) | observability-circle | Wire on-call rotation into PagerDuty schedule; add the postmortem template. |

docs/PERF_BUDGETS.md

@@ -1,222 +0,0 @@
-# Performance Budgets — OmniRoute (2026-06-18)
-
-**Status**: Authoritative. SLO targets that the 71-pillar audit (L13)
-references for the `Perf > 2.00` gate.
-**Methodology**: per-endpoint p50/p95/p99 latency budgets, plus a
-top-level availability SLO. Budgets are derived from the 3-replica
-Caddy + Redis topology (commit `038439fa7`); adjust on infra change.
-**Enforcement**: `benches/perf-gate.k6.js` (k6 reference script) —
-**not** yet wired into CI; `bench/` already exists in the repo
-and the script can be added there in a follow-up PR.
-**Re-evaluation cadence**: quarterly, or on any major infra change.
-
----
-
-## 1. Top-level SLOs
-
-| SLO | Target | Window | Page on breach |
-|---|---|---|---|
-| **Availability** (2xx or 4xx for /v1/* and /api/settings/*) | 99.9% | rolling 30 days | on-call P2 |
-| **Error budget burn rate** (1xx normalized rate) | < 2x for 1h, < 6x for 5m | 1h / 5m windows | on-call P1 |
-| **Aggregate p95 latency** (all /v1/*) | ≤ 1.5 s | rolling 5 min | on-call P2 |
-| **Aggregate p99 latency** (all /v1/*) | ≤ 4.0 s | rolling 5 min | on-call P2 |
-
-**Error budget**: 30-day window = 43.2 minutes of unavailability at
-99.9%. Burn rate > 2x is P2; > 6x is P1.
-
----
-
-## 2. Per-endpoint latency budgets
-
-All budgets measured **server-side** (Next.js Route Handler entry to
-response start, or last byte for streaming). Stream endpoints are
-measured to time-of-first-byte (TTFB) since the body is incremental.
-
-### 2.1 Inference endpoints (the hot path)
-
-| Endpoint | Method | p50 | p95 | p99 | Notes |
-|---|---|---|---|---|---|
-| `/v1/responses` (non-stream) | POST | 800 ms | 1.8 s | 3.5 s | Includes translator + provider roundtrip |
-| `/v1/responses` (stream) | POST (TTFB) | 350 ms | 900 ms | 1.8 s | TTFB only; total duration unbounded |
-| `/v1/relay/chat/completions` (non-stream) | POST | 1.0 s | 2.2 s | 4.0 s | Includes per-(token,IP) rate-limit check |
-| `/v1/relay/chat/completions` (stream) | POST (TTFB) | 400 ms | 1.0 s | 2.0 s | |
-| `/v1/embeddings` | POST | 300 ms | 700 ms | 1.4 s | Pure provider roundtrip; cheap |
-| `/v1/rerank` | POST | 600 ms | 1.4 s | 2.8 s | |
-| `/v1/moderations` | POST | 250 ms | 600 ms | 1.2 s | Lightweight classification |
-| `/v1/audio/speech` | POST | 1.2 s | 3.0 s | 6.0 s | Audio synthesis is slow; budget reflects that |
-| `/v1/audio/transcriptions` | POST | 2.0 s | 5.0 s | 10.0 s | STT is bounded by audio duration + model size |
-| `/v1/images/generations` | POST | 4.0 s | 8.0 s | 15.0 s | Image gen is async-bound by provider |
-| `/v1/videos/generations` | POST (TTFB) | 600 ms | 1.5 s | 3.0 s | Async; client polls `/v1/videos/{id}` |
-| `/v1/music/generations` | POST | 3.0 s | 6.0 s | 12.0 s | |
-
-### 2.2 Files + batches
-
-| Endpoint | Method | p50 | p95 | p99 | Notes |
-|---|---|---|---|---|---|
-| `/v1/files` (GET) | GET | 80 ms | 200 ms | 400 ms | Cached list |
-| `/v1/files` (POST upload) | POST | 500 ms | 1.2 s | 2.5 s | 25 MB cap; multipart parse |
-| `/v1/files/{id}` (GET) | GET | 60 ms | 150 ms | 300 ms | |
-| `/v1/files/{id}` (DELETE) | DELETE | 80 ms | 200 ms | 400 ms | |
-| `/v1/files/{id}/content` (download) | GET | 100 ms | 300 ms | 600 ms | + per-MB throughput |
-| `/v1/batches` (GET) | GET | 150 ms | 400 ms | 800 ms | |
-| `/v1/batches` (POST create) | POST | 200 ms | 500 ms | 1.0 s | Validates input file then enqueues |
-| `/v1/batches/{id}` (GET) | GET | 100 ms | 300 ms | 600 ms | |
-| `/v1/batches/{id}` (DELETE) | DELETE | 100 ms | 300 ms | 600 ms | |
-| `/v1/batches/delete-completed` (POST) | POST | 400 ms | 1.0 s | 2.0 s | Mass delete; n rows |
-
-### 2.3 Agents
-
-| Endpoint | Method | p50 | p95 | p99 | Notes |
-|---|---|---|---|---|---|
-| `/v1/agents/health` | GET | 1.5 s | 4.5 s | 5.0 s | 5s per-provider timeout cap; expect 3-provider total |
-| `/v1/agents/credentials` | GET | 100 ms | 250 ms | 500 ms | Metadata only; values never returned |
-| `/v1/agents/tasks` (GET list) | GET | 150 ms | 400 ms | 800 ms | |
-| `/v1/agents/tasks` (POST create) | POST | 250 ms | 600 ms | 1.2 s | Just enqueues; doesn't run agent |
-| `/v1/agents/tasks/{id}` (GET) | GET | 100 ms | 300 ms | 600 ms | |
-| `/v1/agents/tasks/{id}` (DELETE) | DELETE | 150 ms | 400 ms | 800 ms | |
-
-### 2.4 Combos / me / providers
-
-| Endpoint | Method | p50 | p95 | p99 |
-|---|---|---|---|---|
-| `/v1/combos` | GET | 80 ms | 200 ms | 400 ms |
-| `/v1/me/status` | GET | 60 ms | 150 ms | 300 ms |
-| `/v1/providers/{provider}/models` | GET | 100 ms | 250 ms | 500 ms |
-
-### 2.5 Web / search
-
-| Endpoint | Method | p50 | p95 | p99 | Notes |
-|---|---|---|---|---|---|
-| `/v1/web/fetch` | POST | 1.5 s | 4.0 s | 8.0 s | 10s timeout cap; recurse depth 3 |
-| `/v1/search` | POST | 800 ms | 2.0 s | 4.0 s | Provider search latency varies |
-
-### 2.6 VSCode-CLI shim (token-scoped)
-
-These are the legacy passthrough paths. Budgets are tighter because
-they're called frequently by the VSCode-CLI extension in tight loops.
-
-| Endpoint | Method | p50 | p95 | p99 |
-|---|---|---|---|---|
-| `/v1/vscode/{token}/v1/chat/completions` | POST | 700 ms | 1.6 s | 3.0 s |
-| `/v1/vscode/{token}/v1/models` | GET | 60 ms | 150 ms | 300 ms |
-| `/v1/vscode/{token}/combos` | GET | 80 ms | 200 ms | 400 ms |
-| `/v1/vscode/{token}/chat/completions` (legacy) | POST | 700 ms | 1.6 s | 3.0 s |
-| `/v1/vscode/{token}/models` (legacy) | GET | 60 ms | 150 ms | 300 ms |
-| `/v1/vscode/{token}/responses` | POST | 800 ms | 1.8 s | 3.5 s |
-
-### 2.7 Management / settings
-
-Management endpoints are operator-only and not part of the hot path.
-Budgets are set conservatively; breaches don't page on-call but do
-flag in the weekly perf review.
-
-| Endpoint group | p50 | p95 | p99 |
-|---|---|---|---|
-| `/api/settings/*` (GET) | 100 ms | 300 ms | 600 ms |
-| `/api/settings/*` (POST/PATCH/DELETE) | 200 ms | 500 ms | 1.0 s |
-| `/api/keys/*` (CRUD) | 150 ms | 400 ms | 800 ms |
-| `/api/quota/*` (CRUD) | 150 ms | 400 ms | 800 ms |
-| `/api/monitoring/health` (heavy) | 500 ms | 1.5 s | 3.0 s |
-
-### 2.8 Public probes
-
-| Endpoint | Method | p50 | p95 | p99 |
-|---|---|---|---|---|
-| `/api/health/ping` | GET | 5 ms | 20 ms | 50 ms |
-| `/api/system/version` | GET | 5 ms | 20 ms | 50 ms |
-| `/api/docs` | GET | 20 ms | 80 ms | 200 ms (HTML shell, no provider call) |
-
----
-
-## 3. Throughput targets
-
-| Tier | Per-replica RPS | Cluster RPS (3 replicas) | Notes |
-|---|---|---|---|
-| Inference (non-stream) | 50 RPS | 150 RPS | Bounded by provider quota + translator CPU |
-| Inference (stream) | 25 concurrent streams | 75 streams | Bounded by Node event-loop + memory |
-| Embeddings | 200 RPS | 600 RPS | Cheap |
-| Files (upload) | 10 RPS | 30 RPS | Multipart parse + DB write |
-| Files (download) | 100 RPS | 300 RPS | Static-content via Next.js |
-| Combos / me / providers | 500 RPS | 1,500 RPS | Cached |
-| WebSocket | 100 concurrent connections | 300 | Per-IP cap 5 |
-
-**Cluster ceiling** (all endpoints combined, sustained): ~1,000 RPS
-before p95 latency begins to climb. Scale horizontally beyond that
-by adding replicas; the Caddy LB is stateless.
-
----
-
-## 4. Resource budgets
-
-| Resource | Per-replica cap | Notes |
-|---|---|---|
-| RSS memory | 1.5 GB | Spikes during audio/video gen; expect brief 2 GB |
-| Event-loop lag (p99) | 50 ms | Alert via `clinic doctor` regression |
-| Heap retained | 800 MB | Old-gen GC tuning in `node --max-old-space-size` |
-| File descriptors | 2,000 | `ulimit -n 4096` recommended at host |
-| DB connections (sql.js) | 1 per replica | sql.js is in-process; no pool needed |
-| Redis connections | 20 per replica | Pooled; idle reaped at 5 min |
-
----
-
-## 5. Cold-start budget
-
-Next.js App Router cold-start on a fresh container:
-
-| Phase | Budget |
-|---|---|
-| Container start → HTTP listening | ≤ 800 ms |
-| First request TTFB (warm) | ≤ 200 ms |
-| Translator registry bootstrap | ≤ 500 ms (one-time, first /v1/responses) |
-
-**Measurement script**: `bin/cold-start-bench.sh` (not yet committed;
-`bin/` is the canonical scripts dir).
-
----
-
-## 6. Regression gate (k6 reference)
-
-The `benches/perf-gate.k6.js` script asserts the SLOs above. Not yet
-wired into CI; the JSON output is the contract for the next infra PR.
-
-```javascript
-// benches/perf-gate.k6.js — pseudo-code; not yet committed
-import http from 'k6/http';
-import { check, Trend } from 'k6';
-
-const responsesTTFB = new Trend('v1_responses_ttfb', true);
-
-export const options = {
-  scenarios: {
-    smoke: {
-      executor: 'constant-vus',
-      vus: 10,
-      duration: '1m',
-    },
-  },
-  thresholds: {
-    'http_req_duration{endpoint:v1_responses}': ['p(95)<1800', 'p(99)<3500'],
-    'http_req_failed': ['rate<0.01'],
-    'v1_responses_ttfb': ['p(95)<900'],
-  },
-};
-
-export default function () {
-  const res = http.post(`${__ENV.BASE_URL}/api/v1/responses`, JSON.stringify({
-    model: 'gpt-4o-mini',
-    input: 'ping',
-  }), { headers: { 'Authorization': `Bearer ${__ENV.API_KEY}` }});
-  check(res, { 'status is 200': (r) => r.status === 200 });
-  responsesTTFB.add(res.timings.waiting);
-}
-```
-
----
-
-## 7. Review log
-
-| Date | Reviewer | Change |
-|---|---|---|
-| 2026-06-18 | security-circle lead | Initial per-endpoint budgets derived from 3-replica Caddy + Redis topology |
-| 2026-07-18 (planned) | observability-circle | Wire `benches/perf-gate.k6.js` into CI; gate on p95 + p99 breach |
-| 2026-09-18 (planned) | observability-circle | Quarterly review; adjust after real-traffic baseline data |

docs/README.md

@@ -1,7 +1,7 @@
 ---
 title: "OmniRoute Documentation"
-version: 3.8.24
-lastUpdated: 2026-06-13
+version: 3.8.40
+lastUpdated: 2026-06-28
 ---
 
 # OmniRoute Documentation
@@ -12,16 +12,6 @@ Navigable index of the OmniRoute documentation set. Topics are grouped by intent
 
 ---
 
-## architecture/
-
-How the system is put together — read these to understand the runtime, code layout, and resilience model.
-
-- [ARCHITECTURE.md](architecture/ARCHITECTURE.md) — high-level system architecture (request pipeline, layers, modules).
-- [CODEBASE_DOCUMENTATION.md](architecture/CODEBASE_DOCUMENTATION.md) — engineering reference for the codebase.
-- [REPOSITORY_MAP.md](architecture/REPOSITORY_MAP.md) — directory-by-directory navigation guide.
-- [AUTHZ_GUIDE.md](architecture/AUTHZ_GUIDE.md) — authorization pipeline (route classifier + policy engine).
-- [RESILIENCE_GUIDE.md](architecture/RESILIENCE_GUIDE.md) — provider circuit breaker, connection cooldown, and model lockout.
-
 ## For Non-Tech Users
 
 Simple guides for using OmniRoute — no technical background needed.
@@ -38,26 +28,53 @@ Simple guides for using OmniRoute — no technical background needed.
 
 - [SETUP_GUIDE.md](guides/SETUP_GUIDE.md) — first-time setup of OmniRoute.
 - [USER_GUIDE.md](guides/USER_GUIDE.md) — daily usage of the dashboard and API.
+- [FEATURES.md](guides/FEATURES.md) — dashboard feature gallery.
+- [TIERS.md](guides/TIERS.md) — OmniRoute tiers explained (user guide).
+- [USAGE_QUOTA_GUIDE.md](guides/USAGE_QUOTA_GUIDE.md) — usage, quota & spend tracking.
+- [COST_TRACKING.md](guides/COST_TRACKING.md) — cost and spend tracking.
+- [FREE_PROVIDER_RANKINGS.md](guides/FREE_PROVIDER_RANKINGS.md) — free provider rankings (Arena ELO).
 - [DOCKER_GUIDE.md](guides/DOCKER_GUIDE.md) — running OmniRoute under Docker.
 - [ELECTRON_GUIDE.md](guides/ELECTRON_GUIDE.md) — desktop (Electron) builds.
 - [TERMUX_GUIDE.md](guides/TERMUX_GUIDE.md) — running on Android via Termux.
 - [PWA_GUIDE.md](guides/PWA_GUIDE.md) — installing the dashboard as a PWA.
-- [UNINSTALL.md](guides/UNINSTALL.md) — clean removal steps.
+- [REMOTE-MODE.md](guides/REMOTE-MODE.md) — exposing OmniRoute remotely + scoped tokens.
+- [CLI-INTEGRATIONS.md](guides/CLI-INTEGRATIONS.md) — master table of `setup-*` CLI integrations.
+- [CLAUDE-CODE-CONFIGURATION.md](guides/CLAUDE-CODE-CONFIGURATION.md) — Claude Code CLI with OmniRoute.
+- [CODEX-CLI-CONFIGURATION.md](guides/CODEX-CLI-CONFIGURATION.md) — Codex CLI with OmniRoute.
+- [KIRO_SETUP.md](guides/KIRO_SETUP.md) — Kiro setup.
 - [I18N.md](guides/I18N.md) — translation and locale workflow.
-- [FEATURES.md](guides/FEATURES.md) — dashboard feature gallery.
+- [TROUBLESHOOTING.md](guides/TROUBLESHOOTING.md) — detailed troubleshooting reference.
+- [UNINSTALL.md](guides/UNINSTALL.md) — clean removal steps.
+
+---
 
 ## For Tech Users
 
 Technical documentation for developers and contributors.
 
+## architecture/
+
+How the system is put together — read these to understand the runtime, code layout, and resilience model.
+
+- [ARCHITECTURE.md](architecture/ARCHITECTURE.md) — high-level system architecture (request pipeline, layers, modules).
+- [CODEBASE_DOCUMENTATION.md](architecture/CODEBASE_DOCUMENTATION.md) — engineering reference for the codebase.
+- [REPOSITORY_MAP.md](architecture/REPOSITORY_MAP.md) — directory-by-directory navigation guide.
+- [AUTHZ_GUIDE.md](architecture/AUTHZ_GUIDE.md) — authorization pipeline (route classifier + policy engine).
+- [RESILIENCE_GUIDE.md](architecture/RESILIENCE_GUIDE.md) — provider circuit breaker, connection cooldown, and model lockout.
+- [QUALITY_GATES.md](architecture/QUALITY_GATES.md) — quality-gate scripts and CI jobs inventory.
+- [MONITORING_SECTIONS.md](architecture/MONITORING_SECTIONS.md) — monitoring/costs dashboard navigation.
+- [cluster-decisions.md](architecture/cluster-decisions.md) — optional sidecar/cluster profile decisions.
+
 ## reference/
 
 Lookup material — API surface, environment variables, CLI flags, provider catalog.
 
 - [API_REFERENCE.md](reference/API_REFERENCE.md) — REST API endpoints and shapes.
-- [PROVIDER_REFERENCE.md](reference/PROVIDER_REFERENCE.md) — auto-generated provider catalog.
-- [openapi.yaml](openapi.yaml) — OpenAPI 3.1 spec for the public API.
+- [PROVIDER_REFERENCE.md](reference/PROVIDER_REFERENCE.md) — auto-generated provider catalog (do not edit by hand).
+- [PROVIDER_PLUGIN_MANIFEST.md](reference/PROVIDER_PLUGIN_MANIFEST.md) — sidecar-safe provider plugin contract for Bifrost and CLIProxyAPI migration.
+- [openapi.yaml](openapi.yaml) — OpenAPI spec for the public API.
 - [ENVIRONMENT.md](reference/ENVIRONMENT.md) — environment variables reference.
+- [FEATURE_FLAGS.md](reference/FEATURE_FLAGS.md) — feature flags and their defaults.
 - [CLI-TOOLS.md](reference/CLI-TOOLS.md) — bundled CLI commands.
 - [FREE_TIERS.md](reference/FREE_TIERS.md) — free-tier LLM provider directory.
 
@@ -67,19 +84,35 @@ Pluggable subsystems exposed to clients, agents, and operators.
 
 - [MCP-SERVER.md](frameworks/MCP-SERVER.md) — Model Context Protocol server.
 - [A2A-SERVER.md](frameworks/A2A-SERVER.md) — Agent-to-Agent (A2A) JSON-RPC server.
+- [ACP.md](frameworks/ACP.md) — Agent Client Protocol.
 - [AGENT_PROTOCOLS_GUIDE.md](frameworks/AGENT_PROTOCOLS_GUIDE.md) — A2A / ACP / Cloud agent overview.
+- [AGENTBRIDGE.md](frameworks/AGENTBRIDGE.md) — IDE agent bridge.
+- [AGENT-SKILLS.md](frameworks/AGENT-SKILLS.md) — agent skills catalog.
 - [CLOUD_AGENT.md](frameworks/CLOUD_AGENT.md) — cloud agent runtime and providers.
 - [SKILLS.md](frameworks/SKILLS.md) — Skills framework (sandboxed extension).
 - [MEMORY.md](frameworks/MEMORY.md) — persistent memory (FTS5 + Qdrant).
 - [WEBHOOKS.md](frameworks/WEBHOOKS.md) — webhook events and dispatch.
 - [EVALS.md](frameworks/EVALS.md) — eval suites.
+- [GAMIFICATION.md](frameworks/GAMIFICATION.md) — gamification & leaderboard system.
+- [EMBEDDED-SERVICES.md](frameworks/EMBEDDED-SERVICES.md) — embedded sidecar services (9Router, CLIProxyAPI).
+- [NOTION_CONTEXT.md](frameworks/NOTION_CONTEXT.md) — Notion context source.
+- [OBSIDIAN_CONTEXT.md](frameworks/OBSIDIAN_CONTEXT.md) — Obsidian context source.
+- [OPENCODE.md](frameworks/OPENCODE.md) — OpenCode integration.
+- [OPEN_SSE_ARCHITECTURE.md](frameworks/OPEN_SSE_ARCHITECTURE.md) — open-sse streaming engine internals.
+- [PLAYGROUND_STUDIO.md](frameworks/PLAYGROUND_STUDIO.md) — Playground Studio UI.
+- [SEARCH_TOOLS_STUDIO.md](frameworks/SEARCH_TOOLS_STUDIO.md) — Search Tools Studio UI.
+- [TRAFFIC_INSPECTOR.md](frameworks/TRAFFIC_INSPECTOR.md) — traffic inspector (MITM).
+- [PLUGINS.md](frameworks/PLUGINS.md) — CLI plugin system overview.
+- [PLUGIN_SDK.md](frameworks/PLUGIN_SDK.md) — plugin SDK reference.
+- [PLUGIN_MARKETPLACE.md](frameworks/PLUGIN_MARKETPLACE.md) — plugin marketplace.
 
 ## routing/
 
 Combo routing, scoring, and replay.
 
-- [AUTO-COMBO.md](routing/AUTO-COMBO.md) — Auto-Combo (9-factor scoring, 17 strategies).
-- [REASONING_REPLAY.md](routing/REASONING_REPLAY.md) — reasoning replay flow.
+- [AUTO-COMBO.md](routing/AUTO-COMBO.md) — Auto-Combo (multi-factor scoring, 17 strategies).
+- [QUOTA_SHARE.md](routing/QUOTA_SHARE.md) — quota sharing engine.
+- [REASONING_REPLAY.md](routing/REASONING_REPLAY.md) — reasoning replay cache.
 
 ## security/
 
@@ -90,6 +123,12 @@ Guardrails, compliance, stealth, and the mandatory patterns for handling public
 - [STEALTH_GUIDE.md](security/STEALTH_GUIDE.md) — TLS / fingerprint stealth.
 - [PUBLIC_CREDS.md](security/PUBLIC_CREDS.md) — **mandatory** pattern for embedding public upstream OAuth client_id/secret + Firebase Web keys without tripping secret scanners.
 - [ERROR_SANITIZATION.md](security/ERROR_SANITIZATION.md) — **mandatory** pattern for routing every error response through `sanitizeErrorMessage` to prevent stack-trace exposure.
+- [ROUTE_GUARD_TIERS.md](security/ROUTE_GUARD_TIERS.md) — route-guard classification tiers.
+- [CLI_TOKEN.md](security/CLI_TOKEN.md) — CLI machine-ID token (HMAC + legacy SHA-256) auth.
+- [EGRESS_POLICY.md](security/EGRESS_POLICY.md) — egress IP family (IPv4/IPv6) policy.
+- [MITM-TPROXY-DECRYPT.md](security/MITM-TPROXY-DECRYPT.md) — transparent MITM decrypt.
+- [SUPPLY_CHAIN.md](security/SUPPLY_CHAIN.md) — supply-chain gates (SLSA, SBOM, Trivy, osv-scanner, Scorecard).
+- [SOCKET_DEV_FINDINGS.md](security/SOCKET_DEV_FINDINGS.md) — supply-chain finding attestations.
 
 ## compression/
 
@@ -100,13 +139,33 @@ Prompt compression engines, rules, and language packs.
 - [COMPRESSION_RULES_FORMAT.md](compression/COMPRESSION_RULES_FORMAT.md) — rule file format.
 - [COMPRESSION_LANGUAGE_PACKS.md](compression/COMPRESSION_LANGUAGE_PACKS.md) — language packs.
 - [RTK_COMPRESSION.md](compression/RTK_COMPRESSION.md) — RTK engine deep dive.
+- [CONTEXT_EDITING.md](compression/CONTEXT_EDITING.md) — delegated context editing (Anthropic).
+- [EXTENDING_COMPRESSION.md](compression/EXTENDING_COMPRESSION.md) — adding a custom compression engine.
+
+## providers/
+
+Provider-specific integration guides.
+
+- [CLAUDE_WEB.md](providers/CLAUDE_WEB.md) — Claude Web (cookie-auth) provider.
+- [AGENTROUTER.md](providers/AGENTROUTER.md) — AgentRouter setup.
+- [ZED-DOCKER.md](providers/ZED-DOCKER.md) — Zed IDE integration under Docker.
+
+## comparison/
+
+- [OMNIROUTE_VS_ALTERNATIVES.md](comparison/OMNIROUTE_VS_ALTERNATIVES.md) — how OmniRoute compares to alternatives.
 
 ## ops/
 
-Release, deployment, proxies, tunnels, coverage.
+Release, deployment, proxies, tunnels, coverage, database, monitoring.
 
 - [RELEASE_CHECKLIST.md](ops/RELEASE_CHECKLIST.md) — release flow checklist.
+- [RELEASE_GREEN.md](ops/RELEASE_GREEN.md) — keeping the PR queue and release branch green.
+- [QUALITY_GATE_PLAYBOOK.md](ops/QUALITY_GATE_PLAYBOOK.md) — quality-gate playbook.
+- [BRANCH_PROTECTION_MAIN.md](ops/BRANCH_PROTECTION_MAIN.md) — `main` branch protection.
 - [COVERAGE_PLAN.md](ops/COVERAGE_PLAN.md) — test coverage plan.
+- [DATABASE_GUIDE.md](ops/DATABASE_GUIDE.md) — DB schema and operations.
+- [SQLITE_RUNTIME.md](ops/SQLITE_RUNTIME.md) — SQLite driver resolution chain.
+- [MONITORING_GUIDE.md](ops/MONITORING_GUIDE.md) — monitoring & observability.
 - [FLY_IO_DEPLOYMENT_GUIDE.md](ops/FLY_IO_DEPLOYMENT_GUIDE.md) — Fly.io deployment.
 - [VM_DEPLOYMENT_GUIDE.md](ops/VM_DEPLOYMENT_GUIDE.md) — generic VM deployment.
 - [PROXY_GUIDE.md](ops/PROXY_GUIDE.md) — upstream proxy configuration.
@@ -114,11 +173,11 @@ Release, deployment, proxies, tunnels, coverage.
 
 ## diagrams/
 
-Mermaid sources and exported SVG/PNG diagrams referenced from the docs above. Populated incrementally — see [diagrams/README.md](diagrams/README.md).
+Mermaid sources and exported SVG/PNG diagrams referenced from the docs above. See [diagrams/README.md](diagrams/README.md).
 
 ## i18n/
 
-Translated mirrors of the documentation in 42 locales. See [i18n/README.md](i18n/README.md) for the supported language list.
+Translated mirrors of the documentation in 43 locales. See [i18n/README.md](i18n/README.md) for the supported language list.
 
 ## screenshots/
 

docs/SUBMIT_PR.md

@@ -1,127 +0,0 @@
-# Submitting a Pull Request
-
-Step-by-step for contributors who already have a fork and a working fix.
-
----
-
-## 1 — Set up your fork
-
-```bash
-# Clone your fork
-git clone https://github.com/<your-username>/OmniRoute.git
-cd OmniRoute
-
-# Add the upstream repo so you can sync
-git remote add upstream https://github.com/diegosouzapw/OmniRoute.git
-
-# Install dependencies (.env is auto-created from .env.example)
-npm install
-```
-
----
-
-## 2 — Sync with the current release branch
-
-PRs go to the **current release branch** — `release/v3.8.24` at the time of writing. Always target the latest `release/v*` branch (the repository's active development branch), never `main`. Check the repo's branch list or `CONTRIBUTING.md` if a newer release cycle has opened.
-
-```bash
-git fetch upstream
-git checkout -b fix/your-description upstream/release/v3.8.24
-```
-
-If you already made your changes on another branch, rebase on top of it:
-
-```bash
-git fetch upstream
-git rebase upstream/release/v3.8.24
-```
-
----
-
-## 3 — Branch naming
-
-| Prefix      | Use for                                 |
-| ----------- | --------------------------------------- |
-| `feat/`     | new feature                             |
-| `fix/`      | bug fix                                 |
-| `refactor/` | code restructuring (no behavior change) |
-| `docs/`     | documentation only                      |
-| `test/`     | tests only                              |
-| `chore/`    | tooling, deps, CI                       |
-
-Examples: `fix/codex-token-refresh`, `feat/provider-xyz`, `docs/update-readme`
-
----
-
-## 4 — Validate before committing
-
-```bash
-npm run lint          # must pass (0 errors)
-npm run typecheck:core  # must pass
-npm run test:unit     # must pass
-npm run test:coverage # coverage gate: 60/60/60/60 (statements/lines/functions/branches)
-```
-
-If you changed production code in `src/`, `open-sse/`, `electron/`, or `bin/`, include or update tests in the same PR.
-
----
-
-## 5 — Commit
-
-Follow [Conventional Commits](https://www.conventionalcommits.org/):
-
-```
-feat(dashboard): add provider search filter
-fix(combo): resolve pending request leak on timeout
-docs(readme): update installation steps
-test(auth): add JWT expiry edge case
-```
-
-Common scopes: `api`, `dashboard`, `db`, `sse`, `oauth`, `providers`, `combo`, `mcp`, `cli`, `i18n`
-
----
-
-## 6 — Push and open the PR
-
-```bash
-git push -u origin fix/your-description
-```
-
-Then open a PR on GitHub targeting **`diegosouzapw/OmniRoute`** → **`release/v3.8.24`**.
-
-PR description checklist:
-
-- [ ] What the change does (1–3 bullets)
-- [ ] How to test it
-- [ ] Test files added or updated (if production code changed)
-
----
-
-## 7 — After opening the PR
-
-- CI runs lint + typecheck + tests automatically.
-- Address review comments with new commits (do not force-push after review starts).
-- If the base branch advances, sync with:
-
-```bash
-git fetch upstream
-git rebase upstream/release/v3.8.24
-git push --force-with-lease
-```
-
----
-
-## Quick reference
-
-```bash
-# Full validation in one command
-npm run lint && npm run typecheck:core && npm run test:coverage
-
-# Run a single test file
-node --import tsx/esm --test tests/unit/your-file.test.ts
-
-# Start dev server
-npm run dev   # http://localhost:20128
-```
-
-For the full contributor guide see [CONTRIBUTING.md](../CONTRIBUTING.md).

docs/THREAT_MODEL.md

@@ -1,346 +0,0 @@
-# Threat Model — OmniRoute (2026-06-18)
-
-**Status**: Authoritative. Supersedes any inline threat notes in code comments.
-**Methodology**: STRIDE (Spoofing, Tampering, Repudiation, Information
-Disclosure, Denial of Service, Elevation of Privilege) per endpoint.
-**Scope**: v1 client API + management surface + agent dispatch + relay.
-**Re-evaluation cadence**: every 90 days OR on any new public route
-addition / new auth tier change.
-**Owner**: security-circle lead.
-**Related**: `SECURITY.md` (disclosure policy), `authz-inventory` (live
-tier classification), `docs/openapi.yaml` (API surface), `docs/architecture/`
-(security boundaries).
-
----
-
-## 1. Trust boundaries
-
-```
-┌────────────────────────────────────────────────────────────────────┐
-│ Public Internet                                                    │
-│   └── TLS termination (Caddy / cloud LB)                          │
-│         │                                                          │
-│         ▼  ◀── Trust boundary 1: edge ↔ application                │
-│ ┌──────────────────────────────────────────────────────────────┐   │
-│ │  Next.js App Router (3 replicas behind Caddy LB)              │   │
-│ │    ┌──────────────────────────────────────────────┐           │   │
-│ │    │  per-route authz guards (routeGuard.ts)      │           │   │
-│ │    │   ┌────────┐ ┌────────┐ ┌────────┐ ┌──────┐ │           │   │
-│ │    │   │ PUBLIC │ │CLIENT  │ │MANAGE  │ │ALWAYS│ │           │   │
-│ │    │   │ /health│ │ /v1/*  │ │/settn  │ │PROT  │ │           │   │
-│ │    │   └────────┘ └────┬───┘ └────┬───┘ └──────┘ │           │   │
-│ │    └──────────────────┼─────────┼──────────────┘              │   │
-│ │                       ▼         ▼                             │   │
-│ │    ┌─────────────────────────┐ ┌──────────────────────────┐   │   │
-│ │    │  src/lib/sse/handlers   │ │ src/lib/localDb          │   │   │
-│ │    │  (translator + chat)    │ │  (sql.js encrypted store)│   │   │
-│ │    └──────────┬──────────────┘ └────────────┬─────────────┘   │   │
-│ │               │                              │                 │   │
-│ │               ▼  ◀── Trust boundary 2: app ↔ upstream          │   │
-│ └───────────────┼──────────────────────────────┼─────────────────┘   │
-│                 ▼                              ▼                    │
-│ ┌──────────────────────────┐    ┌────────────────────────────┐      │
-│ │ Provider APIs            │    │ Filesystem (DB + secrets)  │      │
-│ │  (OpenAI, Anthropic, …)  │    │  + Redis (session/quota)   │      │
-│ └──────────────────────────┘    └────────────────────────────┘      │
-└────────────────────────────────────────────────────────────────────┘
-```
-
-**Boundary 1** (edge ↔ app): Mitigated by TLS at the edge + per-route auth gates
-(`src/server/authz/routeGuard.ts` + `extractApiKey`/`isValidApiKey` in each
-`route.ts`; there is no global Next.js middleware). Anything past this boundary is fully authenticated
-unless explicitly in the PUBLIC tier.
-
-**Boundary 2** (app ↔ upstream): Mitigated by per-provider key storage
-in `src/lib/vault/` and the per-(token,IP) relay rate limit.
-
-**Local-only boundary** (loopback-only routes): documented in
-`src/server/authz/routeGuard.ts` as `LOCAL_ONLY_API_PREFIXES`; known
-CVE class is "spawn capable route exposed to non-local traffic"
-(GHSA-fhh6-4qxv-rpqj).
-
----
-
-## 2. STRIDE legend
-
-| Letter | Threat                 | Question it answers                                   |
-| ------ | ---------------------- | ----------------------------------------------------- |
-| **S**  | Spoofing               | Can an attacker pretend to be a legitimate principal? |
-| **T**  | Tampering              | Can an attacker modify data in transit or at rest?    |
-| **R**  | Repudiation            | Can a principal deny an action they took?             |
-| **I**  | Information disclosure | Can an attacker read data they shouldn't?             |
-| **D**  | Denial of service      | Can an attacker degrade or block service?             |
-| **E**  | Elevation of privilege | Can an attacker gain more access than intended?       |
-
-Severity scale: **L**ow (paper), **M**edium (real exploit possible), **H**igh
-(active exploitation likely or already seen in the wild).
-
----
-
-## 3. Per-endpoint STRIDE analysis (top-20 highest-risk routes)
-
-The 50 v1 route handlers are scored below. Top-20 highest-risk routes
-get a full STRIDE row; the remaining 30 are covered by a tier-level
-summary in § 4.
-
-### 3.1 `/api/v1/responses` — POST (primary inference)
-
-| STRIDE | Risk                                            | Mitigation                                                                                                                                                           |
-| ------ | ----------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **S**  | M — Bearer key stolen → caller identity spoofed | Keys hashed (SHA-256) at rest in `src/lib/db/apiKeys.ts`; revocation list in `src/lib/db/apiKeys.ts#revokeKey`                                                       |
-| **T**  | M — Request body modified in transit            | TLS at edge; body re-validated against `ResponsesRequest` schema in `open-sse/handlers/responseSanitizer.ts`                                                         |
-| **R**  | L — Caller denies a request                     | `src/lib/audit/` writes append-only row with `key_id`, `request_hash`, `model`, `tokens`; hash-chain integrity (DEBT-051 follow-up)                                  |
-| **I**  | M — Provider API key leaked via response        | `open-sse/handlers/responseTranslator.ts` strips `x-api-key` headers before proxying; response redaction middleware                                                  |
-| **D**  | H — High-cost model invocation = $$ DoS         | Per-key rate limit (`open-sse/services/rateLimitManager.ts`); per-tenant quota pool (`src/lib/db/quotaPools.ts`); DEBT-001 TPM/TPD reservoir is **not** yet enforced |
-| **E**  | L — Bearer scope escalation                     | API keys carry explicit `scopes` array; routes require specific scopes; `requireManagementAuth` enforces management tier                                             |
-
-### 3.2 `/api/v1/relay/chat/completions` — POST (serverless relay)
-
-| STRIDE | Risk                           | Mitigation                                                                                                                            |
-| ------ | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------- |
-| **S**  | M — Relay token theft          | Tokens hashed with SHA-256 + per-token ID column; per-(token,IP) rate limit in `src/app/api/v1/relay/chat/completions/route.ts:38-58` |
-| **T**  | M — Token rotation bypass      | Token records have `revoked_at`; check happens before each request                                                                    |
-| **R**  | L — Forensic headers sanitized | `sanitizeForensicHeader` strips CR/LF; length cap 256; IP/UA never echoed back to client                                              |
-| **I**  | H — IP-bucket map leaks        | In-memory only, per-instance, capped at 10,000 entries; not persisted; see DEBT-038 (in-memory state loss on restart)                 |
-| **D**  | M — Per-(token,IP) abuse       | `RELAY_IP_PER_MINUTE=30` default; attacker rotates IPs to spread, hits per-token wall                                                 |
-| **E**  | M — Token scope creep          | Tokens carry `allowedModels[]`; reject on model-not-in-list                                                                           |
-
-### 3.3 `/api/v1/embeddings` — POST
-
-| STRIDE | Risk                                                  | Mitigation                                                                      |
-| ------ | ----------------------------------------------------- | ------------------------------------------------------------------------------- |
-| **S**  | L — Same as 3.1                                       | Same auth + key model                                                           |
-| **T**  | L — Inputs are vectors; tampered embedding not useful | Re-encode on receive; reject dimension mismatch                                 |
-| **R**  | L                                                     | `src/lib/audit/` row written                                                    |
-| **I**  | M — Embedding vectors can leak training data          | Reject requests with PII patterns (regex) before forwarding; DEBT-052 follow-up |
-| **D**  | L — Embeddings cheaper than chat                      | Quota pool cap                                                                  |
-| **E**  | L                                                     | Bearer scope                                                                    |
-
-### 3.4 `/api/v1/rerank` — POST
-
-| STRIDE | Risk                               | Mitigation                                                         |
-| ------ | ---------------------------------- | ------------------------------------------------------------------ |
-| **S**  | L                                  | Same auth                                                          |
-| **T**  | L                                  |                                                                    |
-| **R**  | L                                  |                                                                    |
-| **I**  | M — Documents contain user content | Per-tenant key isolation; audit log captures doc hash, not content |
-| **D**  | L                                  |                                                                    |
-| **E**  | L                                  |                                                                    |
-
-### 3.5 `/api/v1/moderations` — POST
-
-| STRIDE | Risk                                             | Mitigation                                                           |
-| ------ | ------------------------------------------------ | -------------------------------------------------------------------- |
-| **S**  | L                                                |                                                                      |
-| **T**  | L                                                |                                                                      |
-| **R**  | L                                                |                                                                      |
-| **I**  | H — Moderation inputs are sensitive user content | Encrypted in transit (TLS); not logged; flag results cached with TTL |
-| **D**  | L                                                |                                                                      |
-| **E**  | L                                                |                                                                      |
-
-### 3.6 `/api/v1/audio/speech` — POST (TTS)
-
-| STRIDE | Risk                                | Mitigation                                 |
-| ------ | ----------------------------------- | ------------------------------------------ |
-| **S**  | L                                   |                                            |
-| **T**  | L                                   |                                            |
-| **R**  | L                                   |                                            |
-| **I**  | L — Audio is synthesised from input | Same as 3.1                                |
-| **D**  | M — Long TTS = bandwidth burn       | `input` cap 4096 chars; per-key rate limit |
-| **E**  | L                                   |                                            |
-
-### 3.7 `/api/v1/audio/transcriptions` — POST (STT, multipart)
-
-| STRIDE | Risk                                        | Mitigation                                                                                                                                                |
-| ------ | ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **S**  | L                                           |                                                                                                                                                           |
-| **T**  | M — Multipart body tampered                 | `multipart-parser` validates Content-Length + boundary; size cap 25 MB                                                                                    |
-| **R**  | L                                           |                                                                                                                                                           |
-| **I**  | H — Audio contains user PII / secrets       | TTL cache; never written to disk by default; redaction of credit-card-like sequences in `open-sse/executors/chatgpt-web.ts` (per-file TODO, see DEBT-019) |
-| **D**  | M — Large audio = bandwidth + provider cost | 25 MB cap; rate limit                                                                                                                                     |
-| **E**  | L                                           |                                                                                                                                                           |
-
-### 3.8 `/api/v1/images/generations` — POST
-
-| STRIDE | Risk                                 | Mitigation                                                                                                                                |
-| ------ | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------- |
-| **S**  | L                                    |                                                                                                                                           |
-| **T**  | L                                    |                                                                                                                                           |
-| **R**  | L                                    |                                                                                                                                           |
-| **I**  | L — Generated images are public URLs | URLs are signed with TTL; provider-controlled CDN                                                                                         |
-| **D**  | M — Image gen is $expensive          | Per-key USD spend limits enforced in the request pipeline (`src/lib/db/tokenLimits.ts`, surfaced via `src/app/api/usage/budget/route.ts`) |
-| **E**  | L                                    |                                                                                                                                           |
-
-### 3.9 `/api/v1/videos/generations` — POST (async)
-
-| STRIDE | Risk                                          | Mitigation                                                                                    |
-| ------ | --------------------------------------------- | --------------------------------------------------------------------------------------------- |
-| **S**  | L                                             |                                                                                               |
-| **T**  | L                                             |                                                                                               |
-| **R**  | M — Long-running async job, hard to attribute | Job records include `key_id`, `request_id`, `created_at`; result includes signed URL with TTL |
-| **I**  | M — Generated video may contain PII           | Same as 3.8                                                                                   |
-| **D**  | M — Video gen is very $expensive              | Cost-budget middleware; max 10-second durations                                               |
-| **E**  | L                                             |                                                                                               |
-
-### 3.10 `/api/v1/files` — POST (multipart upload)
-
-| STRIDE | Risk                                      | Mitigation                                                                                       |
-| ------ | ----------------------------------------- | ------------------------------------------------------------------------------------------------ |
-| **S**  | M — Uploaded file attributed to wrong key | `key_id` captured at upload; immutable record                                                    |
-| **T**  | H — Malicious file (zip bomb, polyglot)   | Size cap 25 MB; MIME sniff + magic-byte check; AV scan is **not** performed (DEBT-053 follow-up) |
-| **R**  | L                                         |                                                                                                  |
-| **I**  | H — Files contain user PII                | Encrypted at rest in `src/lib/vault/`; per-tenant access control                                 |
-| **D**  | M — Large uploads                         | Size cap + rate limit                                                                            |
-| **E**  | L                                         |                                                                                                  |
-
-### 3.11 `/api/v1/files/{id}/content` — GET
-
-| STRIDE | Risk                                      | Mitigation                                                                 |
-| ------ | ----------------------------------------- | -------------------------------------------------------------------------- |
-| **S**  | H — IDOR (file belonging to other tenant) | Per-tenant scope check; `requireTenantScope` middleware (added in v3.8.25) |
-| **T**  | L                                         |                                                                            |
-| **R**  | L                                         |                                                                            |
-| **I**  | H — Tenant isolation breach = data leak   | Per-tenant prefix in file storage; cross-tenant read attempt logged + 403  |
-| **D**  | L                                         |                                                                            |
-| **E**  | L                                         |                                                                            |
-
-### 3.12 `/api/v1/batches` — POST (create batch)
-
-| STRIDE | Risk                                       | Mitigation                                               |
-| ------ | ------------------------------------------ | -------------------------------------------------------- |
-| **S**  | L                                          |                                                          |
-| **T**  | M — Batch input file modified after upload | Content hash stored at upload; mismatch on read = reject |
-| **R**  | L                                          |                                                          |
-| **I**  | M — Input file contains PII                | Same as 3.10                                             |
-| **D**  | M — Large batch                            | 50k row cap per batch                                    |
-| **E**  | L                                          |                                                          |
-
-### 3.13 `/api/v1/batches/delete-completed` — POST
-
-| STRIDE | Risk                                          | Mitigation                                                                                |
-| ------ | --------------------------------------------- | ----------------------------------------------------------------------------------------- |
-| **S**  | L                                             |                                                                                           |
-| **T**  | H — Mass delete                               | Requires manage-scope auth; `requireManagementAuth` enforced; audit log captures `key_id` |
-| **R**  | L                                             |                                                                                           |
-| **I**  | M — Output files may leak                     | Soft-delete with 7-day retention before GC                                                |
-| **D**  | L                                             |                                                                                           |
-| **E**  | M — A misconfigured client could trigger this | Auth gate prevents; no anonymous access                                                   |
-
-### 3.14 `/api/v1/agents/tasks` — POST (cloud-agent dispatch)
-
-| STRIDE | Risk                                     | Mitigation                                                                                                                |
-| ------ | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
-| **S**  | L                                        |                                                                                                                           |
-| **T**  | H — Prompt injection in task `prompt`    | `withInjectionGuard` middleware (per `src/app/api/v1/responses/route.ts:6`); pattern blocklist + sandboxed tool execution |
-| **R**  | M — Long-running agent task, attribution | Task ID + `key_id` + `created_at` recorded; agent result signed by provider                                               |
-| **I**  | H — Agent reads user repo / credentials  | Provider-scoped credentials; least-privilege OAuth; agent result sandboxed before return                                  |
-| **D**  | M — Long-running agent = $$ burn         | 10-minute default timeout; configurable `timeoutSeconds`                                                                  |
-| **E**  | M — Agent tool calls could exceed scope  | Tool allowlist per provider; rejection in `open-sse/executors/`                                                           |
-
-### 3.15 `/api/v1/agents/credentials` — GET (list stored creds)
-
-| STRIDE | Risk                                                     | Mitigation                                                                                     |
-| ------ | -------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
-| **S**  | L                                                        |                                                                                                |
-| **T**  | L                                                        |                                                                                                |
-| **R**  | L                                                        |                                                                                                |
-| **I**  | H — Leaked credential metadata enables targeted phishing | Returns only `provider`, `hasValue`, `updatedAt` (NEVER the value); requires manage-scope auth |
-| **D**  | L                                                        |                                                                                                |
-| **E**  | L                                                        |                                                                                                |
-
-### 3.16 `/api/v1/me/status` — GET (caller introspection)
-
-| STRIDE | Risk                                                 | Mitigation                                     |
-| ------ | ---------------------------------------------------- | ---------------------------------------------- |
-| **S**  | L                                                    |                                                |
-| **T**  | L                                                    |                                                |
-| **R**  | L                                                    |                                                |
-| **I**  | M — Reveals quota usage; could enable timing attacks | Rate-limited; per-key only; no cross-key reads |
-| **D**  | L                                                    |                                                |
-| **E**  | L                                                    |                                                |
-
-### 3.17 `/api/v1/providers/{provider}/models` — GET
-
-| STRIDE | Risk                           | Mitigation                            |
-| ------ | ------------------------------ | ------------------------------------- |
-| **S**  | L                              |                                       |
-| **T**  | L                              |                                       |
-| **R**  | L                              |                                       |
-| **I**  | M — Reveals provider allowlist | Required for client UX; per-key scope |
-| **D**  | L                              |                                       |
-| **E**  | L                              |                                       |
-
-### 3.18 `/api/v1/web/fetch` — POST (server-side fetch)
-
-| STRIDE | Risk                                                          | Mitigation                                                                                                    |
-| ------ | ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
-| **S**  | L                                                             |                                                                                                               |
-| **T**  | L                                                             |                                                                                                               |
-| **R**  | L                                                             |                                                                                                               |
-| **I**  | H — Fetched content could be exfiltrated via prompt injection | Content goes through `withInjectionGuard`; explicit extract modes; URL allowlist (default-deny, see DEBT-054) |
-| **D**  | M — Recursive fetch = bandwidth burn                          | Max redirects 3; max 5 MB response; timeout 10s                                                               |
-| **E**  | L                                                             |                                                                                                               |
-
-### 3.19 `/api/v1/vscode/{token}/v1/chat/completions` — POST (VSCode shim)
-
-| STRIDE | Risk                                              | Mitigation                                                                                |
-| ------ | ------------------------------------------------- | ----------------------------------------------------------------------------------------- |
-| **S**  | M — VSCode token theft = long-lived impersonation | Tokens are 256-bit, single-purpose, scoped to VSCode-CLI; revokable from `/api/keys/{id}` |
-| **T**  | L                                                 |                                                                                           |
-| **R**  | L                                                 |                                                                                           |
-| **I**  | M — Token in URL = logged in access logs          | Token treated as secret; logs hash + last-4 only                                          |
-| **D**  | M — Per-token rate limit (lower than API key)     | `VSCODECLI_RATE_LIMIT=10` req/min default                                                 |
-| **E**  | L                                                 |                                                                                           |
-
-### 3.20 `/api/v1/ws` — WebSocket
-
-| STRIDE | Risk                                            | Mitigation                                                                                    |
-| ------ | ----------------------------------------------- | --------------------------------------------------------------------------------------------- |
-| **S**  | M — WS upgrade lacks standard Bearer header     | Subprotocol-based auth: `Sec-WebSocket-Protocol: bearer, <token>`; per-connection scope check |
-| **T**  | M — WS message frames tampered                  | TLS-only (`wss://`); reject `ws://` in prod                                                   |
-| **R**  | L                                               | Connection ID + auth principal recorded at handshake                                          |
-| **I**  | H — Long-lived connection = larger blast radius | 1-hour max connection; heartbeat every 30s; auto-disconnect on auth revoke                    |
-| **D**  | H — Many WS = connection table exhaustion       | Per-IP WS cap 5; per-key cap 20; rate limit per message                                       |
-| **E**  | L                                               |                                                                                               |
-
----
-
-## 4. Tier-level summary (remaining 30 routes)
-
-Routes in the same tier inherit the same baseline mitigations. Per-route
-deltas are documented in `docs/openapi.yaml` (request schema constraints).
-
-| Tier                                                                                                                                | Count | Baseline mitigations                                       | Residual risks                       |
-| ----------------------------------------------------------------------------------------------------------------------------------- | ----- | ---------------------------------------------------------- | ------------------------------------ |
-| PUBLIC (`/api/health`, `/api/monitoring/health`, `/_next/*`)                                                                        | 3     | No auth; rate limit; static response                       | DoS via flooding (mitigated at LB)   |
-| CLIENT_API inference (`/v1/audio`, `/v1/moderations`, `/v1/rerank`, `/v1/search`, `/v1/embeddings`, `/v1/responses`, `/v1/relay/*`) | 8     | Bearer auth + per-key rate limit + audit log + cost budget | TPM/TPD fairness (DEBT-001)          |
-| CLIENT_API files (`/v1/files`, `/v1/files/{id}`, `/v1/batches/*`)                                                                   | 5     | Bearer auth + per-tenant prefix + AV scan absent           | DEBT-053 (AV)                        |
-| CLIENT_API combos/me/providers                                                                                                      | 3     | Bearer auth + cached                                       | None material                        |
-| CLIENT_API vscode shim                                                                                                              | 13    | Token-scoped + per-token rate limit                        | Token in URL log noise               |
-| MANAGEMENT (`/api/settings/*`, `/api/keys/*`, `/api/quota/*`, `/api/usage/*`)                                                       | ~60   | Manage-scope + dashboard session + 2FA suggested           | See SECURITY.md for P0 items         |
-| ALWAYS_PROTECTED (shutdown, DB settings)                                                                                            | ~5    | Auth + re-auth for security-impacting changes              | None material                        |
-| LOCAL_ONLY (loopback spawn routes)                                                                                                  | ~8    | Loopback-only + bypass-constant gated by manage-scope      | GHSA-fhh6-4qxv-rpqj class if exposed |
-
----
-
-## 5. Mitigations to add (next quarter)
-
-| ID    | Mitigation                                                       | Pillar target | Effort |
-| ----- | ---------------------------------------------------------------- | ------------- | ------ |
-| TM-01 | DEBT-001: TPM/TPD token-bucket fairness for relay + inference    | D, E (cost)   | M      |
-| TM-02 | DEBT-051: Hash-chain integrity for `src/lib/audit/` rows         | R             | M      |
-| TM-03 | DEBT-053: AV scan on `/v1/files` upload (ClamAV or external API) | T, I          | L      |
-| TM-04 | DEBT-054: URL allowlist for `/v1/web/fetch`                      | I, D          | M      |
-| TM-05 | OIDC/SAML SSO for management tier (audit L46)                    | S             | L      |
-| TM-06 | TOTP MFA for manage-scope users (audit L49)                      | S, E          | M      |
-| TM-07 | Field-level encryption for PII columns (audit L47)               | I             | L      |
-
----
-
-## 6. Review log
-
-| Date                 | Reviewer                  | Change                                                                 |
-| -------------------- | ------------------------- | ---------------------------------------------------------------------- |
-| 2026-06-18           | @KooshaPari/core (L5-118) | Initial STRIDE per endpoint, top-20 highest-risk routes + tier summary |
-| 2026-06-25 (planned) | security-circle           | Re-score after DEBT-001, DEBT-051 close-outs                           |
-| 2026-09-18 (planned) | security-circle           | Quarterly full re-review; refresh mitigations list                     |

docs/architecture/ARCHITECTURE.md

@@ -1,14 +1,14 @@
 ---
 title: "OmniRoute Architecture"
-version: 3.8.2
-lastUpdated: 2026-05-13
+version: 3.8.40
+lastUpdated: 2026-06-28
 ---
 
 # OmniRoute Architecture
 
 🌐 **Languages:** 🇺🇸 [English](./ARCHITECTURE.md) | 🇧🇷 [Português (Brasil)](../i18n/pt-BR/docs/architecture/ARCHITECTURE.md) | 🇪🇸 [Español](../i18n/es/docs/architecture/ARCHITECTURE.md) | 🇫🇷 [Français](../i18n/fr/docs/architecture/ARCHITECTURE.md) | 🇮🇹 [Italiano](../i18n/it/docs/architecture/ARCHITECTURE.md) | 🇷🇺 [Русский](../i18n/ru/docs/architecture/ARCHITECTURE.md) | 🇨🇳 [中文 (简体)](../i18n/zh-CN/docs/architecture/ARCHITECTURE.md) | 🇩🇪 [Deutsch](../i18n/de/docs/architecture/ARCHITECTURE.md) | 🇮🇳 [हिन्दी](../i18n/in/docs/architecture/ARCHITECTURE.md) | 🇹🇭 [ไทย](../i18n/th/docs/architecture/ARCHITECTURE.md) | 🇺🇦 [Українська](../i18n/uk-UA/docs/architecture/ARCHITECTURE.md) | 🇸🇦 [العربية](../i18n/ar/docs/architecture/ARCHITECTURE.md) | 🇯🇵 [日本語](../i18n/ja/docs/architecture/ARCHITECTURE.md) | 🇻🇳 [Tiếng Việt](../i18n/vi/docs/architecture/ARCHITECTURE.md) | 🇧🇬 [Български](../i18n/bg/docs/architecture/ARCHITECTURE.md) | 🇩🇰 [Dansk](../i18n/da/docs/architecture/ARCHITECTURE.md) | 🇫🇮 [Suomi](../i18n/fi/docs/architecture/ARCHITECTURE.md) | 🇮🇱 [עברית](../i18n/he/docs/architecture/ARCHITECTURE.md) | 🇭🇺 [Magyar](../i18n/hu/docs/architecture/ARCHITECTURE.md) | 🇮🇩 [Bahasa Indonesia](../i18n/id/docs/architecture/ARCHITECTURE.md) | 🇰🇷 [한국어](../i18n/ko/docs/architecture/ARCHITECTURE.md) | 🇲🇾 [Bahasa Melayu](../i18n/ms/docs/architecture/ARCHITECTURE.md) | 🇳🇱 [Nederlands](../i18n/nl/docs/architecture/ARCHITECTURE.md) | 🇳🇴 [Norsk](../i18n/no/docs/architecture/ARCHITECTURE.md) | 🇵🇹 [Português (Portugal)](../i18n/pt/docs/architecture/ARCHITECTURE.md) | 🇷🇴 [Română](../i18n/ro/docs/architecture/ARCHITECTURE.md) | 🇵🇱 [Polski](../i18n/pl/docs/architecture/ARCHITECTURE.md) | 🇸🇰 [Slovenčina](../i18n/sk/docs/architecture/ARCHITECTURE.md) | 🇸🇪 [Svenska](../i18n/sv/docs/architecture/ARCHITECTURE.md) | 🇵🇭 [Filipino](../i18n/phi/docs/architecture/ARCHITECTURE.md) | 🇨🇿 [Čeština](../i18n/cs/docs/architecture/ARCHITECTURE.md)
 
-_Last updated: 2026-05-13_
+_Last updated: 2026-06-28_
 
 ## Executive Summary
 
@@ -17,13 +17,13 @@ It provides a single OpenAI-compatible endpoint (`/v1/*`) and routes traffic acr
 
 Core capabilities:
 
-- OpenAI-compatible API surface for CLI/tools (226 providers, 60 executors)
+- OpenAI-compatible API surface for CLI/tools (237 providers, 75 executors)
 - Request/response translation across provider formats
 - Model combo fallback (multi-model sequence)
 - Structured combo steps (`provider + model + connection`) with runtime ordering by `compositeTiers`
 - Account-level fallback (multi-account per provider)
 - Quota preflight and quota-aware P2C account selection in the main chat path
-- OAuth + API-key provider connection management (16 OAuth modules)
+- OAuth + API-key provider connection management (19 OAuth provider modules)
 - Embedding generation via `/v1/embeddings` (6 providers, 9 models)
 - Image generation via `/v1/images/generations` (10+ providers, 20+ models)
 - Audio transcription via `/v1/audio/transcriptions` (7 providers)
@@ -66,7 +66,7 @@ Core capabilities:
 - Prompt injection guard middleware
 - Prompt compression pipeline with Caveman, RTK, stacked pipelines, compression combos, language packs, and analytics
 - ACP (Agent Communication Protocol) registry
-- Modular OAuth providers (16 individual modules under `src/lib/oauth/providers/`)
+- Modular OAuth providers (19 individual modules under `src/lib/oauth/providers/`)
 - Uninstall/full-uninstall scripts
 - OAuth environment repair action
 - WebSocket bridge for OpenAI-compatible WS clients (`/v1/ws`)
@@ -912,7 +912,6 @@ Each provider has a specialized executor extending `BaseExecutor` (in `open-sse/
 | `CommandCodeExecutor`    | Command Code                                                                                                                                                | OAuth + per-session header rotation                                  |
 | `CursorExecutor`         | Cursor IDE                                                                                                                                                  | ConnectRPC protocol, Protobuf encoding, request signing via checksum |
 | `DevinCliExecutor`       | Devin CLI                                                                                                                                                   | Devin task lifecycle bridging via cloud agent module                 |
-| `GeminiCLIExecutor`      | Gemini CLI                                                                                                                                                  | Google OAuth token refresh cycle                                     |
 | `GithubExecutor`         | GitHub Copilot                                                                                                                                              | Copilot token refresh, VSCode-mimicking headers                      |
 | `GitlabExecutor`         | GitLab Duo                                                                                                                                                  | GitLab OAuth + project-scoped routing                                |
 | `GlmExecutor`            | Z.AI GLM (incl. `glmt` preset)                                                                                                                              | Thinking-budget aware, GLMT preset constants                         |
@@ -934,7 +933,7 @@ All other providers (including custom compatible nodes) use the `DefaultExecutor
 
 ## Provider Compatibility Matrix
 
-> **Note:** The matrix below is a representative sample of the 226 registered providers in
+> **Note:** The matrix below is a representative sample of the 237 registered providers in
 > OmniRoute v3.8.0. For the canonical and continuously-updated list, refer to
 > [`docs/reference/PROVIDER_REFERENCE.md`](../reference/PROVIDER_REFERENCE.md) (auto-generated) or the source of
 > truth at `src/shared/constants/providers.ts` (Zod-validated at load).
@@ -943,7 +942,6 @@ All other providers (including custom compatible nodes) use the `DefaultExecutor
 | ----------------- | ---------------- | --------------------- | ---------------- | ---------- | ------------- | ------------------ |
 | Claude            | claude           | API Key / OAuth       | ✅               | ✅         | ✅            | ⚠️ Admin only      |
 | Gemini            | gemini           | API Key / OAuth       | ✅               | ✅         | ✅            | ⚠️ Cloud Console   |
-| Gemini CLI        | gemini-cli       | OAuth                 | ✅               | ✅         | ✅            | ⚠️ Cloud Console   |
 | Antigravity       | antigravity      | OAuth                 | ✅               | ✅         | ✅            | ✅ Full quota API  |
 | OpenAI            | openai           | API Key               | ✅               | ✅         | ❌            | ❌                 |
 | Codex             | openai-responses | OAuth                 | ✅ forced        | ❌         | ✅            | ✅ Rate limits     |
@@ -1014,7 +1012,7 @@ Target formats include:
 
 - OpenAI chat/Responses
 - Claude
-- Gemini/Gemini-CLI/Antigravity envelope
+- Gemini/Antigravity envelope
 - Kiro
 - Cursor
 

docs/architecture/AUTHZ_GUIDE.md

@@ -1,13 +1,13 @@
 ---
 title: "Authorization Guide"
-version: 3.8.2
-lastUpdated: 2026-06-05
+version: 3.8.40
+lastUpdated: 2026-06-28
 ---
 
 # Authorization Guide
 
 > **Source of truth:** `src/server/authz/`, `src/shared/constants/publicApiRoutes.ts`, `src/lib/api/requireManagementAuth.ts`, `src/shared/utils/apiAuth.ts`
-> **Last updated:** 2026-06-05 — v3.8.2
+> **Last updated:** 2026-06-28 — v3.8.40
 
 OmniRoute has a route-aware authorization pipeline that gates every API request. Classification is **deterministic** and **fail-closed** — anything that cannot be classified ends up as `MANAGEMENT` and demands a session or management-grade token. This page explains the model for engineers maintaining routes or designing new endpoints.
 
@@ -43,11 +43,11 @@ Some management routes accept **either** mode: cookie OR `Bearer <key>` when the
 
 `src/server/authz/types.ts` defines three classes; any route that cannot be classified deterministically falls back to `MANAGEMENT`.
 
-| Class        | Description                                                                                                            | Auth required                                                           |
-| ------------ | ---------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- |
-| `PUBLIC`     | Explicitly safe routes — login, logout, status, init, health, onboarding bootstrap.                                    | None                                                                    |
-| `CLIENT_API` | Model-serving endpoints — `/api/v1/*`, plus aliases `/v1/*`, `/chat/completions`, `/responses`, `/models`, `/codex/*`. | Bearer key when the effective `REQUIRE_API_KEY` feature flag is enabled |
-| `MANAGEMENT` | Dashboard pages, settings, providers, keys, admin and diagnostics endpoints.                                           | Dashboard session OR Bearer with `manage` scope                         |
+| Class        | Description                                                                                                                                          | Auth required                                                           |
+| ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- |
+| `PUBLIC`     | Explicitly safe routes — login, logout, status, init, health, onboarding bootstrap.                                                                  | None                                                                    |
+| `CLIENT_API` | Model-serving endpoints — `/api/v1/*`, `/api/v1beta/*`, plus aliases `/v1/*`, `/v1beta/*`, `/chat/completions`, `/responses`, `/models`, `/codex/*`. | Bearer key when the effective `REQUIRE_API_KEY` feature flag is enabled |
+| `MANAGEMENT` | Dashboard pages, settings, providers, keys, admin and diagnostics endpoints.                                                                         | Dashboard session OR Bearer with `manage` scope                         |
 
 ## Pipeline
 
@@ -73,7 +73,7 @@ Trusted internal headers (defined in `src/server/authz/headers.ts`) are **stripp
 Each route class has a policy in `src/server/authz/policies/`:
 
 - **`publicPolicy`** (`policies/public.ts`) — always returns `allow({ kind: "anonymous", id: "anonymous" })`.
-- **`clientApiPolicy`** (`policies/clientApi.ts`) — extracts Bearer, validates via `validateApiKey()`. Falls through to anonymous only when the effective `REQUIRE_API_KEY` feature flag is disabled. The effective flag is resolved through `isRequireApiKeyEnabled()` (`DB feature flag override > process.env.REQUIRE_API_KEY > default`) so Dashboard Feature Flags and environment variables govern `/api/v1/*` and aliases consistently; resolver failures fail closed. Allows dashboard-session requests on client API routes (including `/api/v1/models`, used by the dashboard model catalog).
+- **`clientApiPolicy`** (`policies/clientApi.ts`) — extracts Bearer, validates via `validateApiKey()`. Falls through to anonymous only when the effective `REQUIRE_API_KEY` feature flag is disabled. The effective flag is resolved through `isRequireApiKeyEnabled()` (`DB feature flag override > process.env.REQUIRE_API_KEY > default`) so Dashboard Feature Flags and environment variables govern `/api/v1/*`, `/api/v1beta/*`, and aliases consistently; resolver failures fail closed. Allows dashboard-session requests on client API routes (including `/api/v1/models`, used by the dashboard model catalog).
 - **`managementPolicy`** (`policies/management.ts`) — accepts dashboard session, internal model-sync requests (matched against `/api/providers/[name]/(sync-models|models)`), or skips entirely if `isAuthRequired()` returns false. Returns 403 (`AUTH_001`) when a Bearer token is present but invalid, 401 otherwise. Also enforces the route-guard tiers (LOCAL_ONLY / ALWAYS_PROTECTED) before any auth branch — see [Route Guard Tiers](../security/ROUTE_GUARD_TIERS.md). LOCAL_ONLY paths in `LOCAL_ONLY_MANAGE_SCOPE_BYPASS_PREFIXES` (today: `/api/mcp/`) may be accessed from non-loopback when the Bearer key carries the `manage` scope; all other LOCAL_ONLY paths remain strict-loopback regardless of scope.
 
 A successful policy returns `AuthSubject` with `kind ∈ { client_api_key, dashboard_session, management_key, anonymous }`. Downstream handlers can read it via `assertAuth(request, "CLIENT_API")` in `src/server/authz/assertAuth.ts` instead of re-running auth logic.
@@ -99,13 +99,13 @@ PUBLIC_READONLY_API_ROUTE_PREFIXES = ["/api/monitoring/health", "/api/settings/r
 PUBLIC_READONLY_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
 ```
 
-Read-only prefixes are public **only** for safe methods. Note: `classifyRoute()` excludes `/api/v1/*` from the PUBLIC fall-through — those are always `CLIENT_API` so the Bearer-key policy still applies.
+Read-only prefixes are public **only** for safe methods. Note: `classifyRoute()` excludes `/api/v1/*` and `/api/v1beta/*` from the PUBLIC fall-through — those are always `CLIENT_API` so the Bearer-key policy still applies.
 
 ## Adding a New Route
 
 ### Pattern 1 — Public client API endpoint (Bearer-auth)
 
-Routes under `/api/v1/` are classified `CLIENT_API` automatically. The middleware enforces the Bearer check; route handlers don't need to redo it but can read the subject if useful.
+Routes under `/api/v1/` and `/api/v1beta/` are classified `CLIENT_API` automatically. The middleware enforces the Bearer check; route handlers don't need to redo it but can read the subject if useful.
 
 ```typescript
 // src/app/api/v1/your-route/route.ts
@@ -163,7 +163,9 @@ write:resilience, pricing:write, read:cache, write:cache,
 read:compression, write:compression, read:proxies
 ```
 
-Preset bundles (`MCP_SCOPE_PRESETS`): `readonly`, `full`, `monitor`, `agent`. Use `hasRequiredScopes(granted, toolName)` and `getMissingScopes()` for enforcement inside MCP handlers.
+Scope enforcement in `open-sse/mcp-server/server.ts` passes each tool's scope list into
+`evaluateToolScopes()` after `resolveCallerScopeContext()` resolves scopes from MCP auth info,
+request metadata, or `OMNIROUTE_MCP_SCOPES`.
 
 ## Auth Required Toggle
 
@@ -173,7 +175,7 @@ Preset bundles (`MCP_SCOPE_PRESETS`): `readonly`, `full`, `monitor`, `agent`. Us
 - No password configured **and** no `INITIAL_PASSWORD` env var → bootstrap mode allows the onboarding wizard and loopback requests, but exposed network requests still need credentials.
 - Any DB error → fails closed (secure-by-default).
 
-Client API key enforcement uses `isRequireApiKeyEnabled()` in `src/shared/utils/featureFlags.ts`, not a direct `process.env.REQUIRE_API_KEY` read. This matters for deployed instances: toggling `REQUIRE_API_KEY` in Dashboard → Feature Flags stores a DB override and immediately affects `/v1/*`, `/models`, `/responses`, `/chat/completions`, `/codex/*`, and other client-API auth checks that share this helper. If the feature flag store cannot be read, client API auth fails closed and requires a key.
+Client API key enforcement uses `isRequireApiKeyEnabled()` in `src/shared/utils/featureFlags.ts`, not a direct `process.env.REQUIRE_API_KEY` read. This matters for deployed instances: toggling `REQUIRE_API_KEY` in Dashboard → Feature Flags stores a DB override and immediately affects `/v1/*`, `/v1beta/*`, `/models`, `/responses`, `/chat/completions`, `/codex/*`, and other client-API auth checks that share this helper. If the feature flag store cannot be read, client API auth fails closed and requires a key.
 
 ## Breaking Change — v3.8.0
 

docs/architecture/CODEBASE_DOCUMENTATION.md

@@ -1,13 +1,13 @@
 ---
 title: "OmniRoute Codebase Documentation"
-version: 3.8.2
-lastUpdated: 2026-05-13
+version: 3.8.40
+lastUpdated: 2026-06-28
 ---
 
 # OmniRoute Codebase Documentation
 
 > **Version:** v3.8.0
-> **Last updated:** 2026-05-13
+> **Last updated:** 2026-06-28
 > **Audience:** Engineers contributing to OmniRoute or building integrations on top of it.
 >
 > For high-level architecture diagrams and the reasoning behind each subsystem, read
@@ -24,10 +24,10 @@ without inventing new modules.
 ## 1. Tech Stack
 
 | Concern       | Choice                                                                                                                   |
-| ------------- | ------------------------------------------------------------------------------------------------------------------------ | --- | ------------- | --- | ------------------------------------ |
+| ------------- | ------------------------------------------------------------------------------------------------------------------------ |
 | Web framework | **Next.js 16** (App Router, standalone output, no global middleware)                                                     |
-| Language      | **TypeScript 5.9+** — target `ES2022`, `module: esnext`, `moduleResolution: bundler`, `strict: false`                    |
-| Runtime       | **Node.js** `>=20.20.2 <21                                                                                               |     | >=22.22.2 <23 |     | >=24.0.0 <27`(enforced via`engines`) |
+| Language      | **TypeScript 6.0+** — target `ES2022`, `module: esnext`, `moduleResolution: bundler`, `strict: false`                    |
+| Runtime       | **Node.js** `>=22.22.2 <23` or `>=24.0.0 <27` (enforced via `engines` + `SUPPORTED_NODE_RANGE`)                          |
 | Database      | **SQLite** via `better-sqlite3` (singleton, WAL journaling)                                                              |
 | Desktop       | **Electron 41** + `electron-builder` 26.10 (separate workspace at `electron/`)                                           |
 | Tests         | **Node native test runner** (unit/integration), **Vitest** (MCP, autoCombo, cache), **Playwright** (e2e + protocols-e2e) |
@@ -452,12 +452,12 @@ open-sse/
 ├── types.d.ts
 ├── config/                 Provider registries, header profiles, identity, …
 ├── handlers/               Request handlers (chat, embeddings, audio, image, …)
-├── executors/              45 provider-specific HTTP executors
+├── executors/              75 provider-specific HTTP executors
 ├── translator/             Format conversion (OpenAI ↔ Claude ↔ Gemini ↔ Cursor ↔ Kiro)
 ├── transformer/            Responses API ↔ Chat Completions stream transformer
 ├── services/               80+ service modules (combos, fallback, quotas, identity, …)
 ├── utils/                  Streaming helpers, TLS client, AWS SigV4, proxy fetch, …
-└── mcp-server/             MCP server (3 transports, 30 scopes, 87 tools)
+└── mcp-server/             MCP server (3 transports, 30 scopes, 94 tools)
 ```
 
 ### 4.1 `open-sse/handlers/`
@@ -482,17 +482,16 @@ open-sse/
 
 ### 4.2 `open-sse/executors/`
 
-45 provider executors, each extending `BaseExecutor` (`base.ts`):
+75 provider executors, each extending `BaseExecutor` (`base.ts`):
 
 `antigravity`, `azure-openai`, `blackbox-web`, `chatgpt-web`, `cliproxyapi`,
 `cloudflare-ai`, `codex`, `commandCode`, `cursor`, `default`, `devin-cli`,
-`gemini-cli`, `github`, `gitlab`, `glm`, `grok-web`, `kie`, `kiro`,
 `muse-spark-web`, `nlpcloud`, `opencode`, `perplexity-web`, `petals`,
 `pollinations`, `puter`, `qoder`, `vertex`, `windsurf`, plus `claudeIdentity.ts`
 (shared identity helper) and `index.ts` (registry).
 
 > Note: providers not listed here are served by `default.ts` using the generic
-> OpenAI-compatible executor. The full provider catalog (226+ entries) lives in
+> OpenAI-compatible executor. The full provider catalog (237 entries) lives in
 > `src/shared/constants/providers.ts`.
 
 ### 4.3 `open-sse/translator/`
@@ -503,7 +502,7 @@ Hub-and-spoke translation (OpenAI is the hub).
   `antigravity-to-openai`, `claude-to-gemini`, `claude-to-openai`,
   `gemini-to-openai`, `openai-responses`, `openai-to-claude`,
   `openai-to-cursor`, `openai-to-gemini`, `openai-to-kiro`.
-- **8 response translators** (`translator/response/`):
+- **9 response translators** (`translator/response/`):
   `claude-to-openai`, `cursor-to-openai`, `gemini-to-claude`, `gemini-to-openai`,
   `kiro-to-openai`, `openai-responses`, `openai-to-antigravity`,
   `openai-to-claude`.
@@ -523,22 +522,21 @@ Hub-and-spoke translation (OpenAI is the hub).
 
 Highlights (full list under `open-sse/services/`):
 
-| Concern                   | Files                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Combo routing             | `combo.ts` (15 strategies), `comboConfig.ts`, `comboMetrics.ts`, `comboManifestMetrics.ts`, `comboAgentMiddleware.ts`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| Auto Combo engine         | `autoCombo/` — `engine.ts`, `scoring.ts`, `taskFitness.ts`, `virtualFactory.ts`, `modePacks.ts`, `autoPrefix.ts`, `persistence.ts`, `providerDiversity.ts`, `providerRegistryAccessor.ts`, `routerStrategy.ts`, `selfHealing.ts`, `index.ts`                                                                                                                                                                                                                                                                                                                                                                             |
-| Resilience                | `accountFallback.ts` (cooldown + lockout), `errorClassifier.ts`, `emergencyFallback.ts`, `rateLimitManager.ts`, `rateLimitSemaphore.ts`, `accountSemaphore.ts`, `accountSelector.ts`                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| Quotas                    | `quotaMonitor.ts`, `quotaPreflight.ts`, `bailianQuotaFetcher.ts`, `codexQuotaFetcher.ts`, `deepseekQuotaFetcher.ts`, `crofUsageFetcher.ts`, `antigravityCredits.ts`                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| Provider-specific shaping | `claudeCodeCCH.ts`, `claudeCodeCompatible.ts`, `claudeCodeConstraints.ts`, `claudeCodeExtraRemap.ts`, `claudeCodeFingerprint.ts`, `claudeCodeObfuscation.ts`, `claudeCodeToolRemapper.ts`, `cloudCodeHeaders.ts`, `cloudCodeThinking.ts`, `geminiCliHeaders.ts`, `geminiThoughtSignatureStore.ts`, `gigachatAuth.ts`, `antigravityHeaders.ts`, `antigravityHeaderScrub.ts`, `antigravityIdentity.ts`, `antigravityObfuscation.ts`, `antigravityVersion.ts`, `antigravity429Engine.ts`, `chatgptTlsClient.ts`, `chatgptImageCache.ts`, `cursorSessionManager.ts`, `qoderCli.ts`, `qwenThinking.ts`, `modelscopePolicy.ts` |
-| Caching                   | `reasoningCache.ts`, `searchCache.ts`, `signatureCache.ts`, `requestDedup.ts`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| Routing intelligence      | `intentClassifier.ts`, `taskAwareRouter.ts`, `backgroundTaskDetector.ts`, `volumeDetector.ts`, `wildcardRouter.ts`, `workflowFSM.ts`, `specificityDetector.ts`, `specificityRules.ts`, `specificityTypes.ts`                                                                                                                                                                                                                                                                                                                                                                                                             |
-| Model handling            | `modelCapabilities.ts`, `modelDeprecation.ts`, `modelFamilyFallback.ts`, `modelStrip.ts`, `model.ts`, `provider.ts`, `providerRequestDefaults.ts`, `providerCostData.ts`, `payloadRules.ts`                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| Compression               | `compression/` — full compression engine wiring                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| Token + session           | `tokenRefresh.ts`, `sessionManager.ts`, `apiKeyRotator.ts`, `contextManager.ts`, `contextHandoff.ts`, `systemPrompt.ts`, `roleNormalizer.ts`, `responsesInputSanitizer.ts`, `toolSchemaSanitizer.ts`, `toolLimitDetector.ts`, `thinkingBudget.ts`                                                                                                                                                                                                                                                                                                                                                                        |
-| Tier / manifest           | `tierResolver.ts`, `tierConfig.ts`, `tierDefaults.json`, `tierTypes.ts`, `manifestAdapter.ts`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| IP / network              | `ipFilter.ts`, `webSearchFallback.ts`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| Batches                   | `batchProcessor.ts`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| Usage                     | `usage.ts`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| Concern              | Files                                                                                                                                                                                                                                             |
+| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Combo routing        | `combo.ts` (17 strategies), `comboConfig.ts`, `comboMetrics.ts`, `comboManifestMetrics.ts`, `comboAgentMiddleware.ts`                                                                                                                             |
+| Auto Combo engine    | `autoCombo/` — `engine.ts`, `scoring.ts`, `taskFitness.ts`, `virtualFactory.ts`, `modePacks.ts`, `autoPrefix.ts`, `persistence.ts`, `providerDiversity.ts`, `providerRegistryAccessor.ts`, `routerStrategy.ts`, `selfHealing.ts`, `index.ts`      |
+| Resilience           | `accountFallback.ts` (cooldown + lockout), `errorClassifier.ts`, `emergencyFallback.ts`, `rateLimitManager.ts`, `rateLimitSemaphore.ts`, `accountSemaphore.ts`, `accountSelector.ts`                                                              |
+| Quotas               | `quotaMonitor.ts`, `quotaPreflight.ts`, `bailianQuotaFetcher.ts`, `codexQuotaFetcher.ts`, `deepseekQuotaFetcher.ts`, `crofUsageFetcher.ts`, `antigravityCredits.ts`                                                                               |
+| Caching              | `reasoningCache.ts`, `searchCache.ts`, `signatureCache.ts`, `requestDedup.ts`                                                                                                                                                                     |
+| Routing intelligence | `intentClassifier.ts`, `taskAwareRouter.ts`, `backgroundTaskDetector.ts`, `volumeDetector.ts`, `wildcardRouter.ts`, `workflowFSM.ts`, `specificityDetector.ts`, `specificityRules.ts`, `specificityTypes.ts`                                      |
+| Model handling       | `modelCapabilities.ts`, `modelDeprecation.ts`, `modelFamilyFallback.ts`, `modelStrip.ts`, `model.ts`, `provider.ts`, `providerRequestDefaults.ts`, `providerCostData.ts`, `payloadRules.ts`                                                       |
+| Compression          | `compression/` — full compression engine wiring                                                                                                                                                                                                   |
+| Token + session      | `tokenRefresh.ts`, `sessionManager.ts`, `apiKeyRotator.ts`, `contextManager.ts`, `contextHandoff.ts`, `systemPrompt.ts`, `roleNormalizer.ts`, `responsesInputSanitizer.ts`, `toolSchemaSanitizer.ts`, `toolLimitDetector.ts`, `thinkingBudget.ts` |
+| Tier / manifest      | `tierResolver.ts`, `tierConfig.ts`, `tierDefaults.json`, `tierTypes.ts`, `manifestAdapter.ts`                                                                                                                                                     |
+| IP / network         | `ipFilter.ts`, `webSearchFallback.ts`                                                                                                                                                                                                             |
+| Batches              | `batchProcessor.ts`                                                                                                                                                                                                                               |
+| Usage                | `usage.ts`                                                                                                                                                                                                                                        |
 
 ### 4.6 `open-sse/mcp-server/`
 
@@ -636,17 +634,17 @@ Two binaries are exposed in `package.json` → `bin`:
 
 ## 7. `tests/`
 
-| Directory                                                                      | Type                                                                                       |
-| ------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------ |
-| `tests/unit/`                                                                  | Unit tests via Node native test runner (506 files, plus `api/`, `auth/`, `authz/` subdirs) |
-| `tests/integration/`                                                           | Cross-module + DB-state tests                                                              |
-| `tests/e2e/`                                                                   | Playwright UI tests                                                                        |
-| `tests/protocols-e2e/`                                                         | MCP/A2A protocol e2e                                                                       |
-| `tests/translator/`                                                            | Translator-specific tests                                                                  |
-| `tests/security/`                                                              | Security regressions                                                                       |
-| `tests/load/`                                                                  | Load / stress tests                                                                        |
-| `tests/golden-set/`                                                            | Reference outputs for translator regressions                                               |
-| `tests/helpers/`, `tests/fixtures/`, `tests/manual/`, `tests/scratch_test.mjs` | Support                                                                                    |
+| Directory                                                                      | Type                                                                                        |
+| ------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------- |
+| `tests/unit/`                                                                  | Unit tests via Node native test runner (1821 files, plus `api/`, `auth/`, `authz/` subdirs) |
+| `tests/integration/`                                                           | Cross-module + DB-state tests                                                               |
+| `tests/e2e/`                                                                   | Playwright UI tests                                                                         |
+| `tests/protocols-e2e/`                                                         | MCP/A2A protocol e2e                                                                        |
+| `tests/translator/`                                                            | Translator-specific tests                                                                   |
+| `tests/security/`                                                              | Security regressions                                                                        |
+| `tests/load/`                                                                  | Load / stress tests                                                                         |
+| `tests/golden-set/`                                                            | Reference outputs for translator regressions                                                |
+| `tests/helpers/`, `tests/fixtures/`, `tests/manual/`, `tests/scratch_test.mjs` | Support                                                                                     |
 
 Common commands:
 
@@ -795,6 +793,20 @@ See [A2A-SERVER.md § Adding a New Skill](../frameworks/A2A-SERVER.md). Skills l
   inference for cross-module boundaries.
 - **Database**: never write raw SQL in routes or handlers — always go through
   `src/lib/db/` modules. Never add logic to `src/lib/localDb.ts`.
+- **DB-entity typing (#3512)**: a function that writes or reads a DB table's
+  row shape should take/return a named TS interface mirroring that table's
+  columns 1:1, not `any` or an inline anonymous type at the call site. Land
+  the interface next to the function (e.g. `export interface UsageEntry` in
+  `src/lib/usage/usageHistory.ts` above `saveRequestUsage`), keep individual
+  fields optional/nullable when different writers populate the row
+  incrementally, and prefer `unknown` over `any` for a field whose shape
+  varies across callers (documented on the field, e.g. `UsageEntry.tokens`
+  accepts both raw provider-shaped usage and the normalized shape). Once a
+  file's `any` count reaches zero this way, add it to the
+  `check:any-budget:t11` allowlist (`scripts/check/check-t11-any-budget.mjs`,
+  `maxAny: 0`) so it can't regress. This is a first-slice convention — the
+  broader "no anonymous `any`" cleanup is iterative across the rest of the
+  codebase.
 - **Errors**: try/catch with specific error types, log with pino context. Never
   silently swallow errors in SSE streams; use abort signals for cleanup.
 - **Security**: never use `eval()` / `new Function()` / implied eval. Validate
@@ -807,7 +819,7 @@ See [A2A-SERVER.md § Adding a New Skill](../frameworks/A2A-SERVER.md). Skills l
 - **Branches**: prefixes `feat/`, `fix/`, `refactor/`, `docs/`, `test/`,
   `chore/`. Never commit directly to `main`.
 - **Husky**: pre-commit runs `lint-staged` + `check:docs-sync` +
-  `check:any-budget:t11`; pre-push runs `npm run test:unit`.
+  `check:any-budget:t11`; pre-push runs `check:any-budget:t11` + `check:tracked-artifacts` (fast gates; excludes `test:unit`).
 
 ---
 

docs/architecture/DESIGN_SYSTEM.md

@@ -1,7 +1,18 @@
+---
+title: "Design System & Visual Identity"
+lastUpdated: 2026-07-11
+---
+
 # OmniRoute — Design System & Visual Identity
 
-> **Status:** standardization plan. **Phases 1–3 are implemented in this PR** (grid, primitives, status-color centralization, mono token, and the DataTable token migration). The DataTable migration is **faithful** — dark stays byte-identical (the new `--table-*` dark values equal the old hardcoded rgba); light is fixed (it was buggy always-dark via dead `var()` fallbacks). **⚠️ Wants a visual pass before merge** (light-theme tables + the secondary-text shift `#888`→`--color-text-muted`). **Phase 4 is now largely done too** (C6 focus-ring → accent, C7 Checkbox/Textarea primitives, C9 `cn()`→tailwind-merge); only the selective C8 hex-sweep remains. Note several remaining "hardcoded" hex are _intentional_ (always-dark console terminal, ReactFlow SVG strokes) and must NOT be swept. **Phase 5 (D4 + D8): the grid now reaches every standalone screen** (login/auth/error/legal/status/onboarding — their opaque `bg-bg` full-screen wrappers were hiding it) **and the dashboard content shell is fluid up to 4K** (`max-w-7xl` → `max-w-[3840px]`) so it follows the viewport on large monitors instead of centering with wide side gutters. **Phase 6 (D9): data tables are now opaque surfaces** so the grid no longer bleeds through their rows — card-less tables paint `bg-surface`, and the two log tables' semi-transparent `bg-black/5` tint (which tailwind-merge let win over the Card's `bg-surface`) is removed. The grid size itself is already correct (32px, identical to the site); a "bigger" grid on a running instance is a stale build, not code.
-> **Date:** 2026-06-16 · **Scope:** unify the OmniRoute dashboard (`src/`) with the marketing site (`_mono_repo/omnirouteSite/`) into **one visual identity** — same graph-paper grid background, same color tokens, standardized components.
+> **Status:** reference — the standardization described here is **implemented** (phases 1–6: grid wallpaper, primitives, status-color centralization, mono token, DataTable token migration, focus-ring → accent, Checkbox/Textarea primitives, `cn()` → tailwind-merge, grid on every standalone screen, fluid 4K content shell, opaque data-table surfaces). This document is the canonical description of the dashboard's design tokens, components, and conventions; the phase framing below is kept as the rationale for each decision.
+> **Scope:** the OmniRoute dashboard (`src/`) and the marketing site (`_mono_repo/omnirouteSite/`) share **one visual identity** — same graph-paper grid background (32px), same color tokens, standardized components.
+>
+> Practical notes for maintainers:
+>
+> - Several remaining hardcoded hex values are **intentional** (always-dark console terminal, ReactFlow SVG strokes) and must **NOT** be swept into tokens.
+> - A "bigger" grid on a running instance is a stale build, not code — the grid size is 32px, identical to the site.
+> - Dark-theme `--table-*` values are byte-identical to the pre-migration hardcoded rgba; light theme was fixed (it was buggy always-dark via dead `var()` fallbacks).
 
 ---
 

docs/architecture/MONITORING_SECTIONS.md

@@ -1,7 +1,7 @@
 ---
 title: "Monitoring & Costs — Navigation Structure"
-version: 3.8.6
-lastUpdated: 2026-05-28
+version: 3.8.40
+lastUpdated: 2026-06-28
 ---
 
 # Monitoring & Costs — Navigation Structure
@@ -32,13 +32,13 @@ Monitoring     ← REORGANIZED (Group B, plan 16)
 
 Path prefix: `/dashboard/costs/`
 
-| Item | URL | Description |
-|------|-----|-------------|
-| Overview | `/dashboard/costs` | Aggregated cost dashboard (moved from Analytics) |
-| Pricing | `/dashboard/costs/pricing` | Per-model pricing table |
-| Budget | `/dashboard/costs/budget` | Budget thresholds + alerts |
-| Quota Sharing | `/dashboard/costs/quota-share` | Quota Share pools + usage |
-| Plan Config | `/dashboard/costs/quota-share/plans` | Per-provider plan overrides |
+| Item          | URL                                  | Description                                      |
+| ------------- | ------------------------------------ | ------------------------------------------------ |
+| Overview      | `/dashboard/costs`                   | Aggregated cost dashboard (moved from Analytics) |
+| Pricing       | `/dashboard/costs/pricing`           | Per-model pricing table                          |
+| Budget        | `/dashboard/costs/budget`            | Budget thresholds + alerts                       |
+| Quota Sharing | `/dashboard/costs/quota-share`       | Quota Share pools + usage                        |
+| Plan Config   | `/dashboard/costs/quota-share/plans` | Per-provider plan overrides                      |
 
 **Rationale**: Pricing, Budget, and Quota Sharing were previously under
 `Monitoring > Costs Parameters`. Moving them to a dedicated top-level section
@@ -68,11 +68,11 @@ Monitoring
 
 ### What changed from the old structure
 
-| Before | After |
-|--------|-------|
-| Activity = tab inside Logs that rendered the Audit Log | Activity = dedicated feed (`/dashboard/activity`) |
-| Costs Parameters group in Monitoring | Moved to Costs section |
-| Flat list: Logs, Activity (logs), Audit, Health, Runtime, Pricing, Budget, Quota | Structured 3-group + dedicated Costs section |
+| Before                                                                           | After                                             |
+| -------------------------------------------------------------------------------- | ------------------------------------------------- |
+| Activity = tab inside Logs that rendered the Audit Log                           | Activity = dedicated feed (`/dashboard/activity`) |
+| Costs Parameters group in Monitoring                                             | Moved to Costs section                            |
+| Flat list: Logs, Activity (logs), Audit, Health, Runtime, Pricing, Budget, Quota | Structured 3-group + dedicated Costs section      |
 
 ---
 
@@ -80,15 +80,15 @@ Monitoring
 
 These two are now distinct:
 
-| Dimension | Activity (`/dashboard/activity`) | Audit Log (`/dashboard/audit`) |
-|-----------|----------------------------------|-------------------------------|
-| **Purpose** | User-facing event feed ("what happened recently") | Compliance / security log |
-| **Data source** | `GET /api/compliance/audit-log?level=high` | `GET /api/compliance/audit-log?level=all` |
-| **Format** | Timeline, grouped by day, human-readable verbs + icons | Dense paginaged table, 50/page |
-| **Filters** | Event type category | Action, severity, actor, date range |
-| **Export** | Not available | JSON export |
-| **Actor filter** | Not applicable | Filterable by actor |
-| **Events shown** | High-level actions only (allowlist) | All audit events |
+| Dimension        | Activity (`/dashboard/activity`)                       | Audit Log (`/dashboard/audit`)            |
+| ---------------- | ------------------------------------------------------ | ----------------------------------------- |
+| **Purpose**      | User-facing event feed ("what happened recently")      | Compliance / security log                 |
+| **Data source**  | `GET /api/compliance/audit-log?level=high`             | `GET /api/compliance/audit-log?level=all` |
+| **Format**       | Timeline, grouped by day, human-readable verbs + icons | Dense paginaged table, 50/page            |
+| **Filters**      | Event type category                                    | Action, severity, actor, date range       |
+| **Export**       | Not available                                          | JSON export                               |
+| **Actor filter** | Not applicable                                         | Filterable by actor                       |
+| **Events shown** | High-level actions only (allowlist)                    | All audit events                          |
 
 ### High-Level Actions allowlist
 
@@ -133,14 +133,14 @@ reference the old ID.
 
 Namespaces added by Group B:
 
-| Namespace key | Covers |
-|---------------|--------|
-| `sidebar.costsSection` | Costs section label |
-| `sidebar.activity` | Activity sidebar item |
-| `sidebar.logsGroup` | Logs subgroup label |
-| `sidebar.systemGroup` | System subgroup label |
-| `sidebar.costsOverview` | Costs overview item |
-| `activity.*` | All Activity page strings (title, verbs, filters, empty state) |
+| Namespace key           | Covers                                                         |
+| ----------------------- | -------------------------------------------------------------- |
+| `sidebar.costsSection`  | Costs section label                                            |
+| `sidebar.activity`      | Activity sidebar item                                          |
+| `sidebar.logsGroup`     | Logs subgroup label                                            |
+| `sidebar.systemGroup`   | System subgroup label                                          |
+| `sidebar.costsOverview` | Costs overview item                                            |
+| `activity.*`            | All Activity page strings (title, verbs, filters, empty state) |
 
 Source-of-truth locales: `pt-BR` and `en`. All other 39 locales fall back to
 English via the `next-intl` fallback mechanism (configured in `src/i18n/config.ts`).

docs/architecture/QUALITY_GATES.md

@@ -13,7 +13,7 @@ in `CLAUDE.md`.
 
 ---
 
-## Gate Inventory (~48 scripts)
+## Gate Inventory (~50 scripts)
 
 Scripts live under `scripts/check/` (policy gates) and `scripts/quality/` (ratchet engine).
 The CI source of truth is `.github/workflows/ci.yml`.
@@ -31,10 +31,10 @@ Runs on every PR to `main`. Blocks merge on failure.
 | `check:provider-consistency`   | Every provider in `providers.ts` has a matching entry in `providerRegistry.ts` (and vice-versa, within the allowlist)                                              | Yes                                      |
 | `check:fetch-targets`          | Every `fetch("/api/...")` in client-side `src/` resolves to a real `route.ts`                                                                                      | Yes                                      |
 | `check:deps`                   | All `npm install`-able deps across every `package.json` in the repo are in `dependency-allowlist.json`; new unpinned or slopsquatted packages flagged              | Yes                                      |
-| `audit:deps`                   | `npm audit` (root + electron) — no high/critical advisories (overlaps osv `check:vuln-ratchet`; see Rationalization Backlog)                                        | Yes                                      |
+| `audit:deps`                   | `npm audit` (root + electron) — no high/critical advisories (overlaps osv `check:vuln-ratchet`; see Rationalization Backlog)                                       | Yes                                      |
 | `check:lockfile`               | `package-lock.json` integrity — https registry, integrity hashes, no host overrides                                                                                | Yes                                      |
 | `check:licenses`               | SPDX license allowlist for production dependencies                                                                                                                 | Yes                                      |
-| `check:tracked-artifacts`      | No build artifacts / committed `node_modules` symlinks (also runs in husky pre-push)                                                                               | Yes                                      |
+| `check:tracked-artifacts`      | No build artifacts / committed `node_modules` symlinks (also runs in husky pre-commit; pre-push is intentionally light — #6716)                                     | Yes                                      |
 | `check:file-size`              | No source file exceeds the per-extension cap (ratchet: frozen large files in `frozen` list)                                                                        | Yes                                      |
 | `check:error-helper`           | Error responses in executors/handlers use `buildErrorBody()` / `sanitizeErrorMessage()` (Hard Rule #12)                                                            | Yes                                      |
 | `check:migration-numbering`    | Migration SQL files are sequentially numbered, no gaps or duplicates                                                                                               | Yes                                      |
@@ -51,16 +51,16 @@ Runs on every PR to `main`. Blocks merge on failure.
 
 Runs after `test-coverage`. Blocks merge on failure.
 
-| Script              | Validates                                                                                                  | Blocking                  |
-| ------------------- | ---------------------------------------------------------------------------------------------------------- | ------------------------- |
-| `quality:collect`   | Emits `quality-metrics.json` (ESLint warning count, coverage from merged shard report)                     | Yes (upstream of ratchet) |
-| `quality:ratchet`   | Each metric in `quality-baseline.json` has not regressed (ESLint warnings ≤ baseline; coverage ≥ baseline) | Yes                       |
-| `check:duplication` | Code duplication (jscpd@4) does not exceed baseline in `quality-baseline.json`                             | Yes                       |
-| `check:complexity`  | File-level cyclomatic complexity does not exceed the cap (core ESLint `complexity` + `max-lines-per-function`)         | Yes                       |
-| `check:cognitive-complexity` | Cognitive complexity ratchet (`eslint-plugin-sonarjs`) — separate ESLint pass; mergeable with `check:complexity` (see Backlog) | Yes              |
-| `check:dead-code`   | Unused exports / files ratchet (knip) does not regress vs baseline                                         | Yes                       |
-| `check:type-coverage` | Percent-typed ratchet (`type-coverage`) does not regress; largely subsumes `typecheck:noimplicit:core`   | Yes                       |
-| `check:codeql-ratchet` | Open CodeQL alert count does not regress (reads via `gh api`; graceful-skip without token)              | Yes                       |
+| Script                       | Validates                                                                                                                      | Blocking                  |
+| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | ------------------------- |
+| `quality:collect`            | Emits `quality-metrics.json` (ESLint warning count, coverage from merged shard report)                                         | Yes (upstream of ratchet) |
+| `quality:ratchet`            | Each metric in `quality-baseline.json` has not regressed (ESLint warnings ≤ baseline; coverage ≥ baseline)                     | Yes                       |
+| `check:duplication`          | Code duplication (jscpd@4) does not exceed baseline in `quality-baseline.json`                                                 | Yes                       |
+| `check:complexity`           | File-level cyclomatic complexity does not exceed the cap (core ESLint `complexity` + `max-lines-per-function`)                 | Yes                       |
+| `check:cognitive-complexity` | Cognitive complexity ratchet (`eslint-plugin-sonarjs`) — separate ESLint pass; mergeable with `check:complexity` (see Backlog) | Yes                       |
+| `check:dead-code`            | Unused exports / files ratchet (knip) does not regress vs baseline                                                             | Yes                       |
+| `check:type-coverage`        | Percent-typed ratchet (`type-coverage`) does not regress; largely subsumes `typecheck:noimplicit:core`                         | Yes                       |
+| `check:codeql-ratchet`       | Open CodeQL alert count does not regress (reads via `gh api`; graceful-skip without token)                                     | Yes                       |
 
 ### Job: `quality-extended`
 
@@ -68,13 +68,13 @@ Entire job is advisory (`continue-on-error: true`). The npm-based ratchets run f
 real; the external scanners install via `gh release download` and self-skip (exit 0)
 when a binary is still absent.
 
-| Script                   | Validates                                                                                                                            | Blocking     |
-| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------ | ------------ |
-| `check:circular-deps`    | No circular dependencies (dpdm)                                                                                                       | **Advisory** |
-| `check:bundle-size`      | Bundle size does not exceed the cap                                                                                                   | **Advisory** |
-| `check:secrets`          | Secret scanning (gitleaks) — skips if binary absent                                                                                   | **Advisory** |
-| `check:vuln-ratchet`     | Dependency vulnerabilities (osv-scanner) do not regress — skips if binary absent                                                      | **Advisory** |
-| `check:workflows`        | Workflow lint (actionlint + zizmor) — skips if binaries absent                                                                        | **Advisory** |
+| Script                   | Validates                                                                                                                                                                | Blocking     |
+| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------ |
+| `check:circular-deps`    | No circular dependencies (dpdm)                                                                                                                                          | **Advisory** |
+| `check:bundle-size`      | Bundle size does not exceed the cap                                                                                                                                      | **Advisory** |
+| `check:secrets`          | Secret scanning (gitleaks) — skips if binary absent                                                                                                                      | **Advisory** |
+| `check:vuln-ratchet`     | Dependency vulnerabilities (osv-scanner) do not regress — skips if binary absent                                                                                         | **Advisory** |
+| `check:workflows`        | Workflow lint (actionlint + zizmor) — skips if binaries absent                                                                                                           | **Advisory** |
 | `check:openapi-breaking` | Breaking changes to the public API contract (`openapi.yaml`) vs the base branch (oasdiff) — emits `openapiBreaking=N`; skips if oasdiff absent or base spec unresolvable | **Advisory** |
 
 ### Job: `docs-sync-strict`
@@ -127,19 +127,19 @@ Runs after `build`. Blocks merge on failure.
 
 | Suite            | Validates                                               | Blocking                                                                   |
 | ---------------- | ------------------------------------------------------- | -------------------------------------------------------------------------- |
-| `test:vitest`    | MCP server (87 tools), autoCombo, cache — vitest runner | Yes                                                                        |
+| `test:vitest`    | MCP server (94 tools), autoCombo, cache — vitest runner | Yes                                                                        |
 | `test:vitest:ui` | UI component tests — vitest runner                      | **Advisory** (`continue-on-error: true`) — failing until Fase 6A UI triage |
 
 ### Nightly workflows (scheduled, advisory)
 
 These run on a cron schedule (and `workflow_dispatch`), never on PRs. All are advisory.
 
-| Workflow                       | Validates                                                                                                                                              | Blocking     |
-| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------ |
-| `nightly-property`             | fast-check property tests with a random seed + high run count                                                                                           | **Advisory** |
-| `nightly-resilience`           | heap-growth gate, chaos fault-injection, k6 load/soak                                                                                                   | **Advisory** |
-| `nightly-llm-security`         | promptfoo injection guard (block mode) + garak probes (skipped without a provider secret)                                                               | **Advisory** |
-| `nightly-schemathesis`         | OpenAPI contract fuzzing (schemathesis) against a live OmniRoute using `docs/openapi.yaml` — surfaces spec violations / unhandled 500s (Fase 8 B.4) | **Advisory** |
+| Workflow               | Validates                                                                                                                                           | Blocking     |
+| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ |
+| `nightly-property`     | fast-check property tests with a random seed + high run count                                                                                       | **Advisory** |
+| `nightly-resilience`   | heap-growth gate, chaos fault-injection, k6 load/soak                                                                                               | **Advisory** |
+| `nightly-llm-security` | promptfoo injection guard (block mode) + garak probes (skipped without a provider secret)                                                           | **Advisory** |
+| `nightly-schemathesis` | OpenAPI contract fuzzing (schemathesis) against a live OmniRoute using `docs/openapi.yaml` — surfaces spec violations / unhandled 500s (Fase 8 B.4) | **Advisory** |
 
 ---
 
@@ -226,7 +226,7 @@ allowlist is a false sense of quality.
 ## Agent tooling: LSP-in-the-loop (opt-in)
 
 Beyond the CI gates, OmniRoute ships an **opt-in** `agent-lsp` scaffold
-([`.mcp.json.example`](../../.mcp.json.example), Fase 7 Task 15). Copy it to `.mcp.json`
+(a project-level `.mcp.json`, Fase 7 Task 15). Create `.mcp.json`
 to expose a TypeScript language server to coding agents, so they resolve symbols /
 diagnostics **before** writing code — a compile-before-claim companion to
 `typecheck:core` that cuts "invented symbol" errors at the source. It is intentionally
@@ -257,11 +257,12 @@ Each candidate was validated against the live gate state on 2026-06-17 (trust-bu
 several "obvious" merges turned out to hide debt and are **not** clean drop-ins.
 
 - **`check:docs-sync` runs twice** — standalone in the `lint` job and again inside `check:docs-all` (`docs-sync-strict`) and the husky pre-commit hook. ✅ **DONE** — standalone `lint` invocation removed.
-- **CVE scanning** — ❌ **NOT a clean merge.** `audit:deps` hard-fails on any high/critical CVE; `check:vuln-ratchet` (osv) only fails on a *regression* vs baseline (currently 1 MODERATE). Different semantics — dropping `audit:deps` would lose the absolute high/critical gate. Keep both.
+- **CVE scanning** — ❌ **NOT a clean merge.** `audit:deps` hard-fails on any high/critical CVE; `check:vuln-ratchet` (osv) only fails on a _regression_ vs baseline (currently 1 MODERATE). Different semantics — dropping `audit:deps` would lose the absolute high/critical gate. Keep both.
 - **Cycle detection** — ❌ **NOT a clean merge.** `check:circular-deps` (dpdm) reports **91 cycles** (that is why it is advisory); it cannot be promoted to blocking without first resolving them, and it has a broader scope than the green, curated `check:cycles`. Keep `check:cycles` blocking; resolving the 91 dpdm cycles is its own backlog.
-- **Complexity** — ⏳ valid but real surgery. `check:complexity` (core ESLint) + `check:cognitive-complexity` (sonarjs) are two ESLint passes over `src` + `open-sse`; merging into one config emitting both metrics needs careful ratchet re-wiring. Deferred.
-- **`/api` anti-hallucination** — ⏳ valid but script surgery. `check:openapi-routes` (spec→route) + `check:docs-symbols` (prose→route) share resolution logic; collapsing them is a non-trivial script change. Deferred.
+- **Complexity** — ✅ **DONE** (`check:complexity-ratchets` / `eslint.complexity-ratchets.config.mjs`): one ESLint walk, counts by ruleId so cyclomatic+max-lines and cognitive baselines stay independent; individual `check:complexity` / `check:cognitive-complexity` remain for local `--update`.
+- **`/api` anti-hallucination** — ✅ **DONE** (`check:api-docs-refs` + `scripts/check/lib/apiRoutes.mjs`): one FS inventory of `src/app/api`, openapi-routes + docs-symbols still report independently; individuals remain for local runs.
 - **`check:node-runtime` runs in 11 jobs** — ⚠️ **low ROI.** Each is a separate runner and the check is <1s; total savings ~10s, against losing a cheap per-job guard. Not worth the churn.
+- **`typecheck:noimplicit:core` on CI lint** — ✅ **removed from lint job** (was advisory `continue-on-error`); blocking type surface is `typecheck:core` + `check:type-coverage`. Local script retained.
 
 ### Flip / decide (operator policy)
 

docs/architecture/REPOSITORY_MAP.md

@@ -1,13 +1,13 @@
 ---
 title: "Repository Map"
-version: 3.8.26
-lastUpdated: 2026-06-15
+version: 3.8.40
+lastUpdated: 2026-06-28
 ---
 
 # Repository Map
 
 > **One-line description for every directory and root file.**
-> Last updated: 2026-06-15 — OmniRoute v3.8.26
+> Last updated: 2026-06-28 — OmniRoute v3.8.40
 >
 > Use this map to navigate the codebase quickly. For deep dives, follow links to dedicated docs.
 
@@ -98,7 +98,6 @@ OmniRoute/
 | **knip.json**                               | Knip config — unused files/exports/deps (feeds the dead-code gate)                       |
 | **stryker.conf.json**                       | Stryker mutation-testing config                                                          |
 | **.size-limit.json**                        | size-limit bundle budget config                                                          |
-| **semcheck.yaml**                           | semcheck (spec↔code drift) config                                                        |
 | **promptfooconfig.yaml**                    | promptfoo eval config                                                                    |
 | **.gitleaks.toml**                          | gitleaks secret-scan ruleset                                                             |
 | **.zizmor.yml**                             | zizmor GitHub-Actions security-lint config                                               |
@@ -110,7 +109,6 @@ OmniRoute/
 > **Moved out of the root in v3.8.26 (declutter):**
 >
 > - **→ `config/quality/`:** `quality-baseline.json`, `complexity-baseline.json`, `duplication-baseline.json`, `file-size-baseline.json`, `test-discovery-baseline.json`, `dependency-allowlist.json`, `.license-allowlist.json`, and the generated `quality-metrics.json` (gitignored). See [`## config/`](#config--static-configs--quality-gate-state).
-> - **→ `docs/ops/`:** `DOCUMENTATION_AUDIT_REPORT.md`.
 
 ---
 
@@ -184,7 +182,7 @@ src/
 | `compliance/`                            | Audit log + provider audit — see `docs/security/COMPLIANCE.md`                                                                                                                                                                                                                                                          |
 | `compression/`                           | Compression engine glue (engines live in `open-sse/services/compression/`)                                                                                                                                                                                                                                              |
 | `config/`                                | Runtime config helpers                                                                                                                                                                                                                                                                                                  |
-| `db/`                                    | 45+ domain DB modules + 55 migrations (always go through here for SQLite)                                                                                                                                                                                                                                               |
+| `db/`                                    | 95+ domain DB modules + 110+ migrations (always go through here for SQLite)                                                                                                                                                                                                                                               |
 | `quota/`                                 | Quota Sharing Engine: `dimensions.ts` (types/Zod), `types.ts` (QuotaStore interface), `sqliteQuotaStore.ts`, `redisQuotaStore.ts`, `storeFactory.ts`, `fairShare.ts`, `burnRate.ts`, `planResolver.ts`, `planRegistry.ts`, `saturationSignals.ts`, `enforce.ts`, `spendRecorder.ts` — see `docs/routing/QUOTA_SHARE.md` |
 | `display/`                               | UI formatting helpers (cost, latency, etc.)                                                                                                                                                                                                                                                                             |
 | `embeddings/`                            | Embeddings service helpers                                                                                                                                                                                                                                                                                              |
@@ -210,7 +208,7 @@ src/
 | `cacheLayer.ts`, `idempotencyLayer.ts`   | Request caching + idempotency                                                                                                                                                                                                                                                                                           |
 | (~30 more top-level files)               | Specialized helpers (logEnv, modelsDevSync, piiSanitizer, etc.)                                                                                                                                                                                                                                                         |
 
-### `src/db/` — Database (45+ modules + 55 migrations)
+### `src/db/` — Database (94 modules + 106 migrations)
 
 | Subdir                    | Purpose                                                                                                                                                                    |
 | ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -245,9 +243,9 @@ src/
 
 | Module                           | Purpose                                                                |
 | -------------------------------- | ---------------------------------------------------------------------- |
-| `constants/providers.ts`         | **226 providers** with Zod validation (source of truth)                |
+| `constants/providers.ts`         | **236 providers** with Zod validation (source of truth)                |
 | `constants/cliTools.ts`          | External CLI tool registry                                             |
-| `constants/routingStrategies.ts` | **14 routing strategies** with priorities                              |
+| `constants/routingStrategies.ts` | **17 routing strategies** with priorities                              |
 | `constants/publicApiRoutes.ts`   | Routes that require Bearer (vs management) auth                        |
 | `constants/upstreamHeaders.ts`   | Header denylist for upstream requests                                  |
 | `validation/schemas.ts`          | ~80 Zod schemas (single source of truth for API contracts)             |
@@ -266,12 +264,12 @@ Separate npm workspace (`@omniroute/open-sse`). Handles request processing + pro
 
 ```
 open-sse/
-├── handlers/            # 15 files (11 handlers + 4 helpers): chatCore, responsesHandler, embeddings, audio, image, video, music, rerank, moderations, search, etc.
-├── executors/           # 31 provider-specific executors (extend BaseExecutor)
-├── translator/          # Format converters (9 request, 8 response, 9 helpers)
+├── handlers/            # 16 files (12 handlers + 4 helpers): chatCore, responsesHandler, embeddings, audio, image, video, music, rerank, moderations, search, etc.
+├── executors/           # 67 provider-specific executors (extend BaseExecutor)
+├── translator/          # Format converters (9 request, 9 response, 9 helpers)
 ├── transformer/         # Responses API ↔ Chat Completions (TransformStream)
 ├── services/            # ~80+ service modules (combo, accountFallback, autoCombo, reasoningCache, claude code/chatgpt stealth, modelDeprecation, taskAwareRouter, workflowFSM, etc.)
-├── mcp-server/          # MCP server (87 tools, 3 transports, 30 scopes)
+├── mcp-server/          # MCP server (94 tools, 3 transports, 30 scopes)
 ├── config/              # Provider/model registries, header config, model aliases
 ├── utils/               # TLS client, proxy fetch/dispatcher, network helpers
 ├── index.ts             # Workspace entry
@@ -290,7 +288,7 @@ open-sse/
 | `scopeEnforcement.ts`       | Per-tool scope validation                                                      |
 | `runtimeHeartbeat.ts`       | Health heartbeat to `DATA_DIR/runtime/mcp-heartbeat.json`                      |
 | `descriptionCompressor.ts`  | Compress tool description metadata to save context                             |
-| `schemas/tools.ts`          | 30 base tool definitions + scopes                                              |
+| `schemas/tools.ts`          | 34 base tool definitions + scopes                                              |
 | `tools/advancedTools.ts`    | Advanced tool implementations                                                  |
 | `tools/memoryTools.ts`      | 3 memory tools (search/add/clear)                                              |
 | `tools/skillTools.ts`       | 4 skill tools (list/enable/execute/executions)                                 |
@@ -401,13 +399,13 @@ open-sse/
 | `CLI-TOOLS.md`              | External CLI integrations + Internal OmniRoute CLI                                    |
 | `I18N.md`                   | i18n architecture, adding a language, 30 locales                                      |
 | `UNINSTALL.md`              | Clean uninstall steps                                                                 |
-| `PROVIDER_REFERENCE.md`     | **Auto-generated** catalog of 226 providers (regen: `npm run gen:provider-reference`) |
+| `PROVIDER_REFERENCE.md`     | **Auto-generated** catalog of 236 providers (regen: `npm run gen:provider-reference`) |
 
 ### Subsystem deep-dives
 
 | Doc                        | Purpose                                                             |
 | -------------------------- | ------------------------------------------------------------------- |
-| `MCP-SERVER.md`            | MCP server: 87 tools, 3 transports, 30 scopes, REST endpoints      |
+| `MCP-SERVER.md`            | MCP server: 94 tools, 3 transports, 30 scopes, REST endpoints       |
 | `A2A-SERVER.md`            | A2A v0.3: JSON-RPC, 5 skills, REST helpers, agent card              |
 | `AGENT_PROTOCOLS_GUIDE.md` | Unified guide: A2A vs ACP vs Cloud Agents                           |
 | `CLOUD_AGENT.md`           | Codex Cloud / Devin / Jules orchestration                           |
@@ -448,12 +446,12 @@ open-sse/
 
 ### Subdirectories
 
-| Subdir                    | Purpose                                                                               |
-| ------------------------- | ------------------------------------------------------------------------------------- |
-| `docs/archive/`           | Archived/historical docs (e.g., `RFC-AUTO-ASSESSMENT-DRAFT.md` — superseded by EVALS) |
-| `docs/i18n/`              | Localized doc translations (~42 locales)                                              |
-| `docs/screenshots/`       | Image assets for guides                                                               |
-| `docs/superpowers/plans/` | Implementation plans (generated by `superpowers:writing-plans` skill)                 |
+| Subdir                | Purpose                                                                                                                                                                                        |
+| --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `docs/archive/`       | Archived/historical docs (e.g., `RFC-AUTO-ASSESSMENT-DRAFT.md` — superseded by EVALS)                                                                                                          |
+| `docs/i18n/`          | Localized doc translations (~42 locales)                                                                                                                                                       |
+| `docs/screenshots/`   | Image assets for guides                                                                                                                                                                        |
+| `_tasks/superpowers/` | Plans/specs from superpowers (`writing-plans`/`brainstorming`) + research — isolated, separately-versioned repo, gitignored by the main tree. See CLAUDE.md → "Planning & Research Artifacts". |
 
 ---
 

docs/architecture/RESILIENCE_GUIDE.md

@@ -1,7 +1,7 @@
 ---
 title: "Resilience Guide"
-version: 3.8.31
-lastUpdated: 2026-06-20
+version: 3.8.40
+lastUpdated: 2026-06-28
 ---
 
 # Resilience Guide
@@ -81,7 +81,7 @@ OmniRoute has three distinct but related resilience mechanisms. Each has a diffe
 
 **Terminal states (NOT cooldowns):**
 
-- `banned`
+- `banned` — set by banned-keyword / account-ban detection (see [BAN_DETECTION](../security/BAN_DETECTION.md))
 - `expired`
 - `credits_exhausted`
 
@@ -124,18 +124,18 @@ opt-in feature with its own settings card and a self-healing recovery path.
 **Settings card:** Settings → Model Lockout
 (`src/app/(dashboard)/dashboard/settings/components/ModelLockoutCard.tsx`).
 This is **distinct** from the read-only `ModelCooldownsCard` above (which only
-*lists* active lockouts) — the new card *configures the parameters*. Defaults
+_lists_ active lockouts) — the new card _configures the parameters_. Defaults
 live in `DEFAULT_MODEL_LOCKOUT_SETTINGS`
 (`src/lib/resilience/modelLockoutSettings.ts`):
 
-| Setting                 | Default                          | Meaning                                                          |
-| ----------------------- | -------------------------------- | --------------------------------------------------------------- |
-| `enabled`               | `false`                          | Master toggle — model lockout is **off by default**.            |
-| `errorCodes`            | `[403, 404, 429, 502, 503, 504]` | Upstream statuses that count as a model-scoped failure.         |
-| `baseCooldownMs`        | `120_000` (120 s)                | Initial lockout duration for the first failure.                 |
-| `maxCooldownMs`         | `1_800_000` (30 min)             | Cap on the escalated cooldown.                                  |
-| `maxBackoffSteps`       | `10`                             | Max exponential-backoff escalation steps.                       |
-| `useExponentialBackoff` | `true`                           | Whether repeated failures escalate the cooldown exponentially.  |
+| Setting                 | Default                          | Meaning                                                        |
+| ----------------------- | -------------------------------- | -------------------------------------------------------------- |
+| `enabled`               | `false`                          | Master toggle — model lockout is **off by default**.           |
+| `errorCodes`            | `[403, 404, 429, 502, 503, 504]` | Upstream statuses that count as a model-scoped failure.        |
+| `baseCooldownMs`        | `120_000` (120 s)                | Initial lockout duration for the first failure.                |
+| `maxCooldownMs`         | `1_800_000` (30 min)             | Cap on the escalated cooldown.                                 |
+| `maxBackoffSteps`       | `10`                             | Max exponential-backoff escalation steps.                      |
+| `useExponentialBackoff` | `true`                           | Whether repeated failures escalate the cooldown exponentially. |
 
 Settings persist through the normal settings store and validate via the
 resilience settings schema; the card clamps `baseCooldownMs`/`maxCooldownMs`
@@ -154,8 +154,8 @@ either path can re-enable a model.
 
 **State:** lockouts are held **in-memory** (per-process `Map`s of
 `ModelLockoutEntry` keyed by `provider:connectionId:model`), not persisted to
-the DB — they are lost on restart. The *settings* are persisted; the active
-lockout *state* is ephemeral.
+the DB — they are lost on restart. The _settings_ are persisted; the active
+lockout _state_ is ephemeral.
 
 ---
 
@@ -185,7 +185,7 @@ concurrency** (`resilienceSettings.quotaShareConcurrencyLimit.enabled`, default
 on). Without a `max_concurrent` cap the behavior is unchanged.
 
 > The quota-share routing gate (`selectQuotaShareTarget`, DRR + P2C) is itself
-> fail-open and only *deprioritizes* an at-cap connection — with a
+> fail-open and only _deprioritizes_ an at-cap connection — with a
 > single-connection pool it cannot hard-limit, so this semaphore is what actually
 > contains the flood.
 
@@ -201,7 +201,7 @@ Bounded by `comboCooldownWait` (`enabled`, `maxWaitMs` 5s, `maxAttempts` 2,
 
 ## Other Resilience Features
 
-- **17 routing strategies** (priority, weighted, round-robin, context-relay, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, fusion) — see [AUTO-COMBO.md](../routing/AUTO-COMBO.md).
+- **18 routing strategies** (priority, weighted, round-robin, context-relay, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, fusion, pipeline) — see [AUTO-COMBO.md](../routing/AUTO-COMBO.md).
 - **Reset-aware routing** (v3.8.0) — prioritizes connections by quota reset time.
 - **Background mode degradation** — Responses API `background: true` degraded to sync with warning.
 - **Dynamic tool limit detection** — backs off providers when tool count limits hit.
@@ -225,19 +225,19 @@ Provider-specific stealth (JA3/JA4, CCH, obfuscation) is separately documented
 
 ---
 
-## Resilience testing (Fase 8 · Bloco C)
+## Resilience testing (Phase 8 · Block C)
 
-Além dos unit tests da lógica de resiliência, três testes exercitam o runtime sob
-estresse/falha real (todos integração/nightly — nenhum bloqueia PR):
+Beyond unit tests for resilience logic, three tests exercise the runtime under
+real stress/failure conditions (all integration/nightly — none block PRs):
 
-| Teste | O quê | Rodar |
-|---|---|---|
-| Chaos | Fake-upstream node injeta latência/reset/timeout/503 reais; valida que o circuit breaker abre/recupera e `checkFallbackError` classifica 503 como fallback recuperável. | `RUN_CHAOS_INT=1 npm run test:chaos` |
-| Heap-growth | ~500 streams por `createSSEStream` sob `--expose-gc`; falha se o heap crescer além do teto (guarda OOM #3069). | `npm run test:heap` |
-| k6 soak | Carga sustentada contra `/api/monitoring/health`; thresholds p95/erro. | `k6 run tests/load/k6-soak.js` (nightly) |
+| Test        | What                                                                                                                                                                          | Run                                      |
+| ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------- |
+| Chaos       | Fake-upstream node injects real latency/reset/timeout/503; validates that the circuit breaker opens/recovers and `checkFallbackError` classifies 503 as recoverable fallback. | `RUN_CHAOS_INT=1 npm run test:chaos`     |
+| Heap-growth | ~500 streams per `createSSEStream` under `--expose-gc`; fails if the heap grows beyond the ceiling (OOM guard #3069).                                                         | `npm run test:heap`                      |
+| k6 soak     | Sustained load against `/api/monitoring/health`; p95/error thresholds.                                                                                                        | `k6 run tests/load/k6-soak.js` (nightly) |
 
-Orquestrados por `.github/workflows/nightly-resilience.yml` (cron + dispatch). No
-`test:integration` default, chaos e heap se auto-skipam (sem `RUN_CHAOS_INT`/`--expose-gc`).
+Orchestrated by `.github/workflows/nightly-resilience.yml` (cron + dispatch). In the
+default `test:integration`, chaos and heap self-skip (without `RUN_CHAOS_INT`/`--expose-gc`).
 
 ---
 
@@ -245,4 +245,4 @@ Orquestrados por `.github/workflows/nightly-resilience.yml` (cron + dispatch). N
 
 - [Architecture Guide](./ARCHITECTURE.md) — System architecture and internals
 - [User Guide](../guides/USER_GUIDE.md) — Providers, combos, CLI integration
-- [Auto-Combo Engine](../routing/AUTO-COMBO.md) — 6-factor scoring, mode packs
+- [Auto-Combo Engine](../routing/AUTO-COMBO.md) — 12-factor scoring, mode packs

docs/architecture/ROUTER_BACKENDS.md

@@ -0,0 +1,149 @@
+---
+title: "Router Backends & Embedded Services (ADR)"
+version: 3.8.43
+lastUpdated: 2026-07-02
+---
+
+# Router Backends & Embedded Services — architecture contract (ADR)
+
+> **Status:** Accepted · **Context:** [#5670](https://github.com/diegosouzapw/OmniRoute/issues/5670),
+> [#5603](https://github.com/diegosouzapw/OmniRoute/issues/5603) · **Contract:** `domain/routing/routerBackends.ts`
+> (typed registry — code lands with [#5868](https://github.com/diegosouzapw/OmniRoute/pull/5868))
+
+This ADR pins down how `ts` (native), `bifrost`, `cliproxy`, `9router`, and
+VibeProxy-compatible engines relate to each other, so contributors stop
+conflating two things that are architecturally distinct. It documents the typed
+registry introduced by the router-backend-registry work as the single source of
+truth for that model.
+
+## The core distinction — two orthogonal axes
+
+An engine's role is described by **two independent axes**, encoded together in the
+registry's `RouterBackendDefinition`:
+
+1. **Lifecycle** (`RouterBackendLifecycle`) — _how the engine runs_:
+   - `in-process` — runs inside the OmniRoute Node process (the native TS pipeline).
+   - `supervised` — a local child process OmniRoute installs/starts/stops/health-checks
+     via `ServiceSupervisor`, then consumes as a provider connection.
+   - `external` — an HTTP endpoint OmniRoute dispatches to but does **not** manage
+     (configured by an env base URL).
+   - `disabled` — registered but not selectable.
+2. **Selection axis** (relay routing backend) — _whether the relay dispatches to it_:
+   `RelayRoutingBackend = "ts" | "bifrost" | "auto"` in
+   `src/app/api/v1/relay/chat/completions/routingBackend.ts`.
+
+The mistake to avoid: treating "embedded service" and "routing backend" as one
+list. They are not. A `supervised` engine (9router/cliproxy) is a **provider
+connection consumed by the native pipeline**, not an alternate relay dispatch
+backend. `bifrost` is the reverse — a relay dispatch backend that (historically)
+was `external`-only.
+
+## The registry — single source of truth
+
+The `domain/routing/routerBackends.ts` contract (code lands with
+[#5868](https://github.com/diegosouzapw/OmniRoute/pull/5868)) declares every engine once, with its
+lifecycle, capabilities, service identity, default port, health config, and
+telemetry support. Consumers look engines up via `getRouterBackend(id)`,
+`listRouterBackends()`, and `listRouterBackendsByCapability(cap)` instead of
+special-casing each sidecar.
+
+| Backend     | Lifecycle    | Service (axis A) | Relay backend (axis B) | Health        | Default port |
+| ----------- | ------------ | ---------------- | ---------------------- | ------------- | ------------ |
+| `ts`        | `in-process` | —                | `ts` (native)          | —             | —            |
+| `bifrost`   | `external`¹  | —¹               | `bifrost` / `auto`     | `/health`     | —            |
+| `cliproxy`  | `supervised` | `cliproxy`       | — (provider)           | `/v1/models`  | 8317         |
+| `9router`   | `supervised` | `9router`        | — (provider)           | `/api/health` | 20130        |
+| `vibeproxy` | `external`   | —                | — (provider adapter)   | `/v1/models`  | —            |
+
+¹ Bifrost's promotion to a `supervised` embedded service (installable/startable
+from `/api/services/bifrost/`) is tracked in
+[#5817](https://github.com/diegosouzapw/OmniRoute/pull/5817); until it merges,
+Bifrost is `external`-only (reachable solely via `BIFROST_BASE_URL`).
+
+`capabilities` (`chat`, `responses`, `streaming`, `tools`, `vision`,
+`oauth-backed`, `dashboard-embed`, `model-sync`, `native-hot-path`) let callers
+filter by what an engine can actually do rather than hard-coding per-id branches.
+
+## Axis A — embedded services (supervised process side)
+
+- **Registry of supervised processes:** `src/lib/services/bootstrap.ts` `SERVICES[]`
+  (today: `9router`, `cliproxy`).
+- **Lifecycle owner:** `src/lib/services/ServiceSupervisor.ts` — `start()` spawns the
+  child, gates on `waitForHealthy()`, taps stdout/stderr into a ring buffer;
+  `stop()` SIGTERM→SIGKILL; all serialized under a lock.
+- **State union** (`src/lib/services/types.ts`):
+  `not_installed | stopped | starting | running | stopping | error`, plus an
+  orthogonal `HealthState = healthy | unhealthy | unknown`.
+- **Why a separate process (not an in-proc SDK)?** Process isolation is what makes
+  install/start/stop/health/logs independently controllable per sidecar and lets the
+  loopback spawn-guard apply. Modeling an in-proc adapter is future work — the
+  `native-hot-path` capability flag is where that would be expressed.
+
+### Lifecycle route contract (`/api/services/<tool>/…`)
+
+Status codes are **state/verb/path-specific by design** — this is the contract, not
+inconsistency:
+
+| Call                         | Condition                       | Status                               |
+| ---------------------------- | ------------------------------- | ------------------------------------ |
+| `POST .../start`             | service `not_installed`         | **409** (precondition)               |
+| `POST .../stop`              | already stopped                 | **200** (idempotent no-op)           |
+| `GET .../status`             | OK                              | **200** (`live ?? row ?? "unknown"`) |
+| `POST .../start`             | spawn failure                   | **503** (transient)                  |
+| `GET .../status`, `.../stop` | uncaught error                  | **500**                              |
+| `GET /api/services/<x>/logs` | unknown tool `<x>`              | **404** `Service '<x>' not found`    |
+| `GET .../status?reveal=key`  | missing `X-Reveal-Confirm: yes` | **403** (9router only)               |
+| **any** `/api/services/*`    | caller not loopback/private-LAN | **403 LOCAL_ONLY**                   |
+
+All error bodies are shaped by `createErrorResponse()` →
+`{ error: { message, type }, requestId }`, where `type` is derived from the status
+(`500→server_error`, `404→not_found`, `409→conflict`, else `invalid_request`) and is
+the machine-actionable discriminator. Messages are pre-sanitized
+(`sanitizeErrorMessage()`, Hard Rule #12).
+
+**The loopback guard** is the most common source of a `403`: `/api/services/` is in
+`LOCAL_ONLY_API_PREFIXES` (`src/server/authz/routeGuard.ts`) and
+`src/server/authz/policies/management.ts` rejects any non-loopback / non-private-LAN
+caller **before auth**, because these routes spawn child processes (Hard Rules 15
+and 17). Reaching them through a public tunnel is `403` by design.
+
+## Axis B — relay routing backend (dispatch side)
+
+Only the relay proxy path `/api/v1/relay/chat/completions` selects a dispatch
+backend; the main `/api/v1/chat/completions` surface never consults
+`routingBackend.ts`.
+
+- **Selection** (`resolveRelayRoutingBackend`): a single global env toggle —
+  `OMNIROUTE_RELAY_BACKEND` / `RELAY_ROUTING_BACKEND` ∈ {`ts`, `bifrost`, `auto`}.
+  If unset, `auto` when Bifrost is configured+enabled, else `ts`.
+- **Behavior:**
+  - `bifrost` (forced): Bifrost failure → hard `502`, no fallback.
+  - `auto`: try Bifrost, on failure/cooldown silently fall through to native.
+  - `ts` / post-fallback: the native `open-sse` translator/executor pipeline.
+- **Cooldown:** per-`baseUrl` failure cooldown in `bifrostCooldown.ts`.
+
+Selection is **all-or-nothing at the relay level today** — there is no per-provider
+or per-request engine swap on `release/v3.8.43`. The per-request gate is being added
+by the sidecar-manifest work
+([#5869](https://github.com/diegosouzapw/OmniRoute/pull/5869) manifest +
+[#5870](https://github.com/diegosouzapw/OmniRoute/pull/5870) `shouldTryBifrostForRequest`),
+which lets `auto` route only manifest-eligible providers through Bifrost.
+
+## Dashboard integration
+
+The services dashboard polls `GET /api/services/<tool>/status` every 5s via
+`src/app/(dashboard)/dashboard/providers/services/hooks/useServiceStatus.ts`,
+returning `{ tool, state, pid, port, health, installedVersion, latestVersion,
+updateAvailable, autoStart, … }`. There is no shared availability-context provider —
+each component calls the hook per tool. On `!res.ok` the hook currently surfaces a
+bare `HTTP <status>`; mapping the `error.type` field to a human explanation is a
+tracked UX improvement, not a contract change.
+
+## Consequences
+
+- New engines register once in `ROUTER_BACKENDS`; consumers gain them via capability
+  queries without new per-id branches.
+- "Is this a service or a routing backend?" is answered by the `lifecycle` field, not
+  by which list an id happens to appear in.
+- The Bifrost supervision (#5817) and native hot-path migration (#5670) build on this
+  shared contract instead of special-casing each sidecar.

docs/architecture/cluster-decisions.md

@@ -1,7 +1,7 @@
 ---
 title: "Cluster Decisions"
-version: 3.8.32
-lastUpdated: 2026-06-20
+version: 3.8.40
+lastUpdated: 2026-06-28
 ---
 
 # Cluster Decisions — Optional Sidecar Profiles
@@ -31,15 +31,15 @@ The two profiles here are **scale-out options for deployments that hit the SQLit
 
 **When to flip on:**
 
-- >1M embeddings per deployment (sqlite-vec starts to slow at scale).
+- > 1M embeddings per deployment (sqlite-vec starts to slow at scale).
 - Multi-replica deployment that needs shared vector state across `omniroute-1/2/3`.
 - You already have an external Qdrant cluster (Qdrant Cloud, on-prem).
 
 **What it adds:**
 
-| Service         | Image                    | Ports       | Notes                                                                  |
-| --------------- | ------------------------ | ----------- | ---------------------------------------------------------------------- |
-| `qdrant`        | `qdrant/qdrant:v1.12.4`  | `6333` HTTP | HNSW index; persistent volume `omniroute_qdrant_data`                  |
+| Service  | Image                   | Ports       | Notes                                                 |
+| -------- | ----------------------- | ----------- | ----------------------------------------------------- |
+| `qdrant` | `qdrant/qdrant:v1.12.4` | `6333` HTTP | HNSW index; persistent volume `omniroute_qdrant_data` |
 
 **Activation:** flip `qdrantEnabled = true` in the Settings UI **or** set `QDRANT_HOST=qdrant` env. See [`src/lib/memory/qdrant.ts:60`](../../src/lib/memory/qdrant.ts) for the precedence rules (settings table → env var → default).
 
@@ -55,9 +55,9 @@ The two profiles here are **scale-out options for deployments that hit the SQLit
 
 **What it adds:**
 
-| Service   | Image                                       | Ports      | Notes                                                                      |
-| --------- | ------------------------------------------- | ---------- | -------------------------------------------------------------------------- |
-| `bifrost` | `ghcr.io/maximhq/bifrost:1.5.21`            | `8080`     | Go-based Tier-1 router; persistent logs volume `omniroute_bifrost_logs`     |
+| Service   | Image                            | Ports  | Notes                                                                   |
+| --------- | -------------------------------- | ------ | ----------------------------------------------------------------------- |
+| `bifrost` | `ghcr.io/maximhq/bifrost:1.5.21` | `8080` | Go-based Tier-1 router; persistent logs volume `omniroute_bifrost_logs` |
 
 **Activation:** set `BIFROST_BASE_URL=http://bifrost:8080` in `.env.example`. The existing sidecar proxy route at [`src/app/api/v1/relay/chat/completions/bifrost/route.ts`](../../src/app/api/v1/relay/chat/completions/bifrost/route.ts) (added in PR #4381) will pick this up automatically.
 
@@ -67,15 +67,15 @@ The two profiles here are **scale-out options for deployments that hit the SQLit
 
 The original issue thread floated a larger cluster rewrite. After auditing the actual workload shape, the following are **rejected** for the reasons given:
 
-| Component       | Verdict   | Reason                                                                                                       |
-| --------------- | --------- | ------------------------------------------------------------------------------------------------------------ |
-| **Dragonfly**   | **DROP**  | `redis:7-alpine` is already fine for the rate-limit workload at production scale; no ceiling to break.       |
-| **NATS**        | **DROP**  | Each `omniroute` replica is a single Node.js process; no multi-process pub/sub workload exists.              |
-| **PostgreSQL**  | **DROP**  | SQLite + sqlite-vec + FTS5 cover all 3 use cases; 97 migrations + Electron packaging block migration.        |
-| **Neo4j**       | **DROP**  | Routing is a 5-table join; recursive CTE on SQLite is sufficient.                                            |
-| **MinIO**       | **DROP**  | No multi-MB blob workload; images/audio are passthrough proxies.                                            |
-| **pgvector / pg_ai / pg_textsearch** | **DROP** | Same SQLite-ceiling reason as PostgreSQL; pgvector ecosystem fragmented.                                     |
-| **HAProxy / Envoy** | **DROP** | Caddy already does LB + TLS; both were explicitly rejected as Tier-1 routers (see `AGENTS.md`).             |
+| Component                            | Verdict  | Reason                                                                                                 |
+| ------------------------------------ | -------- | ------------------------------------------------------------------------------------------------------ |
+| **Dragonfly**                        | **DROP** | `redis:7-alpine` is already fine for the rate-limit workload at production scale; no ceiling to break. |
+| **NATS**                             | **DROP** | Each `omniroute` replica is a single Node.js process; no multi-process pub/sub workload exists.        |
+| **PostgreSQL**                       | **DROP** | SQLite + sqlite-vec + FTS5 cover all 3 use cases; 97 migrations + Electron packaging block migration.  |
+| **Neo4j**                            | **DROP** | Routing is a 5-table join; recursive CTE on SQLite is sufficient.                                      |
+| **MinIO**                            | **DROP** | No multi-MB blob workload; images/audio are passthrough proxies.                                       |
+| **pgvector / pg_ai / pg_textsearch** | **DROP** | Same SQLite-ceiling reason as PostgreSQL; pgvector ecosystem fragmented.                               |
+| **HAProxy / Envoy**                  | **DROP** | Caddy already does LB + TLS; both were explicitly rejected as Tier-1 routers (see `AGENTS.md`).        |
 
 If a future use case proves out one of these, this doc is the place to amend.
 
@@ -88,14 +88,14 @@ If a future use case proves out one of these, this doc is the place to amend.
 
 ## Files changed in this PR
 
-| File                                                        | Change                                                                |
-| ----------------------------------------------------------- | --------------------------------------------------------------------- |
-| `docker-compose.yml`                                        | +30 lines: `memory` profile (Qdrant), `bifrost` profile (Bifrost), persistent volumes, healthchecks. |
-| `.env.example`                                              | +24 lines: `QDRANT_*` (6 vars), `BIFROST_*` (4 vars).                 |
-| `docs/reference/ENVIRONMENT.md`                             | +6 rows in section 25 for the `QDRANT_*` env vars.                    |
-| `src/lib/memory/qdrant.ts`                                  | +33 lines: env-var fallback chain (settings → env → default) for `QDRANT_HOST`/`QDRANT_PORT`/`QDRANT_API_KEY`/`QDRANT_COLLECTION`/`QDRANT_VECTOR_SIZE`/`QDRANT_HNSW_EF_CONSTRUCT`/`QDRANT_EMBEDDING_MODEL`. |
-| `src/lib/memory/__tests__/qdrant-wiring.test.ts`            | +88 lines: 9 new test cases pinning the env-var fallback precedence.  |
-| `docs/architecture/cluster-decisions.md` (this file)        | NEW — decision record for the opt-in profiles.                        |
-| `AGENTS.md`                                                 | +1 line: pointer to this doc in the reference documentation table.    |
+| File                                                 | Change                                                                                                                                                                                                      |
+| ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `docker-compose.yml`                                 | +30 lines: `memory` profile (Qdrant), `bifrost` profile (Bifrost), persistent volumes, healthchecks.                                                                                                        |
+| `.env.example`                                       | +24 lines: `QDRANT_*` (6 vars), `BIFROST_*` (4 vars).                                                                                                                                                       |
+| `docs/reference/ENVIRONMENT.md`                      | +6 rows in section 25 for the `QDRANT_*` env vars.                                                                                                                                                          |
+| `src/lib/memory/qdrant.ts`                           | +33 lines: env-var fallback chain (settings → env → default) for `QDRANT_HOST`/`QDRANT_PORT`/`QDRANT_API_KEY`/`QDRANT_COLLECTION`/`QDRANT_VECTOR_SIZE`/`QDRANT_HNSW_EF_CONSTRUCT`/`QDRANT_EMBEDDING_MODEL`. |
+| `src/lib/memory/__tests__/qdrant-wiring.test.ts`     | +88 lines: 9 new test cases pinning the env-var fallback precedence.                                                                                                                                        |
+| `docs/architecture/cluster-decisions.md` (this file) | NEW — decision record for the opt-in profiles.                                                                                                                                                              |
+| `AGENTS.md`                                          | +1 line: pointer to this doc in the reference documentation table.                                                                                                                                          |
 
 **Net touched code:** 4 production files (`docker-compose.yml`, `qdrant.ts`, `.env.example`, `ENVIRONMENT.md`), 1 test file (`qdrant-wiring.test.ts`), 2 doc files (`cluster-decisions.md`, `AGENTS.md`).

docs/combo-context-requirements.md

@@ -0,0 +1,262 @@
+# Combo Context Requirements Feature
+
+## Overview
+
+The Context Requirements feature allows combo configurations to filter and sort targets based on their context window size. This is useful for use cases requiring large context windows like:
+
+- Long document processing (100k+ tokens)
+- Large codebase analysis
+- Extensive conversation histories
+- Multi-file code reviews
+
+## Configuration
+
+### Schema
+
+Add `contextRequirements` to your combo's runtime config:
+
+```json
+{
+  "contextRequirements": {
+    "minContextWindow": 128000,
+    "preferLargeContext": true,
+    "contextFilterMode": "strict"
+  }
+}
+```
+
+### Fields
+
+#### `minContextWindow` (optional)
+
+- **Type**: `number` (0 to 10,000,000)
+- **Default**: `undefined` (no filtering)
+- **Description**: Filters out models with context windows below this threshold
+
+**Examples**:
+
+- `32000` - Filter out models with <32K context
+- `128000` - Require 128K+ context (GPT-4 Turbo, Claude 3)
+- `200000` - Require 200K+ context (Claude 3 Opus)
+- `1000000` - Require 1M+ context (Gemini 1.5 Pro)
+
+#### `preferLargeContext` (optional)
+
+- **Type**: `boolean`
+- **Default**: `false`
+- **Description**: When `true`, sorts remaining targets by context size (descending). Large context models are tried first.
+
+#### `contextFilterMode` (optional)
+
+- **Type**: `"strict"` | `"lenient"`
+- **Default**: `"lenient"`
+- **Description**: How to handle models with unknown context window limits
+  - `"strict"`: Excludes models with unknown context limits
+  - `"lenient"`: Includes models with unknown context limits
+
+## Behavior
+
+### Filtering Pipeline
+
+Context requirements are applied after `filterTargetsByRequestCompatibility()`:
+
+1. **Request compatibility filtering** - Removes models incompatible with request (tools, vision, structured output)
+2. **Context requirements filtering** - Applies `minContextWindow` and `contextFilterMode`
+3. **Context-based sorting** - If `preferLargeContext` is true, sorts by context size descending
+
+### Filter Mode Logic
+
+When `minContextWindow` is set:
+
+**Lenient mode** (default):
+
+- ✅ Includes models with context >= minContextWindow
+- ✅ Includes models with unknown context limits
+- ❌ Excludes models with context < minContextWindow
+
+**Strict mode**:
+
+- ✅ Includes models with context >= minContextWindow
+- ❌ Excludes models with unknown context limits
+- ❌ Excludes models with context < minContextWindow
+
+### Sorting Logic
+
+When `preferLargeContext` is true:
+
+- Models are sorted by context window size (descending)
+- Unknown context models sort to the end
+- Original strategy order is used as a tiebreaker
+
+## Use Cases
+
+### Example 1: Long Document Processing
+
+```json
+{
+  "name": "Document Analysis",
+  "strategy": "fusion",
+  "config": {
+    "contextRequirements": {
+      "minContextWindow": 128000,
+      "preferLargeContext": true,
+      "contextFilterMode": "strict"
+    }
+  }
+}
+```
+
+This configuration:
+
+- Requires 128K+ context window
+- Prefers larger context models (Gemini 1.5 Pro > Claude 3 Opus > GPT-4 Turbo)
+- Excludes models with unknown context limits
+
+### Example 2: Large Codebase Analysis
+
+```json
+{
+  "name": "Code Review",
+  "strategy": "auto",
+  "config": {
+    "contextRequirements": {
+      "minContextWindow": 200000,
+      "preferLargeContext": true,
+      "contextFilterMode": "lenient"
+    }
+  }
+}
+```
+
+This configuration:
+
+- Requires 200K+ context window
+- Prefers larger context models
+- Includes models with unknown limits (lenient)
+
+### Example 3: Prefer Large Context Without Strict Requirements
+
+```json
+{
+  "name": "Flexible Chat",
+  "strategy": "weighted",
+  "config": {
+    "contextRequirements": {
+      "preferLargeContext": true
+    }
+  }
+}
+```
+
+This configuration:
+
+- No minimum requirement (all models eligible)
+- Sorts by context size (largest first)
+- Useful when large context is preferred but not required
+
+## API Response
+
+When context requirements filter targets, the combo logger outputs:
+
+```
+[COMBO] Context requirements: filtered 10 → 3 targets (minContextWindow: 128000, mode: strict)
+[COMBO] Context requirements: kept models gemini-1.5-pro, claude-3-opus-20240229, gpt-4-turbo
+[COMBO] Context requirements: sorted by context size (descending): gemini-1.5-pro(1000000), claude-3-opus-20240229(200000), gpt-4-turbo(128000)
+```
+
+## Implementation Details
+
+### Backend Module
+
+`open-sse/services/combo/contextRequirements.ts`:
+
+- `applyContextRequirements()` - Main filtering function
+- `getTargetContextWindow()` - Context lookup helper
+- Uses `getModelContextLimit()` from `modelCapabilities.ts`
+
+### Integration Point
+
+`open-sse/services/combo.ts` line 1187:
+
+```typescript
+orderedTargets = filterTargetsByRequestCompatibility(orderedTargets, body, log);
+orderedTargets = applyContextRequirements(orderedTargets, config.contextRequirements, log);
+```
+
+### Schema Definition
+
+`src/shared/validation/schemas/combo.ts`:
+
+```typescript
+contextRequirements: z
+  .object({
+    minContextWindow: z.coerce.number().int().min(0).max(10_000_000).optional(),
+    preferLargeContext: z.boolean().optional(),
+    contextFilterMode: z.enum(["strict", "lenient"]).optional(),
+  })
+  .strict()
+  .optional(),
+```
+
+## Testing
+
+### Run Tests
+
+```bash
+# Unit tests (schema + logic)
+npm test tests/unit/combo-context-requirements.test.ts
+
+# Integration tests (end-to-end)
+npm test tests/unit/combo/context-requirements-integration.test.ts
+```
+
+### Test Coverage
+
+- Schema validation: 6 tests
+- Filtering logic: 6 tests
+- Integration: 5 tests
+- **Total**: 17/17 passing ✅
+
+## Troubleshooting
+
+### All targets filtered out
+
+**Problem**: All targets removed, combo returns "no compatible models"
+
+**Solutions**:
+
+1. Lower `minContextWindow` threshold
+2. Switch to `"lenient"` mode to include unknown context models
+3. Remove `minContextWindow` and use only `preferLargeContext`
+
+### Unknown context models excluded
+
+**Problem**: Custom/new models excluded even though they have large context
+
+**Solutions**:
+
+1. Switch to `"lenient"` mode (default)
+2. Add model context limit to `modelCapabilities.ts`
+3. Remove context filtering and rely on strategy order
+
+### Sorting not applied
+
+**Problem**: `preferLargeContext` doesn't change order
+
+**Check**:
+
+1. Verify `preferLargeContext: true` in config
+2. Check if all targets have unknown context (all sort equal)
+3. Verify multiple targets remain after filtering
+
+## Related
+
+- [Auto-Combo Routing Strategies](./routing/AUTO-COMBO.md)
+- [Resilience Guide](./architecture/RESILIENCE_GUIDE.md)
+
+## Version History
+
+- **v3.8.47**: Initial implementation
+  - Added `contextRequirements` config
+  - Created backend filtering module
+  - Full test coverage (no dedicated dashboard UI yet — configure via combo JSON)

docs/comparison/OMNIROUTE_VS_ALTERNATIVES.md

@@ -1,7 +1,7 @@
 ---
 title: "OmniRoute vs Alternatives"
-version: 3.8.2
-lastUpdated: 2026-05-15
+version: 3.8.43
+lastUpdated: 2026-07-01
 ---
 
 # OmniRoute vs Alternatives
@@ -11,34 +11,37 @@ Objective feature comparison vs popular open-source AI routers.
 > **Methodology**: Public repos audited 2026-Q2. Versions as listed.
 > Submit corrections via PR — we want this to be accurate.
 
-| Feature                                            |       OmniRoute 3.8        |  LiteLLM 1.x   | OpenRouter (SaaS) |   Portkey   |
-| -------------------------------------------------- | :------------------------: | :------------: | :---------------: | :---------: |
-| **Providers**                                      |          **207+**          |      ~100      |        ~50        |     ~30     |
-| **Self-hostable**                                  |             ✅             |       ✅       |        ❌         |   ⚠ paid    |
-| **OAuth providers (Claude, Codex, Copilot, etc.)** |          **15+**           |    partial     |        ❌         |     ❌      |
-| **Auto-fallback combos**                           |     **17 strategies**      | priority-based |    tier-based     |  weighted   |
-| **Tier 1/2/3 fallback (subscription→cheap→free)**  |          ✅ + UI           |     manual     |        n/a        |   manual    |
-| **Token compression**                              | RTK (47 filters) + Caveman |      none      |       none        |    none     |
-| **Built-in MCP server**                            |   ✅ 87 tools, 30 scopes   |       ❌       |        ❌         |     ❌      |
-| **A2A protocol**                                   |        ✅ 5 skills         |       ❌       |        ❌         |     ❌      |
-| **Memory (FTS5 + vector)**                         |             ✅             |       ❌       |        ❌         |     ❌      |
-| **Guardrails (PII, injection, vision)**            |             ✅             |    partial     |        ❌         |   ✅ paid   |
-| **Cloud agent integrations**                       |    Codex, Devin, Jules     |       ❌       |        ❌         |     ❌      |
-| **Circuit breaker per provider**                   | ✅ 3-state, lazy recovery  |     basic      |        ❌         |     ✅      |
-| **TLS fingerprint stealth (JA3/JA4)**              |         ✅ wreq-js         |       ❌       |        ❌         |     ❌      |
-| **Eval framework**                                 |        ✅ built-in         |       ❌       |        ❌         |   ⚠ paid    |
-| **MITM proxy (intercepts Cursor/Antigravity)**     |     ✅ cross-platform      |       ❌       |        ❌         |     ❌      |
-| **CLI with system tray (no Electron)**             |             ✅             |       ❌       |        n/a        |     n/a     |
-| **CLI machine-ID auto-auth**                       |             ✅             |       ❌       |        n/a        |     n/a     |
-| **Dashboard**                                      |         Next.js 16         |     basic      |    proprietary    | proprietary |
-| **i18n**                                           |      **42+ locales**       |       ❌       |        ❌         |      ⚠      |
-| **Public agent skills (SKILL.md)**                 |           ✅ 10            |       ❌       |        ❌         |     ❌      |
-| **Tunnel support (Cloudflared, Tailscale, Ngrok)** |             ✅             |       ❌       |        n/a        |     n/a     |
-| **License**                                        |            MIT             |      MIT       |    proprietary    | proprietary |
+| Feature                                            |                  OmniRoute 3.8                   |  LiteLLM 1.x   | OpenRouter (SaaS) |   Portkey   |
+| -------------------------------------------------- | :----------------------------------------------: | :------------: | :---------------: | :---------: |
+| **Providers**                                      |                     **237+**                     |      ~100      |        ~50        |     ~30     |
+| **Free-tier providers**                            |                     **90+**                      |      n/a       |    passthrough    |     n/a     |
+| **Self-hostable**                                  |                        ✅                        |       ✅       |        ❌         |   ⚠ paid    |
+| **OAuth providers (Claude, Codex, Copilot, etc.)** |                     **15+**                      |    partial     |        ❌         |     ❌      |
+| **Auto-fallback combos**                           |                **17 strategies**                 | priority-based |    tier-based     |  weighted   |
+| **Fusion (parallel panel + judge synthesis)**      |                        ✅                        |       ❌       |        ❌         |     ❌      |
+| **Tier 1/2/3 fallback (subscription→cheap→free)**  |                     ✅ + UI                      |     manual     |        n/a        |   manual    |
+| **Token compression**                              | 10-engine pipeline (RTK + Caveman + LLMLingua-2) |      none      |       none        |    none     |
+| **Multimodal generation (speech/music/video)**     |                        ✅                        |       ❌       |    passthrough    |     ❌      |
+| **Built-in MCP server**                            |              ✅ 95 tools, 30 scopes              |       ❌       |        ❌         |     ❌      |
+| **A2A protocol**                                   |                   ✅ 6 skills                    |       ❌       |        ❌         |     ❌      |
+| **Memory (FTS5 + vector)**                         |                        ✅                        |       ❌       |        ❌         |     ❌      |
+| **Guardrails (PII, injection, vision)**            |                        ✅                        |    partial     |        ❌         |   ✅ paid   |
+| **Cloud agent integrations**                       |           Codex, Cursor, Devin, Jules            |       ❌       |        ❌         |     ❌      |
+| **Circuit breaker per provider**                   |            ✅ 3-state, lazy recovery             |     basic      |        ❌         |     ✅      |
+| **TLS fingerprint stealth (JA3/JA4)**              |                    ✅ wreq-js                    |       ❌       |        ❌         |     ❌      |
+| **Eval framework**                                 |                   ✅ built-in                    |       ❌       |        ❌         |   ⚠ paid    |
+| **MITM proxy (intercepts Cursor/Antigravity)**     |                ✅ cross-platform                 |       ❌       |        ❌         |     ❌      |
+| **CLI with system tray (no Electron)**             |                        ✅                        |       ❌       |        n/a        |     n/a     |
+| **CLI machine-ID auto-auth**                       |                        ✅                        |       ❌       |        n/a        |     n/a     |
+| **Dashboard**                                      |                    Next.js 16                    |     basic      |    proprietary    | proprietary |
+| **i18n**                                           |                 **42+ locales**                  |       ❌       |        ❌         |      ⚠      |
+| **Public agent skills (SKILL.md)**                 |                      ✅ 43                       |       ❌       |        ❌         |     ❌      |
+| **Tunnel support (Cloudflared, Tailscale, Ngrok)** |                        ✅                        |       ❌       |        n/a        |     n/a     |
+| **License**                                        |                       MIT                        |      MIT       |    proprietary    | proprietary |
 
 ## When to choose OmniRoute
 
-- You self-host and want **maximum provider coverage** (207+)
+- You self-host and want **maximum provider coverage** (237+, 90+ with a free tier)
 - You need a **built-in MCP server** (LLM tools, memory, skills exposed as tools)
 - You need **A2A protocol** for agent-to-agent workflows
 - You want **fingerprint stealth** (JA3/JA4) to avoid detection by upstream CAPTCHAs
@@ -64,4 +67,4 @@ Objective feature comparison vs popular open-source AI routers.
 
 ---
 
-_Last updated: 2026-05-15. Submit corrections via PR to keep this table accurate._
+_Last updated: 2026-06-28. Submit corrections via PR to keep this table accurate._

docs/comparison/meta.json

@@ -0,0 +1,5 @@
+{
+  "title": "Comparison",
+  "description": "How OmniRoute compares to alternatives",
+  "pages": ["OMNIROUTE_VS_ALTERNATIVES"]
+}

docs/compression/2026-06-20-unified-compression-config-panel-design.md

@@ -1,240 +0,0 @@
----
-title: "Unified Compression Config Panel — Design"
-version: 3.8.32
-lastUpdated: 2026-06-20
----
-
-# Unified Compression Config Panel — Design
-
-**Status:** approved direction (2026-06-20), pending spec review
-**Base branch:** `release/v3.8.31`
-**Goal:** Make `/dashboard/context/settings` the single management panel for the master
-on/off and each compression engine's on/off + level, deriving the default pipeline from
-those toggles. Keep the Combos page solely for *chaining* (ordered named pipelines) +
-selecting the globally-active profile, and the per-engine pages solely for *detailed*
-config. Plan for (but phase) multiple named profiles with an active selector and a
-per-request override header.
-
----
-
-## 1. Background — current state (the problem)
-
-Compression on/off + level is split across **two stores and several UIs**, with real
-duplication:
-
-- **`/api/settings/compression`** (DB `key_value` ns=`compression`, via `src/lib/db/compression.ts`)
-  holds: `enabled` (master), `defaultMode`, `autoTriggerTokens`, `cavemanConfig`,
-  `cavemanOutputMode`, `rtkConfig`, `aggressive`, `ultra`, language config, etc.
-- **`/api/context/combos/default`** (the *default combo pipeline*) holds the per-engine
-  `enabled` + config for the **structural** engines (lite, headroom, session-dedup, ccr,
-  llmlingua, aggressive, ultra) as pipeline steps. The per-engine detail pages
-  (`EngineConfigPage.tsx`) read/write here via `setEngineInDefaultCombo`.
-- **`compression_combos`** table holds *named* pipelines assigned to routing combos.
-
-Concrete duplications (from the UI audit):
-- Caveman on/off in **3** places (TokenSaverCard, CompressionSettingsTab, CavemanContextPageClient).
-- Caveman intensity in **3**; RTK intensity in **2**; Caveman output mode in **2**.
-- `lite/session-dedup/headroom/ccr/llmlingua` on/off **absent** from the central settings —
-  only on their per-engine page (which writes the *default combo*, not the central config).
-
-So "is engine X on?" is answered inconsistently (central config for caveman/rtk; default
-combo for the structural engines), and the **Combos page edits the same default pipeline**
-that a central panel would — the conceptual overlap the redesign must remove.
-
-Out of scope as a *config* surface: `dashboard/compression/studio` is the Compression
-Studio (waterfall/cockpit analytics), not toggles — untouched.
-
-Engines (the 10 stackable units): `lite, caveman, aggressive, ultra, rtk, headroom,
-session-dedup, ccr, llmlingua` (registered `CompressionEngine`s) + `mcpAccessibility`
-(separate path: compresses MCP tool-result outputs, not the chat pipeline). Each engine's
-`stackPriority` defines automatic ordering (session-dedup 3, ccr 4, lite 5, rtk 10,
-headroom 15, caveman 20, aggressive 30, llmlingua 35, ultra 40).
-
----
-
-## 2. Design principles — the boundary
-
-| Surface | Concept | Owns | Never does |
-|---|---|---|---|
-| **Panel** (`context/settings`) | "My **Default**: what is on + level" | master on/off; per-engine on/off + level | ordering/chaining; per-route assignment |
-| **Combos** (`context/combos`, menu #2) | "Named **profiles**: chaining + which is active + per-route assignment" | create/edit ordered named pipelines; pick the globally-active profile; assign to routing combos | engine on/off (inherits the active profile's membership) |
-| **Per-engine pages** (menu, after combos) | "Deep config of one engine" | filters, rules, language packs, thresholds | on/off; level (those live in the panel) |
-
-**No duplication rule:** the **Panel owns the Default profile** (membership + level, order
-auto-derived by `stackPriority`). A **Combo is a *named alternative* profile** (membership
-+ level + *explicit order*). Different scopes (the one default vs named alternatives) — not
-the same object edited twice. The editable "default combo" store is **removed**; the
-default pipeline becomes **derived** from the panel.
-
----
-
-## 3. Architecture
-
-### 3.1 Resolution model (per request, most-specific wins)
-
-```
-x-omniroute-compression header          (per-request override)
-  → routing-combo override (comboOverrides[comboId])   (per-route)
-    → active profile (activeComboId: "default" | <comboId>)   (global)
-      → Default = derived from panel engines map
-        → off  (master disabled, or zero engines on)
-```
-
-A single `resolveCompressionPlan(config, { comboId, header })` produces the effective
-`{ mode, stackedPipeline }` fed to the existing `applyCompressionAsync`. It supersedes
-today's `getEffectiveMode` (which only does combo-override → autoTrigger → defaultMode).
-
-### 3.2 Data model (Model A — single source + derived pipeline)
-
-**CompressionConfig gains an engines map** (the single source for the Default's on/off +
-level), replacing the editable default-combo store:
-
-```ts
-interface EngineToggle {
-  enabled: boolean;
-  level?: string;     // caveman/cavemanOutput: lite|full|ultra ; rtk: minimal|standard|aggressive ; others: undefined
-}
-interface CompressionConfig {
-  enabled: boolean;                         // master
-  engines: Record<CompressionEngineId, EngineToggle>;   // NEW — the Default profile
-  activeComboId: string | null;             // NEW — null/"default" = derived default; else a compression_combos id
-  autoTriggerTokens: number;
-  autoTriggerMode?: CompressionMode;        // kept (auto-trigger still selects a profile/mode on large prompts)
-  preserveSystemPrompt: boolean;
-  comboOverrides: Record<string, CompressionMode>;   // existing per-routing-combo override
-  // detailed per-engine config keeps living in its existing sub-objects
-  // (cavemanConfig, rtkConfig, aggressive, ultra, …) — edited by the per-engine pages.
-}
-```
-
-**Deriving the Default pipeline** from `engines` (pure function `deriveDefaultPlan`):
-- master `enabled === false` → `off`.
-- 0 engines enabled → `off`.
-- exactly 1 enabled and it is a single-mode engine (`lite|caveman|aggressive|ultra|rtk`) →
-  that mode (single path — reuses today's `applyCompression(mode)`).
-- otherwise → `stacked` with the enabled engines in `stackPriority` order, each step's
-  `intensity` from its `level` (the global `stackedPipeline` already accepts all 9 engines
-  after the B-PIPELINE-DIVERGENCE fix).
-
-The **stored `defaultMode` field** and the editable default combo
-(`/api/context/combos/default`, `setEngineInDefaultCombo`) are **removed**; the default is
-derived from `engines`. (The `CompressionMode` *type* persists — `comboOverrides`,
-`autoTriggerMode`, and the resolver's output still use it; only the stored `defaultMode`
-field is dropped.) A DB migration backfills `engines` from the current `defaultMode` +
-default-combo steps + caveman/rtk config so existing installs keep their behavior.
-
-**Named combos** (`compression_combos`, existing table): N ordered pipelines. `activeComboId`
-selects which profile is globally active (`Default` or a named combo). Per-routing-combo
-assignment stays in `comboOverrides`.
-
-`mcpAccessibility` keeps its own store (`/api/settings/compression/mcp-accessibility`,
-migration 056) — surfaced in the panel as a row that writes there, with a scope note.
-
-### 3.3 The per-request header
-
-`x-omniroute-compression: <value>` (mirrors the `x-omniroute-no-memory`/`no-cache` pattern,
-PR #4290; parsed in the request pipeline alongside the other omniroute headers). Values:
-- `off` → no compression for this request.
-- `default` → the derived Default profile.
-- `<combo-name|id>` → that named combo.
-- `engine:<id>` → a single engine (if that engine is enabled in the Default), e.g. `engine:rtk`.
-
-Invalid/unknown value → ignored (falls through to the normal resolution); never errors the
-request. Header parsing + validation has a unit test asserting each form and the
-fall-through.
-
----
-
-## 4. Screens
-
-### 4.1 Panel — `context/settings` (engine grid)
-
-A single client component (replacing the scattered `CompressionSettingsTab` +
-`CompressionTokenSaverCard` toggles):
-- **Master** on/off at top.
-- **Engine grid** (one row per engine, ordered by `stackPriority` so the row order mirrors
-  run order): `[engine name + short desc]  [on/off toggle]  [level selector if applicable]
-  [→ detail page]`. Level selector appears only for engines with levels
-  (caveman lite|full|ultra, rtk minimal|standard|aggressive; caveman output mode as its own row).
-- **General** (auto-trigger tokens, preserve-system-prompt) below the grid.
-- Reads/writes the `engines` map + master via `GET/PUT /api/settings/compression` (single
-  endpoint). The displayed default pipeline (derived) is shown read-only ("runs: rtk →
-  caveman → …") so the user sees the effect without editing order here.
-
-### 4.2 Combos — `context/combos` (menu #2)
-
-- List of named combos; create/edit an **ordered** pipeline (drag/reorder + per-step level)
-  — the only place for explicit chaining.
-- **Active profile selector**: `Default (panel)` | `<combo>` → writes `activeComboId`.
-- Assign a combo to a routing combo (existing `comboOverrides`).
-- Reuses the existing `CompressionCombosPageClient` / `comboFlowModel`; the `CompressionHub`
-  "master mode selector" is removed (mode is now derived; the Hub becomes a read-only
-  overview or is folded into the panel).
-
-### 4.3 Per-engine pages (menu, after combos)
-
-`EngineConfigPage` + the caveman/rtk custom pages: **lose** the on/off + level controls
-(moved to the panel) and keep only **detailed** config (filters, rules, language packs,
-thresholds, preview). They **stop writing** `/api/context/combos/default`; detailed config
-writes to its own sub-object in `/api/settings/compression` (or the existing
-caveman/rtk facade routes, which already proxy to it).
-
-### 4.4 Navigation
-
-`COMPRESSION_CONTEXT_GROUP` (`src/shared/constants/sidebarVisibility.ts`) reordered:
-**Settings (panel) → Combos → per-engine pages → Studio (analytics)**.
-
----
-
-## 5. Consolidation / migration
-
-- `CompressionTokenSaverCard` quick toggles → **absorbed into the panel; the card is removed**.
-- Duplicate caveman/rtk on/off + intensity in `CompressionSettingsTab` → removed.
-- `EngineConfigPage` → on/off+level removed; stops writing the default combo.
-- DB migration: backfill `engines` map + `activeComboId="default"` from current state
-  (defaultMode + default-combo steps + caveman/rtk/ultra/aggressive enabled), so live
-  installs preserve behavior. The editable default-combo route (`PUT /api/context/combos/default`)
-  becomes a **read-only shim for one release** (returns the derived default; rejects writes
-  with a deprecation note), then is removed.
-
----
-
-## 6. Phasing
-
-Each phase is its own implementation plan + PR, independently shippable and TDD'd
-(Hard Rule #18). `writing-plans` will author **Phase 1 first**; Phases 2–3 get their own
-plans later.
-
-- **Phase 1 (core consolidation):** the `engines` map + `deriveDefaultPlan` + migration;
-  the engine-grid panel; remove scattered/duplicate toggles; per-engine pages lose on/off;
-  menu reorder. Delivers the single-panel goal. *No behavior change for existing installs
-  (migration backfills).*
-- **Phase 2 (profiles):** multiple named combos + the `activeComboId` active-profile selector.
-- **Phase 3 (header):** the `x-omniroute-compression` per-request override.
-
-Phases 2–3 reuse the Phase-1 resolution model (`resolveCompressionPlan`), which is built
-header/active-aware from the start so later phases only wire UI + header parsing.
-
----
-
-## 7. Testing
-
-- **Unit:** `deriveDefaultPlan` (every engines-map shape → expected mode/pipeline);
-  migration backfill (old config → equivalent engines map); `resolveCompressionPlan`
-  precedence (header > comboOverride > active > default > off); header parsing (each form +
-  fall-through); panel reducer (toggle/level edits → config patch).
-- **Component (vitest):** the panel renders all engines, toggles persist, derived pipeline
-  preview updates.
-- **Integration:** a config with engines `{rtk,caveman}` on → `applyCompressionAsync` runs the
-  derived stacked pipeline; single engine on → single-mode path; equivalence with the old
-  defaultMode behavior for the same logical config.
-- Both runners green (`test:unit` + `test:vitest`); typecheck:core clean; lint 0 errors.
-
----
-
-## 8. Non-goals (YAGNI)
-
-- No new compression engines in this work (the model just makes adding them trivial later).
-- No change to the engines' internal algorithms (the recent fixes are separate).
-- The Compression Studio (analytics) is not restructured.
-- Phases 2–3 UI polish (combo templates, sharing) is out of scope.

docs/compression/2026-06-20-unified-compression-config-panel-plan.md

@@ -1,495 +0,0 @@
----
-title: "Unified Compression Config Panel — Phase 1 Implementation Plan"
-version: 3.8.32
-lastUpdated: 2026-06-20
----
-
-# Unified Compression Config Panel — Phase 1 Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Make `/dashboard/context/settings` the single source for the master + per-engine on/off + level, with the default compression pipeline DERIVED from those toggles, removing the scattered/duplicate toggles — with zero behavior change for existing installs (a migration backfills).
-
-**Architecture:** Add an `engines` map (+`activeComboId`) to `CompressionConfig` as the single source. A pure `deriveDefaultPlan(engines)` turns it into `{mode, stackedPipeline}`; a pure `resolveCompressionPlan(config, ctx)` applies precedence (header→combo-override→active-profile→derived-default→off) and feeds the existing `applyCompressionAsync`. A DB migration backfills the map. The engine-grid panel reads/writes the map via the single `/api/settings/compression` endpoint; per-engine pages lose on/off+level; the editable default-combo route becomes a read-only shim.
-
-**Tech Stack:** TypeScript, Next.js 16 App Router, Zod, SQLite (better-sqlite3), Node test runner + Vitest (component), React.
-
-**Base:** worktree `feat/compression-config-panel-v3831` off `release/v3.8.31`. Spec: `docs/compression/2026-06-20-unified-compression-config-panel-design.md`.
-
-**Conventions:** unit tests run `node --import tsx/esm --test tests/unit/<f>.test.ts`; component tests run `npm run test:vitest`. Each task ends by running the FULL compression suite (`node --import tsx/esm --test tests/unit/compression/*.test.ts`) + `npm run typecheck:core` before commit. Never `--no-verify`.
-
----
-
-## File Structure
-
-**Create:**
-- `open-sse/services/compression/engineCatalog.ts` — pure metadata: per-engine `{ id, label, stackPriority, levels?, isSingleMode }`. One source of truth for "which engines exist, which have levels, which can be a standalone mode".
-- `open-sse/services/compression/deriveDefaultPlan.ts` — pure: `engines` map → `{ mode, stackedPipeline }`.
-- `open-sse/services/compression/resolveCompressionPlan.ts` — pure: precedence resolver.
-- `src/lib/db/migrations/102_compression_engines_map.sql` — backfill `engines` + `activeComboId`.
-- `src/app/(dashboard)/dashboard/context/settings/CompressionPanel.tsx` — the engine-grid panel.
-- `tests/unit/compression/engine-catalog.test.ts`, `derive-default-plan.test.ts`, `resolve-compression-plan.test.ts`, `compression-engines-map-migration.test.ts`.
-- `tests/unit/ui/compressionPanel.test.tsx` (vitest).
-
-**Modify:**
-- `open-sse/services/compression/types.ts` — add `EngineToggle`, `CompressionConfig.engines`, `activeComboId`; keep `CompressionMode` type; drop stored `defaultMode` usage (derive).
-- `src/lib/db/compression.ts` — normalize/persist `engines` + `activeComboId`.
-- `open-sse/services/compression/strategySelector.ts` — `selectCompressionStrategy`/`getEffectiveMode` delegate to `resolveCompressionPlan`.
-- `open-sse/handlers/chatCore.ts` — call `resolveCompressionPlan`.
-- `src/app/api/settings/compression/route.ts` — accept/return `engines` + `activeComboId`.
-- `src/app/api/context/combos/default/route.ts` — read-only shim (reject writes).
-- `src/app/(dashboard)/dashboard/context/settings/page.tsx` — render `CompressionPanel` (not the old tab).
-- `src/shared/components/compression/EngineConfigPage.tsx` + caveman/rtk client pages — remove on/off+level; stop writing default combo.
-- `src/shared/constants/sidebarVisibility.ts` — reorder `COMPRESSION_CONTEXT_GROUP`.
-
-**Engine reference (`stackPriority`, levels, single-mode):**
-`session-dedup`(3,—,no) `ccr`(4,—,no) `lite`(5,—,yes) `rtk`(10,minimal|standard|aggressive,yes) `headroom`(15,—,no) `caveman`(20,lite|full|ultra,yes) `aggressive`(30,—,yes) `llmlingua`(35,—,no) `ultra`(40,—,yes). Plus `cavemanOutput`(intensity lite|full|ultra, separate from input caveman) and `mcpAccessibility`(no level, separate store).
-
----
-
-## Task 1: Engine catalog (single source of engine metadata)
-
-**Files:**
-- Create: `open-sse/services/compression/engineCatalog.ts`
-- Test: `tests/unit/compression/engine-catalog.test.ts`
-
-- [ ] **Step 1: Write the failing test**
-
-```ts
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { ENGINE_CATALOG, engineMeta, ENGINE_IDS } from "@omniroute/open-sse/services/compression/engineCatalog.ts";
-
-test("catalog lists every engine with stackPriority", () => {
-  for (const id of ["session-dedup","ccr","lite","rtk","headroom","caveman","aggressive","llmlingua","ultra"]) {
-    assert.ok(engineMeta(id), `${id} present`);
-    assert.equal(typeof engineMeta(id).stackPriority, "number");
-  }
-});
-test("levels + single-mode flags are correct", () => {
-  assert.deepEqual(engineMeta("rtk").levels, ["minimal","standard","aggressive"]);
-  assert.deepEqual(engineMeta("caveman").levels, ["lite","full","ultra"]);
-  assert.equal(engineMeta("headroom").levels, undefined);
-  assert.equal(engineMeta("caveman").isSingleMode, true);
-  assert.equal(engineMeta("headroom").isSingleMode, false);
-});
-test("ENGINE_IDS is ordered by stackPriority", () => {
-  const ps = ENGINE_IDS.map((id) => engineMeta(id).stackPriority);
-  assert.deepEqual(ps, [...ps].sort((a,b)=>a-b));
-});
-```
-
-- [ ] **Step 2: Run → FAIL** (`node --import tsx/esm --test tests/unit/compression/engine-catalog.test.ts`) — module not found.
-
-- [ ] **Step 3: Implement** `engineCatalog.ts`:
-
-```ts
-export interface EngineMeta {
-  id: string;
-  label: string;
-  stackPriority: number;
-  levels?: string[];        // intensity options; undefined = no level selector
-  isSingleMode: boolean;    // can be the effective mode when it is the only engine on
-  description: string;
-}
-export const ENGINE_CATALOG: Record<string, EngineMeta> = {
-  "session-dedup": { id:"session-dedup", label:"Session Dedup", stackPriority:3, isSingleMode:false, description:"Cross-turn block deduplication." },
-  ccr:             { id:"ccr", label:"CCR (Retrieval)", stackPriority:4, isSingleMode:false, description:"Content-addressed retrieval markers." },
-  lite:            { id:"lite", label:"Lite", stackPriority:5, isSingleMode:true, description:"Whitespace/format cleanup." },
-  rtk:             { id:"rtk", label:"RTK", stackPriority:10, levels:["minimal","standard","aggressive"], isSingleMode:true, description:"Command-output filtering." },
-  headroom:        { id:"headroom", label:"Headroom", stackPriority:15, isSingleMode:false, description:"Tabular JSON compaction." },
-  caveman:         { id:"caveman", label:"Caveman", stackPriority:20, levels:["lite","full","ultra"], isSingleMode:true, description:"Rule-based prose compression." },
-  aggressive:      { id:"aggressive", label:"Aggressive", stackPriority:30, isSingleMode:true, description:"Summarize + age old turns." },
-  llmlingua:       { id:"llmlingua", label:"LLMLingua (SLM)", stackPriority:35, isSingleMode:false, description:"Semantic pruning (ONNX)." },
-  ultra:           { id:"ultra", label:"Ultra", stackPriority:40, isSingleMode:true, description:"Heuristic token pruning (+ optional SLM)." },
-};
-export const ENGINE_IDS: string[] = Object.values(ENGINE_CATALOG).sort((a,b)=>a.stackPriority-b.stackPriority).map((e)=>e.id);
-export function engineMeta(id: string): EngineMeta { return ENGINE_CATALOG[id]; }
-```
-
-- [ ] **Step 4: Run → PASS.**
-- [ ] **Step 5: Commit** `git add open-sse/services/compression/engineCatalog.ts tests/unit/compression/engine-catalog.test.ts && git commit -m "feat(compression): engine catalog metadata (levels, single-mode, order)"`
-
----
-
-## Task 2: `EngineToggle` + `engines` map + `activeComboId` on the config type
-
-**Files:**
-- Modify: `open-sse/services/compression/types.ts` (the `CompressionConfig` interface + `DEFAULT_COMPRESSION_CONFIG`)
-- Test: `tests/unit/compression/engine-catalog.test.ts` (extend) — assert the default config shape.
-
-- [ ] **Step 1: Add the test** (append):
-
-```ts
-import { DEFAULT_COMPRESSION_CONFIG } from "@omniroute/open-sse/services/compression/types.ts";
-test("default config has an engines map + activeComboId", () => {
-  assert.equal(typeof DEFAULT_COMPRESSION_CONFIG.engines, "object");
-  assert.equal(DEFAULT_COMPRESSION_CONFIG.activeComboId, null);
-  // default-off: every engine disabled by default (opt-in preserved)
-  for (const id of ENGINE_IDS) assert.equal(DEFAULT_COMPRESSION_CONFIG.engines[id]?.enabled, false);
-});
-```
-
-- [ ] **Step 2: Run → FAIL.**
-- [ ] **Step 3: Implement** in `types.ts`: add `export interface EngineToggle { enabled: boolean; level?: string }`; add to `CompressionConfig`: `engines: Record<string, EngineToggle>;` and `activeComboId: string | null;`. In `DEFAULT_COMPRESSION_CONFIG` add `engines: Object.fromEntries(ENGINE_IDS.map((id)=>[id,{enabled:false}]))` (import `ENGINE_IDS`) and `activeComboId: null`. Keep `defaultMode` field for now (removed in Task 9 once derive is wired) to avoid breaking compilation.
-
-- [ ] **Step 4: Run → PASS + `npm run typecheck:core`.**
-- [ ] **Step 5: Commit** `... -m "feat(compression): add engines map + activeComboId to CompressionConfig"`
-
----
-
-## Task 3: `deriveDefaultPlan` (the heart — engines map → mode/pipeline)
-
-**Files:**
-- Create: `open-sse/services/compression/deriveDefaultPlan.ts`
-- Test: `tests/unit/compression/derive-default-plan.test.ts`
-
-- [ ] **Step 1: Write the failing test**
-
-```ts
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { deriveDefaultPlan } from "@omniroute/open-sse/services/compression/deriveDefaultPlan.ts";
-
-const on = (level) => ({ enabled: true, ...(level?{level}:{}) });
-test("master off / empty / none-on => off", () => {
-  assert.deepEqual(deriveDefaultPlan({}, false), { mode:"off", stackedPipeline:[] });
-  assert.deepEqual(deriveDefaultPlan({}, true), { mode:"off", stackedPipeline:[] });
-  assert.deepEqual(deriveDefaultPlan({ rtk:{enabled:false} }, true), { mode:"off", stackedPipeline:[] });
-});
-test("exactly one single-mode engine => that mode", () => {
-  assert.deepEqual(deriveDefaultPlan({ caveman: on("full") }, true), { mode:"standard", stackedPipeline:[] });
-  assert.deepEqual(deriveDefaultPlan({ rtk: on("minimal") }, true), { mode:"rtk", stackedPipeline:[] });
-  assert.deepEqual(deriveDefaultPlan({ lite: on() }, true), { mode:"lite", stackedPipeline:[] });
-});
-test("one non-single-mode engine => stacked with that engine", () => {
-  const p = deriveDefaultPlan({ headroom: on() }, true);
-  assert.equal(p.mode, "stacked");
-  assert.deepEqual(p.stackedPipeline, [{ engine:"headroom" }]);
-});
-test("multiple engines => stacked in stackPriority order, levels as intensity", () => {
-  const p = deriveDefaultPlan({ caveman: on("full"), rtk: on("standard"), headroom: on() }, true);
-  assert.equal(p.mode, "stacked");
-  assert.deepEqual(p.stackedPipeline, [
-    { engine:"rtk", intensity:"standard" },   // pri 10
-    { engine:"headroom" },                    // pri 15
-    { engine:"caveman", intensity:"full" },   // pri 20
-  ]);
-});
-```
-
-- [ ] **Step 2: Run → FAIL.**
-- [ ] **Step 3: Implement** `deriveDefaultPlan.ts`:
-
-```ts
-import { ENGINE_CATALOG, engineMeta } from "./engineCatalog.ts";
-import type { EngineToggle } from "./types.ts";
-
-const SINGLE_MODE_OF: Record<string,string> = { lite:"lite", caveman:"standard", aggressive:"aggressive", ultra:"ultra", rtk:"rtk" };
-
-export interface DerivedPlan { mode: string; stackedPipeline: Array<{ engine: string; intensity?: string }>; }
-
-export function deriveDefaultPlan(engines: Record<string, EngineToggle>, masterEnabled: boolean): DerivedPlan {
-  if (!masterEnabled) return { mode:"off", stackedPipeline:[] };
-  const onIds = Object.keys(ENGINE_CATALOG).filter((id) => engines[id]?.enabled === true);
-  if (onIds.length === 0) return { mode:"off", stackedPipeline:[] };
-  if (onIds.length === 1 && engineMeta(onIds[0]).isSingleMode) {
-    return { mode: SINGLE_MODE_OF[onIds[0]], stackedPipeline:[] };
-  }
-  const ordered = onIds.sort((a,b)=>engineMeta(a).stackPriority-engineMeta(b).stackPriority);
-  const stackedPipeline = ordered.map((id) => {
-    const level = engines[id]?.level;
-    return level ? { engine:id, intensity:level } : { engine:id };
-  });
-  return { mode:"stacked", stackedPipeline };
-}
-```
-
-- [ ] **Step 4: Run → PASS.**
-- [ ] **Step 5: Commit** `... -m "feat(compression): deriveDefaultPlan (engines map -> mode/pipeline)"`
-
----
-
-## Task 4: Migration 102 — backfill `engines` + `activeComboId`
-
-**Files:**
-- Create: `src/lib/db/migrations/102_compression_engines_map.sql`
-- Test: `tests/unit/compression/compression-engines-map-migration.test.ts`
-
-- [ ] **Step 1: Write the failing test** (uses `resetDbInstance()` + closes handles in `test.after`, per repo rule):
-
-```ts
-import { test, after } from "node:test";
-import assert from "node:assert/strict";
-import { getDbInstance, resetDbInstance } from "@/lib/db/core.ts";
-import { getCompressionSettings } from "@/lib/db/compression.ts";
-
-after(() => resetDbInstance());
-test("migration backfills engines map from prior defaultMode + default combo", () => {
-  resetDbInstance();
-  const db = getDbInstance(); // runs migrations incl. 102
-  // simulate a pre-102 install: master on, defaultMode 'standard', caveman enabled
-  db.prepare("INSERT OR REPLACE INTO key_value(namespace,key,value) VALUES('compression','enabled','true')").run();
-  db.prepare("INSERT OR REPLACE INTO key_value(namespace,key,value) VALUES('compression','defaultMode','\"standard\"')").run();
-  db.prepare("INSERT OR REPLACE INTO key_value(namespace,key,value) VALUES('compression','cavemanConfig','{\"enabled\":true}')").run();
-  const cfg = getCompressionSettings();
-  assert.equal(cfg.engines.caveman.enabled, true);
-  assert.equal(cfg.activeComboId, null);
-});
-```
-
-- [ ] **Step 2: Run → FAIL.**
-- [ ] **Step 3: Implement** the SQL migration (idempotent; the row backfill of derived `engines` is done in `normalizeCompressionSettings` read-path — the SQL only seeds `activeComboId` default and a marker). Migration `102_compression_engines_map.sql`:
-
-```sql
--- Phase 1 of the unified compression panel: the engines map + activeComboId become the
--- single source. The engines map is DERIVED on read (normalizeCompressionSettings) from the
--- legacy defaultMode + default-combo steps + caveman/rtk/ultra/aggressive config, so existing
--- installs keep their behavior. Here we only ensure activeComboId defaults to NULL ("default").
-INSERT OR IGNORE INTO key_value (namespace, key, value) VALUES ('compression', 'activeComboId', 'null');
-```
-
-(The read-path derivation in Task 5 is what makes `getCompressionSettings().engines` correct; the migration just guarantees `activeComboId` exists.)
-
-- [ ] **Step 4: Run → PASS** (after Task 5's normalize is in — if running 4 before 5, expect the engines assertion to fail; do Task 5 then re-run). Commit after Task 5.
-
----
-
-## Task 5: Persist + normalize `engines` / `activeComboId` (read-path derivation)
-
-**Files:**
-- Modify: `src/lib/db/compression.ts` (`getCompressionSettings`/`normalizeCompressionSettings`/`updateCompressionSettings`)
-- Test: reuse Task 4's migration test + add a round-trip test in the same file.
-
-- [ ] **Step 1: Add round-trip test**:
-
-```ts
-import { updateCompressionSettings } from "@/lib/db/compression.ts";
-test("engines map persists round-trip + activeComboId", () => {
-  resetDbInstance(); getDbInstance();
-  updateCompressionSettings({ enabled:true, engines:{ rtk:{enabled:true,level:"standard"}, caveman:{enabled:true,level:"full"} }, activeComboId:null });
-  const cfg = getCompressionSettings();
-  assert.equal(cfg.engines.rtk.enabled, true);
-  assert.equal(cfg.engines.rtk.level, "standard");
-  assert.equal(cfg.engines.caveman.level, "full");
-});
-```
-
-- [ ] **Step 2: Run → FAIL.**
-- [ ] **Step 3: Implement** in `compression.ts`:
-  - In `normalizeCompressionSettings`: read stored `engines` if present; ELSE derive it from legacy fields — `engines[id].enabled` from: caveman/rtk/ultra/aggressive `*.enabled`; structural engines from the default-combo steps (read the default combo); single-modes from `defaultMode`. Levels from `cavemanConfig.intensity`/`rtkConfig.intensity`. Read `activeComboId` (default null).
-  - In `updateCompressionSettings`: accept `engines` (validate each value `{enabled:boolean, level?:string}`) + `activeComboId` and persist as `key_value` rows (`engines` as one JSON row).
-  - Add a Zod sub-schema `engineToggleSchema = z.object({ enabled: z.boolean(), level: z.string().optional() })` and `engines: z.record(engineToggleSchema).optional()`, `activeComboId: z.string().nullable().optional()`.
-
-- [ ] **Step 4: Run → PASS** (Task 4 + Task 5 tests). `npm run typecheck:core`.
-- [ ] **Step 5: Commit** `git add src/lib/db/migrations/102_compression_engines_map.sql src/lib/db/compression.ts tests/unit/compression/compression-engines-map-migration.test.ts && git commit -m "feat(compression): persist+backfill engines map and activeComboId (migration 102)"`
-
----
-
-## Task 6: `resolveCompressionPlan` (precedence resolver)
-
-**Files:**
-- Create: `open-sse/services/compression/resolveCompressionPlan.ts`
-- Test: `tests/unit/compression/resolve-compression-plan.test.ts`
-
-- [ ] **Step 1: Write the failing test**
-
-```ts
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { resolveCompressionPlan } from "@omniroute/open-sse/services/compression/resolveCompressionPlan.ts";
-
-const base = { enabled:true, engines:{ caveman:{enabled:true,level:"full"} }, activeComboId:null, comboOverrides:{} };
-test("derived default when no override/active/header", () => {
-  assert.deepEqual(resolveCompressionPlan(base, {}), { mode:"standard", stackedPipeline:[] });
-});
-test("routing-combo override wins over default", () => {
-  const cfg = { ...base, comboOverrides:{ cmb:"aggressive" } };
-  assert.equal(resolveCompressionPlan(cfg, { comboId:"cmb" }).mode, "aggressive");
-});
-test("active named combo wins over default (Phase 2 wiring uses combos table; here pass it in)", () => {
-  const cfg = { ...base, activeComboId:"c1" };
-  const combos = { c1: [{ engine:"rtk", intensity:"standard" }] };
-  const plan = resolveCompressionPlan(cfg, { combos });
-  assert.equal(plan.mode, "stacked");
-  assert.deepEqual(plan.stackedPipeline, [{ engine:"rtk", intensity:"standard" }]);
-});
-test("master off => off regardless", () => {
-  assert.equal(resolveCompressionPlan({ ...base, enabled:false }, {}).mode, "off");
-});
-```
-
-- [ ] **Step 2: Run → FAIL.**
-- [ ] **Step 3: Implement** `resolveCompressionPlan.ts`:
-
-```ts
-import { deriveDefaultPlan, type DerivedPlan } from "./deriveDefaultPlan.ts";
-
-export interface ResolveCtx {
-  comboId?: string | null;
-  header?: string | null;              // x-omniroute-compression (Phase 3 parses+passes; Phase 1 callers pass undefined)
-  combos?: Record<string, Array<{ engine:string; intensity?:string }>>;  // named combo pipelines by id
-}
-export function resolveCompressionPlan(config: any, ctx: ResolveCtx): DerivedPlan {
-  if (config?.enabled === false) return { mode:"off", stackedPipeline:[] };
-  // 1. header (Phase 3 supplies parsed value; here it composes if present)
-  if (ctx.header) {
-    if (ctx.header === "off") return { mode:"off", stackedPipeline:[] };
-    if (ctx.header !== "default") {
-      const fromHeader = headerToPlan(ctx.header, config, ctx);
-      if (fromHeader) return fromHeader;            // unknown => fall through
-    }
-  }
-  // 2. routing-combo override
-  const ov = ctx.comboId ? config?.comboOverrides?.[ctx.comboId] : undefined;
-  if (ov) return modeToPlan(ov, config);
-  // 3. active named combo
-  if (config?.activeComboId && ctx.combos?.[config.activeComboId]) {
-    return { mode:"stacked", stackedPipeline: ctx.combos[config.activeComboId] };
-  }
-  // 4. derived default
-  return deriveDefaultPlan(config?.engines ?? {}, config?.enabled !== false);
-}
-function modeToPlan(mode: string, config: any): DerivedPlan {
-  return mode === "stacked"
-    ? { mode:"stacked", stackedPipeline: config?.stackedPipeline ?? [] }
-    : { mode, stackedPipeline:[] };
-}
-function headerToPlan(h: string, config: any, ctx: ResolveCtx): DerivedPlan | null {
-  if (h.startsWith("engine:")) { const id = h.slice(7); return config?.engines?.[id]?.enabled ? deriveDefaultPlan({ [id]: config.engines[id] }, true) : null; }
-  if (ctx.combos?.[h]) return { mode:"stacked", stackedPipeline: ctx.combos[h] };
-  return null;
-}
-```
-
-- [ ] **Step 4: Run → PASS.**
-- [ ] **Step 5: Commit** `... -m "feat(compression): resolveCompressionPlan precedence resolver (header>override>active>default)"`
-
----
-
-## Task 7: Wire the resolver into strategy selection + chatCore
-
-**Files:**
-- Modify: `open-sse/services/compression/strategySelector.ts` (`selectCompressionStrategy`)
-- Modify: `open-sse/handlers/chatCore.ts` (the compression call site)
-- Test: `tests/unit/compression/strategySelector.test.ts` (extend with an engines-map case)
-
-- [ ] **Step 1: Add test** asserting `selectCompressionStrategy` with `engines:{rtk:{enabled:true}}` + master on returns mode `rtk`; with `{rtk,caveman}` returns `stacked`. (Use the existing test's import + harness.)
-- [ ] **Step 2: Run → FAIL.**
-- [ ] **Step 3: Implement** — `selectCompressionStrategy` calls `resolveCompressionPlan(config, { comboId, combos })` and returns its `mode` (and expose the `stackedPipeline` so `applyCompressionAsync` uses the derived pipeline when mode==="stacked"). Load named `combos` from the combos DB module. In `chatCore.ts`, pass the active combo set; keep the `header` arg `undefined` (Phase 3 fills it). Keep `autoTriggerMode` behavior (auto-trigger still overrides to its mode on large prompts — apply BEFORE step 4 default).
-- [ ] **Step 4: Run → PASS** + full compression suite + typecheck.
-- [ ] **Step 5: Commit** `... -m "feat(compression): selectCompressionStrategy uses resolveCompressionPlan"`
-
----
-
-## Task 8: API — `/api/settings/compression` carries `engines` + `activeComboId`
-
-**Files:**
-- Modify: `src/app/api/settings/compression/route.ts`
-- Test: `tests/unit/api/compression/compression-api.test.ts` (extend)
-
-- [ ] **Step 1: Add test**: `PUT` with `{engines:{rtk:{enabled:true,level:"standard"}}}` then `GET` returns it; error body has no stack (`!body.error?.message?.includes("at /")`).
-- [ ] **Step 2: Run → FAIL.**
-- [ ] **Step 3: Implement** — extend the route's Zod body schema with `engines` + `activeComboId` (reuse the db sub-schema); GET returns them; errors via `buildErrorBody`.
-- [ ] **Step 4: Run → PASS** + vitest if the route is covered there.
-- [ ] **Step 5: Commit** `... -m "feat(api): settings/compression carries engines map + activeComboId"`
-
----
-
-## Task 9: Remove stored `defaultMode` write-path + default-combo editable route → shim
-
-**Files:**
-- Modify: `open-sse/services/compression/types.ts` (drop `defaultMode` from the persisted shape; keep `CompressionMode` type)
-- Modify: `src/app/api/context/combos/default/route.ts` (PUT → 410/deprecation; GET → derived default read-only)
-- Test: `tests/unit/api/...` for the shim (PUT rejected, GET returns derived).
-
-- [ ] **Step 1: Add test**: `PUT /api/context/combos/default` returns a deprecation error (not 200); `GET` returns the derived default pipeline.
-- [ ] **Step 2: Run → FAIL.**
-- [ ] **Step 3: Implement** — `setEngineInDefaultCombo` no longer the write path; PUT route returns `buildErrorBody` "deprecated: edit engines in /api/settings/compression"; GET returns `deriveDefaultPlan(config.engines, config.enabled)`. Remove remaining reads of stored `defaultMode` (derive).
-- [ ] **Step 4: Run → PASS** + full suite + typecheck.
-- [ ] **Step 5: Commit** `... -m "refactor(compression): derive default; default-combo route is a read-only shim"`
-
----
-
-## Task 10: The engine-grid panel UI
-
-**Files:**
-- Create: `src/app/(dashboard)/dashboard/context/settings/CompressionPanel.tsx`
-- Modify: `src/app/(dashboard)/dashboard/context/settings/page.tsx` (render `CompressionPanel`)
-- Test: `tests/unit/ui/compressionPanel.test.tsx` (vitest, `createRoot`+`act`)
-
-- [ ] **Step 1: Write the failing component test**: render `CompressionPanel` with a stubbed `fetch` returning `{enabled:true, engines:{rtk:{enabled:true,level:"standard"}}}`; assert it renders a row per `ENGINE_IDS`, the rtk level shows "standard", toggling caveman issues a `PUT` with `engines.caveman.enabled:true`, and the derived-pipeline preview text appears.
-- [ ] **Step 2: Run → FAIL** (`npm run test:vitest`).
-- [ ] **Step 3: Implement** `CompressionPanel.tsx`: master toggle; map `ENGINE_IDS` → a row component `[label+desc][Toggle][LevelSelect if meta.levels][Link → /dashboard/context/<id>]`; a derived-pipeline preview computed client-side via `deriveDefaultPlan` (import the pure fn); a `cavemanOutput` row; an `mcpAccessibility` row (writes its own endpoint, with a "MCP tool outputs" note); general settings (auto-trigger, preserve system prompt). Save via `PUT /api/settings/compression` (debounced, merge-patch like the existing `save()` pattern in `CompressionSettingsTab`). Reuse existing primitives (`Toggle`, segmented control) from the current cards.
-- [ ] **Step 4:** Update `page.tsx` to render `<CompressionPanel/>`. Run → PASS.
-- [ ] **Step 5: Commit** `... -m "feat(dashboard): engine-grid compression panel (single source for on/off + level)"`
-
----
-
-## Task 11: Consolidate — remove scattered/duplicate toggles + per-engine on/off
-
-**Files:**
-- Modify: `src/app/(dashboard)/dashboard/settings/components/CompressionTokenSaverCard.tsx` (remove; or strip to a read-only summary linking to the panel)
-- Modify: `CompressionSettingsTab.tsx` (remove duplicate caveman/rtk on/off + intensity sections; keep only things not in the panel, or delete if fully superseded)
-- Modify: `src/shared/components/compression/EngineConfigPage.tsx` + `CavemanContextPageClient.tsx` + `RtkContextPageClient.tsx` (remove on/off + level; keep detailed config; stop writing `/api/context/combos/default`)
-- Test: vitest render tests for the per-engine pages assert NO enabled toggle is present; the existing tests updated to the new shape (alignment, not masking).
-
-- [ ] **Step 1:** Update the affected render tests to expect the new (toggle-free) shape; run → FAIL on the still-present toggles.
-- [ ] **Step 2:** Implement the removals; per-engine detail save writes detailed config to its facade route (caveman/rtk) or the settings sub-object.
-- [ ] **Step 3:** Run vitest + full compression suite → PASS.
-- [ ] **Step 4: Commit** `... -m "refactor(dashboard): remove duplicate compression toggles; per-engine pages keep only detailed config"`
-
----
-
-## Task 12: Menu reorder + integration + full validation
-
-**Files:**
-- Modify: `src/shared/constants/sidebarVisibility.ts` (`COMPRESSION_CONTEXT_GROUP`: Settings → Combos → per-engine → Studio)
-- Test: `tests/unit/...` sidebar order test (if one exists) + an integration test.
-
-- [ ] **Step 1:** Add an integration test: build a config with `engines:{rtk:{enabled:true},caveman:{enabled:true,level:"full"}}`, call `selectCompressionStrategy` + `applyCompressionAsync` on a realistic body, assert the derived stacked pipeline ran (engineBreakdown has rtk+caveman) and equals the behavior of an explicit `[rtk,caveman]` stacked config. Run → (write fails first if any wiring gap).
-- [ ] **Step 2:** Reorder the sidebar group; update any sidebar order test (alignment).
-- [ ] **Step 3:** FULL validation: `npm run typecheck:core` (clean) · `npm run lint` (0 errors) · `node --import tsx/esm --test tests/unit/compression/*.test.ts` (green) · `npm run test:vitest` (green) · the api/integration compression tests.
-- [ ] **Step 4: Commit** `... -m "feat(compression): unified panel menu order + integration coverage"`
-
----
-
-## Self-review notes (done while writing)
-- Spec coverage: panel (T10), combos boundary (default derived T3/T9; named/active resolver T6 — UI for active selection is Phase 2), per-engine detail-only (T11), header (resolver is header-aware T6; parsing+wiring is Phase 3), migration (T4/T5), menu (T12). ✓
-- Type consistency: `EngineToggle` (T2) used by `deriveDefaultPlan` (T3), `resolveCompressionPlan` (T6), normalize (T5), panel (T10). `DerivedPlan` shape consistent T3↔T6↔T7. ✓
-- No placeholders: each task has concrete code/tests. UI tasks (T10/T11) specify exact behavior + assertions; final per-line component code is produced at execution following the existing card patterns.
-
----
-
-# 📌 RESUMO — o que ESTE plano (Fase 1) entrega
-
-1. **Catálogo de engines** (`engineCatalog.ts`) — fonte única de metadados (níveis, single-mode, ordem).
-2. **Modelo de dados Fase A** — `engines` map + `activeComboId` em `CompressionConfig`, com migração 102 + backfill (zero mudança de comportamento).
-3. **`deriveDefaultPlan`** — pipeline default DERIVADO dos toggles (0/1/N engines → off/modo/stacked).
-4. **`resolveCompressionPlan`** — resolvedor de precedência (header > override por-rota > perfil ativo > default derivado > off), já header/active-aware.
-5. **Fiação no runtime** — `selectCompressionStrategy`/`chatCore` usam o resolvedor.
-6. **API** — `/api/settings/compression` carrega `engines` + `activeComboId`; rota `combos/default` vira shim read-only; `defaultMode` armazenado removido (derivado).
-7. **Painel engine-grid** — `CompressionPanel.tsx` como fonte única de master + on/off + nível, com preview do pipeline derivado.
-8. **Consolidação** — remove toggles duplicados (TokenSaverCard, CompressionSettingsTab) e tira on/off+nível das páginas por-engine (que ficam só com config detalhada).
-9. **Menu** — Settings → Combos → páginas por-engine → Studio.
-
----
-
-# ⏳ PENDÊNCIAS — a fazer DEPOIS deste plano (cada uma vira seu próprio plano/PR)
-
-### Fase 2 — Perfis nomeados + seletor de ativo
-- **UI de combos como perfis**: a página `context/combos` lista N combos nomeados, edita pipeline **ordenado** (drag/reorder + nível por step), e tem o seletor **"perfil ativo"** (`Default` | `<combo>`) gravando `activeComboId`. O resolvedor (Fase 1) já consome `activeComboId`; falta a UI + o carregamento dos combos nomeados no `selectCompressionStrategy`. Remover o "master mode selector" do `CompressionHub` (modo agora é derivado).
-
-### Fase 3 — Header por-request `x-omniroute-compression`
-- **Parsing + wiring do header**: ler `x-omniroute-compression` no pipeline (espelhando `x-omniroute-no-memory`, PR #4290), passar como `ctx.header` ao `resolveCompressionPlan` (que já trata `off`/`default`/`<combo>`/`engine:<id>`). Doc no `API_REFERENCE` + teste de fetch-capture provando precedência por-request.
-
-### Itens de compressão deferidos (do ciclo de fixes, independentes deste painel)
-- **B-OBSERVABILITY** (telemetria): engines no-op somem do `engineBreakdown` (não dá pra distinguir "rodou 0%" de "pulou"). Exige um refactor do modelo de breakdown (campo `ran`/`skipped`) que toca a UI Studio + testes que asseram `.length` — deferido conscientemente.
-- **B-CAVEMAN-PACKS**: `de`/`fr`/`ja` sem `dedup.json`+`ultra.json` (ultra==full nessas línguas). Conteúdo linguístico — adicionar os packs (ou contribuição), **sem** fallback EN que mutilaria.
-- **js-tiktoken 1.0.21→1.0.22**: bump trivial (o range `^1.0.20` já permite; só pinar o lockfile num install real).
-
-### Decisão operacional pendente (não-código)
-- **Ligar o SLM (tier ultra) em produção**: validado ao vivo (49,4% real), mas mantido **OFF** por sua escolha. Quando decidir o trade-off (custo/latência/qualidade do pruning), ligar via o painel (após Fase 1) ou pela escrita de config — começando conservador (≥2000 tok).
-
-### Portes upstream (opcionais, do audit — fora do escopo deste painel)
-- headroom *safety-rails*/BM25; filtros novos do rtk/token-savior; conformance GCF v3.1 (já cobrimos o `[..]:`); transformers.js 3.5.2→4.x (arriscado, major).