chore(quality): re-baseline eslintWarnings 3760->3769 (v3.8.26 cycle drift) (#3962 )

The main quality-gate failed on the forward-merge release->main (run 27593205254): eslintWarnings 3769 > baseline 3760. Measured now on origin/release/v3.8.26 (273ecf7b5, all cycle merges) via quality:collect = 3769 — identical to CI. The later gate PRs (#3947/#3949/#3951/#3956/#3961) did not change the count (scripts/check/*.mjs are eslint-ignored; the new test files added no any/warnings). The +9 is pre-existing release-wide drift from v3.8.26 feature/other-session merges, not a product regression. Conscious re-baseline to the real measured value; tighten via --require-tighten at cycle-end (consistent with prior _eslint_rebaseline notes). Validated: ratchet passes with the real CI metrics (24 metrics OK, exit 0).
ci(quality): flip secret/workflow/bundle scanners to ratchet-blocking (Etapa 2) (#3961 )
2026-07-31 04:12:10 +03:00 · 2026-06-16 01:52:29 -03:00 · 2026-06-16 01:39:14 -03:00 · 2026-06-16 00:58:46 -03:00 · 2026-06-16 00:48:08 -03:00 · 2026-06-16 00:43:17 -03:00
3476 changed files with 66882 additions and 319015 deletions
--- a/.dockerignore
+++ b/.dockerignore
@@ -77,8 +77,6 @@ bun.lock
 # Agent config
 .agents
 .gemini
-.claude
-.source

 # Misc
 llm.txt
--- a/.env.example
+++ b/.env.example
@@ -56,12 +56,10 @@ STORAGE_ENCRYPTION_KEY_VERSION=v1
 DISABLE_SQLITE_AUTO_BACKUP=false

 # ── Redis (Rate Limiting) ──
-# Redis connection URL for the rate limiter backend. OPT-IN: leave this
-# commented out to use the built-in in-memory rate limiter. Setting it to a
-# non-running localhost (#4878) makes ioredis flood "[REDIS] Error:" logs.
+# Redis connection URL for the rate limiter backend.
 # Used by: src/shared/utils/rateLimiter.ts
-# Example: redis://localhost:6379 (or redis://redis:6379 in Docker)
-# REDIS_URL=redis://localhost:6379
+# Default: redis://localhost:6379 (or redis://redis:6379 in Docker)
+REDIS_URL=redis://localhost:6379

 # ═══════════════════════════════════════════════════════════════════════════════
 # 3. NETWORK & PORTS
@@ -111,18 +109,8 @@ PORT=20128
 # Used by: src/app/api/v1/relay/chat/completions/route.ts
 # RELAY_IP_PER_MINUTE=30

-# Bundler selection for `npm run dev`. Set to 0 to fall back to webpack.
-# Default is 1 (Turbopack). PR #4092 had forced webpack because earlier
-# Turbopack 16.2.x panicked on the OmniRoute module graph with "internal error:
-# entered unreachable code: there must be a path to a root"
-# (turbopack-core/module_graph/mod.rs:662). That panic no longer reproduces on
-# the pinned Next 16.2.9 — verified across a broad cold-compile sweep (36
-# dashboard routes + open-sse-heavy API routes incl. /api/v1/chat/completions,
-# /api/v1/models, /api/mcp) and repeated HMR rebuilds: zero panics. Turbopack
-# also keeps dev memory far lower on the edit→rebuild loop (HMR rebuild RSS stays
-# ~flat vs webpack's monotonic growth), which mitigates the dev-server OOM on
-# this 60+ route app. The production build still uses webpack (build pipeline is
-# unaffected by this dev-only flag).
+# Use Turbopack in local dev. Next 16.2.4 can fail to compile next/font/google
+# through the custom dev runner without this on Windows.
 OMNIROUTE_USE_TURBOPACK=1

 # Skip the SQLite integrity health check on startup (faster boot on large DBs).
@@ -201,8 +189,7 @@ AUTH_COOKIE_SECURE=false
 REQUIRE_API_KEY=false

 # Allow revealing full API key values in the Dashboard UI.
-# Used by: src/shared/constants/featureFlagDefinitions.ts — controls show/hide of key values.
-# Also configurable from Dashboard > Settings > Feature Flags.
+# Used by: Dashboard providers page — controls show/hide of key values.
 # Default: false  |  Security risk if enabled on shared instances.
 ALLOW_API_KEY_REVEAL=false

@@ -239,13 +226,10 @@ ALLOW_API_KEY_REVEAL=false
 # Default: 10485760 (10 MB)
 # MAX_BODY_SIZE_BYTES=10485760

-# CORS configuration — controls which cross-origin browser clients can call the API.
-# Used by: src/server/cors/origins.ts — sets Access-Control-Allow-Origin.
-# Same-origin dashboard requests behind a reverse proxy do not need CORS; set
-# NEXT_PUBLIC_BASE_URL instead. No wildcard is sent unless CORS_ALLOW_ALL=true.
-# CORS_ALLOWED_ORIGINS=https://your-frontend.example.com
-# CORS_ORIGIN=https://your-frontend.example.com  # legacy single-origin alias
-# CORS_ALLOW_ALL=false
+# CORS configuration — controls which origins can call the API.
+# Used by: Next.js middleware — sets Access-Control-Allow-Origin header.
+# Default: * (all origins)  |  Restrict for production security.
+# CORS_ORIGIN=https://your-domain.com

 # Allow provider URLs pointing to private/local networks (localhost, 192.168.x.x, etc.).
 # REQUIRED for self-hosted providers: LM Studio, Ollama, vLLM, Llamafile, Triton, etc.
@@ -253,12 +237,6 @@ ALLOW_API_KEY_REVEAL=false
 # Default: false (blocked)  |  Set true to enable local providers.
 # OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS=true

-# Allow adding/validating providers on local/private addresses (127.0.0.1, localhost, LAN).
-# Used by: src/shared/network/outboundUrlGuard.ts — scopes to the provider validation path and
-# still blocks cloud-metadata (169.254.169.254, metadata.google.internal). Default: true
-# (OmniRoute is local-first). Set false to enforce strict public-only blocking.
-# OMNIROUTE_ALLOW_LOCAL_PROVIDER_URLS=false
-
 # Legacy alias toggling the SSRF guard. Used by: src/shared/network/outboundUrlGuard.ts
 # When unset, OmniRoute uses the per-feature defaults. Set to "false"/"0" to disable.
 # OUTBOUND_SSRF_GUARD_ENABLED=true
@@ -295,15 +273,6 @@ ALLOW_API_KEY_REVEAL=false
 # PII_RESPONSE_SANITIZATION=false
 # PII_RESPONSE_SANITIZATION_MODE=redact  # redact = mask PII | warn = log only | block = drop response

-# ── VS Code Tokenized-Route Context Sanitizer ──
-# Strips implicit active-editor context (editorContext/activeEditor/currentFile/
-# selection/openTabs…) from requests on the /v1/vscode/[token]/* routes before
-# forwarding upstream, and redacts the content of explicitly-attached sensitive
-# files (.env, private keys, kubeconfig, credentials/secrets). Explicit
-# attachments otherwise pass through. Secure-by-default: ON unless set to 0.
-# Used by: src/app/api/v1/vscode/contextSanitizer.ts
-# OMNIROUTE_VSCODE_SANITIZE_CONTEXT=1  # set to 0 to disable
-
 # ═══════════════════════════════════════════════════════════════════════════════
 # 6. TOOL & ROUTING POLICIES
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -335,7 +304,6 @@ ALLOW_API_KEY_REVEAL=false
 # URLs used for internal sync jobs, OAuth callbacks, and cloud relay.

 # Internal base URL — used by server-side sync jobs to call /api/sync/cloud.
-# Keep this as a loopback/container URL even when the app is publicly proxied.
 # Used by: src/lib/cloudSync.ts, src/lib/initCloudSync.ts
 # Default: http://localhost:20128
 BASE_URL=http://localhost:20128
@@ -350,8 +318,7 @@ CLOUD_URL=
 # CLOUD_SYNC_TIMEOUT_MS=12000

 # Public-facing base URL — CRITICAL for reverse proxy / OAuth callback setups.
-# Used by: OAuth redirect_uri computation, Dashboard UI links, generated public
-# URLs, and same-origin browser mutation checks.
+# Used by: OAuth redirect_uri computation, Dashboard UI links, cloud/model sync.
 # Set to your public URL when behind nginx/Caddy (e.g., https://omniroute.example.com).
 #
 # Dashboard display behavior: when this variable is unset, the dashboard
@@ -365,7 +332,6 @@ CLOUD_URL=
 NEXT_PUBLIC_BASE_URL=http://localhost:20128

 # Browser-facing OmniRoute origin for generated assets in API responses.
-# Highest-priority public origin override; also used by public-origin validation.
 # Used by: chatgpt-web image generation cache URLs (/v1/chatgpt-web/image/<id>).
 # Set this when OpenWebUI or another relay reaches OmniRoute by an internal URL
 # but the user's browser must fetch images from a LAN, tunnel, or public origin.
@@ -383,30 +349,12 @@ NEXT_PUBLIC_BASE_URL=http://localhost:20128
 # is heavy and clients are racing the 30-minute TTL.
 # OMNIROUTE_CGPT_WEB_IMAGE_CACHE_MAX_MB=256

-# Overall wait budget for a chatgpt-web GPT-5.5 Pro background-poll handoff,
-# in milliseconds. Default 1200000 (20 minutes). Pro reasoning runs are slow
-# and complete out-of-band, so OmniRoute polls until the answer lands or this
-# budget elapses. Raise it if Pro requests time out before finishing.
-# OMNIROUTE_CGPT_WEB_PRO_TIMEOUT_MS=1200000
-
-# Interval between chatgpt-web GPT-5.5 Pro background-poll attempts, in
-# milliseconds. Default 4000 (4 seconds). Lower for snappier completion at the
-# cost of more upstream polling; raise to reduce request volume.
-# OMNIROUTE_CGPT_WEB_PRO_POLL_INTERVAL_MS=4000
-
 # Public cloud URL — client-side mirror of CLOUD_URL.
 NEXT_PUBLIC_CLOUD_URL=

 # Legacy alias — fallback for NEXT_PUBLIC_BASE_URL in sync schedulers.
 # NEXT_PUBLIC_APP_URL=http://localhost:20128

-# Advanced reverse-proxy trust mode for deriving public origin from Forwarded /
-# X-Forwarded-* headers when no explicit public base URL is set. Prefer setting
-# NEXT_PUBLIC_BASE_URL. Only enable if direct client access to OmniRoute is blocked
-# and your proxy strips/rebuilds incoming forwarded headers.
-# Values: true/loopback (trust loopback proxy peers), private/lan (also trust LAN peers).
-# OMNIROUTE_TRUST_PROXY=
-
 # Public callback URL for asynchronous image/audio jobs (kie.ai, etc.).
 # Used by: open-sse/utils/kieTask.ts — overrides callbackUrlFromBaseUrl().
 # Honor order: KIE_CALLBACK_URL → OMNIROUTE_KIE_CALLBACK_URL → OMNIROUTE_PUBLIC_URL.
@@ -414,35 +362,14 @@ NEXT_PUBLIC_CLOUD_URL=
 #OMNIROUTE_KIE_CALLBACK_URL=
 #OMNIROUTE_PUBLIC_URL=

-# Headroom token-saver proxy URL. The dashboard lifecycle (api/headroom/*) spawns
-# a local headroom-ai CLI on loopback by default; override only to point at an
-# external Docker sidecar proxy. Defaults to http://localhost:8787 when unset.
-# Used by: src/lib/headroom/detect.ts.
-#HEADROOM_URL=http://localhost:8787
-
 # Upstream quota endpoints used by the Usage page. Override only for
 # debugging or when routing through a corporate mirror. Used by:
 # open-sse/services/usage.ts.
 #OMNIROUTE_CROF_USAGE_URL=https://crof.ai/usage_api/
+#OMNIROUTE_GEMINI_CLI_USAGE_URL=https://cloudcode-pa.googleapis.com/v1internal:loadCodeAssist
 #OMNIROUTE_CODEWHISPERER_BASE_URL=https://codewhisperer.us-east-1.amazonaws.com
 #OMNIROUTE_OPENCODE_QUOTA_URL=https://opencode.ai/zen/go/v1/quota
 #OMNIROUTE_OPENCODE_GO_QUOTA_URL=https://api.z.ai/api/monitor/usage/quota/limit
-#OMNIROUTE_OPENCODE_GO_DASHBOARD_URL=https://opencode.ai/workspace
-#OMNIROUTE_OLLAMA_CLOUD_USAGE_URL=https://ollama.com/settings
-
-# OpenCode Go dashboard quota scraping. Prefer configuring these per connection
-# in Dashboard → Providers → OpenCode Go. Env vars are useful for headless
-# deployments or shared server defaults. The cookie is sensitive.
-#OPENCODE_GO_WORKSPACE_ID=wrk_...
-#OMNIROUTE_OPENCODE_GO_WORKSPACE_ID=wrk_...
-#OPENCODE_GO_AUTH_COOKIE=auth=...
-#OMNIROUTE_OPENCODE_GO_AUTH_COOKIE=auth=...
-
-# Ollama Cloud quota scraping. Prefer configuring this per connection in
-# Dashboard → Providers → Ollama Cloud. The cookie is sensitive.
-#OLLAMA_USAGE_COOKIE=__Secure-session=...
-#OLLAMA_CLOUD_USAGE_COOKIE=__Secure-session=...
-#OMNIROUTE_OLLAMA_USAGE_COOKIE=__Secure-session=...

 # ═══════════════════════════════════════════════════════════════════════════════
 # 8. OUTBOUND PROXY (Upstream Provider Calls)
@@ -461,19 +388,6 @@ NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
 # ALL_PROXY=socks5://127.0.0.1:7890
 # NO_PROXY=localhost,127.0.0.1

-# Max concurrent sockets per cached HTTP/SOCKS proxy dispatcher.
-# Long-lived SSE streams such as Codex /v1/responses need more than one
-# connection when multiple requests share the same account-level proxy.
-# Set to 1 only for legacy diagnostics. Values above 256 are capped.
-# OMNIROUTE_PROXY_DISPATCHER_CONNECTIONS=32
-
-# SOCKS5 handshake (connect) timeout in ms (default 10000, capped at 120000).
-# Raise it when a single residential gateway host is hit by high concurrency
-# (e.g. 100 simultaneous requests): the real SOCKS5 handshake can exceed 10s
-# under a saturated pool even though the proxy is reachable, which otherwise
-# surfaces as a false "[Proxy Fast-Fail] Proxy unreachable".
-# SOCKS_HANDSHAKE_TIMEOUT_MS=10000
-
 # Proxy fail-open mode (default: false = fail-closed).
 # When false, a request whose assigned proxy fails to resolve is REFUSED rather than
 # falling back to a direct connection — prevents real-IP leaks in egress-controlled
@@ -546,11 +460,6 @@ NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
 # Legacy alias for OMNIROUTE_API_KEY.
 # ROUTER_API_KEY=

-# CLI remote-mode context/profile for `omniroute` commands (overrides the active
-# context in the local contexts store). Equivalent to the `--context <name>` flag.
-# Used by: bin/cli/program.mjs, bin/cli/api.mjs (remote mode).
-# OMNIROUTE_CONTEXT=
-
 # Enforce scope-based access control on MCP tool calls.
 # Used by: open-sse/mcp-server/server.ts — rejects calls outside allowed scopes.
 # OMNIROUTE_MCP_ENFORCE_SCOPES=false
@@ -601,16 +510,6 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # heuristic in instrumentation-node.ts.  Default: unset (tests skip background).
 #OMNIROUTE_ENABLE_RUNTIME_BACKGROUND_TASKS=1

-# Proactive connection-cooldown recovery (#8): re-validates connections whose
-# transient `rate_limited_until` window has elapsed OUTSIDE the request hot path,
-# so the first request after a cooldown does not pay the probe latency. Lazy
-# recovery in getProviderCredentials still applies regardless. Used by:
-# src/lib/quota/connectionRecovery.ts.
-# Tick cadence (ms). Default 60000, floor 5000.
-# OMNIROUTE_CONNECTION_RECOVERY_INTERVAL_MS=60000
-# Disable the proactive recovery scheduler entirely (default: false).
-# OMNIROUTE_DISABLE_CONNECTION_RECOVERY=false
-
 # Background job interval for budget reset checks (ms).  Default: 600000 (10m).
 # Used by: src/lib/jobs/budgetResetJob.ts.  Floor: 10000.
 #OMNIROUTE_BUDGET_RESET_JOB_INTERVAL_MS=600000
@@ -658,11 +557,6 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # Used by: scripts/postinstall.mjs.
 #OMNIROUTE_SKIP_POSTINSTALL=0

-# Operator-supplied JSON credentials for the offline compression-eval CLI
-# (parsed with JSON.parse; leave unset for a dry run). Developer tooling only.
-# Used by: scripts/compression-eval/index.ts.  Default: {} (empty).
-#OMNIROUTE_EVAL_CREDENTIALS={}
-
 # Skip the DB healthcheck entirely on startup (useful for short-lived tasks / tests).
 # Used by: src/lib/db/core.ts, src/lib/db/healthCheck.ts.  Set to 1 to disable.  Default: 0.
 #OMNIROUTE_SKIP_DB_HEALTHCHECK=0
@@ -731,7 +625,7 @@ CODEX_OAUTH_CLIENT_ID=app_EMoamEEZ73f0CkXaXp7hrann
 # Used by: open-sse/executors/theoldllm.ts. Default: 30000 (30s).
 # THEOLDLLM_NAV_TIMEOUT_MS=30000

-# ── Gemini / Antigravity / Windsurf (all Google-based) ──
+# ── Gemini / Gemini CLI / Antigravity / Windsurf (all Google-based) ──
 # These providers ship public OAuth client_id/secret values (or Firebase Web
 # keys) embedded in their public CLIs/binaries. Defaults are baked into the
 # code via open-sse/utils/publicCreds.ts — leave the env vars unset to use
@@ -740,6 +634,8 @@ CODEX_OAUTH_CLIENT_ID=app_EMoamEEZ73f0CkXaXp7hrann
 #
 # GEMINI_OAUTH_CLIENT_ID=
 # GEMINI_OAUTH_CLIENT_SECRET=
+# GEMINI_CLI_OAUTH_CLIENT_ID=
+# GEMINI_CLI_OAUTH_CLIENT_SECRET=
 # ANTIGRAVITY_OAUTH_CLIENT_ID=
 # ANTIGRAVITY_OAUTH_CLIENT_SECRET=
 # WINDSURF_FIREBASE_API_KEY=
@@ -827,7 +723,7 @@ GITHUB_OAUTH_CLIENT_ID=Iv1.b507a08c87ecfe98
 # VISION_BRIDGE_API_KEY=

 # ─────────────────────────────────────────────────────────────────────────────
-# ⚠️  GOOGLE OAUTH (Antigravity) & OTHER PROVIDERS — REMOTE SERVERS
+# ⚠️  GOOGLE OAUTH (Antigravity, Gemini CLI) & OTHER PROVIDERS — REMOTE SERVERS
 # ─────────────────────────────────────────────────────────────────────────────
 # The default Client IDs above ONLY work when OmniRoute runs on localhost.
 # For remote/VPS hosting (including Docker containers on remote servers):
@@ -855,7 +751,7 @@ GITHUB_OAUTH_CLIENT_ID=Iv1.b507a08c87ecfe98
 # Used by: open-sse/executors/base.ts — buildHeaders() dynamic lookup.
 # Update these when providers release new CLI versions to avoid blocks.

-CLAUDE_USER_AGENT="claude-cli/2.1.195 (external, cli)"
+CLAUDE_USER_AGENT="claude-cli/2.1.158 (external, cli)"

 # Disable the deterministic tool-name cloak applied on both Anthropic-bound paths
 # (executors/base.ts native OAuth + executors/cliproxyapi.ts CLIProxyAPI) —
@@ -864,34 +760,23 @@ CLAUDE_USER_AGENT="claude-cli/2.1.195 (external, cli)"
 # stream with a misleading 400 out-of-extra-usage placeholder. Set to true to
 # forward the original names verbatim (debugging only).
 # CLAUDE_DISABLE_TOOL_NAME_CLOAK=false
-CODEX_USER_AGENT="codex-cli/0.142.0 (Windows 10.0.26200; x64)"
-GITHUB_USER_AGENT="GitHubCopilotChat/0.54.0"
+CODEX_USER_AGENT="codex-cli/0.132.0 (Windows 10.0.26200; x64)"
+GITHUB_USER_AGENT="GitHubCopilotChat/0.45.1"
 ANTIGRAVITY_USER_AGENT="antigravity/2.0.1 linux/arm64 google-api-nodejs-client/10.3.0"
 KIRO_USER_AGENT="AWS-SDK-JS/3.0.0 kiro-ide/1.0.0"
-# KIRO_VERIFY_FULL_CRC=false           # opt-in: full per-frame message CRC validation on the Kiro event stream (debug corrupted streams; prelude CRC + TLS already protect framing)
 # Optional override for the Kiro social device-code OAuth clientId. Kiro's
 # device endpoint accepts any non-empty string and behaves like a User-Agent
 # rather than a secret. Only override if AWS ever starts enforcing this field.
 # Used by: src/lib/oauth/constants/oauth.ts (KIRO_CONFIG.socialClientId).
 # KIRO_OAUTH_CLIENT_ID=kiro-cli
-# Enable full per-frame message CRC validation for Kiro streams. Off by default
-# because it is O(frame bytes) on the main thread; use only for debugging
-# suspected corrupted-stream issues.
-# Used by: open-sse/executors/kiro.ts
-# KIRO_VERIFY_FULL_CRC=false
 QODER_USER_AGENT="Qoder-Cli"
-QWEN_USER_AGENT="QwenCode/0.19.3 (linux; x64)"
+QWEN_USER_AGENT="QwenCode/0.15.11 (linux; x64)"
 CURSOR_USER_AGENT="Cursor/3.4"
+GEMINI_CLI_USER_AGENT="google-api-nodejs-client/10.3.0"

 # Override Codex client version sent in headers independently of the
 # CODEX_USER_AGENT string. Used by: open-sse/config/codexClient.ts.
-# CODEX_CLIENT_VERSION=0.142.0
-
-# Kill-switch to strip non-standard `codex.*` SSE events (e.g. codex.rate_limits)
-# from the Codex Responses stream. These frames break the OpenAI SDK's
-# responses.stream() with a 502 "Controller is already closed". Off by default;
-# set to true/1/yes to enable. Used by: open-sse/executors/codex.ts.
-# OMNIROUTE_CODEX_DROP_NONSTANDARD_EVENTS=true
+# CODEX_CLIENT_VERSION=0.132.0

 # ═══════════════════════════════════════════════════════════════════════════════
 # 13. CLI FINGERPRINT COMPATIBILITY (Anti-Detection)
@@ -975,10 +860,6 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # layered on top of it when the native library is wedged.
 # OMNIROUTE_CHATGPT_TLS_TIMEOUT_MS=60000
 # OMNIROUTE_CHATGPT_TLS_GRACE_MS=10000
-# Max wait for the FIRST streamed byte from the ChatGPT TLS sidecar before the
-# request is aborted as a dead stream, in milliseconds. Default 30000 (30s).
-# Raise it if upstream cold-starts routinely exceed the window.
-# OMNIROUTE_CHATGPT_STREAM_FIRST_BYTE_TIMEOUT_MS=30000

 # ── Claude TLS sidecar (Chromium-fingerprinted client) ──
 # Used by: open-sse/services/claudeTlsClient.ts — wire-level timeout for
@@ -1022,15 +903,6 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # OMNIROUTE_CIRCUIT_BREAKER_LOCAL_THRESHOLD=2
 # OMNIROUTE_CIRCUIT_BREAKER_LOCAL_RESET_MS=15000

-# ── Context-cache pin health gate ──
-# Used by: open-sse/services/combo.ts. When a context-cache pin points at a
-# provider that is durably unhealthy, the pin is dropped to allow failover.
-# PIN_DROP_BACKOFF_LEVEL gates how deep a connection's backoff must be before the
-# pin is considered durably unhealthy; PIN_DROP_GRACE_MS is the anti-flap window
-# that tolerates brief transient cooldowns before dropping the pin.
-# PIN_DROP_BACKOFF_LEVEL=2
-# PIN_DROP_GRACE_MS=20000
-
 # ── Stream idle detection ──
 # STREAM_IDLE_TIMEOUT_MS=600000      # Max silence between SSE chunks (default: 600000)
 #                                     # Extended-thinking models rarely pause >90s.
@@ -1103,11 +975,6 @@ APP_LOG_TO_FILE=true
 # Default: 100000
 # CALL_LOGS_TABLE_MAX_ROWS=100000

-# Maximum age for orphaned active request log entries before the in-memory
-# pending-request reaper removes them. Accepts milliseconds.
-# Default: 3600000 (1 hour)
-# MAX_PENDING_REQUEST_AGE_MS=3600000
-
 # Whether call log pipeline capture stores stream chunks when enabled in settings.
 # Only applies when call_log_pipeline_enabled=true.
 # Default: true
@@ -1281,34 +1148,6 @@ APP_LOG_TO_FILE=true
 # Used by: open-sse/executors/cloudflare-ai.ts
 # CLOUDFLARE_ACCOUNT_ID=

-# ── Deno Deploy proxy relay (#4643 / 9router#1437) ──
-# Override the Deno Deploy REST API base used by the proxy-pool relay deployer.
-# Default: https://api.deno.com/v2 (omit unless mocking).
-# Used by: src/app/api/settings/proxy/deno-deploy/route.ts
-# DENO_DEPLOY_API_BASE=https://api.deno.com/v2
-
-# Default Deno Deploy app name suggested in the "Deploy Relay" modal.
-# Used by: src/app/(dashboard)/dashboard/settings/components/proxy/DenoRelayModal.tsx
-# NEXT_PUBLIC_DENO_RELAY_DEFAULT_PROJECT=omniroute-deno-relay
-
-# Set to "false" to hide the Deno Deploy relay option from the Proxy Pool tab.
-# Used by: src/app/(dashboard)/dashboard/settings/components/proxy/ProxyPoolTab.tsx
-# NEXT_PUBLIC_DENO_RELAY_ENABLED=true
-
-# ── Cloudflare Workers proxy relay (#4640 / 9router#1360) ──
-# Override the Cloudflare REST API base used by the proxy-pool relay deployer.
-# Default: https://api.cloudflare.com/client/v4 (omit unless mocking).
-# Used by: src/app/api/settings/proxy/cloudflare-deploy/route.ts
-# CLOUDFLARE_API_BASE=https://api.cloudflare.com/client/v4
-
-# Default worker project name suggested in the "Deploy Relay" modal.
-# Used by: src/app/(dashboard)/dashboard/settings/components/proxy/CloudflareRelayModal.tsx
-# NEXT_PUBLIC_CLOUDFLARE_RELAY_DEFAULT_PROJECT=omniroute-relay
-
-# Set to "false" to hide the Cloudflare Workers relay option from the Proxy Pool tab.
-# Used by: src/app/(dashboard)/dashboard/settings/components/proxy/ProxyPoolTab.tsx
-# NEXT_PUBLIC_CLOUDFLARE_RELAY_ENABLED=true
-
 # ── Cloudflare Tunnel (cloudflared) ──
 # Custom path to cloudflared binary for tunnel management.
 # Used by: src/lib/cloudflaredTunnel.ts
@@ -1373,16 +1212,6 @@ APP_LOG_TO_FILE=true
 # Health check result cache TTL (ms).  Default: 30000 (30s)
 # PROXY_HEALTH_CACHE_TTL_MS=30000

-# Unhealthy health check result cache TTL (ms). Default: 2000 (2s)
-# Keeps transient fast-fail timeouts from poisoning a proxy for the full
-# healthy-result cache window under high concurrency.
-# PROXY_HEALTH_UNHEALTHY_CACHE_TTL_MS=2000
-
-# Allow OAuth and provider validation flows to bypass a pinned proxy and connect
-# directly when proxy reachability pre-checks fail. Default: false.
-# Also configurable from Dashboard > Settings > Feature Flags.
-# OMNIROUTE_CONTROL_PLANE_PROXY_DIRECT_FALLBACK=false
-
 # Rate limit maximum wait time before failing a request (ms).  Default: 120000 (2 min)
 # Used by: open-sse/services/rateLimitManager.ts
 # RATE_LIMIT_MAX_WAIT_MS=120000
@@ -1411,25 +1240,6 @@ APP_LOG_TO_FILE=true
 # Accepted values: true|1|on (enable). Unset or anything else = disabled (default).
 # PROVIDER_COOLDOWN_ENABLED=true

-# Transparent stream recovery (free-claude-code port). When enabled, the opening SSE
-# window is briefly held (up to STREAM_RECOVERY.HOLDBACK_MS) so an upstream truncation
-# before any byte reaches the client can be retried invisibly. Opt-in: holding the
-# window adds up to that much time-to-first-token latency on every stream, so it is
-# OFF by default. Seeds ResilienceSettings.streamRecovery.enabled.
-# Used by: open-sse/services/streamRecovery.ts, open-sse/handlers/chatCore.ts
-# Accepted values: true|1|on (enable). Unset or anything else = disabled (default).
-# STREAM_RECOVERY_ENABLED=true
-
-# Mid-stream continuation (Fase 4.4): when an upstream stream truncates AFTER bytes
-# already reached the client, re-request with the partial text as an assistant prefill
-# and stitch the missing suffix (plain-text OpenAI-compatible streams only; never with a
-# tool call in flight). OFF by default — the recovered tail arrives as one burst, not
-# token-by-token. Independent of STREAM_RECOVERY_ENABLED (different risk profile).
-# Seeds ResilienceSettings.streamRecovery.continueMidStream.
-# Used by: open-sse/services/streamRecovery.ts, open-sse/handlers/chatCore.ts
-# Accepted values: true|1|on (enable). Unset or anything else = disabled (default).
-# STREAM_RECOVERY_MIDSTREAM_ENABLED=true
-
 # Stagger interval (ms) between provider token healthchecks at startup.
 # Used by: src/lib/tokenHealthCheck.ts.  Default: 3000.
 # HEALTHCHECK_STAGGER_MS=3000
@@ -1553,12 +1363,6 @@ APP_LOG_TO_FILE=true
 # Used by: src/mitm/server.cjs — captures upstream traffic for inspection.
 # MITM_LOCAL_PORT=443
 # MITM_DISABLE_TLS_VERIFY=0
-# Idle socket timeout (ms) for proxied connections; sockets idle past this are torn
-# down to avoid leaking half-open tunnels (src/mitm/socketTimeouts.ts, server.cjs).
-# MITM_IDLE_TIMEOUT_MS=60000
-# Routing-decision log verbosity: 0 silences, higher values log more bypass/route
-# decisions (src/mitm/server.cjs, _internal/bypass.cjs).
-# MITM_VERBOSE=1

 # ── 1Proxy egress pool ──
 # Used by: src/lib/oneproxySync.ts — fetches proxy nodes from the OmniRoute
@@ -1602,10 +1406,6 @@ APP_LOG_TO_FILE=true
 # dashboard's tunnel manager. Used by: src/lib/tailscaleTunnel.ts.
 # TAILSCALE_BIN=/usr/local/bin/tailscale
 # TAILSCALED_BIN=/usr/local/bin/tailscaled
-# Pre-shared Tailscale auth key for non-interactive / headless `tailscale up`
-# (passed via --auth-key=). When unset, login falls back to the interactive
-# browser auth URL. Used by: src/lib/tailscaleTunnel.ts.
-# TAILSCALE_AUTHKEY=

 # ── Ngrok tunnel ──
 # Used by: src/lib/ngrokTunnel.ts — authenticates outbound tunnels.
@@ -1751,17 +1551,7 @@ QUOTA_STORE_DRIVER=sqlite              # sqlite | redis
 # QUOTA_STORE_REDIS_URL=               # ex.: redis://localhost:6379 (apenas quando driver=redis)
 # QUOTA_SATURATION_THRESHOLD=0.5       # 0..1; >= threshold ativa modo strict (sem empréstimo)
 # QUOTA_SOFT_DEPRIORITIZE_FACTOR=0.7   # 0..1; multiplicador do score quando soft policy ativa
-# STATUS_SOFT_DEPRIORITIZE_FACTOR=0.5  # 0..1; multiplicador do score p/ provider esgotado (credits_exhausted/rate_limited) quando preflight cutoff OFF (#4540)
 # QUOTA_CONSUMPTION_RETENTION_DAYS=14  # GC de buckets quota_consumption.updated_at antigos
-# QUOTA_PREFLIGHT_CUTOFF_ENABLED=false # opt-in (default OFF): hard quota cutoff drops low-quota candidates before auto-routing scoring
-
-# ─── Auto-Combo tier filter (#4517) ───────────────────────────────────────
-# When an `auto/<category>:free` (or any `:<tier>`) request matches NO connected
-# candidates, OmniRoute returns an EMPTY pool by default — so `:free` really means
-# "free tier only" and a paid model is never picked just because no free provider is
-# connected. Set this to `true`/`1` to restore the legacy behavior of falling back to
-# the full (unfiltered) pool with a warning. Source: open-sse/services/autoCombo/virtualFactory.ts
-# OMNIROUTE_AUTO_FREE_FALLBACK_TO_FULL_POOL=false

 # ─── OpenCode config regeneration (scripts/ad-hoc/regen-opencode-config.ts) ───
 # Base URL of the OmniRoute instance to query for /v1/models when regenerating
@@ -1774,104 +1564,3 @@ QUOTA_STORE_DRIVER=sqlite              # sqlite | redis
 # OpenCode-style API key (sk-...) for the regenerated opencode.json. Used by:
 # scripts/ad-hoc/regen-opencode-config.ts. Falls back to OMNIROUTE_KEY.
 # OPENCODE_API_KEY=
-
-# ─── Bifrost Go sidecar (PR-4 in #3932) ──────────────────────────────────────
-# Master kill switch for the bifrost sidecar proxy. When set to 0, the
-# /api/v1/relay/chat/completions/bifrost route returns 503 with the
-# X-Bifrost-Killswitch header and the operator is bounced to the TS path.
-# Use this to disable the sidecar without redeploying (e.g. during a
-# tier-1 router incident or a key rotation). Default: 1 (sidecar active).
-# BIFROST_ENABLED=1
-# When BIFROST_BASE_URL is set, /api/v1/relay/chat/completions/bifrost routes
-# traffic to the Go gateway instead of the TS relay handler, removing TS from
-# the hot path. Auth/rate-limit/injection-guard stay in the route (security not
-# duplicated). Falls back to TS path via X-Bifrost-Fallback header on
-# timeout/failure. See bin/omniroute for the local-redis companion.
-# BIFROST_BASE_URL=
-# API key for the Bifrost gateway (sent as Authorization: Bearer ...). If
-# unset, the route expects the request to carry a valid OmniRoute API key;
-# this key is for gateway-side auth only.
-# BIFROST_API_KEY=
-# When true, the Bifrost sidecar route streams responses back via SSE through
-# the gateway rather than the TS streaming executor. Default: true (when
-# BIFROST_BASE_URL is set).
-# BIFROST_STREAMING_ENABLED=
-# Per-request timeout when proxying to the Bifrost gateway. Default: 30000 (30s).
-# BIFROST_TIMEOUT_MS=
-# Alias for BIFROST_API_KEY (used by scripts that read the env via
-# OMNIROUTE_*). BIFROST_API_KEY takes precedence when both are set.
-# OMNIROUTE_BIFROST_KEY=
-# Relay backend selection for the OpenAI-compatible relay endpoint:
-# ts | bifrost | auto. "ts" (default when Bifrost is not configured) uses the
-# TypeScript relay; "auto" selects Bifrost when BIFROST_BASE_URL is set (and
-# BIFROST_ENABLED != 0) and falls back to TS if the sidecar is unreachable;
-# "bifrost" forces Bifrost (strict — no TS fallback). Auth, rate limits,
-# injection guard and model allowlists always run in the Next route first.
-# RELAY_ROUTING_BACKEND is an accepted alias. Responses carry X-Routing-Backend
-# and X-Routing-Fallback.
-# OMNIROUTE_RELAY_BACKEND=
-# RELAY_ROUTING_BACKEND=
-# Cooldown (ms) after a Bifrost sidecar hop fails in "auto" mode before the relay
-# re-attempts the sidecar; it goes straight to the TS path while the cooldown lasts.
-# 0 disables. Default 5000. Only applies when OMNIROUTE_RELAY_BACKEND=auto.
-# OMNIROUTE_BIFROST_FAILURE_COOLDOWN_MS=
-# Opt-in native HTTPS/TLS for `omniroute serve` (equivalent to --tls-cert /
-# --tls-key). Provide BOTH a PEM certificate and its private key and the
-# standalone server terminates TLS on the same listener (wss:// works
-# unchanged). With neither set the server stays plain HTTP; providing only one
-# (or an unreadable path) logs a warning and stays HTTP (never half-enables).
-# OMNIROUTE_TLS_CERT=
-# OMNIROUTE_TLS_KEY=
-
-# ─── 1-click local service launchers (PR-3 in #3932) ────────────────────────
-# Master switch for /api/local/* routes. When unset or "0", all /api/local/*
-# routes return 503 in production. Default: 0. Must be "1" in non-loopback
-# deploys to enable the Redis launcher and similar 1-click local service
-# starters. Belt-and-suspenders with the isLocalOnlyPath() route-guard
-# classification (LOCAL_ONLY_API_PREFIXES in src/server/authz/routeGuard.ts).
-# OMNIROUTE_LOCAL_ENDPOINTS_ENABLED=
-# Bearer token for /api/local/* callers that aren't on loopback (e.g. the
-# desktop app). When set, requests from non-loopback IPs must carry
-# Authorization: Bearer <token>. Required when
-# OMNIROUTE_LOCAL_ENDPOINTS_ENABLED=1 in non-loopback deployments. Default:
-# unset (loopback-only).
-# OMNIROUTE_LOCAL_ENDPOINTS_TOKEN=
-# Container name for the 1-click Redis launcher (`omniroute redis up`).
-# Default: omniroute-redis. Used by bin/cli/commands/redis.mjs and the
-# RedisLauncherPanel.
-# OMNIROUTE_REDIS_CONTAINER_NAME=
-# Host port for the 1-click Redis launcher. Default: 6379. Bump if the host
-# already binds 6379. The container's internal port stays 6379.
-# OMNIROUTE_REDIS_HOST_PORT=
-# Redis image used by the 1-click Redis launcher. Default: redis:7-alpine.
-# Override to redis:8-alpine or a private registry mirror as needed.
-# OMNIROUTE_REDIS_IMAGE=
-
-# ── Cluster Profile: Qdrant Vector Memory (opt-in via `docker compose --profile memory up`) ──
-# Qdrant is an OPTIONAL sidecar for deployments that need cosine-distance vector
-# search at >1M embeddings. The default vector store is sqlite-vec
-# (src/lib/memory/vectorStore.ts:108); flip this profile on only if you hit the
-# sqlite-vec ceiling or want persistent cross-replica vector state. See
-# docs/architecture/cluster-decisions.md § "Qdrant (memory profile)".
-# QDRANT_HOST=qdrant
-# QDRANT_PORT=6333
-# QDRANT_GRPC_PORT=6334
-# QDRANT_API_KEY=
-# QDRANT_COLLECTION=omniroute-memory
-# QDRANT_EMBEDDING_MODEL=text-embedding-3-small
-# QDRANT_VECTOR_SIZE=1536
-# QDRANT_HNSW_EF_CONSTRUCT=128
-
-# ── Cluster Profile: Bifrost Tier-1 Router (opt-in via `docker compose --profile bifrost up`) ──
-# Bifrost is an OPTIONAL Go-based Tier-1 router that handles the upstream-provider
-# multiplexing layer. Default: OmniRoute's open-sse/executors/bifrost.ts in-process
-# executor handles routing directly. Flip this profile on only if you want the
-# gateway as a separate sidecar (helps in 3+ replica deployments where you want
-# provider rotation centralised). See docs/architecture/cluster-decisions.md §
-# "Bifrost (bifrost profile)".
-# Set OMNIROUTE_RELAY_BACKEND=auto to use this sidecar when healthy, or
-# OMNIROUTE_RELAY_BACKEND=bifrost to require it without TS fallback.
-# BIFROST_BASE_URL=http://bifrost:8080
-# BIFROST_API_KEY=
-# BIFROST_STREAMING_ENABLED=true
-# BIFROST_TIMEOUT_MS=30000
--- a/.github/actions/npm-ci-retry/action.yml
+++ b/.github/actions/npm-ci-retry/action.yml
@@ -1,29 +0,0 @@
-name: npm ci with retry
-description: Run npm ci with retries for transient registry/network failures.
-runs:
-  using: composite
-  steps:
-    - shell: bash
-      run: |
-        set -euo pipefail
-
-        max_attempts=3
-        delay_seconds=20
-
-        for attempt in $(seq 1 "$max_attempts"); do
-          if [ "$attempt" -gt 1 ]; then
-            echo "npm ci attempt $attempt/$max_attempts after transient failure"
-          fi
-
-          if npm ci; then
-            exit 0
-          fi
-
-          exit_code=$?
-          if [ "$attempt" -eq "$max_attempts" ]; then
-            exit "$exit_code"
-          fi
-
-          sleep "$delay_seconds"
-          delay_seconds=$((delay_seconds * 2))
-        done
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -24,20 +24,6 @@ updates:
        update-types: ["version-update:semver-major"]
      - dependency-name: "eslint-config-next"
        update-types: ["version-update:semver-major"]
-      # jscpd v5 is a Rust rewrite (native binary, no Node.js programmatic API).
-      # scripts/check/check-duplication.mjs is deliberately pinned to jscpd@4 (it
-      # parses jscpd-report.json against a frozen baseline). A v5 major would break
-      # the duplication gate — migrate the gate intentionally, not via dependabot.
-      - dependency-name: "jscpd"
-        update-types: ["version-update:semver-major"]
-      # @huggingface/transformers is HARD-PINNED at 3.5.2 (exact, no caret) — FROZEN.
-      # It is load-bearing for the LLMLingua ONNX compression engine (open-sse/services/
-      # compression/engines/llmlingua/ — worker.ts pins @huggingface/transformers@3.5.2)
-      # and for local memory embeddings (src/lib/memory/embedding/transformersLocal.ts),
-      # and was VPS-validated at 3.5.2 (#4014). 4.x breaks both, and even 3.x minors must
-      # be re-validated on the VPS — so freeze ALL auto-bumps (no update-types = ignore
-      # every version). Migrate it intentionally, not via dependabot (#4050).
-      - dependency-name: "@huggingface/transformers"

  - package-ecosystem: "github-actions"
    directory: "/"
--- a/.github/workflows/build-fork.yml
+++ b/.github/workflows/build-fork.yml
@@ -25,9 +25,7 @@ jobs:
      packages: write
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v6

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,74 +21,6 @@ env:
  CI_NODE_26_VERSION: "26"

 jobs:
-  changes:
-    name: Change Classification
-    runs-on: ubuntu-latest
-    outputs:
-      code: ${{ steps.classify.outputs.code }}
-      docs: ${{ steps.classify.outputs.docs }}
-      i18n: ${{ steps.classify.outputs.i18n }}
-      workflow: ${{ steps.classify.outputs.workflow }}
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-        with:
-          persist-credentials: false
-          fetch-depth: 0
-      - id: classify
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          if [ "$EVENT_NAME" != "pull_request" ]; then
-            {
-              echo "code=true"
-              echo "docs=true"
-              echo "i18n=true"
-              echo "workflow=true"
-            } >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          code=false
-          docs=false
-          i18n=false
-          workflow=false
-
-          git diff --name-only "$BASE_SHA" "$HEAD_SHA" > changed-files.txt
-
-          while IFS= read -r file; do
-            case "$file" in
-              .github/workflows/*|.zizmor.yml)
-                workflow=true
-                code=true
-                ;;
-              docs/*|*.md)
-                docs=true
-                ;;
-              src/i18n/*|src/i18n/messages/*|scripts/i18n/*|config/i18n.json)
-                i18n=true
-                code=true
-                ;;
-              src/*|open-sse/*|bin/*|electron/*|tests/*|scripts/*|package.json|package-lock.json|tsconfig*.json|next.config.*|vitest*.config.*|playwright.config.*)
-                code=true
-                ;;
-              db/*|config/*)
-                code=true
-                ;;
-              *)
-                code=true
-                ;;
-            esac
-          done < changed-files.txt
-
-          {
-            echo "code=$code"
-            echo "docs=$docs"
-            echo "i18n=$i18n"
-            echo "workflow=$workflow"
-          } >> "$GITHUB_OUTPUT"
-
  lint:
    name: Lint
    runs-on: ubuntu-latest
@@ -99,14 +31,12 @@ jobs:
      API_KEY_SECRET: ci-lint-api-key-secret-long
      DISABLE_SQLITE_AUTO_BACKUP: "true"
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
+      - run: npm ci
      - run: npm run check:node-runtime
      - run: npm run audit:deps
      - run: npm run lint
@@ -127,8 +57,7 @@ jobs:
      - run: npm run check:tracked-artifacts
      - run: npm run check:lockfile
      - run: npm run check:licenses
-      # check:docs-sync is run by the docs-sync-strict job (via check:docs-all) and the
-      # husky pre-commit hook; the standalone copy here was redundant (ROI dedup).
+      - run: npm run check:docs-sync
      - run: npm run typecheck:core
      # typecheck:noimplicit:core is a forward-looking gate (noImplicitAny).
      # Run informationally for now — many pre-existing call sites still need
@@ -140,36 +69,21 @@ jobs:
    name: Quality Ratchet
    runs-on: ubuntu-latest
    needs: test-coverage
-    # Run even when test-coverage was SKIPPED/FAILED (e.g. a single flaky Coverage
-    # Shard breaks the shard→coverage→ratchet chain). The DETERMINISTIC ratchets
-    # (eslint / complexity / cognitive-complexity / duplication / codeql) do NOT need
-    # the coverage artifact and MUST still run so cycle drift is measured on the
-    # release PR — otherwise a flake silently skips the whole gate (incident: v3.8.36
-    # release PR #4854, where the drift cascade only surfaced post-merge in #5029).
-    # The coverage.* metrics degrade gracefully: the download is continue-on-error and
-    # the ratchet runs with --allow-missing, so absent coverage is skipped, not failed.
-    if: ${{ !cancelled() }}
+    if: ${{ always() && needs.test-coverage.result == 'success' }}
    # security-events: read lets the CodeQL ratchet read open code-scanning alerts
    # via `gh api .../code-scanning/alerts`. contents: read keeps checkout working.
    permissions:
      contents: read
      security-events: read
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
+      - run: npm ci
      # Coverage mergeada (coverage-summary.json) p/ o ratchet de cobertura.
-      # continue-on-error: o artifact pode não existir se a job test-coverage foi
-      # SKIPPED (shard flaky). Nesse caso collect-metrics pula coverage.* (ausente sem
-      # erro) e o ratchet roda com --allow-missing — as métricas determinísticas
-      # (eslint/complexity/cognitive) seguem BLOQUEANTES.
      - uses: actions/download-artifact@v8
-        continue-on-error: true
        with:
          name: coverage-report
          path: coverage/
@@ -177,19 +91,17 @@ jobs:
      # Catraca: falha se qualquer métrica regredir vs quality-baseline.json (commitado).
      # Hoje: contagem de warnings do ESLint. Fase 4 estende com cobertura (lida do
      # coverage mergeado). Tamanho de arquivo e duplicação têm gates dedicados.
-      # --allow-missing: pula métricas do baseline ausentes do collect (coverage.* quando
-      # o artifact não veio) em vez de falhar — mantém os gates determinísticos ativos.
      - name: Ratchet check
-        run: node scripts/quality/check-quality-ratchet.mjs --allow-missing --summary .artifacts/quality-ratchet.md
-      # Fase 6A.5: require-tighten — BLOQUEANTE (promovido de advisory no fim do ciclo
-      # v3.8.27). Falha quando uma métrica MELHOROU sem o baseline ter sido apertado no
-      # mesmo PR (força capturar ganhos permanentes). As métricas coverage.* carregam
-      # tightenSlack para o gap anti-flake (CI mergeado > baseline) não disparar falso-
-      # positivo. Verificado limpo (exit 0) no tip de release/v3.8.27 com a cobertura
-      # mergeada == baseline (ver a nota _require_tighten_flip_blocking em
-      # config/quality/quality-baseline.json).
-      - name: Require-tighten (blocking)
-        run: node scripts/quality/check-quality-ratchet.mjs --allow-missing --require-tighten
+        run: node scripts/quality/check-quality-ratchet.mjs --summary .artifacts/quality-ratchet.md
+      # Fase 6A.5: require-tighten — ADVISORY por enquanto (continue-on-error). Reporta
+      # quando uma métrica MELHOROU sem o baseline ter sido apertado no mesmo PR (força
+      # capturar ganhos permanentes). As métricas coverage.* carregam tightenSlack para
+      # o gap anti-flake (CI mergeado > baseline) não disparar falso-positivo. Promover a
+      # BLOQUEANTE no fim do ciclo removendo o `continue-on-error` (ver a nota
+      # _require_tighten_advisory em config/quality/quality-baseline.json).
+      - name: Require-tighten (advisory — flip to blocking at cycle-end)
+        continue-on-error: true
+        run: node scripts/quality/check-quality-ratchet.mjs --require-tighten
      # Catraca de duplicação (jscpd@4 sobre src+open-sse). Roda neste job (paralelo)
      # para não pesar no caminho crítico do lint.
      - name: Duplication ratchet
@@ -205,8 +117,6 @@ jobs:
        run: npm run check:cognitive-complexity
      - name: Type coverage ratchet
        run: npm run check:type-coverage
-      - name: Compression budget ratchet (F2.4 / N4)
-        run: npm run check:compression-budget
      # CodeQL alerts ratchet — BLOQUEANTE (promovido de advisory na v3.8.26).
      # Lê metrics.codeqlAlerts.value de quality-baseline.json e sai 1 SOMENTE numa
      # regressão real (alertas abertos > baseline). Falha de medição (gh/auth/api)
@@ -242,17 +152,16 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      # fetch-depth: 0 — the OpenAPI breaking-change gate (oasdiff) reads the base
-      # spec via `git show <base_ref>:docs/openapi.yaml`; a shallow clone
+      # spec via `git show <base_ref>:docs/reference/openapi.yaml`; a shallow clone
      # would lack the base ref and the gate would self-skip (base-unresolved).
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
        with:
-          persist-credentials: false
          fetch-depth: 0
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
+      - run: npm ci
      # Dead-code, cognitive-complexity, type-coverage foram promovidos ao job
      # quality-gate (bloqueante) na Fase 7 INT — não rodam aqui para evitar duplo custo.
      - name: Circular deps (dpdm; advisory)
@@ -318,14 +227,9 @@ jobs:
      # is absent (a missing binary never blocks).
      - name: Secret scan (gitleaks, ratchet, blocking)
        run: npm run check:secrets -- --ratchet
-      # BLOCKING ratchet (v3.8.27 cycle-end): vulnCount must not regress vs the
-      # baseline. --ratchet exits 1 on a measured regression (measured > baseline);
-      # it SKIPs (exit 0) when osv-scanner is absent or osv.dev is unreachable (a
-      # missing/failed measurement never blocks). See the CVE-variance note in
-      # docs/security/SUPPLY_CHAIN.md — a newly-disclosed CVE on an unchanged dep can
-      # red this gate; the fix is to bump the dep or re-baseline metrics.vulnCount.
-      - name: Vulnerability ratchet (osv-scanner, ratchet, blocking)
-        run: npm run check:vuln-ratchet -- --ratchet
+      - name: Vulnerability ratchet (osv-scanner; advisory, skips if absent)
+        continue-on-error: true
+        run: npm run check:vuln-ratchet
      # BLOCKING ratchet (Etapa 2): zizmorFindings must not regress vs the baseline.
      # ONLY zizmor is ratcheted — actionlint findings are reported, not blocking.
      # --ratchet exits 1 on a measured zizmor regression; it SKIPs (exit 0) when
@@ -333,29 +237,26 @@ jobs:
      - name: Workflow lint (actionlint+zizmor, ratchet, blocking)
        run: npm run check:workflows -- --ratchet
      # OpenAPI breaking-change detection (oasdiff). Diffs the PR's public API
-      # contract (docs/openapi.yaml) against the base branch's spec.
-      # BLOCKING ratchet (Fase 9 Onda 0): reads metrics.openapiBreaking.value and
-      # exits 1 ONLY on a measured regression (count > baseline). It SKIPs (exit 0)
-      # when oasdiff is absent or the base spec can't be resolved — a missing
-      # measurement never blocks. BASE_REF is read by the script from the env
-      # (never interpolated into a shell body) — workflow-injection-safe.
-      - name: OpenAPI breaking-change (oasdiff, ratchet, blocking)
+      # contract (docs/reference/openapi.yaml) against the base branch's spec.
+      # ADVISORY: reports `openapiBreaking=N` and self-skips when oasdiff is absent
+      # or the base spec can't be resolved. BASE_REF is read by the script from the
+      # env (never interpolated into a shell body) — workflow-injection-safe.
+      - name: OpenAPI breaking-change (oasdiff; advisory)
+        continue-on-error: true
        env:
          BASE_REF: ${{ github.base_ref }}
-        run: npm run check:openapi-breaking -- --ratchet
+        run: npm run check:openapi-breaking

  docs-sync-strict:
    name: Docs Sync (Strict)
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
+      - run: npm ci
      - run: npm run check:docs-all
      # Previously-orphaned contract gates (existed as files, never wired anywhere).
      # All exit 0 today: cli-i18n is a hard gate, openapi-coverage is a ratchet
@@ -380,9 +281,7 @@ jobs:
    # existing doc corpus is brought up to style. Promote to blocking once it converges.
    continue-on-error: true
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
@@ -403,14 +302,12 @@ jobs:
    name: i18n UI Coverage
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
+      - run: npm ci
      - run: node scripts/i18n/check-ui-keys-coverage.mjs --threshold=65

  i18n-matrix:
@@ -419,9 +316,7 @@ jobs:
    outputs:
      langs: ${{ steps.langs.outputs.langs }}
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - id: langs
        run: |
          LANG_DIR="src/i18n/messages"
@@ -438,9 +333,7 @@ jobs:
        lang: ${{ fromJson(needs.i18n-matrix.outputs.langs) }}
    needs: i18n-matrix
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
@@ -467,9 +360,8 @@ jobs:
    if: ${{ github.event_name == 'pull_request' }}
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
        with:
-          persist-credentials: false
          fetch-depth: 0
      - uses: actions/setup-node@v6
        with:
@@ -496,40 +388,28 @@ jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
-    needs: changes
-    if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.code == 'true' }}
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
+      - run: npm ci
      - run: npm run check:node-runtime
-      - name: Cache Next.js build cache
-        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8
-        with:
-          path: .build/next/cache
-          key: nextjs-${{ runner.os }}-node-${{ env.CI_NODE_VERSION }}-${{ hashFiles('package-lock.json') }}-${{ hashFiles('src/**/*', 'open-sse/**/*', 'db/**/*', 'next.config.mjs', 'tsconfig*.json', 'postcss.config.*', 'tailwind.config.*') }}
-          restore-keys: |
-            nextjs-${{ runner.os }}-node-${{ env.CI_NODE_VERSION }}-${{ hashFiles('package-lock.json') }}-
      - run: npm run build
-      - name: Archive Next.js build for downstream jobs
+      - name: Archive Next.js build for E2E shards
        # Use tar so the archive preserves paths relative to CWD (.build/next/...).
        # upload-artifact path-stripping is ambiguous when exclude patterns are used;
        # an explicit tar avoids the double-nesting issue (.build/next/next/...).
-        # Keep standalone/node_modules intact: package/electron jobs consume the
-        # Next-traced standalone tree and must not replace it with root node_modules.
        run: |
          tar -czf /tmp/e2e-build.tar.gz \
+            --exclude='.build/next/standalone/node_modules' \
            --exclude='.build/next/cache' \
            .build/next
-      - name: Upload Next.js build for downstream jobs
+      - name: Upload Next.js build for E2E shards
        uses: actions/upload-artifact@v7
        with:
-          name: next-build
+          name: e2e-next-build
          path: /tmp/e2e-build.tar.gz
          retention-days: 1

@@ -540,25 +420,15 @@ jobs:
    env:
      JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
+      - run: npm ci
      - run: npm run check:node-runtime
-      - name: Download Next.js build artifact
-        uses: actions/download-artifact@v8
-        with:
-          name: next-build
-          path: /tmp/
-      - name: Extract Next.js build artifact
-        run: |
-          tar -xzf /tmp/e2e-build.tar.gz
-      # build:cli consumes the downloaded .build/next standalone artifact and assembles dist/;
-      # it only rebuilds if the downloaded standalone artifact is missing.
+      # build:cli runs a clean build into .build/next and assembles dist/
+      # For release builds prefer: npm run build:release (clean rebuild + HEAD sentinel)
      - run: npm run build:cli
      - name: Assert dist/server.js exists
        run: test -f dist/server.js || (echo "dist/server.js missing — build:cli did not assemble correctly" && exit 1)
@@ -573,23 +443,14 @@ jobs:
      JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
      CSC_IDENTITY_AUTO_DISCOVERY: "false"
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
+      - run: npm ci
      - run: npm run check:node-runtime
-      - name: Download Next.js build artifact
-        uses: actions/download-artifact@v8
-        with:
-          name: next-build
-          path: /tmp/
-      - name: Extract Next.js build artifact
-        run: |
-          tar -xzf /tmp/e2e-build.tar.gz
+      - run: npm run build
      - name: Install Electron dependencies
        working-directory: electron
        run: npm install --no-audit --no-fund
@@ -615,16 +476,14 @@ jobs:
      API_KEY_SECRET: ci-test-api-key-secret-long
      DISABLE_SQLITE_AUTO_BACKUP: "true"
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
+      - run: npm ci
      - run: npm run check:node-runtime
-      - run: node --max-old-space-size=4096 --import tsx --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 --test-shard=${{ matrix.shard }}/8 tests/unit/*.test.ts "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui,usage}/**/*.test.ts"
+      - run: node --max-old-space-size=4096 --import tsx --test --test-force-exit --test-concurrency=4 --test-shard=${{ matrix.shard }}/8 tests/unit/*.test.ts "tests/unit/{api,auth,authz,build,cli,cli-helper,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui}/**/*.test.ts"

  test-vitest:
    name: Vitest (MCP / autoCombo / UI components)
@@ -636,14 +495,12 @@ jobs:
      API_KEY_SECRET: ci-test-api-key-secret-long
      DISABLE_SQLITE_AUTO_BACKUP: "true"
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
+      - run: npm ci
      # The second test runner (CLAUDE.md: "Both test runners must pass") — was never
      # wired into CI until the 2026-06-09 quality audit (Fase 6A.2).
      - run: npm run test:vitest
@@ -654,82 +511,52 @@ jobs:
        continue-on-error: true

  node-24-compat:
-    name: Node 24 Compatibility Tests (${{ matrix.shard }}/4)
+    name: Node 24 Compatibility (${{ matrix.shard }}/2)
    runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 15
    needs: build
    strategy:
      fail-fast: false
      matrix:
-        shard: [1, 2, 3, 4]
+        shard: [1, 2]
    env:
      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
      API_KEY_SECRET: ci-test-api-key-secret-long
      DISABLE_SQLITE_AUTO_BACKUP: "true"
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.CI_NODE_24_VERSION }}
          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
+      - run: npm ci
      - run: npm run check:node-runtime
-      - run: node --max-old-space-size=4096 --import tsx --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 --test-shard=${{ matrix.shard }}/4 tests/unit/*.test.ts "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui,usage}/**/*.test.ts"
-
-  node-26-compat-build:
-    name: Node 26 Compatibility Build
-    runs-on: ubuntu-latest
-    timeout-minutes: 25
-    needs: build
-    env:
-      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
-      API_KEY_SECRET: ci-test-api-key-secret-long
-      DISABLE_SQLITE_AUTO_BACKUP: "true"
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v6
-        with:
-          node-version: ${{ env.CI_NODE_26_VERSION }}
-          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
-      - run: npm run check:node-runtime
-      - name: Cache Next.js build cache
-        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8
-        with:
-          path: .build/next/cache
-          key: nextjs-${{ runner.os }}-node-${{ env.CI_NODE_26_VERSION }}-${{ hashFiles('package-lock.json') }}-${{ hashFiles('src/**/*', 'open-sse/**/*', 'db/**/*', 'next.config.mjs', 'tsconfig*.json', 'postcss.config.*', 'tailwind.config.*') }}
-          restore-keys: |
-            nextjs-${{ runner.os }}-node-${{ env.CI_NODE_26_VERSION }}-${{ hashFiles('package-lock.json') }}-
      - run: npm run build
+      - run: node --import tsx --test --test-force-exit --test-concurrency=4 --test-shard=${{ matrix.shard }}/2 tests/unit/*.test.ts "tests/unit/{api,auth,authz,build,cli,cli-helper,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui}/**/*.test.ts"

  node-26-compat:
-    name: Node 26 Compatibility Tests (${{ matrix.shard }}/4)
+    name: Node 26 Compatibility (${{ matrix.shard }}/2)
    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    needs: node-26-compat-build
+    timeout-minutes: 15
+    needs: build
    strategy:
      fail-fast: false
      matrix:
-        shard: [1, 2, 3, 4]
+        shard: [1, 2]
    env:
      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
      API_KEY_SECRET: ci-test-api-key-secret-long
      DISABLE_SQLITE_AUTO_BACKUP: "true"
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.CI_NODE_26_VERSION }}
          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
+      - run: npm ci
      - run: npm run check:node-runtime
-      - run: node --max-old-space-size=4096 --import tsx --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 --test-shard=${{ matrix.shard }}/4 tests/unit/*.test.ts "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui,usage}/**/*.test.ts"
+      - run: npm run build
+      - run: node --import tsx --test --test-force-exit --test-concurrency=4 --test-shard=${{ matrix.shard }}/2 tests/unit/*.test.ts "tests/unit/{api,auth,authz,build,cli,cli-helper,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui}/**/*.test.ts"

  test-coverage-shard:
    name: Coverage Shard (${{ matrix.shard }}/8)
@@ -745,14 +572,12 @@ jobs:
      API_KEY_SECRET: ci-test-api-key-secret-long
      DISABLE_SQLITE_AUTO_BACKUP: "true"
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
+      - run: npm ci
      - run: npm run check:node-runtime
      - name: Run c8 over shard ${{ matrix.shard }}/8
        run: |
@@ -769,8 +594,8 @@ jobs:
            --reporter=json \
            --exclude=tests/** \
            --exclude=**/*.test.* \
-            node --max-old-space-size=4096 --import tsx --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 \
-              --test-shard=${{ matrix.shard }}/8 tests/unit/*.test.ts "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui,usage}/**/*.test.ts"
+            node --max-old-space-size=4096 --import tsx --test --test-force-exit --test-concurrency=4 \
+              --test-shard=${{ matrix.shard }}/8 tests/unit/*.test.ts "tests/unit/{api,auth,authz,build,cli,cli-helper,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui}/**/*.test.ts"
      - name: Upload raw shard coverage
        if: always()
        uses: actions/upload-artifact@v7
@@ -784,19 +609,17 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs: test-coverage-shard
-    if: ${{ !cancelled() && needs.test-coverage-shard.result == 'success' }}
+    if: ${{ always() && needs.test-coverage-shard.result == 'success' }}
    env:
      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
      API_KEY_SECRET: ci-test-api-key-secret-long
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
+      - run: npm ci
      - name: Download all shard coverage
        uses: actions/download-artifact@v8
        with:
@@ -804,18 +627,14 @@ jobs:
          path: coverage-shards/
          merge-multiple: true
      - name: Merge + report + gate
-        # Merging 8 shards of raw v8 coverage is memory-heavy. `--merge-async`
-        # keeps the V8 coverage merge incremental instead of loading every raw
-        # JSON blob into one in-memory merge, which avoids Node heap OOMs.
+        # Merging 8 shards of raw v8 coverage is memory-heavy; the 6 GB heap can
+        # still OOM on large PR runs. Keep this job focused on the gate and
+        # JSON summary that downstream ratchets consume.
        env:
          NODE_OPTIONS: --max-old-space-size=8192
        run: |
          mkdir -p coverage
-          first_coverage_file=""
-          if [ -d coverage-shards ]; then
-            first_coverage_file="$(find coverage-shards -maxdepth 1 -type f -name '*.json' -print -quit)"
-          fi
-          if [ -z "$first_coverage_file" ]; then
+          if [ ! -d coverage-shards ] || ! find coverage-shards -maxdepth 1 -type f -name '*.json' | grep -q .; then
            echo "::error::No raw coverage shard data was downloaded."
            find . -maxdepth 3 -type f | sort
            exit 1
@@ -829,7 +648,6 @@ jobs:
          npx c8 report \
            --temp-directory coverage-shards \
            --reports-dir coverage \
-            --merge-async \
            --reporter=text-summary \
            --reporter=json-summary \
            --exclude=tests/** \
@@ -861,21 +679,19 @@ jobs:
          path: |
            coverage/coverage-summary.json
            coverage/coverage-report.md
-            coverage/lcov.info
          if-no-files-found: warn

  sonarqube:
    name: SonarQube
    runs-on: ubuntu-latest
    needs: test-coverage
-    if: ${{ !cancelled() && needs.test-coverage.result == 'success' }}
+    if: ${{ always() && needs.test-coverage.result == 'success' }}
    env:
      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
      SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
        with:
-          persist-credentials: false
          fetch-depth: 0
      - uses: actions/download-artifact@v8
        with:
@@ -899,9 +715,8 @@ jobs:
  coverage-pr-comment:
    name: PR Coverage Comment
    runs-on: ubuntu-latest
-    if: ${{ !cancelled() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false && needs.changes.outputs.code == 'true' }}
+    if: ${{ always() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false }}
    needs:
-      - changes
      - pr-test-policy
      - test-coverage
    permissions:
@@ -994,17 +809,15 @@ jobs:
      DISABLE_SQLITE_AUTO_BACKUP: "true"
      OMNIROUTE_PLAYWRIGHT_SKIP_BUILD: "1"
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
+      - run: npm ci
      - run: npm run check:node-runtime
      - name: Cache Playwright browsers
-        uses: actions/cache@v6.0.0
+        uses: actions/cache@v5
        with:
          path: ~/.cache/ms-playwright
          key: playwright-chromium-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
@@ -1013,11 +826,12 @@ jobs:
      - name: Download Next.js build artifact
        uses: actions/download-artifact@v8
        with:
-          name: next-build
+          name: e2e-next-build
          path: /tmp/
-      - name: Extract Next.js build artifact
+      - name: Extract Next.js build and restore standalone node_modules
        run: |
          tar -xzf /tmp/e2e-build.tar.gz
+          cp -r node_modules .build/next/standalone/node_modules
      - run: npx playwright test tests/e2e/*.spec.ts --shard=${{ matrix.shard }}/9

  test-integration:
@@ -1036,16 +850,14 @@ jobs:
      DATA_DIR: /tmp/omniroute-ci-${{ matrix.shard }}
      DISABLE_SQLITE_AUTO_BACKUP: "true"
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
+      - run: npm ci
      - run: npm run check:node-runtime
-      - run: node --import tsx --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=1 --test-shard=${{ matrix.shard }}/2 tests/integration/*.test.ts
+      - run: node --import tsx --test --test-force-exit --test-concurrency=1 --test-shard=${{ matrix.shard }}/2 tests/integration/*.test.ts

  test-security:
    name: Security Tests
@@ -1056,34 +868,31 @@ jobs:
      API_KEY_SECRET: ci-test-api-key-secret-long
      DISABLE_SQLITE_AUTO_BACKUP: "true"
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
+      - run: npm ci
      - run: npm run check:node-runtime
      - run: npm run test:security

  ci-summary:
    name: CI Dashboard
    runs-on: ubuntu-latest
-    if: ${{ !cancelled() }}
+    if: always()
    needs:
-      - changes
      - lint
      - docs-sync-strict
      - i18n-ui-coverage
      - i18n
      - pr-test-policy
+
      - build
      - package-artifact
      - electron-package-smoke
      - test-unit
      - node-24-compat
-      - node-26-compat-build
      - node-26-compat
      - test-coverage
      - sonarqube
@@ -1120,11 +929,11 @@ jobs:
          echo "## 🧱 Core Checks" >> "$GITHUB_STEP_SUMMARY"
          echo "| Job | Status |" >> "$GITHUB_STEP_SUMMARY"
          echo "|-----|--------|" >> "$GITHUB_STEP_SUMMARY"
-          echo "| Change Classification | $(status '${{ needs.changes.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Lint | $(status '${{ needs.lint.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Docs Sync (Strict) | $(status '${{ needs.docs-sync-strict.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| i18n UI Coverage | $(status '${{ needs.i18n-ui-coverage.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| PR Test Policy | $(status '${{ needs.pr-test-policy.result }}') |" >> "$GITHUB_STEP_SUMMARY"
+
          echo "| SonarQube | $(status '${{ needs.sonarqube.result }}') |" >> "$GITHUB_STEP_SUMMARY"

          echo "" >> "$GITHUB_STEP_SUMMARY"
@@ -1134,15 +943,14 @@ jobs:
          echo "| Build Matrix | $(status '${{ needs.build.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Package Artifact | $(status '${{ needs.package-artifact.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Electron Package Smoke | $(status '${{ needs.electron-package-smoke.result }}') |" >> "$GITHUB_STEP_SUMMARY"
-          echo "| Node 26 Compatibility Build | $(status '${{ needs.node-26-compat-build.result }}') |" >> "$GITHUB_STEP_SUMMARY"

          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "## 🧪 Tests" >> "$GITHUB_STEP_SUMMARY"
          echo "| Suite | Status |" >> "$GITHUB_STEP_SUMMARY"
          echo "|-------|--------|" >> "$GITHUB_STEP_SUMMARY"
          echo "| Unit | $(status '${{ needs.test-unit.result }}') |" >> "$GITHUB_STEP_SUMMARY"
-          echo "| Node 24 Compatibility Tests | $(status '${{ needs.node-24-compat.result }}') |" >> "$GITHUB_STEP_SUMMARY"
-          echo "| Node 26 Compatibility Tests | $(status '${{ needs.node-26-compat.result }}') |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Node 24 Compatibility | $(status '${{ needs.node-24-compat.result }}') |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Node 26 Compatibility | $(status '${{ needs.node-26-compat.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Coverage | $(status '${{ needs.test-coverage.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| PR Coverage Comment | $(status '${{ needs.coverage-pr-comment.result }}') |" >> "$GITHUB_STEP_SUMMARY"
          echo "| E2E | $(status '${{ needs.test-e2e.result }}') |" >> "$GITHUB_STEP_SUMMARY"
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -30,9 +30,8 @@ jobs:
      actions: read # Required for Claude to read CI results on PRs
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
        with:
-          persist-credentials: false
          fetch-depth: 1

      - name: Run Claude Code
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,31 +0,0 @@
-name: CodeQL
-# OWNER ACTION REQUIRED before enabling auto-triggers: advanced CodeQL conflicts with
-# GitHub "default setup" — the analyze step fails with "CodeQL analyses from advanced
-# configurations cannot be processed when the default setup is enabled". Switch repo
-# Settings → Code security → CodeQL from Default to Advanced, THEN restore the
-# push/pull_request/schedule triggers below. Until then this only runs on manual dispatch
-# so it never produces a red check on PRs. (The codeqlAlerts ratchet keeps working via the
-# default setup's alerts in the meantime.)
-on:
-  workflow_dispatch:
-permissions:
-  contents: read
-jobs:
-  analyze:
-    name: Analyze (javascript-typescript)
-    runs-on: ubuntu-latest
-    permissions:
-      security-events: write
-      actions: read
-      contents: read
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-      - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
-        with:
-          languages: javascript-typescript
-          queries: security-extended
-      - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
-        with:
-          category: "/language:javascript-typescript"
--- a/.github/workflows/dast-smoke.yml
+++ b/.github/workflows/dast-smoke.yml
@@ -1,62 +0,0 @@
-name: DAST smoke (PR)
-on:
-  pull_request:
-    branches: ["main", "release/**"]
-permissions:
-  contents: read
-jobs:
-  dast-smoke:
-    runs-on: ubuntu-latest
-    # ADVISORY while this new gate matures (repo convention: advisory -> blocking).
-    # Flip to blocking (remove continue-on-error) once it's proven stable across a few PRs.
-    continue-on-error: true
-    timeout-minutes: 12
-    env:
-      JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
-      API_KEY_SECRET: ci-api-key-secret-with-sufficient-length-aaaa
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "24"
-          cache: npm
-      - run: npm ci
-      - name: Build CLI bundle
-        run: npm run build:cli
-      - name: Start OmniRoute
-        env:
-          PORT: "20128"
-          INJECTION_GUARD_MODE: block
-        run: |
-          node dist/server.js > server.log 2>&1 &
-          echo $! > server.pid
-          for _ in $(seq 1 30); do
-            if curl -sf http://localhost:20128/api/monitoring/health >/dev/null; then echo up; break; fi
-            sleep 2
-          done
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-      - run: pip install schemathesis
-      - name: Schemathesis smoke (high-risk endpoints, blocking)
-        run: |
-          schemathesis run docs/openapi.yaml --url http://localhost:20128 \
-            --include-path-regex '^/v1/(chat/completions|models)$|^/api/(auth|keys)' \
-            --max-examples 8 --workers 4 --checks all --max-response-time 30 \
-            --request-timeout 20 --suppress-health-check all --no-color
-      - name: promptfoo injection-guard (blocking)
-        env:
-          OMNIROUTE_URL: http://localhost:20128
-          OMNIROUTE_API_KEY: not-needed-blocked-before-upstream
-        run: npx --yes promptfoo@latest eval -c promptfooconfig.yaml --no-cache
-      - name: Stop server
-        if: always()
-        run: kill "$(cat server.pid)" || true
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        if: always()
-        with:
-          name: dast-smoke-logs
-          path: server.log
-          retention-days: 7
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -42,9 +42,8 @@ jobs:
      IMAGE_NAME: diegosouzapw/omniroute
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
        with:
-          persist-credentials: false
          ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/tags/v{0}', inputs.version) || '' }}
          # Need full tag history for semver comparison when deciding :latest.
          fetch-depth: 0
@@ -98,13 +97,11 @@ jobs:
            PROMOTE="${PROMOTE_INPUT:-false}"
          else
            git fetch --tags --quiet || true
-            # Decide via the extracted helper, which folds VERSION into the
-            # candidate set so the result is independent of git-tag sync timing
-            # on `release` events (#5301). Without that, the freshly-created tag
-            # is often not yet visible here and :latest stays a release behind.
-            PROMOTE=$(git tag -l 'v[0-9]*' | bash scripts/ci/should-promote-latest.sh "$VERSION")
-            if [ "$PROMOTE" != "true" ]; then
-              echo "Version $VERSION is not the highest stable semver. Not promoting :latest."
+            HIGHEST=$(git tag -l 'v[0-9]*' | sed 's/^v//' | grep -vE -- '-(rc|alpha|beta|pre|next)' | sort -V | tail -1 || echo "")
+            if [ -n "$HIGHEST" ] && [ "$VERSION" = "$HIGHEST" ]; then
+              PROMOTE="true"
+            else
+              echo "Version $VERSION is not the highest semver tag (highest=${HIGHEST:-<none>}). Not promoting :latest."
            fi
          fi
          echo "promote_latest=$PROMOTE" >> "$GITHUB_OUTPUT"
@@ -145,9 +142,8 @@ jobs:
      GHCR_IMAGE_NAME: ghcr.io/diegosouzapw/omniroute
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
        with:
-          persist-credentials: false
          ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/tags/v{0}', inputs.version) || '' }}
          fetch-depth: 0

@@ -245,9 +241,8 @@ jobs:
      PROMOTE_LATEST: ${{ needs.prepare.outputs.promote_latest }}
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
        with:
-          persist-credentials: false
          ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/tags/v{0}', inputs.version) || '' }}
          fetch-depth: 0

@@ -344,53 +339,21 @@ jobs:
          output-file: sbom-image.cdx.json
          artifact-name: sbom-image.cdx.json

-      # Visibility scan: reports HIGH + CRITICAL into the SARIF (Security tab) but
-      # never blocks (exit-code 0). The blocking gate below narrows to CRITICAL.
-      #
-      # ignore-unfixed mirrors the blocking gate: the Security tab must surface only
-      # ACTIONABLE vulnerabilities — ones with a published fix we can pull by rebuilding
-      # on a patched base or bumping the dep. Without it the advisory upload floods the
-      # tab with unfixable base-image OS CVEs (Debian trixie packages with no upstream
-      # patch yet, overwhelmingly local-only and not reachable from the proxy request
-      # surface), which is noise an operator cannot act on. trivyignores points at the
-      # repo-root .trivyignore so accepted-risk fixable CVEs have one auditable home.
-      # See docs/security/SUPPLY_CHAIN.md.
-      - name: Trivy image scan (SARIF, advisory)
+      - name: Trivy image scan (advisory)
        if: needs.prepare.outputs.version != 'main'
        continue-on-error: true
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        uses: aquasecurity/trivy-action@v0.36.0
        with:
          image-ref: ${{ env.GHCR_IMAGE_NAME }}:${{ env.VERSION }}
          format: sarif
          output: trivy-results.sarif
          severity: HIGH,CRITICAL
-          ignore-unfixed: true
-          trivyignores: .trivyignore
          exit-code: "0"

-      # BLOCKING gate (v3.8.27 cycle-end): fail the release on a CRITICAL CVE in the
-      # published image. Narrowed to severity CRITICAL (HIGH stays visible in the
-      # SARIF step above, not blocking). ignore-unfixed:true so an unfixable base-image
-      # CVE with no upstream patch does not red the release (reduces false-blocks);
-      # a fixable CRITICAL still blocks. Per docs/security/SUPPLY_CHAIN.md. NB: Trivy
-      # scans against a CVE DB that grows continuously — a newly-disclosed CRITICAL on
-      # an unchanged base image can red this gate; the fix is to rebuild on a patched
-      # base, bump the dep, or add a justified .trivyignore entry (see the CVE-variance
-      # note in docs/security/SUPPLY_CHAIN.md).
-      - name: Trivy CRITICAL gate (blocking)
-        if: needs.prepare.outputs.version != 'main'
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-        with:
-          image-ref: ${{ env.GHCR_IMAGE_NAME }}:${{ env.VERSION }}
-          format: table
-          severity: CRITICAL
-          ignore-unfixed: true
-          exit-code: "1"
-
      - name: Upload Trivy SARIF to Security tab
        if: needs.prepare.outputs.version != 'main'
        continue-on-error: true
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-results.sarif
          category: trivy-image
--- a/.github/workflows/electron-release.yml
+++ b/.github/workflows/electron-release.yml
@@ -27,9 +27,8 @@ jobs:
      version: ${{ steps.validate.outputs.version }}
    steps:
      - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
        with:
-          persist-credentials: false
          fetch-depth: 0

      - name: Validate version format
@@ -52,7 +51,7 @@ jobs:
            echo "Error: Invalid version format. Expected: v1.6.8"
            exit 1
          fi
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "✓ Valid version: $VERSION"

  build:
@@ -84,9 +83,7 @@ jobs:
            deb_ext: .deb

    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - name: Setup Node
        uses: actions/setup-node@v6
        with:
@@ -94,7 +91,7 @@ jobs:
          cache: npm

      - name: Cache node_modules
-        uses: actions/cache@v6.0.0
+        uses: actions/cache@v5
        with:
          path: node_modules
          key: ${{ runner.os }}-node-${{ hashFiles('package-lock.json') }}
@@ -114,7 +111,7 @@ jobs:
          # that cause EPERM errors during Next.js standalone build glob scans.
          # Create a clean temp profile directory to avoid this.
          mkdir -p "$RUNNER_TEMP/home"
-          echo "USERPROFILE=$RUNNER_TEMP/home" >> "$GITHUB_ENV"
+          echo "USERPROFILE=$RUNNER_TEMP/home" >> $GITHUB_ENV

      - name: Build Next.js standalone
        env:
@@ -216,9 +213,8 @@ jobs:
      contents: write # softprops/action-gh-release creates the GitHub Release
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
        with:
-          persist-credentials: false
          fetch-depth: 0

      - name: Download all artifacts
@@ -272,11 +268,7 @@ jobs:
    name: Publish to npm
    needs: [validate, release]
    permissions:
-      # Must be `write`, not `read`: this job calls the reusable npm-publish.yml whose
-      # `publish` job needs `contents: write` (gh release upload — attach the SBOM, #3874).
-      # A reusable workflow's job cannot request more permission than the caller grants,
-      # so a `read` here makes GitHub reject the run at startup (startup_failure).
-      contents: write
+      contents: read
      id-token: write # npm provenance (forwarded to the reusable workflow)
      packages: write # publish to npm.pkg.github.com
    uses: ./.github/workflows/npm-publish.yml
--- a/.github/workflows/mutation-redundancy.yml
+++ b/.github/workflows/mutation-redundancy.yml
@@ -1,63 +0,0 @@
-name: Mutation Redundancy (disableBail, on-demand)
-# One-off measurement to UNBLOCK R1 (test-redundancy prune). The nightly mutation run
-# (nightly-mutation.yml) bails on the first kill, so `killedBy` lists only the FIRST
-# killer — 🟠 redundant is understated and 🟢 unique overstated (see the caveat in
-# scripts/quality/mutation-radiography.mjs). This workflow re-runs the SAME combo +
-# chatCore leaf batches with stryker.disablebail.json (disableBail:true, incremental:false)
-# so `killedBy` lists EVERY killer. Feed the uploaded reports to
-# `node scripts/quality/mutation-radiography.mjs --candidates mutation-nobail-*/mutation.json`
-# to get the accurate R1 prune-candidate list (🔴 empty ∪ 🟠 redundant) for human review.
-#
-# Batches mirror the nightly's leaf decomposition (d/e/f/g/h/i) rather than 2 mega-batches:
-# disableBail is MORE expensive than bail (it never stops early), and Stryker only writes
-# mutation.json on a SUCCESSFUL finish — a batch cancelled at the cap produces NO data — so
-# smaller batches each fit the 300min headroom and run in parallel. auth/accountFallback and
-# the security quartet are out of scope: R1 targets the combo/chatCore leaves.
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  stryker-nobail:
-    name: Stryker disableBail (batch ${{ matrix.batch.name }})
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        batch:
-          - name: d
-            mutate: "open-sse/services/combo/comboStructure.ts,open-sse/services/combo/autoStrategy.ts,open-sse/services/combo/validateQuality.ts"
-          - name: e
-            mutate: "open-sse/services/combo/shadowRouting.ts,open-sse/services/combo/targetSorters.ts,open-sse/services/combo/comboPredicates.ts,open-sse/services/combo/rrState.ts,open-sse/services/combo/comboData.ts"
-          - name: f
-            mutate: "open-sse/services/combo/quotaScoring.ts,open-sse/services/combo/quotaStrategies.ts"
-          - name: g
-            mutate: "open-sse/handlers/chatCore/comboContextCache.ts,open-sse/handlers/chatCore/idempotency.ts,open-sse/handlers/chatCore/passthroughHelpers.ts,open-sse/handlers/chatCore/responseHeaders.ts,open-sse/handlers/chatCore/sanitization.ts,open-sse/handlers/chatCore/upstreamTimeouts.ts"
-          - name: h
-            mutate: "open-sse/handlers/chatCore/headers.ts,open-sse/handlers/chatCore/logTruncation.ts,open-sse/handlers/chatCore/memoryExtraction.ts,open-sse/handlers/chatCore/nonStreamingSse.ts,open-sse/handlers/chatCore/passthroughToolNames.ts,open-sse/handlers/chatCore/executorHelpers.ts"
-          - name: i
-            mutate: "open-sse/handlers/chatCore/telemetryHelpers.ts,open-sse/handlers/chatCore/memorySkillsInjection.ts,open-sse/handlers/chatCore/semanticCache.ts"
-    timeout-minutes: 300
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v6
-        with:
-          node-version: "24"
-          cache: npm
-      - run: npm ci
-      - name: Run Stryker (disableBail)
-        env:
-          BATCH_MUTATE: ${{ matrix.batch.mutate }}
-        run: npx stryker run --config-file stryker.disablebail.json --mutate "$BATCH_MUTATE"
-      - name: Upload mutation report
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: mutation-nobail-${{ matrix.batch.name }}
-          path: reports/mutation/
-          if-no-files-found: warn
-          retention-days: 14
--- a/.github/workflows/nightly-llm-security.yml
+++ b/.github/workflows/nightly-llm-security.yml
@@ -12,9 +12,7 @@ jobs:
    name: promptfoo — injection guard (block mode, no secret)
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with: { node-version: "24", cache: npm }
      - run: npm ci
@@ -61,9 +59,7 @@ jobs:
            echo "run=false" >> "$GITHUB_OUTPUT"
            echo "::notice::PROMPTFOO_PROVIDER_KEY not set — skipping garak probes (advisory)."
          fi
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
        if: steps.gate.outputs.run == 'true'
      - uses: actions/setup-node@v6
        if: steps.gate.outputs.run == 'true'
@@ -86,7 +82,7 @@ jobs:
            if curl -sf http://localhost:20128/api/monitoring/health >/dev/null; then echo up; break; fi
            sleep 2
          done
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v5
        if: steps.gate.outputs.run == 'true'
        with: { python-version: "3.12" }
      - run: pip install garak
--- a/.github/workflows/nightly-mutation.yml
+++ b/.github/workflows/nightly-mutation.yml
@@ -9,155 +9,29 @@ permissions:

 jobs:
  stryker:
-    name: Stryker mutation (batch ${{ matrix.batch.name }} — advisory)
+    name: Stryker mutation testing (8 critical modules — advisory)
    runs-on: ubuntu-latest
-    # Mutation testing is expensive. History of the budget:
-    #   - Full 8-module set TIMED OUT at the 180min cap (run 27705123780 = exactly 180min).
-    #     The two god-files chatCore.ts/combo.ts dominated ~2/3 of the mutants and were
-    #     removed from stryker.conf.json `mutate`.
-    #   - The remaining 6 modules in 3 batches: auth.ts and accountFallback.ts are large; the
-    #     a (auth+publicCreds) and b (accountFallback+error) batches still ran near the 180min
-    #     cap (the perTest dry-run over ~130 covering test files is itself costly), so the two
-    #     big modules are now ISOLATED into their own batches (a=auth, b=accountFallback).
-    #   - Onda 3 / Fase 9 T5 re-add: combo.ts was split into 11 leaves; the 8 well-covered
-    #     combo/* leaves are back in `mutate` (covered by the 24 combo-*.test.ts), grouped into
-    #     2 batches (d=heavy, e=light). After #4204 (D7b) merged, the reset-aware quota pair
-    #     quotaScoring/quotaStrategies was added as batch f. A covering-test audit then added the
-    #     6 chatCore/* leaves with direct unit coverage as batch g. A follow-up then wrote dedicated
-    #     unit tests for 6 more leaves and added them as batch h. A final follow-up added dedicated
-    #     tests (no mock.module — fetch-override + crafted inputs + temp-DATA_DIR) for telemetryHelpers
-    #     + memorySkillsInjection + semanticCache (its cache-HIT block now has a setCachedResponse
-    #     fixture) as batch i — ALL 15/15 chatCore leaves are now mutated. See
-    #     _mutate_godfiles_excluded_comment in stryker.conf.json.
-    # 9 PARALLEL batches, each overriding the mutate set via `--mutate` (Stryker 9 CLI:
-    # `-m, --mutate <comma-list>`; the conf's `mutate[]` remains the local-run default/union).
-    #   - Cold-seeding budget (per-batch `timeout-minutes: ${{ matrix.batch.timeout || 180 }}`):
-    #     a COLD run must COMPLETE once to write stryker-incremental.json (Stryker writes it only on
-    #     a successful finish); a job cancelled at the cap writes nothing, so the next run is cold
-    #     again — an infinite never-seeds loop. actions/cache is also branch-scoped, so each branch
-    #     (incl. release) must seed its OWN cache via a run with enough headroom. Measured cold runs
-    #     Measured cold totals (run 27801802713, extrapolated from the % at the 180/350 cancel point):
-    #     auth ~375min (2301 mutants — EXCEEDS the 360min job max even isolated), accountFallback
-    #     ~358min (1441), the c security quartet ~348min (1163), d ~197min (1316), g=142, h=132, e=66,
-    #     f=45, i=33. The widely-covered modules blow the budget because the tap-runner re-runs every
-    #     covering test file per mutant (a perTest fixed cost over ~138 test files, times thousands of
-    #     mutants). A flat timeout bump cannot rescue auth (>360min max) — so the three over-budget
-    #     batches are SPLIT so each half fits: auth->a1/a2 and accountFallback->b1/b2 by mutation range
-    #     (`file:startLine-endLine`), the c quartet->c1/c2 by module pair. Splitting also seeds each
-    #     sub-batch's own incremental cache, after which nightlies re-test only changed mutants.
-    # Full coverage every night in parallel; wall-clock = the slowest batch's cold run until seeded.
-    # Runs at stryker concurrency=4 with per-process DATA_DIR isolation
-    # (tests/_setup/isolateDataDir.ts) — see _concurrency_comment in stryker.conf.json.
-    strategy:
-      fail-fast: false
-      matrix:
-        batch:
-          # Per-batch `timeout` (minutes) tiers the cold-seeding budget by measured cost; batches
-          # without the key default to 180. Cold-run profiling (run 27801802713) showed the
-          # widely-covered modules need FAR more than the 180 cap because the tap-runner re-runs every
-          # covering test file per mutant: auth ~375min (2301 mutants, EXCEEDS the 360min GitHub job
-          # max even isolated), accountFallback ~358min, the c security quartet ~348min — none fit a
-          # single job. So auth/accountFallback are split by MUTATION RANGE (`file:startLine-endLine`,
-          # ~half the mutants each) into a1/a2, b1/b2; the c quartet is split by MODULE pair into
-          # c1/c2. d (3 combo modules, ~197min) stays whole. Split-heavy batches get 300min headroom
-          # for their cold seeding run; once each batch completes once and writes
-          # stryker-incremental.json, later runs re-test only changed mutants and finish far faster.
-          # g/h (142/132min cold) keep a 240 buffer; e/f/i (33-66min) keep the 180 default.
-          - name: a1
-            mutate: "src/sse/services/auth.ts:1-1109"
-            timeout: 300
-          - name: a2
-            mutate: "src/sse/services/auth.ts:1110-2218"
-            timeout: 300
-          - name: b1
-            mutate: "open-sse/services/accountFallback.ts:1-863"
-            timeout: 300
-          - name: b2
-            mutate: "open-sse/services/accountFallback.ts:864-1726"
-            timeout: 300
-          - name: c1
-            mutate: "src/server/authz/routeGuard.ts,src/shared/utils/circuitBreaker.ts"
-            timeout: 300
-          - name: c2
-            mutate: "open-sse/utils/error.ts,open-sse/utils/publicCreds.ts"
-            timeout: 300
-          - name: d
-            mutate: "open-sse/services/combo/comboStructure.ts,open-sse/services/combo/autoStrategy.ts,open-sse/services/combo/validateQuality.ts"
-            timeout: 300
-          - name: e
-            mutate: "open-sse/services/combo/shadowRouting.ts,open-sse/services/combo/targetSorters.ts,open-sse/services/combo/comboPredicates.ts,open-sse/services/combo/rrState.ts,open-sse/services/combo/comboData.ts"
-          - name: f
-            mutate: "open-sse/services/combo/quotaScoring.ts,open-sse/services/combo/quotaStrategies.ts"
-          - name: g
-            mutate: "open-sse/handlers/chatCore/comboContextCache.ts,open-sse/handlers/chatCore/idempotency.ts,open-sse/handlers/chatCore/passthroughHelpers.ts,open-sse/handlers/chatCore/responseHeaders.ts,open-sse/handlers/chatCore/sanitization.ts,open-sse/handlers/chatCore/upstreamTimeouts.ts"
-            timeout: 240
-          - name: h
-            mutate: "open-sse/handlers/chatCore/headers.ts,open-sse/handlers/chatCore/logTruncation.ts,open-sse/handlers/chatCore/memoryExtraction.ts,open-sse/handlers/chatCore/nonStreamingSse.ts,open-sse/handlers/chatCore/passthroughToolNames.ts,open-sse/handlers/chatCore/executorHelpers.ts"
-            timeout: 240
-          - name: i
-            mutate: "open-sse/handlers/chatCore/telemetryHelpers.ts,open-sse/handlers/chatCore/memorySkillsInjection.ts,open-sse/handlers/chatCore/semanticCache.ts"
-    # Per-batch budget: split-heavy batches (a1/a2/b1/b2/c1/c2/d) override to 300min, g/h to 240min;
-    # the rest default to 180min. `matrix.batch.timeout` is null for batches without the key -> `|| 180`.
-    # NOTE: a1+a2 both mutate auth.ts (disjoint line ranges) and b1+b2 both mutate accountFallback.ts;
-    # when merging the per-batch mutation.json for radiography/scores, same-file mutants from sibling
-    # ranges must be UNIONED (scripts/check/check-mutation-ratchet.mjs::measureMutationScores and
-    # scripts/quality/mutation-radiography.mjs both merge per file).
-    timeout-minutes: ${{ matrix.batch.timeout || 180 }}
+    # Mutation testing is expensive (~200-500 mutants, 30-90 min). It runs only
+    # on the nightly schedule / manual dispatch, never on PRs. The score is NOT
+    # yet enforced as a ratchet (wired in a later INT phase) — for now the job
+    # just produces the HTML/JSON report and uploads it as an artifact.
+    timeout-minutes: 120
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: "24"
          cache: npm
      - run: npm ci
-      - name: Restore Stryker incremental cache
-        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
-        with:
-          path: reports/mutation/stryker-incremental.json
-          key: stryker-incremental-${{ matrix.batch.name }}-${{ github.run_id }}
-          restore-keys: stryker-incremental-${{ matrix.batch.name }}-
      - name: Run Stryker (advisory)
        id: stryker
        continue-on-error: true
-        env:
-          BATCH_MUTATE: ${{ matrix.batch.mutate }}
-        run: npx stryker run --mutate "$BATCH_MUTATE"
+        run: npx stryker run
      - name: Upload mutation report
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v4
        with:
-          name: mutation-report-${{ matrix.batch.name }}
+          name: mutation-report
          path: reports/mutation/
          if-no-files-found: warn
          retention-days: 14
-
-  # Aggregation gate (T3): each split batch emits a PARTIAL view of a mutated file
-  # (auth.ts lives in a1+a2, accountFallback in b1+b2), so a PER-BATCH ratchet would
-  # only ever see half a file vs the whole-file baseline. This job runs AFTER every
-  # batch, downloads all reports, and ratchets the MERGED per-module scores
-  # (check-mutation-ratchet UNIONS same-file mutants across reports) against the
-  # dedicatedGate `mutationScore.*` floors in quality-baseline.json (seeded ~2pt below
-  # the first full measurement). Blocking: a module dropping below its floor fails the
-  # run. Missing reports (e.g. an artifact-upload flake) are skipped, never failed.
-  mutation-ratchet:
-    name: Mutation score ratchet (blocking)
-    needs: stryker
-    if: always()
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v6
-        with:
-          node-version: "24"
-      - name: Download all mutation reports
-        uses: actions/download-artifact@v8
-        with:
-          pattern: mutation-report-*
-          path: reports/all
-      - name: Ratchet merged per-module mutation scores
-        run: node scripts/check/check-mutation-ratchet.mjs reports/all/*/mutation.json --ratchet
--- a/.github/workflows/nightly-property.yml
+++ b/.github/workflows/nightly-property.yml
@@ -10,9 +10,7 @@ jobs:
  property-random-seed:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: "24"
@@ -23,7 +21,7 @@ jobs:
        run: FC_SEED=random FC_NUM_RUNS=2000 npm run test:property
      - name: Open issue on failure
        if: failure()
-        uses: actions/github-script@v9
+        uses: actions/github-script@v7
        with:
          script: |
            await github.rest.issues.create({
--- a/.github/workflows/nightly-release-green.yml
+++ b/.github/workflows/nightly-release-green.yml
@@ -1,137 +0,0 @@
-name: Nightly Release-Green
-
-# Solution D — continuous, NON-BLOCKING drift signal for the active release branch.
-#
-# WHY: the full gate (ci.yml) only runs on the release PR (PR → main), so reds
-# accrue silently on release/** and explode — in layers — at release time. This
-# nightly reproduces the release-equivalent validation on the active release branch
-# HEAD and, when there are HARD failures, opens/updates a single tracking issue.
-#
-# It is NOT a required status check and never touches a contributor PR — it only
-# reports. Ratchet drift (eslint warnings / cognitive-complexity / file-size) is
-# expected mid-cycle and is reported but never raises the alarm on its own; only
-# real defects (typecheck / lint errors / unit / vitest / db-rules / public-creds /
-# package-artifact) flip the issue open.
-
-on:
-  schedule:
-    - cron: "23 5 * * *" # 05:23 UTC daily — off-peak, distinct from other nightlies
-  workflow_dispatch:
-    inputs:
-      branch:
-        description: "Release branch to validate (default: highest release/vX.Y.Z)"
-        required: false
-        type: string
-
-permissions:
-  contents: read
-  issues: write
-
-concurrency:
-  group: nightly-release-green
-  cancel-in-progress: true
-
-jobs:
-  release-green:
-    name: Validate active release branch
-    runs-on: ubuntu-latest
-    env:
-      JWT_SECRET: ci-nightly-secret-with-sufficient-length-for-validation
-      API_KEY_SECRET: ci-nightly-api-key-secret-long
-      DISABLE_SQLITE_AUTO_BACKUP: "true"
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Resolve active release branch
-        id: branch
-        env:
-          INPUT_BRANCH: ${{ github.event.inputs.branch }}
-        run: |
-          set -euo pipefail
-          if [ -n "${INPUT_BRANCH:-}" ]; then
-            TARGET="$INPUT_BRANCH"
-          else
-            # highest release/vX.Y.Z by semver among remote branches
-            TARGET=$(git for-each-ref --format='%(refname:short)' 'refs/remotes/origin/release/v*' \
-              | sed 's#origin/##' \
-              | sort -t/ -k2 -V \
-              | tail -1)
-          fi
-          if [ -z "$TARGET" ]; then echo "No release/v* branch found"; exit 1; fi
-          # Strict format guard — reject anything that isn't release/vX.Y.Z (blocks
-          # ref/command injection via the workflow_dispatch input).
-          if ! printf '%s' "$TARGET" | grep -qE '^release/v[0-9]+\.[0-9]+\.[0-9]+$'; then
-            echo "Refusing non-canonical branch name: $TARGET"; exit 1
-          fi
-          echo "target=$TARGET" >> "$GITHUB_OUTPUT"
-          echo "Active release branch: $TARGET"
-
-      - name: Checkout the release branch
-        env:
-          TARGET: ${{ steps.branch.outputs.target }}
-        run: |
-          set -euo pipefail
-          git checkout "$TARGET"
-          git log -1 --oneline
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version: "24"
-          cache: npm
-
-      - uses: ./.github/actions/npm-ci-retry
-
-      - name: Release-green validation (full)
-        id: validate
-        run: |
-          set +e
-          node scripts/quality/validate-release-green.mjs --json --with-build \
-            1> release-green.json 2> release-green.log
-          echo "exit=$?" >> "$GITHUB_OUTPUT"
-          echo "------- report -------"
-          cat release-green.log
-
-      - name: Open / update tracking issue on HARD failure
-        if: steps.validate.outputs.exit != '0'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          TARGET: ${{ steps.branch.outputs.target }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: |
-          set -euo pipefail
-          TITLE="🔴 Release branch not green: ${TARGET}"
-          {
-            echo "The nightly **release-green** validation found HARD failures on \`${TARGET}\`."
-            echo "These are real defects that would block the release PR — fix them in the"
-            echo "originating PR branch (via co-authorship), not by demanding it from contributors."
-            echo ""
-            echo "**Run:** ${RUN_URL}"
-            echo ""
-            echo '```'
-            sed -n '/──────── verdict ────────/,$p' release-green.log || tail -40 release-green.log
-            echo '```'
-            echo ""
-            echo "_Ratchet drift (eslint warnings / cognitive-complexity / file-size) listed above is expected mid-cycle and is rebaselined at release — it is NOT a contributor concern and did not, on its own, open this issue._"
-          } > issue-body.md
-
-          EXISTING=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open \
-            --search "in:title $TITLE" --json number --jq '.[0].number' 2>/dev/null || echo "")
-          if [ -n "$EXISTING" ]; then
-            gh issue comment "$EXISTING" --repo "$GITHUB_REPOSITORY" --body-file issue-body.md
-            echo "Updated existing issue #$EXISTING"
-          else
-            gh issue create --repo "$GITHUB_REPOSITORY" --title "$TITLE" --body-file issue-body.md
-          fi
-
-      - name: Upload report artifact
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: release-green-report
-          path: |
-            release-green.json
-            release-green.log
-          if-no-files-found: ignore
--- a/.github/workflows/nightly-resilience.yml
+++ b/.github/workflows/nightly-resilience.yml
@@ -12,9 +12,7 @@ jobs:
    name: Heap-growth gate
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: "24"
@@ -26,9 +24,7 @@ jobs:
    name: Resilience chaos (fault injection)
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: "24"
@@ -40,9 +36,7 @@ jobs:
    name: k6 load/soak
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: "24"
@@ -74,37 +68,3 @@ jobs:
      - name: Stop server
        if: always()
        run: kill "$(cat server.pid)" || true
-
-  a11y:
-    name: A11y axe (nightly, freeze-and-alert)
-    runs-on: ubuntu-latest
-    # The Playwright webServer (`start` mode) builds Next via build-next-isolated.mjs and
-    # boots the standalone server itself (waits on /api/monitoring/health, 15min webServer
-    # timeout). Unlike the per-PR test-e2e job, this nightly job has no pre-built artifact,
-    # so it self-builds — hence the generous job timeout. REQUIRE_AXE=1 makes the suite run
-    # the real axe analysis (the 4 page tests are gated to nightly so per-PR e2e stays fast)
-    # and makes the meta-test fail loudly if @axe-core/playwright ever goes missing.
-    timeout-minutes: 30
-    env:
-      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
-      API_KEY_SECRET: ci-test-api-key-secret-long
-      DISABLE_SQLITE_AUTO_BACKUP: "true"
-      REQUIRE_AXE: "1"
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v6
-        with:
-          node-version: "24"
-          cache: npm
-      - run: npm ci
-      - name: Cache Playwright browsers
-        uses: actions/cache@v6.0.0
-        with:
-          path: ~/.cache/ms-playwright
-          key: playwright-chromium-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
-          restore-keys: playwright-chromium-${{ runner.os }}-
-      - run: npx playwright install --with-deps chromium
-      - name: Run axe a11y suite (self-building webServer)
-        run: npx playwright test tests/e2e/a11y.spec.ts
--- a/.github/workflows/nightly-schemathesis.yml
+++ b/.github/workflows/nightly-schemathesis.yml
@@ -13,9 +13,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with: { node-version: "24", cache: npm }
      - run: npm ci
@@ -33,7 +31,7 @@ jobs:
            if curl -sf http://localhost:20128/api/monitoring/health >/dev/null; then echo "server up"; break; fi
            sleep 2
          done
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      - name: Install schemathesis
        run: pip install schemathesis
@@ -45,7 +43,7 @@ jobs:
        # PROVE the contract is fuzzable and surface regressions, not to gate the build.
        continue-on-error: true
        run: |
-          schemathesis run docs/openapi.yaml \
+          schemathesis run docs/reference/openapi.yaml \
            --url http://localhost:20128 \
            --max-examples 20 \
            --workers 4 \
@@ -62,7 +60,7 @@ jobs:
        run: kill "$(cat server.pid)" || true
      - name: Upload schemathesis report
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v4
        with:
          name: schemathesis-report
          path: |
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -55,9 +55,8 @@ jobs:
      packages: write # publish to npm.pkg.github.com
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
        with:
-          persist-credentials: false
          # Need full tag history to compare against highest semver when
          # deciding whether this release should claim dist-tag `latest`.
          fetch-depth: 0
@@ -202,11 +201,7 @@ jobs:
      id-token: write # npm provenance
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-          fetch-depth: 0
-          # Full history needed for auto-bump: git diff against previous release tag
+        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
@@ -214,47 +209,6 @@ jobs:
          node-version: ${{ env.NPM_PUBLISH_NODE_VERSION }}
          registry-url: https://registry.npmjs.org

-      - name: Auto-bump plugin version if plugin changed since last release
-        id: bump
-        working-directory: "@omniroute/opencode-plugin"
-        env:
-          CURRENT_TAG: ${{ github.ref_name }}
-        run: |
-          set -euo pipefail
-
-          PKG_VERSION=$(node -p "require('./package.json').version")
-          PKG_NAME=$(node -p "require('./package.json').name")
-
-          # 1) Skip if current version is not yet published (no bump needed)
-          PUBLISHED="$(npm view "${PKG_NAME}@${PKG_VERSION}" version 2>/dev/null || true)"
-          if [ "$PUBLISHED" != "$PKG_VERSION" ]; then
-            echo "✅ ${PKG_NAME}@${PKG_VERSION} is new — no bump needed."
-            echo "bumped=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          # 2) Find the previous release tag (exclude the current one)
-          PREV_TAG=$(git tag -l 'v*' --sort=-version:refname \
-            | grep -v "^${CURRENT_TAG}$" | head -1 || echo "")
-          if [ -z "$PREV_TAG" ]; then
-            echo "No previous tag to compare — skipping bump."
-            echo "bumped=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          # 3) Check if plugin dir actually changed since that tag
-          if git diff --quiet "$PREV_TAG" -- "@omniroute/opencode-plugin/"; then
-            echo "⏭️ No plugin changes since $PREV_TAG — nothing to publish."
-            echo "bumped=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          # 4) Auto-bump patch version
-          npm version patch --no-git-tag-version --allow-same-version
-          NEW_VERSION=$(node -p "require('./package.json').version")
-          echo "bumped=true" >> "$GITHUB_OUTPUT"
-          echo "📦 Auto-bumped ${PKG_NAME} from ${PKG_VERSION} to ${NEW_VERSION}"
-
      - name: Install plugin dependencies
        working-directory: "@omniroute/opencode-plugin"
        run: npm install --no-audit --no-fund
--- a/.github/workflows/opencode-plugin-ci.yml
+++ b/.github/workflows/opencode-plugin-ci.yml
@@ -32,9 +32,7 @@ jobs:
      matrix:
        node: ["22", "24"]
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v4
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ matrix.node }}
@@ -49,9 +47,7 @@ jobs:
    runs-on: ubuntu-latest
    needs: test
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v4
      - uses: actions/setup-node@v6
        with:
          node-version: "22"
--- a/.github/workflows/opencode-provider-ci.yml
+++ b/.github/workflows/opencode-provider-ci.yml
@@ -32,9 +32,7 @@ jobs:
      matrix:
        node: ["20", "22", "24"]
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v4
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ matrix.node }}
@@ -48,9 +46,7 @@ jobs:
    runs-on: ubuntu-latest
    needs: test
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v4
      - uses: actions/setup-node@v6
        with:
          node-version: "20"
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -27,10 +27,7 @@ jobs:
      API_KEY_SECRET: ci-lint-api-key-secret-long
      DISABLE_SQLITE_AUTO_BACKUP: "true"
    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-          persist-credentials: false
+      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.CI_NODE_VERSION }}
@@ -40,8 +37,6 @@ jobs:
      - run: npm run check:fetch-targets
      - run: npm run check:openapi-routes
      - run: npm run check:docs-symbols
-      - name: Docs accuracy (fabricated-docs + i18n mirrors, strict)
-        run: npm run check:docs-all
      - run: npm run check:deps
      - run: npm run check:file-size
      - run: npm run check:error-helper
@@ -51,94 +46,4 @@ jobs:
      - run: npm run check:known-symbols
      - run: npm run check:route-guard-membership
      - run: npm run check:test-discovery
-      - run: npm run check:test-runner-api
      - run: npm run check:any-budget:t11
-      # Build-scope guard: fails if worktrees/cruft leak into the tsconfig include
-      # scope (would OOM `next build`). Instant. See incident 2026-06-25 / #5031.
-      - run: npm run check:build-scope
-      # Pack-policy (unexpected-files allowlist) WITHOUT a build — catches a stray file
-      # leaking into the npm tarball (v3.8.36: 6 ops bin/*.sh) per-PR instead of only on
-      # the release PR's heavy Package Artifact job.
-      - run: npm run check:pack-policy
-      # Complexity + cognitive-complexity ratchets on the fast-path (PR→release) so
-      # cycle drift is rebaselined PER-PR instead of cascading onto the release PR's
-      # Quality Ratchet (v3.8.36: +30 complexity / +15 cognitive surfaced only post-merge).
-      - run: npm run check:complexity
-      - run: npm run check:cognitive-complexity
-      - name: Typecheck (core)
-        run: npm run typecheck:core
-      # TIA: build the impact map at runtime (gitignored, ~21MB) and run only the
-      # unit tests impacted by this PR's changed files. Fail-safe runs the FULL
-      # unit suite on hub/unmapped changes — TIA accelerates, never replaces, the net.
-      #
-      # BLOCKING (flipped 2026-06-17). The pre-existing release unit test-debt that kept
-      # this advisory was cleared: #4030 (16 Zod/registry reds, lossless restore) and
-      # #4063 (the last red — the LiveWS boot test — root-caused as a real event-loop
-      # stall in the WS sidecar, fixed + relocated to the integration suite). A full
-      # ci.yml run on release/v3.8.28 then showed all 8 unit shards green, so PR->release
-      # now blocks on unit-test regressions in the impacted set (typecheck:core already
-      # blocked above). Fail-safe still runs the FULL unit suite on hub/unmapped changes.
-      - name: Impacted unit tests (TIA, fail-safe full; blocking)
-        env:
-          GITHUB_BASE_REF: ${{ github.base_ref }}
-        run: |
-          git fetch --no-tags origin "$GITHUB_BASE_REF" || true
-          node scripts/quality/build-test-impact-map.mjs
-          SEL="$(node scripts/quality/select-impacted-tests.mjs)"
-          if [ -z "$SEL" ]; then echo "No source/test changes — skipping unit tests"; exit 0; fi
-          # CI runners are 4-vCPU; run at --test-concurrency=4 (matching the ci.yml unit
-          # job) rather than test:unit's local-tuned concurrency=20. Oversubscribing the
-          # runner makes timing-sensitive tests (db-backup, upstream-timeout, ...) flake,
-          # which must not happen on a blocking gate. DATA_DIR isolation keeps the parallel
-          # run race-free regardless of concurrency.
-          if echo "$SEL" | grep -q "__RUN_ALL__"; then
-            echo "Fail-safe: running FULL unit suite (CI concurrency)"; npm run test:unit:ci; exit $?
-          fi
-          echo "Running impacted tests:"; echo "$SEL"
-          mapfile -t FILES <<< "$SEL"
-          node --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 "${FILES[@]}"
-
-  fast-vitest:
-    name: Vitest (fast-path)
-    runs-on: ubuntu-latest
-    env:
-      JWT_SECRET: ci-lint-secret-with-sufficient-length-for-validation
-      API_KEY_SECRET: ci-lint-api-key-secret-long
-      DISABLE_SQLITE_AUTO_BACKUP: "true"
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v6
-        with:
-          node-version: ${{ env.CI_NODE_VERSION }}
-          cache: npm
-      - run: npm ci
-      - run: npm run test:vitest
-
-  fast-unit:
-    name: Unit Tests fast-path (${{ matrix.shard }}/2)
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        shard: [1, 2]
-    env:
-      JWT_SECRET: ci-lint-secret-with-sufficient-length-for-validation
-      API_KEY_SECRET: ci-lint-api-key-secret-long
-      DISABLE_SQLITE_AUTO_BACKUP: "true"
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v6
-        with:
-          node-version: ${{ env.CI_NODE_VERSION }}
-          cache: npm
-      - run: npm ci
-      - run: >
-          node --max-old-space-size=4096 --import tsx
-          --import ./tests/_setup/isolateDataDir.ts
-          --test --test-force-exit --test-concurrency=4 --test-shard=${{ matrix.shard }}/2
-          tests/unit/*.test.ts
-          "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui}/**/*.test.ts"
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -21,12 +21,12 @@ jobs:
      contents: read
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Run analysis
-        uses: ossf/scorecard-action@v2.4.3
+        uses: ossf/scorecard-action@v2.4.0
        with:
          results_file: results.sarif
          results_format: sarif
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -1,29 +0,0 @@
-name: semgrep
-on:
-  pull_request:
-    branches: ["main", "release/**"]
-  push:
-    branches: ["main"]
-permissions:
-  contents: read
-jobs:
-  semgrep:
-    runs-on: ubuntu-latest
-    container:
-      image: semgrep/semgrep
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-      - name: Run semgrep (advisory)
-        continue-on-error: true
-        run: |
-          semgrep scan --config p/owasp-top-ten --config p/secrets \
-            --sarif --output semgrep.sarif --metrics off || true
-          python -c "import json; d=json.load(open('semgrep.sarif')); print('semgrepFindings=%d' % len(d['runs'][0]['results']))" || echo "semgrepFindings=SKIP"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        if: always()
-        with:
-          name: semgrep-sarif
-          path: semgrep.sarif
-          retention-days: 14
--- a/.github/workflows/wiki-sync.yml
+++ b/.github/workflows/wiki-sync.yml
@@ -9,7 +9,7 @@ name: Wiki Sync
 # It does NOT overwrite existing wiki pages by default: several docs sources still carry
 # stale counts (e.g. ARCHITECTURE.md says "177 providers" while the wiki cover is 226),
 # so blind overwrite would regress the wiki. Full content parity (--update-existing) is
-# gated on regenerating those sources first.
+# gated on regenerating those sources — see docs/ops/DOCUMENTATION_AUDIT_REPORT.md.

 on:
  push:
@@ -37,10 +37,10 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4

      - name: Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
        with:
          node-version: "24"

--- a/.gitignore
+++ b/.gitignore
@@ -49,10 +49,6 @@ docs/new-features/

 # dependencies
 node_modules/
-# Also ignore a root node_modules SYMLINK (worktree setups symlink it from the main
-# checkout). The trailing-slash pattern above only matches a directory, so without this
-# a symlink named node_modules could be staged by `git add -A` and committed.
-/node_modules
 *.map
 .DS_Store

@@ -161,11 +157,6 @@ typescript

 # Superpowers plans/specs (internal tooling, not project code)
 docs/superpowers/
-# Superpowers visual-companion brainstorm mockups (ephemeral)
-.superpowers/
-
-# TIA test-impact map — generated at runtime in CI (build-test-impact-map.mjs), never committed (~21MB)
-config/quality/test-impact-map.json

 # GitNexus local index
 .gitnexus
--- a/.husky/pre-commit
+++ b/.husky/pre-commit
@@ -10,4 +10,3 @@ fi
 npx lint-staged
 node scripts/check/check-docs-sync.mjs
 npm run check:any-budget:t11
-node scripts/check/check-tracked-artifacts.mjs
--- a/.mcp.json.example
+++ b/.mcp.json.example
@@ -0,0 +1,17 @@
+{
+  "$comment_purpose": "OPT-IN agent-lsp / LSP-in-the-loop (Quality Gates Fase 7 Task 15). Copy this file to `.mcp.json` to enable. It exposes a TypeScript language server to coding agents (Claude Code, etc.) so they get diagnostics / hover / go-to-definition / blast-radius BEFORE writing code — turning 'invented symbol' review-catches into impossible-at-edit-time. Pairs with `npm run typecheck:core` as a compile-before-claim check.",
+  "$comment_safety": "Shipped as `.example` (NOT `.mcp.json`) on purpose so it never auto-loads an unvetted server into everyone's session. Pick an MCP<->LSP bridge you trust and have verified locally, then drop in its package + args below. A broken MCP entry only logs a connection error; it does not break agent sessions. The underlying language server is `typescript-language-server` (npm, mature) — install via `npm i -g typescript-language-server typescript` or rely on npx.",
+  "mcpServers": {
+    "typescript-lsp": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "<your-mcp-lsp-bridge>",
+        "--lsp",
+        "typescript-language-server",
+        "--stdio"
+      ],
+      "$note": "Replace <your-mcp-lsp-bridge> with the concrete MCP<->LSP adapter you chose. It must speak MCP on stdio and proxy to `typescript-language-server --stdio`. Scope it to this repo's tsconfig (open-sse/tsconfig.json / tsconfig.json) for accurate diagnostics."
+    }
+  }
+}
--- a/.npmrc
+++ b/.npmrc
@@ -2,13 +2,3 @@
 # Keeping peer auto-install disabled prevents npm from pulling @lobehub/ui/mermaid
 # back into the tree and reopening npm audit findings for unused packages.
 legacy-peer-deps=true
-
-# Network resilience: enlarge npm's fetch retry budget so a transient registry
-# socket reset (ECONNRESET) mid-download retries instead of failing the job.
-# npm defaults to only 2 retries with short timeouts; `npm ci` in
-# electron-release.yml hit ECONNRESET during v3.8.41 publish. Applies to every
-# CI workflow (electron / docker / unit) and local installs.
-fetch-retries=5
-fetch-retry-factor=4
-fetch-retry-mintimeout=20000
-fetch-retry-maxtimeout=120000
--- a/.prettierignore
+++ b/.prettierignore
@@ -1,2 +0,0 @@
-# Long reference tables are manually aligned; formatting the whole file causes noisy diffs.
-docs/reference/ENVIRONMENT.md
--- a/.trivyignore
+++ b/.trivyignore
@@ -1,22 +0,0 @@
-# .trivyignore — accepted-risk suppressions for the container image scan
-#
-# Policy (see docs/security/SUPPLY_CHAIN.md):
-#   - The Trivy steps in .github/workflows/docker-publish.yml run with
-#     `ignore-unfixed: true`, so vulnerabilities WITHOUT a published fix are
-#     already excluded from both the blocking CRITICAL gate and the advisory
-#     Security-tab upload. You do NOT need an entry here for an unfixable
-#     base-image OS CVE — it will not be reported.
-#   - This file is the single auditable home for the rare case where a *fixable*
-#     CVE must be temporarily accepted (e.g. the upstream fix is not yet in the
-#     pinned base tag, or the affected package/binary is provably unreachable
-#     from the proxy request surface and rebuilding now is not justified).
-#
-# Format — one CVE id per line, each with a justification comment and, where
-# possible, an expiry, e.g.:
-#   # CVE-XXXX-YYYY — <why accepted>; revisit on next base-image bump (YYYY-MM-DD)
-#   CVE-XXXX-YYYY
-#
-# Keep this list SHORT and reviewed every release. Prefer fixing (rebuild on a
-# patched base / bump the dep) over suppressing. Stale entries are debt.
-#
-# (No accepted-risk suppressions at present — ignore-unfixed covers the noise.)
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -19,79 +19,30 @@
    }
  },
  "git.ignoreLimitWarning": true,
-
-  // ─── Git: não adicionar os ~44 repos aninhados (9 worktrees + _references/* +
-  // _mono_repo/* + _ideia/_tasks/.agents) ao Source Control. Era a causa do
-  // "validando muito": um git status + watcher por repo. Só o repo raiz fica. ───
-  "git.autoRepositoryDetection": false,
-  "git.repositoryScanMaxDepth": 0,
-  "git.detectSubmodules": false,
-  "git.autofetch": false,
-  "git.autorefresh": true,
-
-  // ─── Performance: não seguir o symlink de node_modules criado pelas worktrees ───
-  // As worktrees em .worktrees/ apontam node_modules para o checkout principal;
-  // sem isto a busca atravessa o symlink mesmo com node_modules excluído.
-  "search.followSymlinks": false,
-
-  // ─── TypeScript server (monorepo grande: ~6,6k arquivos rastreados, Next.js 16) ───
-  "typescript.tsserver.maxTsServerMemory": 4096,
-  "typescript.disableAutomaticTypeAcquisition": true,
-  "typescript.tsc.autoDetect": "off",
-  "npm.autoDetect": "off",
-  // O tsserver tem o próprio watcher (independente de files.watcherExclude).
-  // excludeDirectories evita que ele vigie as árvores pesadas.
-  "typescript.tsserver.watchOptions": {
-    "excludeDirectories": [
-      "**/node_modules",
-      "**/.next",
-      "**/.build",
-      "**/dist",
-      "**/coverage",
-      "**/.worktrees"
-    ]
-  },
-
-  // Para esconder os diretórios gerados da árvore do Explorer, descomente:
  // "files.exclude": {
-  //   "**/.worktrees": true,
-  //   "**/coverage": true,
-  //   "**/dist": true,
-  //   "**/.build": true,
-  //   "**/.next": true,
  //   "**/_references": true,
  //   "**/_mono_repo": true,
-  //   "**/_tasks": true,
-  //   "**/omniroute-*.tgz": true
+  //   "**/electron": true,
+  //   "**/node_modules": true,
+  //   "**/.next": true,
+  //   "**/coverage": true,
+  //   "**/omniroute-*.tgz": true,
+  //   "**/_tasks": true
  // },
  "files.watcherExclude": {
-    "**/.git/objects/**": true,
-    "**/.git/subtree-cache/**": true,
+    "**/_references/**": true,
+    "**/_mono_repo/**": true,
+    "**/electron/**": true,
    "**/node_modules/**": true,
    "**/.next/**": true,
-    "**/.build/**": true,
+    "**/coverage/**": true,
+    "**/_tasks/**": true,
+    "**/.git/objects/**": true,
    "**/dist/**": true,
    "**/build/**": true,
    "**/out/**": true,
-    "**/coverage/**": true,
-    "**/.coverage/**": true,
-    "**/.nyc_output/**": true,
    "**/.cache/**": true,
    "**/.turbo/**": true,
-    "**/.swc/**": true,
-    "**/.stryker-tmp/**": true,
-    "**/stryker-output-*/**": true,
-    "**/playwright-report/**": true,
-    "**/test-results/**": true,
-    "**/.worktrees/**": true,
-    "**/.claude/worktrees/**": true,
-    "**/electron/**": true,
-    "**/_references/**": true,
-    "**/_mono_repo/**": true,
-    "**/_tasks/**": true,
-    "**/logs/**": true,
-    "**/*.tgz": true,
-    "**/*.tsbuildinfo": true,
    "**/OmniRoute-*/**": true,
    "**/*-merge-*/**": true,
    "**/*-worktree-*/**": true,
@@ -99,32 +50,16 @@
    "**/*-reorg*/**": true
  },
  "search.exclude": {
+    "**/_references": true,
+    "**/_mono_repo": true,
+    "**/electron": true,
    "**/node_modules": true,
    "**/.next": true,
-    "**/.build": true,
+    "**/coverage": true,
+    "**/_tasks": true,
    "**/dist": true,
    "**/build": true,
    "**/out": true,
-    "**/coverage": true,
-    "**/.coverage": true,
-    "**/.nyc_output": true,
-    "**/.cache": true,
-    "**/.turbo": true,
-    "**/.swc": true,
-    "**/.stryker-tmp": true,
-    "**/stryker-output-*": true,
-    "**/playwright-report": true,
-    "**/test-results": true,
-    "**/.worktrees": true,
-    "**/.claude/worktrees": true,
-    "**/electron": true,
-    "**/_references": true,
-    "**/_mono_repo": true,
-    "**/_tasks": true,
-    "**/logs": true,
-    "**/*.tgz": true,
-    "**/*.tsbuildinfo": true,
-    "**/package-lock.json": true,
    "**/OmniRoute-*": true,
    "**/*-merge-*": true,
    "**/*-worktree-*": true,
--- a/.zizmor.yml
+++ b/.zizmor.yml
@@ -71,34 +71,3 @@ rules:
    # Accepted risk, re-review at the next release cycle (added 2026-06-15).
    ignore:
      - deploy-vps.yml
-
-  cache-poisoning:
-    # zizmor's cache-poisoning audit flags `actions/setup-node` (cache: npm) and
-    # `actions/cache` steps that populate a cache which a later artifact-publishing
-    # job could consume — the attack is: a fork PR seeds a poisoned cache that a
-    # trusted publish run then restores and ships. None of the four entries below
-    # are exploitable in that way:
-    #
-    #   • electron-release.yml / npm-publish.yml — PUBLISH workflows that trigger
-    #     ONLY on trusted events: `push: tags v*` + `workflow_dispatch` (electron)
-    #     and `release: [released]` + `workflow_dispatch` + `workflow_call`
-    #     (npm). They NEVER run on a `pull_request` from a fork, so an untrusted
-    #     ref can never populate the npm/node_modules cache they restore. The
-    #     cache key is `hashFiles('package-lock.json')` / `runner.os-node-…`, a
-    #     first-party, lockfile-pinned key on trusted events.
-    #
-    #   • opencode-plugin-ci.yml / opencode-provider-ci.yml — CI-only workflows
-    #     (lint/test of the two opencode packages). They DO run on `pull_request`,
-    #     but (a) they publish NO artifacts — there is no downstream publish job
-    #     that restores their cache, and (b) GitHub Actions cache is branch-scoped:
-    #     a fork-PR run writes to a PR-isolated cache that base-branch / release
-    #     runs cannot read. The `cache: npm` here only speeds up `npm ci` within
-    #     the same ephemeral CI run.
-    #
-    # Accepted risk (first-party caching on trusted/isolated events), re-review at
-    # the next release cycle (added 2026-06-16).
-    ignore:
-      - electron-release.yml
-      - npm-publish.yml
-      - opencode-plugin-ci.yml
-      - opencode-provider-ci.yml
--- a/@omniroute/opencode-plugin/README.md
+++ b/@omniroute/opencode-plugin/README.md
@@ -196,7 +196,7 @@ Every field is optional. Defaults mirror v0.1.0 behaviour so existing `opencode.
 | `combos`              | `boolean` | `true`  | Discover `/api/combos` and surface them as pseudo-models with LCD capabilities. Combos are keyed under the `combo/<slug>` namespace and labelled `Combo: <name>` in the model picker so they're distinguishable from raw provider/model pairs.                                                                                                                                                                                                                                                                                                                               |
 | `enrichment`          | `boolean` | `true`  | Pull display names from `/api/pricing/models` AND per-million-token pricing (`input`, `output`, `cached` → `cacheRead`, `cache_creation` → `cacheWrite`) from `/api/pricing`, then overlay both onto the live catalog (so the UI shows `Claude 4.7 Opus` with `cost.input: 5`, `cost.output: 25` instead of raw IDs and zeroed cost).                                                                                                                                                                                                                                        |
 | `compressionMetadata` | `boolean` | `false` | Pull `/api/context/combos` so combo names get tagged with their compression pipeline, e.g. `Combo: claude-primary [rtk🟡 → caveman🟠]`. Intensity tokens render as traffic-light emoji (🟢 lite/minimal · 🟡 standard · 🟠 aggressive/full · 🔴 ultra) so the picker advertises "how compressed" each combo is at a glance.                                                                                                                                                                                                                                                  |
-| `providerTag`         | `boolean` | `true`  | Prepend a short upstream-provider label to the enriched display name with `" - "` separator, so `cc/claude-opus-4-7 → Claude - Claude Opus 4.7` differs visibly from `kr/claude-opus-4-7 → Kiro - Claude Opus 4.7` in the OC TUI model picker. Label resolution: use `/api/pricing/models[<alias>].name` verbatim when ≤8 chars (e.g. `Claude`, `Kiro`, `Codex`, `Qwen`), otherwise fall back to `UPPER(alias)` (e.g. `GitHub Models` → `GHM`, `Gemini` → `GEMINI`). Idempotent. Combos intentionally skipped (the `Combo: ` prefix already conveys multi-upstream). |
+| `providerTag`         | `boolean` | `true`  | Prepend a short upstream-provider label to the enriched display name with `" - "` separator, so `cc/claude-opus-4-7 → Claude - Claude Opus 4.7` differs visibly from `kr/claude-opus-4-7 → Kiro - Claude Opus 4.7` in the OC TUI model picker. Label resolution: use `/api/pricing/models[<alias>].name` verbatim when ≤8 chars (e.g. `Claude`, `Kiro`, `Codex`, `Qwen`), otherwise fall back to `UPPER(alias)` (e.g. `GitHub Models` → `GHM`, `Gemini-cli` → `GEMINI-CLI`). Idempotent. Combos intentionally skipped (the `Combo: ` prefix already conveys multi-upstream). |
 | `usableOnly`          | `boolean` | `false` | Read `/api/providers` and filter the catalog to providers that have at least one connection with `isActive: true` AND `testStatus: 'active'`. Subtract-filter semantics: providers unknown to BOTH the pricing-models catalog AND the connection table pass through (so synthetic prefixes like `agentrouter/*` survive). On fetch failure the filter is disabled for the refresh — never hides the whole catalog.                                                                                                                                                           |
 | `diskCache`           | `boolean` | `true`  | Persist the last successful `/v1/models` + `/api/combos` + enrichment + connections + compression snapshot to `${OPENCODE_DATA_DIR ?? ~/.local/share/opencode}/plugins/omniroute-<providerId>.json`. On a subsequent cold start where `/v1/models` throws (network down / IP whitelist drop / 5xx) the static block hydrates from the snapshot so OC's model picker survives offline. Soft-fail on read/write — never blocks publishing.                                                                                                                                     |
 | `geminiSanitization`  | `boolean` | `true`  | Strip `$schema`/`$ref`/`additionalProperties` from tool params when the model id matches `gemini`                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
--- a/@omniroute/opencode-plugin/package.json
+++ b/@omniroute/opencode-plugin/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@omniroute/opencode-plugin",
-  "version": "0.2.0",
+  "version": "0.1.0",
  "description": "OpenCode plugin for the OmniRoute AI Gateway. Drives dynamic model discovery, /connect auth flow, and multi-instance OmniRoute providers via the official @opencode-ai/plugin contract.",
  "type": "module",
  "main": "./dist/index.js",
--- a/@omniroute/opencode-plugin/src/index.ts
+++ b/@omniroute/opencode-plugin/src/index.ts
@@ -240,18 +240,10 @@ export function resolveOmniRoutePluginOptions(
  opts?: OmniRoutePluginOptions
 ): Required<Pick<OmniRoutePluginOptions, "providerId" | "displayName" | "modelCacheTtl">> &
  Pick<OmniRoutePluginOptions, "baseURL" | "features"> {
-  const rawProviderId = opts?.providerId ?? OMNIROUTE_PROVIDER_KEY;
-  // OC 1.17.8+ native-adapter gate rejects providerID not in
-  // {openai, anthropic, opencode*}. Silently prefix so existing
-  // configs (providerId: "omniroute") keep working.
-  const providerId = rawProviderId.startsWith("opencode-")
-    ? rawProviderId
-    : `opencode-${rawProviderId}`;
+  const providerId = opts?.providerId ?? OMNIROUTE_PROVIDER_KEY;
  const displayName =
    opts?.displayName ??
-    (providerId === `opencode-${OMNIROUTE_PROVIDER_KEY}`
-      ? "OmniRoute"
-      : `OmniRoute (${providerId})`);
+    (providerId === OMNIROUTE_PROVIDER_KEY ? "OmniRoute" : `OmniRoute (${providerId})`);
  const modelCacheTtl =
    typeof opts?.modelCacheTtl === "number" && opts.modelCacheTtl > 0
      ? opts.modelCacheTtl
@@ -716,14 +708,7 @@ export function mapRawModelToModelV2(
  const outMods = new Set(raw.output_modalities ?? ["text"]);

  return {
-    // OC's static-catalog reader parses the key on `/` to recover
-    // `(providerID, modelID)`. If the raw id is already provider-prefixed
-    // (e.g. `cc/claude-opus-4-7` from the `cc` Claude Code alias, or
-    // `nvidia/llama-3-70b` from a provider that ships prefixed ids), leave
-    // it as-is — double-prefixing breaks OC's lookup. Otherwise prefix with
-    // the resolved `providerId` so a bare key like `claude-opus-4` parses as
-    // `(omniroute, claude-opus-4)` and the credentials resolve correctly.
-    id: raw.id.includes("/") ? raw.id : `${ctx.providerId}/${raw.id}`,
+    id: raw.id,
    /**
     * Display name. Falls back to raw.id when no enrichment is available;
     * the caller (`createOmniRouteProviderHook`) overlays
@@ -1181,10 +1166,6 @@ export function mapAutoComboToStaticEntry(
    typeof autoCombo.max_output_tokens === "number" && autoCombo.max_output_tokens > 0
      ? autoCombo.max_output_tokens
      : AUTO_COMBO_FALLBACK_OUTPUT;
-  // No `providerID` field on static-catalog entries — OC ignores it on the static
-  // path, and stamping it on auto-combos but not on raw/combo entries was an
-  // internal inconsistency. The dynamic-hook path builds its ModelV2 from the
-  // individual fields below and never read this field either.
  return {
    name,
    attachment: false,
@@ -1225,7 +1206,7 @@ export interface OmniRouteEnrichmentEntry {
    cacheWrite?: number;
  };
  /**
-   * Provider alias prefix seen in `/v1/models` ids (e.g. `cc`, `gemini`).
+   * Provider alias prefix seen in `/v1/models` ids (e.g. `cc`, `gemini-cli`).
   * Populated by `defaultOmniRouteEnrichmentFetcher` from
   * `/api/pricing/models` keys. Drives the `usableOnly` alias↔canonical
   * resolution.
@@ -1233,7 +1214,7 @@ export interface OmniRouteEnrichmentEntry {
  providerAlias?: string;
  /**
   * Canonical provider id used by `/api/providers` connections (e.g.
-   * `claude`, `gemini`, `kiro`). Populated from the per-provider
+   * `claude`, `gemini-cli`, `kiro`). Populated from the per-provider
   * `entry.id` field inside `/api/pricing/models`.
   */
  providerCanonical?: string;
@@ -2046,7 +2027,7 @@ export function formatCompressionPipeline(pipeline: OmniRouteCompressionStep[]):
 export interface OmniRouteProviderConnection {
  /** Connection UUID. */
  id: string;
-  /** Canonical provider id, e.g. `claude`, `gemini`, `kiro`. Matches `entry.id` in `/api/pricing/models`. */
+  /** Canonical provider id, e.g. `claude`, `gemini-cli`, `kiro`. Matches `entry.id` in `/api/pricing/models`. */
  provider: string;
  /** Connection auth flavor, e.g. `apikey`, `oauth`, `cookie`. */
  authType?: string;
@@ -2125,7 +2106,7 @@ export const defaultOmniRouteProvidersFetcher: OmniRouteProvidersFetcher = async
 * walk only the namespaced keys to derive the alias↔canonical mapping).
 *
 * Returns:
- *   - `aliases`: set of alias prefixes safe to keep (e.g. `cc`, `gemini`).
+ *   - `aliases`: set of alias prefixes safe to keep (e.g. `cc`, `gemini-cli`).
 *   - `canonicals`: set of canonical provider ids (e.g. `claude`, `kiro`).
 *
 * Callers should treat membership in EITHER set as "usable" — raw model
@@ -2174,7 +2155,7 @@ export function usableProviderAliasSet(
  }
  // Always include every usable canonical as an alias too — handles the
  // common case where `/v1/models` ids use the canonical id directly
-  // (e.g. `gemini/gemini-1.5-pro`).
+  // (e.g. `gemini-cli/gemini-1.5-pro`).
  for (const canonical of usableCanonicals) aliases.add(canonical);
  return { aliases, canonicals: usableCanonicals, knownAliases };
 }
@@ -2267,38 +2248,26 @@ export function slugifyComboName(name: string): string {
 }

 /**
- * Build a combo's static-block key, provider-prefixed as `<providerId>/<slug>`
- * (e.g. `omniroute/MASTER`, `omniroute/MASTER-LIGHT`), guaranteeing uniqueness
- * across an entire static catalog. If `<providerId>/<slug>` is already present in
- * `used`, suffixes a short UUID-prefix disambiguator from `combo.id` so the second
- * combo doesn't silently overwrite the first. Mutates `used` in place by recording
- * the chosen key. Returns the final `<providerId>/<slug>` key.
+ * Build a combo's static-block key (`combo/<slug>`), guaranteeing uniqueness
+ * across an entire static catalog. If `<slug>` is already present in `used`,
+ * suffixes a short UUID-prefix disambiguator from `combo.id` so the second
+ * combo doesn't silently overwrite the first. Mutates `used` in place by
+ * recording the chosen key. Returns the final `combo/<...>` key.
 *
- * NOTE: the key MUST carry the OWNING provider prefix (`omniroute/…`), never a
- * `combo/` namespace — OpenCode parses model IDs on `/` to extract the provider,
- * so `combo/MASTER` would resolve provider=`combo` (no credentials) and fail with
- * "Unable to determine provider", whereas `omniroute/MASTER` resolves provider=
- * `omniroute` and the openai-compatible adapter strips the prefix and sends the
- * bare slug upstream, which the server resolves via getComboByName. See PR #4184.
- *
- * Falls back to `<providerId>/<id>` when the friendly name slugifies to the empty
+ * Falls back to `combo/<id>` when the friendly name slugifies to the empty
 * string (e.g. a combo named just punctuation).
 */
-export function buildComboKey(
-  combo: OmniRouteRawCombo,
-  used: Set<string>,
-  providerId: string
-): string {
+export function buildComboKey(combo: OmniRouteRawCombo, used: Set<string>): string {
  const friendlyName = combo.name && combo.name.trim().length > 0 ? combo.name.trim() : combo.id;
  let slug = slugifyComboName(friendlyName);
  if (slug.length === 0) slug = combo.id;
-  let key = `${providerId}/${slug}`;
+  let key = `combo/${slug}`;
  if (used.has(key)) {
    const tail = combo.id.split("-")[0] ?? combo.id;
-    key = `${providerId}/${slug}-${tail}`;
+    key = `combo/${slug}-${tail}`;
    // Defensive: in the (impossible) event the disambiguated key also
    // collides, append the full id.
-    if (used.has(key)) key = `${providerId}/${slug}-${combo.id}`;
+    if (used.has(key)) key = `combo/${slug}-${combo.id}`;
  }
  used.add(key);
  return key;
@@ -2682,12 +2651,7 @@ export function createOmniRouteProviderHook(
          );
          applyProviderTag(model, tagEntry);
        }
-        // OC's static-catalog reader parses the key on `/` to recover
-        // (providerID, modelID). `mapRawModelToModelV2` already stamps the
-        // prefixed id on `model.id` (e.g. `omniroute/claude-primary`), so we
-        // must key by `model.id` — not by the raw `entry.id` which would be
-        // a bare slug and parse as `providerID=slug, modelID=""`.
-        models[model.id] = model;
+        models[entry.id] = model;
      }

      // Default compression combo (used to decorate ALL combo names when
@@ -2837,6 +2801,18 @@ export function createOmniRouteProviderHook(
          // models with curated names).
          applyEnrichment(mapped, rawEnrichment.get(combo.id));

+          // `Combo: ` prefix surfaces the combo nature in OC's model picker.
+          // Idempotent guard covers the case where enrichment overwrote
+          // mapped.name with an already-prefixed string. Mirrors the
+          // static-hook Combo:-prefix decoration.
+          if (!mapped.name.startsWith("Combo: ")) {
+            mapped.name = `Combo: ${mapped.name}`;
+          }
+
+          // Optionally decorate combo name with its compression pipeline.
+          // Only fires when features.compressionMetadata: true, OmniRoute
+          // returned at least one default compression combo, AND the
+          // combo has resolvable members — claiming compression on an
          // unroutable combo would mislead the picker.
          if (hasMembers && defaultCompression && defaultCompression.pipeline.length > 0) {
            const tag = formatCompressionPipeline(defaultCompression.pipeline);
@@ -2845,37 +2821,18 @@ export function createOmniRouteProviderHook(
            }
          }

-          const comboKey = buildComboKey(combo, usedComboKeys, resolved.providerId);
+          const comboKey = buildComboKey(combo, usedComboKeys);

          // Collision policy: combos win. Warn ONCE per (cacheKey, comboKey)
          // when overwriting a same-key raw model so the operator can spot
-          // the unusual naming choice without log spam. Suppress the warning
-          // when the collision is the intentional dedup pattern (combo.name
-          // exactly matches an existing raw model's id) — /v1/models
-          // pre-mirrors combos as raw entries and the operator's intent is
-          // always "combo wins" in that case.
+          // the unusual naming choice without log spam.
          if (Object.prototype.hasOwnProperty.call(models, comboKey)) {
-            const existing = models[comboKey];
-            // Intentional dedup: `/v1/models` pre-mirrors combos as raw
-            // entries, so the bare combo name appears as the model id in
-            // `rawModels`. After our prefixing the existing entry's id is
-            // `${providerId}/${raw.id}` — the combo name is a substring of
-            // that prefixed id (or, for already-prefixed raw models, the
-            // exact id). Use `endsWith` to avoid matching substrings of
-            // unrelated prefixed ids.
-            const isIntentionalDedup =
-              existing &&
-              combo.name &&
-              combo.name.trim().length > 0 &&
-              (existing.id === combo.name.trim() || existing.id.endsWith(`/${combo.name.trim()}`));
-            if (!isIntentionalDedup) {
-              const dedupeKey = `${cacheKey}::${comboKey}`;
-              if (!collisionWarned.has(dedupeKey)) {
-                collisionWarned.add(dedupeKey);
-                console.warn(
-                  `[omniroute-plugin] combo key "${comboKey}" collides with a model id; combo wins.`
-                );
-              }
+            const dedupeKey = `${cacheKey}::${comboKey}`;
+            if (!collisionWarned.has(dedupeKey)) {
+              collisionWarned.add(dedupeKey);
+              console.warn(
+                `[omniroute-plugin] combo key "${comboKey}" collides with a model id; combo wins.`
+              );
            }
          }
          models[comboKey] = mapped;
@@ -3174,6 +3131,7 @@ export function sanitizeGeminiToolSchemas(payload: unknown): unknown {
 *     `gemini-2.5-flash`, etc.)
 *   - `models/gemini-…` (Google Generative AI canonical id form)
 *   - `google-vertex/gemini-…` (OpenCode + AI-SDK Vertex routing prefix)
+ *   - `gemini-cli/…` (real OmniRoute alias surfaced on b35 prod `/v1/models`)
 *
 * Liberal by design: a false positive (cleaning a payload that didn't
 * need cleaning) costs only a structuredClone + one walk; a false negative
@@ -3388,18 +3346,8 @@ function normaliseModalities(raw: unknown): OmniRouteModalityKind[] {
 }

 export interface OmniRouteStaticModelEntry {
-  /** Owning provider id. SHOULD match the parent `provider.<id>` key so OC's
-   * static-catalog reader resolves credentials via `providerID` instead of
-   * parsing the model key on `/`. Optional: OC's schema validator may
-   * reject the entire provider block when this field is present but the
-   * model KEY already carries the provider prefix (e.g. `omniroute/MASTER`),
-   * since the prefix makes the field redundant and the field is not part of
-   * OC's expected schema. We omit it from entries and rely on the prefix
-   * on the KEY alone. See PR #4184. */
-  providerID?: string;
  /** Display label rendered in OC's model picker. Defaults to the model id. */
  name: string;
-
  /** ISO date the model was released. Surfaces in OC's model card when present. */
  release_date?: string;
  /** Model accepts image / file attachments. */
@@ -3597,12 +3545,6 @@ export function buildStaticProviderEntry(
        if (!displayName.startsWith(prefix)) displayName = `${prefix}${displayName}`;
      }
    }
-    // OC's static-catalog schema doesn't expect a `providerID` field on
-    // individual entries — the parent block ID is the provider. Adding
-    // unknown fields here can cause OC's schema validator to reject the
-    // entire provider block, hiding ALL models. The provider prefix on the
-    // model KEY (e.g. `omniroute/claude-opus-4`) is what OC uses to recover
-    // (providerID, modelID) when the user selects a model.
    const entry: OmniRouteStaticModelEntry = { name: displayName };

    const attachment = caps.attachment ?? caps.vision;
@@ -3666,12 +3608,7 @@ export function buildStaticProviderEntry(
      entry.release_date = raw.release_date;
    }

-    // OC's static-catalog reader parses each key on `/` and rejects the
-    // entire provider block if ANY key resolves to a parsed providerID that
-    // has no corresponding provider block. So bare keys (no `/`) MUST be
-    // prefixed with the resolved providerId. Already-prefixed keys
-    // (e.g. `cc/claude-opus-4-7`) are left as-is to avoid double-prefixing.
-    models[raw.id.includes("/") ? raw.id : `${opts.providerId}/${raw.id}`] = entry;
+    models[raw.id] = entry;
  }

  // Combo entries → stripped LCD shape. Each combo is keyed as
@@ -3780,11 +3717,12 @@ export function buildStaticProviderEntry(
      const hasMembers = memberEntries.length > 0;
      const friendlyName =
        combo.name && combo.name.trim().length > 0 ? combo.name.trim() : combo.id;
+      // `Combo: ` prefix surfaces the combo nature in OC's model picker — the
+      // catalog key (`combo/<slug>`) is already namespaced, but the picker
+      // shows `name`, so prefix the display string too.
+      const prefixedName = `Combo: ${friendlyName}`;
      const displayName =
-        hasMembers && compressionSuffix ? `${friendlyName} ${compressionSuffix}` : friendlyName;
-      // See the raw-model entry comment above — `providerID` on entries is
-      // not part of OC's static-catalog schema; the parent block ID is the
-      // provider and the KEY prefix (`omniroute/<slug>`) is what OC parses.
+        hasMembers && compressionSuffix ? `${prefixedName}${compressionSuffix}` : prefixedName;
      const entry: OmniRouteStaticModelEntry = { name: displayName };

      if (hasMembers) {
@@ -3852,12 +3790,12 @@ export function buildStaticProviderEntry(
        entry.tool_call = false;
      }

-      // Key under bare slug (e.g. `claude-primary`) — no `combo/` prefix
-      // because OpenCode parses model IDs on `/` and would treat
-      // `combo/MASTER` as provider=`combo`. Slug collisions across
+      // Key under `combo/<slug>` (e.g. `combo/claude-primary`) so the
+      // namespace cleanly separates combos from raw provider/model pairs
+      // and so the key is copy/paste-friendly. Slug collisions across
      // combos are disambiguated with a short UUID-prefix suffix; see
      // `buildComboKey` for the policy.
-      models[buildComboKey(combo, usedComboKeys, opts.providerId)] = entry;
+      models[buildComboKey(combo, usedComboKeys)] = entry;

      // Make this combo's resolved entry available to parent combos
      // that reference it via combo-ref. Use the friendly name since
@@ -4405,24 +4343,8 @@ export function createOmniRouteConfigHook(
      authJson = undefined;
    }

-    // Try both prefixed (e.g. opencode-omniroute) and unprefixed (e.g. omniroute)
-    // keys so a user who ran `/connect omniroute` before the auto-prefix fix
-    // does not need to re-auth. Also handles dual-key for auth.json entries
-    // written by a newer OC dispatcher with the prefixed key.
-    const bareKey = resolved.providerId.startsWith("opencode-")
-      ? resolved.providerId.slice("opencode-".length)
-      : resolved.providerId;
-    const lookupKeys = [resolved.providerId];
-    if (bareKey !== resolved.providerId) lookupKeys.push(bareKey);
-    let entry;
-    for (const k of lookupKeys) {
-      const e = authJson?.[k];
-      if (e?.type === "api" && typeof e.key === "string" && e.key.length > 0) {
-        entry = e;
-        break;
-      }
-    }
-    const apiKey = entry?.type === "api" && typeof entry.key === "string" ? entry.key : "";
+    const entry = authJson?.[resolved.providerId] as AuthJsonApiEntry | undefined;
+    const apiKey = entry && entry.type === "api" && typeof entry.key === "string" ? entry.key : "";

    if (!apiKey) {
      // (c) no apiKey — silent no-op (with debug breadcrumb). The operator
--- a/@omniroute/opencode-plugin/tests/auth.test.ts
+++ b/@omniroute/opencode-plugin/tests/auth.test.ts
@@ -13,12 +13,12 @@ import { createOmniRouteAuthHook } from "../src/index.js";

 test("createOmniRouteAuthHook: default providerId is 'omniroute'", () => {
  const hook = createOmniRouteAuthHook();
-  assert.equal(hook.provider, "opencode-omniroute");
+  assert.equal(hook.provider, "omniroute");
 });

 test("createOmniRouteAuthHook: custom providerId binds to hook.provider (multi-instance)", () => {
  const hook = createOmniRouteAuthHook({ providerId: "omniroute-preprod" });
-  assert.equal(hook.provider, "opencode-omniroute-preprod");
+  assert.equal(hook.provider, "omniroute-preprod");
 });

 test("createOmniRouteAuthHook: methods[0] is type 'api' with label including displayName", () => {
@@ -30,7 +30,7 @@ test("createOmniRouteAuthHook: methods[0] is type 'api' with label including dis
  assert.equal(m.label, "OmniRoute API Key");

  const custom = createOmniRouteAuthHook({ providerId: "omniroute-preprod" });
-  assert.equal(custom.methods[0].label, "OmniRoute (opencode-omniroute-preprod) API Key");
+  assert.equal(custom.methods[0].label, "OmniRoute (omniroute-preprod) API Key");
 });

 test("createOmniRouteAuthHook: prompts[0] uses key='apiKey' per @opencode-ai/plugin contract", () => {
--- a/@omniroute/opencode-plugin/tests/combos.test.ts
+++ b/@omniroute/opencode-plugin/tests/combos.test.ts
@@ -447,14 +447,14 @@ test("models() returns combo entries merged into the map", async () => {

  // 3 raw models + 1 combo = 4 entries
  assert.equal(Object.keys(out).length, 4);
-  assert.ok(out["opencode-omniroute/claude-primary"]);
-  assert.ok(out["opencode-omniroute/claude-secondary"]);
-  assert.ok(out["opencode-omniroute/gemini-3-flash"]);
-  assert.ok(out["opencode-omniroute/claude-tier"]);
+  assert.ok(out["claude-primary"]);
+  assert.ok(out["claude-secondary"]);
+  assert.ok(out["gemini-3-flash"]);
+  assert.ok(out["combo/claude-tier"]);

-  const combo = out["opencode-omniroute/claude-tier"];
-  assert.equal(combo.name, "Claude Tier");
-  assert.equal(combo.providerID, "opencode-omniroute");
+  const combo = out["combo/claude-tier"];
+  assert.equal(combo.name, "Combo: Claude Tier");
+  assert.equal(combo.providerID, "omniroute");
  // LCD over claude-primary (200k, reasoning) + claude-secondary (100k, no reasoning)
  assert.equal(combo.limit.context, 100_000);
  assert.equal(combo.capabilities.reasoning, false);
@@ -478,11 +478,11 @@ test("models(): combo with unknown member ids degrades to all-false LCD posture"
    { fetcher: modelsFetcher, combosFetcher }
  );
  const out = await hook.models!({} as never, { auth: apiAuth("sk-z") as never });
-  assert.ok(out["opencode-omniroute/phantom-combo"]);
+  assert.ok(out["combo/phantom-combo"]);
  // With zero resolvable members, LCD = all-false (defensive posture).
-  assert.equal(out["opencode-omniroute/phantom-combo"].capabilities.toolcall, false);
-  assert.equal(out["opencode-omniroute/phantom-combo"].capabilities.reasoning, false);
-  assert.equal(out["opencode-omniroute/phantom-combo"].limit.context, 0);
+  assert.equal(out["combo/phantom-combo"].capabilities.toolcall, false);
+  assert.equal(out["combo/phantom-combo"].capabilities.reasoning, false);
+  assert.equal(out["combo/phantom-combo"].limit.context, 0);
 });

 test("models(): hidden combos are excluded from the map", async () => {
@@ -505,11 +505,11 @@ test("models(): hidden combos are excluded from the map", async () => {
    { fetcher: modelsFetcher, combosFetcher }
  );
  const out = await hook.models!({} as never, { auth: apiAuth("sk-z") as never });
-  assert.ok(out["opencode-omniroute/visible"]);
-  assert.ok(!out["opencode-omniroute/hidden"], "hidden combo must be omitted");
+  assert.ok(out["combo/visible"]);
+  assert.ok(!out["combo/hidden"], "hidden combo must be omitted");
 });

-test("models(): combo name exactly matches raw model id → raw deleted, raw deleted, no warn", async () => {
+test("models(): combo name exactly matches raw model id → raw deleted, combo lives at combo/ key, no warn", async () => {
  // Combo.name === raw model id triggers the dedup deletion. This mirrors
  // the real OmniRoute payload where /v1/models pre-mirrors combos as
  // no-slash raw entries whose ids match /api/combos friendly names.
@@ -529,9 +529,10 @@ test("models(): combo name exactly matches raw model id → raw deleted, raw del
    return hook.models!({} as never, { auth: apiAuth("sk-z") as never });
  });

-  // Raw model replaced by combo of the same key; combo now lives at the bare slug.
-  assert.ok(out["opencode-omniroute/claude-primary"], "combo surfaces under prefixed key");
-  assert.equal(out["opencode-omniroute/claude-primary"].name, "claude-primary");
+  // Raw model deleted by combo-name dedup; combo surfaces under combo/<slug>.
+  assert.equal(out["claude-primary"], undefined, "raw deleted by combo-name dedup");
+  assert.ok(out["combo/claude-primary"], "combo surfaces under combo/ namespace");
+  assert.equal(out["combo/claude-primary"].name, "Combo: claude-primary");

  // No collision warning fires — dedup makes keys disjoint.
  const collisionWarns = warnings.filter((w) => {
@@ -542,7 +543,7 @@ test("models(): combo name exactly matches raw model id → raw deleted, raw del
 });

 test("models(): two combos with same slug → second gets disambiguator suffix", async () => {
-  // Both combos slug to `claude` — second must get `claude-<id-prefix>`.
+  // Both combos slug to `claude` — second must get `combo/claude-<id-prefix>`.
  const combos: OmniRouteRawCombo[] = [
    {
      id: "uuid-a",
@@ -565,8 +566,8 @@ test("models(): two combos with same slug → second gets disambiguator suffix",

  const out = await hook.models!({} as never, { auth: apiAuth("sk-z") as never });
  // First combo gets the bare slug; second gets disambiguated.
-  assert.ok(out["opencode-omniroute/claude"], "first combo at prefixed slug");
-  assert.ok(out["opencode-omniroute/claude-uuid"], "second combo disambiguated by id prefix");
+  assert.ok(out["combo/claude"], "first combo at bare slug");
+  assert.ok(out["combo/claude-uuid"], "second combo disambiguated by id prefix");
 });

 test("models(): combos fetch fails → falls back to models-only, warn emitted, no throw", async () => {
@@ -583,8 +584,8 @@ test("models(): combos fetch fails → falls back to models-only, warn emitted,

  // Catalog includes the models but NOT any combo entries.
  assert.equal(Object.keys(out).length, 2);
-  assert.ok(out["opencode-omniroute/claude-primary"]);
-  assert.ok(out["opencode-omniroute/claude-secondary"]);
+  assert.ok(out["claude-primary"]);
+  assert.ok(out["claude-secondary"]);

  // Soft-fail warning surfaced.
  const softFail = warnings.find((w) => {
@@ -609,7 +610,7 @@ test("models(): combos cached + reused within TTL (one combo fetch per TTL windo
  const second = await hook.models!({} as never, { auth: apiAuth("sk-z") as never });
  assert.equal(combosFetcher.callCount(), 1, "combos fetched only once within TTL");
  assert.equal(modelsFetcher.callCount(), 1, "models fetched only once within TTL");
-  assert.ok(second["opencode-omniroute/claude-tier"]);
+  assert.ok(second["combo/claude-tier"]);
 });

 test("models(): combos refetched after TTL expiry (same key as models)", async () => {
@@ -701,7 +702,7 @@ test("models(): nested combo-ref context is the min of nested + raw members", as
    { fetcher: modelsFetcher, combosFetcher }
  );
  const out = await hook.models!({} as never, { auth: apiAuth("sk-z") as never });
-  const masterLight = out["opencode-omniroute/master-light"];
+  const masterLight = out["combo/master-light"];
  assert.ok(masterLight, "MASTER-LIGHT entry must exist");
  assert.equal(
    masterLight.limit.context,
--- a/@omniroute/opencode-plugin/tests/config-shim.test.ts
+++ b/@omniroute/opencode-plugin/tests/config-shim.test.ts
@@ -203,7 +203,7 @@ function makeInput(initialProvider: Record<string, unknown> = {}): Config {

 test("config: with valid auth.json + apiKey + baseURL → mutates input.provider[id] with stripped models block", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test-1", baseURL: "https://or.example.com/v1" },
+    omniroute: { type: "api", key: "sk-test-1", baseURL: "https://or.example.com/v1" },
  });
  const fetcher = stubModelsFetcher([MODEL_CLAUDE, MODEL_GEMINI]);
  const combosFetcher = stubCombosFetcher([COMBO_CLAUDE_TIER]);
@@ -217,8 +217,8 @@ test("config: with valid auth.json + apiKey + baseURL → mutates input.provider
  await hook(input);

  const provider = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider;
-  const entry = provider["opencode-omniroute"];
-  assert.ok(entry, "input.provider['opencode-omniroute'] set");
+  const entry = provider.omniroute;
+  assert.ok(entry, "input.provider.omniroute set");
  assert.equal(entry.npm, "@ai-sdk/openai-compatible");
  assert.equal(entry.name, "OmniRoute");
  assert.equal(entry.options.baseURL, "https://or.example.com/v1");
@@ -227,7 +227,7 @@ test("config: with valid auth.json + apiKey + baseURL → mutates input.provider
  // Stripped per-model shape: name + cap flags + modalities + (optional)
  // cost. OC's SDK static schema accepts only `limit.{context,output}` —
  // `limit.input` is NOT in the SDK shape and gets dropped silently.
-  const claude = entry.models["opencode-omniroute/claude-sonnet-4-6"];
+  const claude = entry.models["claude-sonnet-4-6"];
  assert.ok(claude, "claude model surfaced");
  assert.equal(claude.name, "claude-sonnet-4-6");
  assert.equal(claude.attachment, true);
@@ -246,75 +246,16 @@ test("config: with valid auth.json + apiKey + baseURL → mutates input.provider
  assert.deepEqual(claude.modalities?.input, ["text", "image"]);
  assert.deepEqual(claude.modalities?.output, ["text"]);

-  // Combo surfaces under bare key + LCD'd
+  // Combo surfaces under `combo/<friendly-name>` namespace + LCD'd
  // (gemini's reasoning=false → combo reasoning=false).
-  const combo = entry.models["opencode-omniroute/claude-tier"];
-  assert.ok(combo, "combo surfaced under bare key");
-  assert.equal(combo.name, "Claude Tier");
+  const combo = entry.models["combo/claude-tier"];
+  assert.ok(combo, "combo surfaced under combo/ namespace");
+  assert.equal(combo.name, "Combo: Claude Tier");
  assert.equal(combo.reasoning, false, "LCD: any member reasoning=false → combo reasoning=false");
  assert.equal(combo.tool_call, true);
  assert.equal(combo.limit?.context, 200_000, "LCD: min(200_000, 1_000_000)");
 });

-// ────────────────────────────────────────────────────────────────────────────
-// 1b. Dual-key fallback (#5027) — auth.json stored under the BARE providerId
-//     (pre-auto-prefix login) must still resolve when the active providerId is
-//     prefixed (`opencode-omniroute`). Without the fallback the lookup misses
-//     the stored key and the user is forced to re-auth.
-// ────────────────────────────────────────────────────────────────────────────
-
-test("config: auth.json under bare key (pre-prefix login) resolves via dual-key fallback", async () => {
-  // Stored under bare `omniroute` (the key OC wrote before the auto-prefix fix),
-  // but the resolved providerId is now `opencode-omniroute`.
-  const readAuthJson = stubReadAuthJson({
-    omniroute: { type: "api", key: "sk-bare-1", baseURL: "https://or.example.com/v1" },
-  });
-  const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
-  const combosFetcher = stubCombosFetcher([]);
-  const logger = captureWarn();
-
-  const hook = createOmniRouteConfigHook(
-    { providerId: "omniroute" }, // resolves to opencode-omniroute internally
-    { readAuthJson, fetcher, combosFetcher, logger }
-  );
-  const input = makeInput();
-  await hook(input);
-
-  const provider = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider;
-  const entry = provider["opencode-omniroute"];
-  assert.ok(entry, "provider entry published from bare-key apiKey");
-  assert.equal(entry.options.apiKey, "sk-bare-1", "apiKey resolved from the bare auth.json key");
-  assert.equal(entry.options.baseURL, "https://or.example.com/v1");
-});
-
-test("config: prefixed key wins over bare key when both present (dual-key precedence)", async () => {
-  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-prefixed", baseURL: "https://pref.example/v1" },
-    omniroute: { type: "api", key: "sk-bare", baseURL: "https://bare.example/v1" },
-  });
-  const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
-  const combosFetcher = stubCombosFetcher([]);
-  const logger = captureWarn();
-
-  const hook = createOmniRouteConfigHook(
-    { providerId: "omniroute" },
-    { readAuthJson, fetcher, combosFetcher, logger }
-  );
-  const input = makeInput();
-  await hook(input);
-
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
-  assert.ok(entry);
-  assert.equal(
-    entry.options.apiKey,
-    "sk-prefixed",
-    "prefixed key takes precedence (looked up first)"
-  );
-  assert.equal(entry.options.baseURL, "https://pref.example/v1");
-});
-
 // ────────────────────────────────────────────────────────────────────────────
 // 2. Missing auth.json → no-op, no throw, no mutation
 // ────────────────────────────────────────────────────────────────────────────
@@ -382,7 +323,7 @@ test("config: existing input.provider[id] → no overwrite (respect manual overr
    models: { "manual-model": { name: "manual-model" } },
  };
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
  });
  const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
  const combosFetcher = stubCombosFetcher([]);
@@ -392,11 +333,11 @@ test("config: existing input.provider[id] → no overwrite (respect manual overr
    { providerId: "omniroute" },
    { readAuthJson, fetcher, combosFetcher, logger }
  );
-  const input = makeInput({ "opencode-omniroute": manual });
+  const input = makeInput({ omniroute: manual });
  await hook(input);

  const provider = (input as { provider: Record<string, unknown> }).provider;
-  assert.equal(provider["opencode-omniroute"], manual, "manual override preserved by reference");
+  assert.equal(provider.omniroute, manual, "manual override preserved by reference");
  assert.equal(fetcher.callCount(), 0, "no fetch — short-circuited before I/O");
  assert.equal(readAuthJson.callCount(), 0, "no auth.json read either");
  assert.ok(
@@ -411,7 +352,7 @@ test("config: existing input.provider[id] → no overwrite (respect manual overr

 test("config: fetchers throw → warn + emit stub entry with models: {}", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
  });
  const fetcher = throwingModelsFetcher();
  const combosFetcher = throwingCombosFetcher();
@@ -427,9 +368,8 @@ test("config: fetchers throw → warn + emit stub entry with models: {}", async
  const input = makeInput();
  await hook(input);

-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
  assert.ok(entry, "stub provider entry published even when fetchers fail");
  assert.equal(entry.npm, "@ai-sdk/openai-compatible");
  assert.deepEqual(entry.models, {}, "models stub is empty object");
@@ -452,7 +392,7 @@ test("config: fetchers throw → warn + emit stub entry with models: {}", async

 test("config: combos fetcher throws → emit models-only catalog (no combos in models block)", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
  });
  const fetcher = stubModelsFetcher([MODEL_CLAUDE, MODEL_GEMINI]);
  const combosFetcher = throwingCombosFetcher();
@@ -465,16 +405,12 @@ test("config: combos fetcher throws → emit models-only catalog (no combos in m
  const input = makeInput();
  await hook(input);

-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
  assert.ok(entry);
  const ids = Object.keys(entry.models).sort();
-  assert.deepEqual(ids, [
-    "opencode-omniroute/claude-sonnet-4-6",
-    "opencode-omniroute/gemini-3-flash",
-  ]);
-  assert.equal(entry.models["opencode-omniroute/claude-tier"], undefined, "no combo entry");
+  assert.deepEqual(ids, ["claude-sonnet-4-6", "gemini-3-flash"]);
+  assert.equal(entry.models["combo-claude-tier"], undefined, "no combo entry");
  assert.ok(
    logger.entries.some((e) => String(e[0]).includes("/api/combos fetch failed")),
    "combos-fetch breadcrumb emitted"
@@ -487,7 +423,7 @@ test("config: combos fetcher throws → emit models-only catalog (no combos in m

 test("config: baseURL from auth.json takes precedence when opts.baseURL absent", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://creds.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://creds.example/v1" },
  });
  const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
  const combosFetcher = stubCombosFetcher([]);
@@ -501,15 +437,14 @@ test("config: baseURL from auth.json takes precedence when opts.baseURL absent",
  await hook(input);

  assert.equal(fetcher.callsBy()[0][0], "https://creds.example/v1");
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
  assert.equal(entry.options.baseURL, "https://creds.example/v1");
 });

 test("config: opts.baseURL wins over auth.json's stored baseURL", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://creds.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://creds.example/v1" },
  });
  const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
  const combosFetcher = stubCombosFetcher([]);
@@ -523,15 +458,14 @@ test("config: opts.baseURL wins over auth.json's stored baseURL", async () => {
  await hook(input);

  assert.equal(fetcher.callsBy()[0][0], "https://opts.example/v1");
-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
  assert.equal(entry.options.baseURL, "https://opts.example/v1");
 });

 test("config: no baseURL resolvable (no opts, no auth.json baseURL) → no-op", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test" }, // NO baseURL on the credential
+    omniroute: { type: "api", key: "sk-test" }, // NO baseURL on the credential
  });
  const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
  const combosFetcher = stubCombosFetcher([]);
@@ -559,12 +493,12 @@ test("config: no baseURL resolvable (no opts, no auth.json baseURL) → no-op",

 test("config: multi-instance — two plugins with different providerIds publish to their own keys without collision", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute-prod": {
+    "omniroute-prod": {
      type: "api",
      key: "sk-prod",
      baseURL: "https://prod.example/v1",
    },
-    "opencode-omniroute-preprod": {
+    "omniroute-preprod": {
      type: "api",
      key: "sk-preprod",
      baseURL: "https://preprod.example/v1",
@@ -588,18 +522,15 @@ test("config: multi-instance — two plugins with different providerIds publish
  await hookB(input);

  const provider = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider;
-  assert.ok(provider["opencode-omniroute-prod"], "prod block present");
-  assert.ok(provider["opencode-omniroute-preprod"], "preprod block present");
-  assert.equal(provider["opencode-omniroute-prod"].options.apiKey, "sk-prod");
-  assert.equal(provider["opencode-omniroute-preprod"].options.apiKey, "sk-preprod");
-  assert.equal(provider["opencode-omniroute-prod"].options.baseURL, "https://prod.example/v1");
-  assert.equal(
-    provider["opencode-omniroute-preprod"].options.baseURL,
-    "https://preprod.example/v1"
-  );
+  assert.ok(provider["omniroute-prod"], "prod block present");
+  assert.ok(provider["omniroute-preprod"], "preprod block present");
+  assert.equal(provider["omniroute-prod"].options.apiKey, "sk-prod");
+  assert.equal(provider["omniroute-preprod"].options.apiKey, "sk-preprod");
+  assert.equal(provider["omniroute-prod"].options.baseURL, "https://prod.example/v1");
+  assert.equal(provider["omniroute-preprod"].options.baseURL, "https://preprod.example/v1");
  assert.notEqual(
-    provider["opencode-omniroute-prod"],
-    provider["opencode-omniroute-preprod"],
+    provider["omniroute-prod"],
+    provider["omniroute-preprod"],
    "blocks are distinct references"
  );
 });
@@ -611,7 +542,7 @@ test("config: multi-instance — two plugins with different providerIds publish

 test("config + provider share cache: second call uses cached fetch result (single fetch per TTL)", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-shared", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-shared", baseURL: "https://or.example/v1" },
  });
  const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
  const combosFetcher = stubCombosFetcher([COMBO_CLAUDE_TIER]);
@@ -643,7 +574,7 @@ test("config + provider share cache: second call uses cached fetch result (singl

 test("provider → config order also dedupes (cache populated by provider, consumed by config)", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-reverse", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-reverse", baseURL: "https://or.example/v1" },
  });
  const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
  const combosFetcher = stubCombosFetcher([]);
@@ -707,7 +638,6 @@ test("buildStaticProviderEntry: stripped per-model shape matches sibling @omniro
    "cost",
    "limit",
    "modalities",
-    "providerID",
  ]);
  for (const [id, entry] of Object.entries(block.models)) {
    for (const key of Object.keys(entry)) {
@@ -723,7 +653,7 @@ test("buildStaticProviderEntry: stripped per-model shape matches sibling @omniro
  }

  // Sanity: claude entry has all expected stripped fields.
-  const claude = block.models["opencode-omniroute/claude-sonnet-4-6"];
+  const claude = block.models["claude-sonnet-4-6"];
  assert.equal(typeof claude.name, "string");
  assert.equal(typeof claude.attachment, "boolean");
  assert.equal(typeof claude.reasoning, "boolean");
@@ -748,8 +678,8 @@ test("buildStaticProviderEntry: hidden combos are excluded", () => {
    "https://or.example/v1",
    "sk-test"
  );
-  assert.equal(block.models["opencode-omniroute/claude-tier"], undefined);
-  assert.ok(block.models["opencode-omniroute/claude-sonnet-4-6"]);
+  assert.equal(block.models["combo-claude-tier"], undefined);
+  assert.ok(block.models["claude-sonnet-4-6"]);
 });

 // ────────────────────────────────────────────────────────────────────────────
@@ -765,7 +695,7 @@ test("buildStaticProviderEntry: emits modalities.input from raw.input_modalities
    "https://or.example/v1",
    "sk-test"
  );
-  const claude = block.models["opencode-omniroute/claude-sonnet-4-6"];
+  const claude = block.models["claude-sonnet-4-6"];
  assert.deepEqual(claude.modalities?.input, ["text", "image"]);
  assert.deepEqual(claude.modalities?.output, ["text"]);
 });
@@ -779,7 +709,7 @@ test("buildStaticProviderEntry: never emits limit.input (OC SDK rejects it)", ()
    "https://or.example/v1",
    "sk-test"
  );
-  const claude = block.models["opencode-omniroute/claude-sonnet-4-6"];
+  const claude = block.models["claude-sonnet-4-6"];
  assert.equal((claude.limit as Record<string, unknown>).input, undefined);
  assert.equal(typeof claude.limit?.context, "number");
  assert.equal(typeof claude.limit?.output, "number");
@@ -807,7 +737,7 @@ test("buildStaticProviderEntry: emits cost when enrichment carries pricing", ()
    "sk-test",
    enrichment
  );
-  const claude = block.models["opencode-omniroute/claude-sonnet-4-6"];
+  const claude = block.models["claude-sonnet-4-6"];
  assert.equal(claude.cost?.input, 3);
  assert.equal(claude.cost?.output, 15);
  assert.equal(claude.cost?.cache_read, 0.3);
@@ -828,8 +758,8 @@ test("buildStaticProviderEntry: emits release_date when raw carries it; omits wh
    "https://or.example/v1",
    "sk-test"
  );
-  assert.equal(block.models["opencode-omniroute/claude-with-date"].release_date, "2026-02-19");
-  assert.equal(block.models["opencode-omniroute/gemini-3-flash"].release_date, undefined);
+  assert.equal(block.models["claude-with-date"].release_date, "2026-02-19");
+  assert.equal(block.models["gemini-3-flash"].release_date, undefined);
 });

 test("buildStaticProviderEntry: combo modalities = intersection of members (LCD)", () => {
@@ -858,7 +788,7 @@ test("buildStaticProviderEntry: combo modalities = intersection of members (LCD)
    "https://or.example/v1",
    "sk-test"
  );
-  const combo = block.models["opencode-omniroute/mixed-tier"];
+  const combo = block.models["combo/mixed-tier"];
  assert.ok(combo, "combo emitted under slug key");
  // claude has text+image, text-only has text → intersection drops image.
  assert.deepEqual(combo.modalities?.input, ["text"]);
@@ -882,7 +812,7 @@ test("OmniRoutePlugin factory exposes config hook alongside auth + provider", as

 test("config: auth.json entry of wrong type (oauth) → no-op", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "oauth", refresh: "r", access: "a", expires: 0 },
+    omniroute: { type: "oauth", refresh: "r", access: "a", expires: 0 },
  });
  const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
  const combosFetcher = stubCombosFetcher([]);
@@ -919,7 +849,7 @@ test("config: readAuthJson throws → treat as missing file (silent fallback)",

 test("config: initialises input.provider when undefined", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk", baseURL: "https://or.example/v1" },
  });
  const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
  const combosFetcher = stubCombosFetcher([]);
@@ -934,7 +864,7 @@ test("config: initialises input.provider when undefined", async () => {
  await hook(input);
  const provider = (input as { provider?: Record<string, unknown> }).provider;
  assert.ok(provider, "provider bag initialised");
-  assert.ok(provider!["opencode-omniroute"]);
+  assert.ok(provider!.omniroute);
 });

 // ────────────────────────────────────────────────────────────────────────────
@@ -944,7 +874,7 @@ test("config: initialises input.provider when undefined", async () => {

 test("config: enrichment fetched + name overlaid on raw-model entries", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
  });
  const fetcher = stubModelsFetcher([MODEL_CLAUDE, MODEL_GEMINI]);
  const combosFetcher = stubCombosFetcher([COMBO_CLAUDE_TIER]);
@@ -963,20 +893,19 @@ test("config: enrichment fetched + name overlaid on raw-model entries", async ()
  const input = makeInput();
  await hook(input);

-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
  assert.ok(entry);
-  assert.equal(entry.models["opencode-omniroute/claude-sonnet-4-6"].name, "Claude Sonnet 4.6");
-  assert.equal(entry.models["opencode-omniroute/gemini-3-flash"].name, "Gemini 3 Flash");
+  assert.equal(entry.models["claude-sonnet-4-6"].name, "Claude Sonnet 4.6");
+  assert.equal(entry.models["gemini-3-flash"].name, "Gemini 3 Flash");
  // Combo names still come from /api/combos — enrichment overlay does NOT touch combos.
-  assert.equal(entry.models["opencode-omniroute/claude-tier"].name, "Claude Tier");
+  assert.equal(entry.models["combo/claude-tier"].name, "Combo: Claude Tier");
  assert.equal(enrichmentFetcher.callCount(), 1);
 });

 test("config: features.enrichment=false skips enrichment fetch + keeps raw-id names", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
  });
  const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
  const combosFetcher = stubCombosFetcher([]);
@@ -994,21 +923,16 @@ test("config: features.enrichment=false skips enrichment fetch + keeps raw-id na
  const input = makeInput();
  await hook(input);

-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
  assert.ok(entry);
  assert.equal(enrichmentFetcher.callCount(), 0, "enrichment fetch suppressed by feature flag");
-  assert.equal(
-    entry.models["opencode-omniroute/claude-sonnet-4-6"].name,
-    "claude-sonnet-4-6",
-    "raw id retained"
-  );
+  assert.equal(entry.models["claude-sonnet-4-6"].name, "claude-sonnet-4-6", "raw id retained");
 });

 test("config: enrichment fetcher throws → soft-fail (warn + raw-id static catalog)", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
  });
  const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
  const combosFetcher = stubCombosFetcher([]);
@@ -1022,15 +946,10 @@ test("config: enrichment fetcher throws → soft-fail (warn + raw-id static cata
  const input = makeInput();
  await hook(input);

-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
  assert.ok(entry, "static block still published on enrichment failure");
-  assert.equal(
-    entry.models["opencode-omniroute/claude-sonnet-4-6"].name,
-    "claude-sonnet-4-6",
-    "raw id retained"
-  );
+  assert.equal(entry.models["claude-sonnet-4-6"].name, "claude-sonnet-4-6", "raw id retained");
  assert.equal(enrichmentFetcher.callCount(), 1);
  assert.ok(
    logger.entries.some((e) => String(e[0]).includes("/api/pricing/models fetch failed")),
@@ -1071,7 +990,7 @@ const MODEL_NV_LLAMA: OmniRouteRawModelEntry = {

 test("config: usableOnly=false → no filter (existing behavior)", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
  });
  const fetcher = stubModelsFetcher([MODEL_CC_OPUS, MODEL_NV_LLAMA]);
  const combosFetcher = stubCombosFetcher([]);
@@ -1093,9 +1012,8 @@ test("config: usableOnly=false → no filter (existing behavior)", async () => {
  const input = makeInput();
  await hook(input);

-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
  assert.ok(entry.models["cc/claude-opus-4-7"], "claude kept");
  assert.ok(entry.models["nvidia/llama-3-70b"], "nvidia kept (filter off)");
  assert.equal(providersFetcher.callCount(), 0, "providers fetch not called when feature off");
@@ -1103,7 +1021,7 @@ test("config: usableOnly=false → no filter (existing behavior)", async () => {

 test("config: usableOnly=true → drops models for non-usable providers, keeps usable + unknown", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
  });
  const fetcher = stubModelsFetcher([
    MODEL_CC_OPUS,
@@ -1143,9 +1061,8 @@ test("config: usableOnly=true → drops models for non-usable providers, keeps u
  const input = makeInput();
  await hook(input);

-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
  assert.ok(entry.models["cc/claude-opus-4-7"], "claude kept (active)");
  assert.equal(entry.models["nvidia/llama-3-70b"], undefined, "nvidia dropped (error status)");
  assert.ok(entry.models["agentrouter/synthetic-1"], "unknown prefix kept (subtract-filter)");
@@ -1154,7 +1071,7 @@ test("config: usableOnly=true → drops models for non-usable providers, keeps u

 test("config: usableOnly=true + providers fetch fails → soft-fail keeps everything", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
  });
  const fetcher = stubModelsFetcher([MODEL_CC_OPUS, MODEL_NV_LLAMA]);
  const combosFetcher = stubCombosFetcher([]);
@@ -1175,9 +1092,8 @@ test("config: usableOnly=true + providers fetch fails → soft-fail keeps everyt
  const input = makeInput();
  await hook(input);

-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
  assert.ok(entry.models["cc/claude-opus-4-7"]);
  assert.ok(entry.models["nvidia/llama-3-70b"], "soft-fail keeps both");
  assert.ok(
@@ -1188,7 +1104,7 @@ test("config: usableOnly=true + providers fetch fails → soft-fail keeps everyt

 test("config: diskCache hydrates stale snapshot when /v1/models throws", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
  });
  const fetcher = throwingModelsFetcher();
  const combosFetcher = stubCombosFetcher([]);
@@ -1225,15 +1141,11 @@ test("config: diskCache hydrates stale snapshot when /v1/models throws", async (
  const input = makeInput();
  await hook(input);

-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
-  assert.ok(
-    entry.models["opencode-omniroute/claude-sonnet-4-6"],
-    "stale snapshot hydrated into static block"
-  );
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
+  assert.ok(entry.models["claude-sonnet-4-6"], "stale snapshot hydrated into static block");
  assert.equal(
-    entry.models["opencode-omniroute/claude-sonnet-4-6"].name,
+    entry.models["claude-sonnet-4-6"].name,
    "Claude Sonnet 4.6 (cached)",
    "stale enrichment also reused"
  );
@@ -1246,7 +1158,7 @@ test("config: diskCache hydrates stale snapshot when /v1/models throws", async (

 test("config: cached rawEnrichment from earlier provider hook is reused (no refetch)", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-shared", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-shared", baseURL: "https://or.example/v1" },
  });
  const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
  const combosFetcher = stubCombosFetcher([]);
@@ -1278,10 +1190,9 @@ test("config: cached rawEnrichment from earlier provider hook is reused (no refe
  await configHook(input);
  assert.equal(enrichmentFetcher.callCount(), 1, "config reused cached enrichment");

-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
-  assert.equal(entry.models["opencode-omniroute/claude-sonnet-4-6"].name, "Claude Sonnet 4.6");
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
+  assert.equal(entry.models["claude-sonnet-4-6"].name, "Claude Sonnet 4.6");
 });

 // ─────────────────────────────────────────────────────────────────────
@@ -1292,7 +1203,7 @@ test("config: cached rawEnrichment from earlier provider hook is reused (no refe

 test("config: providerTag (default-on) prepends '<provider> - ' to enriched raw-model names", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
  });
  const fetcher = stubModelsFetcher([MODEL_CLAUDE, MODEL_GEMINI]);
  const combosFetcher = stubCombosFetcher([COMBO_CLAUDE_TIER]);
@@ -1311,9 +1222,9 @@ test("config: providerTag (default-on) prepends '<provider> - ' to enriched raw-
        "gemini-3-flash",
        {
          name: "Gemini 3 Flash",
-          providerAlias: "gemini",
-          providerCanonical: "gemini",
-          providerDisplayName: "Gemini",
+          providerAlias: "gemini-cli",
+          providerCanonical: "gemini-cli",
+          providerDisplayName: "Gemini-cli",
        },
      ],
    ])
@@ -1327,22 +1238,18 @@ test("config: providerTag (default-on) prepends '<provider> - ' to enriched raw-
  const input = makeInput();
  await hook(input);

-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
  assert.ok(entry);
-  assert.equal(
-    entry.models["opencode-omniroute/claude-sonnet-4-6"].name,
-    "Claude - Claude Sonnet 4.6"
-  );
-  assert.equal(entry.models["opencode-omniroute/gemini-3-flash"].name, "Gemini - Gemini 3 Flash");
+  assert.equal(entry.models["claude-sonnet-4-6"].name, "Claude - Claude Sonnet 4.6");
+  assert.equal(entry.models["gemini-3-flash"].name, "Gemini-cli - Gemini 3 Flash");
  // Combos stay untouched — `Combo: ` prefix already conveys multi-upstream.
-  assert.equal(entry.models["opencode-omniroute/claude-tier"].name, "Claude Tier");
+  assert.equal(entry.models["combo/claude-tier"].name, "Combo: Claude Tier");
 });

 test("config: providerTag=false suppresses the suffix", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
  });
  const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
  const combosFetcher = stubCombosFetcher([]);
@@ -1360,11 +1267,10 @@ test("config: providerTag=false suppresses the suffix", async () => {
  const input = makeInput();
  await hook(input);

-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
  assert.equal(
-    entry.models["opencode-omniroute/claude-sonnet-4-6"].name,
+    entry.models["claude-sonnet-4-6"].name,
    "Claude Sonnet 4.6",
    "enriched name kept, provider tag suppressed"
  );
@@ -1372,7 +1278,7 @@ test("config: providerTag=false suppresses the suffix", async () => {

 test("config: providerTag falls back to UPPER(alias) when providerDisplayName missing", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
  });
  const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
  const combosFetcher = stubCombosFetcher([]);
@@ -1393,15 +1299,14 @@ test("config: providerTag falls back to UPPER(alias) when providerDisplayName mi
  const input = makeInput();
  await hook(input);

-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
-  assert.equal(entry.models["opencode-omniroute/claude-sonnet-4-6"].name, "CC - Claude Sonnet 4.6");
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
+  assert.equal(entry.models["claude-sonnet-4-6"].name, "CC - Claude Sonnet 4.6");
 });

 test("config: providerTag skipped entirely when neither providerDisplayName nor providerAlias set", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
  });
  const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
  const combosFetcher = stubCombosFetcher([]);
@@ -1420,15 +1325,14 @@ test("config: providerTag skipped entirely when neither providerDisplayName nor
  const input = makeInput();
  await hook(input);

-  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
-  assert.equal(entry.models["opencode-omniroute/claude-sonnet-4-6"].name, "Claude Sonnet 4.6");
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
+  assert.equal(entry.models["claude-sonnet-4-6"].name, "Claude Sonnet 4.6");
 });

 test("config: providerTag is idempotent — second hook call doesn't double-suffix", async () => {
  const readAuthJson = stubReadAuthJson({
-    "opencode-omniroute": { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
+    omniroute: { type: "api", key: "sk-test", baseURL: "https://or.example/v1" },
  });
  const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
  const combosFetcher = stubCombosFetcher([]);
@@ -1447,24 +1351,16 @@ test("config: providerTag is idempotent — second hook call doesn't double-suff

  const inputA = makeInput();
  await hook(inputA);
-  const entryA = (inputA as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
-  assert.equal(
-    entryA.models["opencode-omniroute/claude-sonnet-4-6"].name,
-    "Claude - Claude Sonnet 4.6"
-  );
+  const entryA = (inputA as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
+  assert.equal(entryA.models["claude-sonnet-4-6"].name, "Claude - Claude Sonnet 4.6");

  // Second invocation (cache hit) — name must still be single-suffixed.
  const inputB = makeInput();
  await hook(inputB);
-  const entryB = (inputB as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
-    "opencode-omniroute"
-  ];
-  assert.equal(
-    entryB.models["opencode-omniroute/claude-sonnet-4-6"].name,
-    "Claude - Claude Sonnet 4.6"
-  );
+  const entryB = (inputB as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider
+    .omniroute;
+  assert.equal(entryB.models["claude-sonnet-4-6"].name, "Claude - Claude Sonnet 4.6");
 });

 // ────────────────────────────────────────────────────────────────────────────
@@ -1516,7 +1412,7 @@ test("buildStaticProviderEntry: nested combo-ref context is the bottleneck acros
  );
  // Pre-fix: Parent would advertise 200_000 (only raw-big counted).
  // Post-fix: Parent should advertise 8_000 (TinyCombo bottleneck).
-  const parent = block.models["opencode-omniroute/parent"];
+  const parent = block.models["combo/parent"];
  assert.ok(parent, "Parent combo must be in the static catalog");
  assert.equal(parent.limit?.context, 8_000);
 });
--- a/@omniroute/opencode-plugin/tests/features.test.ts
+++ b/@omniroute/opencode-plugin/tests/features.test.ts
@@ -376,7 +376,7 @@ test("provider hook: enrichment fetcher called when features.enrichment !== fals
  );
  const out = await hook.models!({} as never, { auth: apiAuth("sk") as never });
  assert.equal(called, 1, "enrichment fetcher called once");
-  const m = out["opencode-omniroute/claude-sonnet-4-6"];
+  const m = out["claude-sonnet-4-6"];
  assert.equal(m.name, "Claude Sonnet 4.6", "enrichment name overlay applied");
  assert.equal(m.cost.input, 3, "enrichment pricing applied");
  assert.equal(m.cost.output, 15);
@@ -401,11 +401,7 @@ test("provider hook: enrichment fetcher NOT called when features.enrichment:fals
  );
  const out = await hook.models!({} as never, { auth: apiAuth("sk") as never });
  assert.equal(called, 0, "enrichment fetcher NOT called when gated off");
-  assert.equal(
-    out["opencode-omniroute/claude-sonnet-4-6"].name,
-    "claude-sonnet-4-6",
-    "raw id preserved"
-  );
+  assert.equal(out["claude-sonnet-4-6"].name, "claude-sonnet-4-6", "raw id preserved");
 });

 test("provider hook: compression metadata fetcher NOT called by default (opt-in)", async () => {
@@ -463,7 +459,7 @@ test("provider hook: compression metadata fetcher called when opted in", async (
  );
  const out = await hook.models!({} as never, { auth: apiAuth("sk") as never });
  assert.equal(called, 1, "compression metadata fetcher called");
-  const combo = out["opencode-omniroute/claude-primary"];
+  const combo = out["combo/claude-primary"];
  assert.ok(combo, "combo entry present");
  assert.match(
    combo.name,
@@ -477,7 +473,7 @@ test("provider hook: compression metadata fetcher called when opted in", async (
 // ─────────────────────────────────────────────────────────────────────────

 const stubAuthJson = (apiKey: string) => async () => ({
-  "opencode-omniroute": { type: "api" as const, key: apiKey },
+  omniroute: { type: "api" as const, key: apiKey },
 });

 test("config hook: MCP auto-emit OFF by default (no mcp entry)", async () => {
@@ -492,7 +488,7 @@ test("config hook: MCP auto-emit OFF by default (no mcp entry)", async () => {
  );
  const input: { provider?: Record<string, unknown>; mcp?: Record<string, unknown> } = {};
  await hook(input as never);
-  assert.ok(input.provider?.["opencode-omniroute"], "provider block written");
+  assert.ok(input.provider?.omniroute, "provider block written");
  assert.equal(input.mcp, undefined, "no mcp block written");
 });

@@ -512,7 +508,7 @@ test("config hook: features.mcpAutoEmit:true writes mcp entry with provider apiK
  );
  const input: { provider?: Record<string, unknown>; mcp?: Record<string, unknown> } = {};
  await hook(input as never);
-  const entry = input.mcp?.["opencode-omniroute"] as
+  const entry = input.mcp?.omniroute as
    | { type: string; url: string; enabled: boolean; headers: Record<string, string> }
    | undefined;
  assert.ok(entry, "mcp entry written");
@@ -542,7 +538,7 @@ test("config hook: features.mcpToken overrides provider apiKey in mcp Bearer", a
  );
  const input: { provider?: Record<string, unknown>; mcp?: Record<string, unknown> } = {};
  await hook(input as never);
-  const entry = input.mcp?.["opencode-omniroute"] as { headers: Record<string, string> };
+  const entry = input.mcp?.omniroute as { headers: Record<string, string> };
  assert.equal(
    entry.headers.Authorization,
    "Bearer sk-mcp-narrower",
@@ -565,11 +561,11 @@ test("config hook: existing operator mcp.<providerId> wins (no overwrite)", asyn
    }
  );
  const input: { provider?: Record<string, unknown>; mcp?: Record<string, unknown> } = {
-    mcp: { "opencode-omniroute": { type: "custom-user-entry", url: "https://manual.example/mcp" } },
+    mcp: { omniroute: { type: "custom-user-entry", url: "https://manual.example/mcp" } },
  };
  await hook(input as never);
  assert.deepEqual(
-    input.mcp?.["opencode-omniroute"],
+    input.mcp?.omniroute,
    { type: "custom-user-entry", url: "https://manual.example/mcp" },
    "operator override preserved"
  );
@@ -584,7 +580,7 @@ test("config hook: features.mcpAutoEmit:true with /v1 in baseURL → strips corr
    },
    {
      readAuthJson: async () => ({
-        "opencode-omniroute-preprod": { type: "api" as const, key: "sk-preprod" },
+        "omniroute-preprod": { type: "api" as const, key: "sk-preprod" },
      }),
      fetcher: async () => SAMPLE_RAW,
      combosFetcher: async () => [],
@@ -593,7 +589,7 @@ test("config hook: features.mcpAutoEmit:true with /v1 in baseURL → strips corr
  );
  const input: { provider?: Record<string, unknown>; mcp?: Record<string, unknown> } = {};
  await hook(input as never);
-  const entry = input.mcp?.["opencode-omniroute-preprod"] as { url: string };
+  const entry = input.mcp?.["omniroute-preprod"] as { url: string };
  assert.equal(
    entry.url,
    "https://or-preprod.example.com/api/mcp/stream",
--- a/@omniroute/opencode-plugin/tests/gemini-sanitize.test.ts
+++ b/@omniroute/opencode-plugin/tests/gemini-sanitize.test.ts
@@ -212,8 +212,8 @@ test("shouldSanitizeForGemini: google-vertex/gemini-1.5-flash → true", () => {
  assert.equal(shouldSanitizeForGemini({ model: "google-vertex/gemini-1.5-flash" }), true);
 });

-test("shouldSanitizeForGemini: gemini/gemini-2.5-pro → true", () => {
-  assert.equal(shouldSanitizeForGemini({ model: "gemini/gemini-2.5-pro" }), true);
+test("shouldSanitizeForGemini: gemini-cli/gemini-2.5-pro → true (real OmniRoute alias)", () => {
+  assert.equal(shouldSanitizeForGemini({ model: "gemini-cli/gemini-2.5-pro" }), true);
 });

 test("shouldSanitizeForGemini: claude-sonnet-4 → false", () => {
--- a/@omniroute/opencode-plugin/tests/multi-instance.test.ts
+++ b/@omniroute/opencode-plugin/tests/multi-instance.test.ts
@@ -38,8 +38,8 @@ test("multi-instance: two plugin invocations bind to their own providerId", asyn
    baseURL: "https://b.example/v1",
  });

-  assert.equal(a.auth?.provider, "opencode-omniroute-prod");
-  assert.equal(b.auth?.provider, "opencode-omniroute-preprod");
+  assert.equal(a.auth?.provider, "omniroute-prod");
+  assert.equal(b.auth?.provider, "omniroute-preprod");
 });

 test("multi-instance: hook objects + nested arrays are independent references", async () => {
@@ -70,8 +70,8 @@ test("multi-instance: identical opts twice still yield independent objects", asy
  assert.notEqual(first.auth, second.auth);
  assert.notEqual(first.auth?.methods, second.auth?.methods);
  // Same provider id is fine — what matters is no shared mutable state.
-  assert.equal(first.auth?.provider, "opencode-twin");
-  assert.equal(second.auth?.provider, "opencode-twin");
+  assert.equal(first.auth?.provider, "twin");
+  assert.equal(second.auth?.provider, "twin");
 });

 test("multi-instance: mutating instance A's auth.methods does not affect instance B", async () => {
@@ -132,5 +132,5 @@ test("multi-instance: invalid opts on one instance does not poison the other", a
    providerId: "recovered",
    baseURL: "https://ok.example/v1",
  });
-  assert.equal(ok.auth?.provider, "opencode-recovered");
+  assert.equal(ok.auth?.provider, "recovered");
 });
--- a/@omniroute/opencode-plugin/tests/provider.test.ts
+++ b/@omniroute/opencode-plugin/tests/provider.test.ts
@@ -75,7 +75,7 @@ const apiAuth = (key: string, baseURL?: string): unknown =>

 test("createOmniRouteProviderHook: default providerId is 'omniroute'", () => {
  const hook = createOmniRouteProviderHook(undefined, { combosFetcher: async () => [] });
-  assert.equal(hook.id, "opencode-omniroute");
+  assert.equal(hook.id, "omniroute");
 });

 test("createOmniRouteProviderHook: custom providerId binds to hook.id (multi-instance)", () => {
@@ -87,8 +87,8 @@ test("createOmniRouteProviderHook: custom providerId binds to hook.id (multi-ins
    { providerId: "omniroute-local" },
    { combosFetcher: async () => [] }
  );
-  assert.equal(a.id, "opencode-omniroute-preprod");
-  assert.equal(b.id, "opencode-omniroute-local");
+  assert.equal(a.id, "omniroute-preprod");
+  assert.equal(b.id, "omniroute-local");
 });

 test("models: extracts apiKey from ctx.auth (type=api) and calls fetcher with it", async () => {
@@ -101,7 +101,7 @@ test("models: extracts apiKey from ctx.auth (type=api) and calls fetcher with it
  assert.equal(fetcher.callCount(), 1);
  assert.deepEqual(fetcher.callsBy()[0], ["https://or.example.com/v1", "sk-abc"]);
  assert.equal(Object.keys(out).length, 3);
-  assert.ok(out["opencode-omniroute/claude-primary"]);
+  assert.ok(out["claude-primary"]);
 });

 test("models: returns {} when ctx.auth is null/undefined/wrong-type/empty-key", async () => {
@@ -152,13 +152,11 @@ test("models: maps a sample /v1/models entry to ModelV2 (sanity)", async () => {
    { fetcher, combosFetcher: async () => [] }
  );
  const out = await hook.models!({} as never, { auth: apiAuth("sk-abc") as never });
-  const claude = out["opencode-omniroute/claude-primary"];
+  const claude = out["claude-primary"];
  assert.ok(claude, "claude-primary present");
-  // `mapRawModelToModelV2` stamps the provider prefix on the id so OC's
-  // static-catalog reader resolves `(providerID, modelID)` from the key.
-  assert.equal(claude.id, "opencode-omniroute/claude-primary");
+  assert.equal(claude.id, "claude-primary");
  assert.equal(claude.name, "claude-primary");
-  assert.equal(claude.providerID, "opencode-omniroute");
+  assert.equal(claude.providerID, "omniroute");
  assert.equal(claude.api.id, "openai-compatible");
  assert.equal(claude.api.url, "https://or.example.com/v1");
  assert.equal(claude.api.npm, "@ai-sdk/openai-compatible");
--- a/@omniroute/opencode-plugin/tests/scaffold.test.ts
+++ b/@omniroute/opencode-plugin/tests/scaffold.test.ts
@@ -1,5 +1,6 @@
 import test from "node:test";
 import assert from "node:assert/strict";
+import { createRequire } from "node:module";
 import {
  OmniRoutePlugin,
  OMNIROUTE_PROVIDER_KEY,
@@ -26,7 +27,7 @@ test("scaffold: default export is v1 plugin shape { id, server: OmniRoutePlugin

 test("resolveOmniRoutePluginOptions: defaults", () => {
  const r = resolveOmniRoutePluginOptions();
-  assert.equal(r.providerId, "opencode-omniroute");
+  assert.equal(r.providerId, "omniroute");
  assert.equal(r.displayName, "OmniRoute");
  assert.equal(r.modelCacheTtl, 300_000);
  assert.equal(r.baseURL, undefined);
@@ -34,8 +35,8 @@ test("resolveOmniRoutePluginOptions: defaults", () => {

 test("resolveOmniRoutePluginOptions: custom providerId derives displayName", () => {
  const r = resolveOmniRoutePluginOptions({ providerId: "omniroute-preprod" });
-  assert.equal(r.providerId, "opencode-omniroute-preprod");
-  assert.equal(r.displayName, "OmniRoute (opencode-omniroute-preprod)");
+  assert.equal(r.providerId, "omniroute-preprod");
+  assert.equal(r.displayName, "OmniRoute (omniroute-preprod)");
 });

 test("resolveOmniRoutePluginOptions: explicit displayName wins", () => {
@@ -62,12 +63,11 @@ test("OmniRoutePlugin: returns an empty hooks object (scaffold)", async () => {
  assert.notEqual(hooks, null);
 });

-test("scaffold: built ESM default export resolves with the v1 plugin shape", async () => {
-  // The plugin is ESM-only now — the CJS bundle was dropped to fix the OpenCode
-  // loader (#3883), so there is no more ../dist/index.cjs. Validate that the built
-  // distributable's default export still carries the OpenCode v1 { id, server } shape.
-  const mod = await import("../dist/index.js");
-  assert.strictEqual(typeof mod.default, "object");
-  assert.strictEqual(mod.default.id, "@omniroute/opencode-plugin");
-  assert.strictEqual(typeof mod.default.server, "function");
+test("scaffold: CJS default export resolves via require() with v1 shape", () => {
+  const require_ = createRequire(import.meta.url);
+  const cjs = require_("../dist/index.cjs");
+  // after cjsInterop:true, default export is on cjs.default
+  assert.strictEqual(typeof cjs.default, "object");
+  assert.strictEqual(cjs.default.id, "@omniroute/opencode-plugin");
+  assert.strictEqual(typeof cjs.default.server, "function");
 });
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -3,14 +3,14 @@
 ## Project

 Unified AI proxy/router — route any LLM through one endpoint. Multi-provider support
-with **236 provider entries** (OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Fireworks,
+with **226 provider entries** (OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Fireworks,
 Cohere, NVIDIA, Cerebras, Pollinations, Puter, Cloudflare AI, HuggingFace, DeepInfra,
 SambaNova, Meta Llama API, Moonshot AI, AI21 Labs, Databricks, Snowflake, and many more)
-with **MCP Server** (94 tools), **A2A v0.3 Protocol**, and **Electron desktop app**.
+with **MCP Server** (87 tools), **A2A v0.3 Protocol**, and **Electron desktop app**.

-> **Live counts (v3.8.40)**: providers 236 · MCP tools 94 · MCP scopes 30 · A2A skills 6 ·
-> open-sse services 298 · routing strategies 17 · auto-combo scoring factors 12 ·
-> DB modules 94 · DB migrations 106 · base tables 17 · search providers 11 ·
+> **Live counts (v3.8.24)**: providers 226 · MCP tools 87 · MCP scopes 30 · A2A skills 6 ·
+> open-sse services 115 · routing strategies 15 · auto-combo scoring factors 9 ·
+> DB modules 83 · DB migrations 97 · base tables 17 · search providers 11 ·
 > i18n locales 42. **Refresh with `npm run check:docs-all`.**

 ## Doc Accuracy Discipline (read before writing any doc)
@@ -267,7 +267,7 @@ Zod schemas, and unit tests aligned when editing.

 ### Provider Categories

- **Free** (3): Qoder AI, Qwen Code, Kiro AI
+- **Free** (4): Qoder AI, Qwen Code, Gemini CLI (deprecated), Kiro AI
 - **OAuth** (14): Claude Code, Antigravity, Codex, GitHub Copilot, Cursor, Kimi Coding, Kilo Code, Cline, Qwen (⚠️ free tier discontinued 2026-04-15), Kiro, Qoder, Gemini, Windsurf (v3.8), GitLab Duo (v3.8)
 - **API Key** (120+): OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Perplexity,
  Together, Fireworks, Cerebras, Cohere, NVIDIA, Nebius, SiliconFlow, Hyperbolic,
@@ -291,7 +291,7 @@ Providers are registered in `src/shared/constants/providers.ts` with Zod validat
 ### Executors (`open-sse/executors/`)

 Provider-specific request executors: `base.ts`, `default.ts`, `cursor.ts`, `codex.ts`,
-`antigravity.ts`, `github.ts`, `kiro.ts`, `qoder.ts`, `vertex.ts`,
+`antigravity.ts`, `github.ts`, `gemini-cli.ts`, `kiro.ts`, `qoder.ts`, `vertex.ts`,
 `cloudflare-ai.ts`, `opencode.ts`, `pollinations.ts`, `puter.ts`.

 #### Executor Internals
@@ -391,7 +391,7 @@ Policy engine modules: `policyEngine.ts`, `comboResolver.ts`, `costRules.ts`,

 ### MCP Server (`open-sse/mcp-server/`)

-**94 tools** total (`TOTAL_MCP_TOOL_COUNT`, `open-sse/mcp-server/server.ts`): a 34-entry base registry (`MCP_TOOLS` in `schemas/tools.ts`, bundling the core / cache / compression / 1proxy / advanced tools) **plus** standalone module sets — memory (3), skill (4), agentSkill (3), pool (6), gamification (8), plugin (8), notion (6), obsidian (22). 3 transports (stdio / SSE / Streamable HTTP). Scoped auth (30 scopes — see `OMNIROUTE_MCP_SCOPES`), Zod schemas. See [`docs/frameworks/MCP-SERVER.md`](docs/frameworks/MCP-SERVER.md).
+**87 tools** total (`TOTAL_MCP_TOOL_COUNT`, `open-sse/mcp-server/server.ts`): a 33-entry base registry (`MCP_TOOLS` in `schemas/tools.ts`, bundling the core / cache / compression / 1proxy / advanced tools) **plus** standalone module sets — memory (3), skill (4), agentSkill (3), gamification (8), plugin (8), notion (6), obsidian (22). 3 transports (stdio / SSE / Streamable HTTP). Scoped auth (30 scopes — see `OMNIROUTE_MCP_SCOPES`), Zod schemas. See [`docs/frameworks/MCP-SERVER.md`](docs/frameworks/MCP-SERVER.md).

 **Core tools** (20): get_health, list_combos, get_combo_metrics, switch_combo, check_quota,
 route_request, cost_report, list_models_catalog, web_search, simulate_route, set_budget_guard,
@@ -489,7 +489,7 @@ Request middleware including `promptInjectionGuard.ts`.

 ### Guardrails (`src/lib/guardrails/`)

-Hot-reloadable guardrails framework (3 built-in: pii-masker, prompt-injection, vision-bridge). Fail-open. The `pii-masker` guardrail is registered and runs on every request, but its data-mutating logic is **opt-in** and OFF by default — it only redacts when `PII_REDACTION_ENABLED` (request) / `PII_RESPONSE_SANITIZATION` (response + streaming) are enabled (both `defaultValue: "false"`); with them off, payloads pass through untouched. A request can additionally opt OUT of any guardrail via header (`x-omniroute-disabled-guardrails`). Never make PII default-on (Hard Rule #20). See [`docs/security/GUARDRAILS.md`](docs/security/GUARDRAILS.md).
+Hot-reloadable guardrails framework (3 built-in: pii-masker, prompt-injection, vision-bridge). Fail-open; per-request opt-out via header. See [`docs/security/GUARDRAILS.md`](docs/security/GUARDRAILS.md).

 ### Cloud Agents (`src/lib/cloudAgent/`)

@@ -534,33 +534,32 @@ Cloudflare Quick/Named, ngrok, Tailscale Funnel. See [`docs/ops/TUNNELS_GUIDE.md

 For any non-trivial change, read the matching deep-dive first:

-| Area                                       | Doc                                                                                                             |
-| ------------------------------------------ | --------------------------------------------------------------------------------------------------------------- |
-| Repo navigation                            | [`docs/architecture/REPOSITORY_MAP.md`](docs/architecture/REPOSITORY_MAP.md)                                    |
-| Architecture                               | [`docs/architecture/ARCHITECTURE.md`](docs/architecture/ARCHITECTURE.md)                                        |
-| Engineering reference                      | [`docs/architecture/CODEBASE_DOCUMENTATION.md`](docs/architecture/CODEBASE_DOCUMENTATION.md)                    |
-| Auto-Combo (12-factor, 17 strategies)      | [`docs/routing/AUTO-COMBO.md`](docs/routing/AUTO-COMBO.md)                                                      |
-| Resilience (3 layers)                      | [`docs/architecture/RESILIENCE_GUIDE.md`](docs/architecture/RESILIENCE_GUIDE.md)                                |
-| Skills                                     | [`docs/frameworks/SKILLS.md`](docs/frameworks/SKILLS.md)                                                        |
-| Memory                                     | [`docs/frameworks/MEMORY.md`](docs/frameworks/MEMORY.md)                                                        |
-| Cloud agents                               | [`docs/frameworks/CLOUD_AGENT.md`](docs/frameworks/CLOUD_AGENT.md)                                              |
-| Guardrails                                 | [`docs/security/GUARDRAILS.md`](docs/security/GUARDRAILS.md)                                                    |
-| Evals                                      | [`docs/frameworks/EVALS.md`](docs/frameworks/EVALS.md)                                                          |
-| Compliance                                 | [`docs/security/COMPLIANCE.md`](docs/security/COMPLIANCE.md)                                                    |
-| Webhooks                                   | [`docs/frameworks/WEBHOOKS.md`](docs/frameworks/WEBHOOKS.md)                                                    |
-| Authz                                      | [`docs/architecture/AUTHZ_GUIDE.md`](docs/architecture/AUTHZ_GUIDE.md)                                          |
-| Stealth                                    | [`docs/security/STEALTH_GUIDE.md`](docs/security/STEALTH_GUIDE.md)                                              |
-| Reasoning replay                           | [`docs/routing/REASONING_REPLAY.md`](docs/routing/REASONING_REPLAY.md)                                          |
-| Agent protocols (A2A / ACP / Cloud)        | [`docs/frameworks/AGENT_PROTOCOLS_GUIDE.md`](docs/frameworks/AGENT_PROTOCOLS_GUIDE.md)                          |
-| MCP server                                 | [`docs/frameworks/MCP-SERVER.md`](docs/frameworks/MCP-SERVER.md)                                                |
-| A2A server                                 | [`docs/frameworks/A2A-SERVER.md`](docs/frameworks/A2A-SERVER.md)                                                |
-| API reference                              | [`docs/reference/API_REFERENCE.md`](docs/reference/API_REFERENCE.md) + [`docs/openapi.yaml`](docs/openapi.yaml) |
-| Provider catalog (auto-generated)          | [`docs/reference/PROVIDER_REFERENCE.md`](docs/reference/PROVIDER_REFERENCE.md)                                  |
-| Tunnels                                    | [`docs/ops/TUNNELS_GUIDE.md`](docs/ops/TUNNELS_GUIDE.md)                                                        |
-| Electron desktop                           | [`docs/guides/ELECTRON_GUIDE.md`](docs/guides/ELECTRON_GUIDE.md)                                                |
-| Release flow                               | [`docs/ops/RELEASE_CHECKLIST.md`](docs/ops/RELEASE_CHECKLIST.md)                                                |
-| Quality gates (35 gates, allowlist policy) | [`docs/architecture/QUALITY_GATES.md`](docs/architecture/QUALITY_GATES.md)                                      |
-| Cluster opt-in profiles (memory, bifrost)  | [`docs/architecture/cluster-decisions.md`](docs/architecture/cluster-decisions.md)                              |
+| Area                                       | Doc                                                                                                                                 |
+| ------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------- |
+| Repo navigation                            | [`docs/architecture/REPOSITORY_MAP.md`](docs/architecture/REPOSITORY_MAP.md)                                                        |
+| Architecture                               | [`docs/architecture/ARCHITECTURE.md`](docs/architecture/ARCHITECTURE.md)                                                            |
+| Engineering reference                      | [`docs/architecture/CODEBASE_DOCUMENTATION.md`](docs/architecture/CODEBASE_DOCUMENTATION.md)                                        |
+| Auto-Combo (12-factor, 15 strategies)      | [`docs/routing/AUTO-COMBO.md`](docs/routing/AUTO-COMBO.md)                                                                          |
+| Resilience (3 layers)                      | [`docs/architecture/RESILIENCE_GUIDE.md`](docs/architecture/RESILIENCE_GUIDE.md)                                                    |
+| Skills                                     | [`docs/frameworks/SKILLS.md`](docs/frameworks/SKILLS.md)                                                                            |
+| Memory                                     | [`docs/frameworks/MEMORY.md`](docs/frameworks/MEMORY.md)                                                                            |
+| Cloud agents                               | [`docs/frameworks/CLOUD_AGENT.md`](docs/frameworks/CLOUD_AGENT.md)                                                                  |
+| Guardrails                                 | [`docs/security/GUARDRAILS.md`](docs/security/GUARDRAILS.md)                                                                        |
+| Evals                                      | [`docs/frameworks/EVALS.md`](docs/frameworks/EVALS.md)                                                                              |
+| Compliance                                 | [`docs/security/COMPLIANCE.md`](docs/security/COMPLIANCE.md)                                                                        |
+| Webhooks                                   | [`docs/frameworks/WEBHOOKS.md`](docs/frameworks/WEBHOOKS.md)                                                                        |
+| Authz                                      | [`docs/architecture/AUTHZ_GUIDE.md`](docs/architecture/AUTHZ_GUIDE.md)                                                              |
+| Stealth                                    | [`docs/security/STEALTH_GUIDE.md`](docs/security/STEALTH_GUIDE.md)                                                                  |
+| Reasoning replay                           | [`docs/routing/REASONING_REPLAY.md`](docs/routing/REASONING_REPLAY.md)                                                              |
+| Agent protocols (A2A / ACP / Cloud)        | [`docs/frameworks/AGENT_PROTOCOLS_GUIDE.md`](docs/frameworks/AGENT_PROTOCOLS_GUIDE.md)                                              |
+| MCP server                                 | [`docs/frameworks/MCP-SERVER.md`](docs/frameworks/MCP-SERVER.md)                                                                    |
+| A2A server                                 | [`docs/frameworks/A2A-SERVER.md`](docs/frameworks/A2A-SERVER.md)                                                                    |
+| API reference                              | [`docs/reference/API_REFERENCE.md`](docs/reference/API_REFERENCE.md) + [`docs/reference/openapi.yaml`](docs/reference/openapi.yaml) |
+| Provider catalog (auto-generated)          | [`docs/reference/PROVIDER_REFERENCE.md`](docs/reference/PROVIDER_REFERENCE.md)                                                      |
+| Tunnels                                    | [`docs/ops/TUNNELS_GUIDE.md`](docs/ops/TUNNELS_GUIDE.md)                                                                            |
+| Electron desktop                           | [`docs/guides/ELECTRON_GUIDE.md`](docs/guides/ELECTRON_GUIDE.md)                                                                    |
+| Release flow                               | [`docs/ops/RELEASE_CHECKLIST.md`](docs/ops/RELEASE_CHECKLIST.md)                                                                    |
+| Quality gates (35 gates, allowlist policy) | [`docs/architecture/QUALITY_GATES.md`](docs/architecture/QUALITY_GATES.md)                                                          |

 ---

--- a/CHANGELOG.md
+++ b/CHANGELOG.md
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -35,22 +35,22 @@ For full test matrix, see `CONTRIBUTING.md` → "Running Tests". For deep archit

 ## Project at a Glance

-**OmniRoute** — unified AI proxy/router. One endpoint, 236 LLM providers, auto-fallback.
+**OmniRoute** — unified AI proxy/router. One endpoint, 226 LLM providers, auto-fallback.

-| Layer         | Location                | Purpose                                                                                                                                                |
-| ------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| API Routes    | `src/app/api/v1/`       | Next.js App Router — entry points                                                                                                                      |
-| Handlers      | `open-sse/handlers/`    | Request processing (chat, embeddings, etc)                                                                                                             |
-| Executors     | `open-sse/executors/`   | Provider-specific HTTP dispatch                                                                                                                        |
-| Translators   | `open-sse/translator/`  | Format conversion (OpenAI↔Claude↔Gemini)                                                                                                               |
-| Transformer   | `open-sse/transformer/` | Responses API ↔ Chat Completions                                                                                                                       |
-| Services      | `open-sse/services/`    | Combo routing, rate limits, caching, etc                                                                                                               |
-| Database      | `src/lib/db/`           | SQLite domain modules (94 files, 106 migrations)                                                                                                       |
-| Domain/Policy | `src/domain/`           | Policy engine, cost rules, fallback logic                                                                                                              |
-| MCP Server    | `open-sse/mcp-server/`  | 94 tools (34 base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules), 3 transports (stdio / SSE / Streamable HTTP), 30 scopes |
-| A2A Server    | `src/lib/a2a/`          | JSON-RPC 2.0 agent protocol                                                                                                                            |
-| Skills        | `src/lib/skills/`       | Extensible skill framework                                                                                                                             |
-| Memory        | `src/lib/memory/`       | Persistent conversational memory                                                                                                                       |
+| Layer         | Location                | Purpose                                                                                                                                |
+| ------------- | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
+| API Routes    | `src/app/api/v1/`       | Next.js App Router — entry points                                                                                                      |
+| Handlers      | `open-sse/handlers/`    | Request processing (chat, embeddings, etc)                                                                                             |
+| Executors     | `open-sse/executors/`   | Provider-specific HTTP dispatch                                                                                                        |
+| Translators   | `open-sse/translator/`  | Format conversion (OpenAI↔Claude↔Gemini)                                                                                               |
+| Transformer   | `open-sse/transformer/` | Responses API ↔ Chat Completions                                                                                                       |
+| Services      | `open-sse/services/`    | Combo routing, rate limits, caching, etc                                                                                               |
+| Database      | `src/lib/db/`           | SQLite domain modules (83 files, 97 migrations)                                                                                        |
+| Domain/Policy | `src/domain/`           | Policy engine, cost rules, fallback logic                                                                                              |
+| MCP Server    | `open-sse/mcp-server/`  | 87 tools (33 base + memory/skill/notion/obsidian/gamification/plugin modules), 3 transports (stdio / SSE / Streamable HTTP), 30 scopes |
+| A2A Server    | `src/lib/a2a/`          | JSON-RPC 2.0 agent protocol                                                                                                            |
+| Skills        | `src/lib/skills/`       | Extensible skill framework                                                                                                             |
+| Memory        | `src/lib/memory/`       | Persistent conversational memory                                                                                                       |

 Monorepo: `src/` (Next.js 16 app), `open-sse/` (streaming engine workspace), `electron/` (desktop app), `tests/`, `bin/` (CLI entry point).

@@ -72,7 +72,7 @@ Client → /v1/chat/completions (Next.js route)

 API routes follow a consistent pattern: `Route → CORS preflight → Zod body validation → Optional auth (extractApiKey/isValidApiKey) → API key policy enforcement → Handler delegation (open-sse)`. No global Next.js middleware — interception is route-specific.

-**Combo routing** (`open-sse/services/combo.ts`): 17 strategies (priority, weighted, fill-first, round-robin, P2C, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion). Each target calls `handleSingleModel()` which wraps `handleChatCore()` with per-target error handling and circuit breaker checks. The `fusion` strategy is the exception: it fans out to a panel of models in parallel, then a judge model synthesizes one final answer (`open-sse/services/fusion.ts`). See `docs/routing/AUTO-COMBO.md` for the 12-factor Auto-Combo scoring + the full strategy table and `docs/architecture/RESILIENCE_GUIDE.md` for the 3 resilience layers.
+**Combo routing** (`open-sse/services/combo.ts`): 15 strategies (priority, weighted, fill-first, round-robin, P2C, random, least-used, cost-optimized, reset-aware, reset-window, strict-random, auto, lkgp, context-optimized, context-relay). Each target calls `handleSingleModel()` which wraps `handleChatCore()` with per-target error handling and circuit breaker checks. See `docs/routing/AUTO-COMBO.md` for the 9-factor Auto-Combo scoring and `docs/architecture/RESILIENCE_GUIDE.md` for the 3 resilience layers.

 ---

@@ -311,7 +311,7 @@ connection continue serving other models.
 4. Create 7 API endpoints under `src/app/api/services/{name}/` (`_lib.ts`, `install`, `start`, `stop`, `restart`, `update`, `status`, `auto-start`). All delegate errors through `createErrorResponse()`. The shared `logs` endpoint is already wired via `[name]/logs/route.ts`.
 5. Verify `/api/services/` is in `LOCAL_ONLY_API_PREFIXES` in `src/server/authz/routeGuard.ts`; add a test asserting `isLocalOnlyPath()` returns `true` for the new prefix if you add one (hard rule #17).
 6. Add a UI tab in `src/app/(dashboard)/dashboard/providers/services/tabs/` reusing `ServiceStatusCard`, `ServiceLifecycleButtons`, `ServiceLogsPanel`.
-7. Document in `docs/frameworks/EMBEDDED-SERVICES.md` (update §1 service table + §4 API reference) and `docs/openapi.yaml`.
+7. Document in `docs/frameworks/EMBEDDED-SERVICES.md` (update §1 service table + §4 API reference) and `docs/reference/openapi.yaml`.
 8. Write tests: unit (`tests/unit/services/`), integration (`tests/integration/services/`, gated by `RUN_SERVICES_INT=1`), and update `docs/ops/RELEASE_CHECKLIST.md` smoke section.

 ### Adding a New Guardrail / Eval / Skill / Webhook event
@@ -327,33 +327,33 @@ connection continue serving other models.

 For any non-trivial change, read the matching deep-dive first:

-| Area                                          | Doc                                                     |
-| --------------------------------------------- | ------------------------------------------------------- |
-| Repo navigation                               | `docs/architecture/REPOSITORY_MAP.md`                   |
-| Architecture                                  | `docs/architecture/ARCHITECTURE.md`                     |
-| Engineering reference                         | `docs/architecture/CODEBASE_DOCUMENTATION.md`           |
-| Auto-Combo (12-factor scoring, 17 strategies) | `docs/routing/AUTO-COMBO.md`                            |
-| Resilience (3 mechanisms)                     | `docs/architecture/RESILIENCE_GUIDE.md`                 |
-| Reasoning replay                              | `docs/routing/REASONING_REPLAY.md`                      |
-| Skills framework                              | `docs/frameworks/SKILLS.md`                             |
-| Memory system (FTS5 + Qdrant)                 | `docs/frameworks/MEMORY.md`                             |
-| Cloud agents                                  | `docs/frameworks/CLOUD_AGENT.md`                        |
-| Guardrails (PII / injection / vision)         | `docs/security/GUARDRAILS.md`                           |
-| Public upstream credentials (Gemini/etc.)     | `docs/security/PUBLIC_CREDS.md`                         |
-| Error message sanitization                    | `docs/security/ERROR_SANITIZATION.md`                   |
-| Evals                                         | `docs/frameworks/EVALS.md`                              |
-| Compliance / audit                            | `docs/security/COMPLIANCE.md`                           |
-| Webhooks                                      | `docs/frameworks/WEBHOOKS.md`                           |
-| Authorization pipeline                        | `docs/architecture/AUTHZ_GUIDE.md`                      |
-| Stealth (TLS / fingerprint)                   | `docs/security/STEALTH_GUIDE.md`                        |
-| Agent protocols (A2A / ACP / Cloud)           | `docs/frameworks/AGENT_PROTOCOLS_GUIDE.md`              |
-| MCP server                                    | `docs/frameworks/MCP-SERVER.md`                         |
-| A2A server                                    | `docs/frameworks/A2A-SERVER.md`                         |
-| API reference + OpenAPI                       | `docs/reference/API_REFERENCE.md` + `docs/openapi.yaml` |
-| Provider catalog (auto-generated)             | `docs/reference/PROVIDER_REFERENCE.md`                  |
-| Release flow                                  | `docs/ops/RELEASE_CHECKLIST.md`                         |
-| Embedded services                             | `docs/frameworks/EMBEDDED-SERVICES.md`                  |
-| Quality gates (~48 scripts, allowlist policy) | `docs/architecture/QUALITY_GATES.md`                    |
+| Area                                          | Doc                                                               |
+| --------------------------------------------- | ----------------------------------------------------------------- |
+| Repo navigation                               | `docs/architecture/REPOSITORY_MAP.md`                             |
+| Architecture                                  | `docs/architecture/ARCHITECTURE.md`                               |
+| Engineering reference                         | `docs/architecture/CODEBASE_DOCUMENTATION.md`                     |
+| Auto-Combo (9-factor scoring, 15 strategies)  | `docs/routing/AUTO-COMBO.md`                                      |
+| Resilience (3 mechanisms)                     | `docs/architecture/RESILIENCE_GUIDE.md`                           |
+| Reasoning replay                              | `docs/routing/REASONING_REPLAY.md`                                |
+| Skills framework                              | `docs/frameworks/SKILLS.md`                                       |
+| Memory system (FTS5 + Qdrant)                 | `docs/frameworks/MEMORY.md`                                       |
+| Cloud agents                                  | `docs/frameworks/CLOUD_AGENT.md`                                  |
+| Guardrails (PII / injection / vision)         | `docs/security/GUARDRAILS.md`                                     |
+| Public upstream credentials (Gemini/etc.)     | `docs/security/PUBLIC_CREDS.md`                                   |
+| Error message sanitization                    | `docs/security/ERROR_SANITIZATION.md`                             |
+| Evals                                         | `docs/frameworks/EVALS.md`                                        |
+| Compliance / audit                            | `docs/security/COMPLIANCE.md`                                     |
+| Webhooks                                      | `docs/frameworks/WEBHOOKS.md`                                     |
+| Authorization pipeline                        | `docs/architecture/AUTHZ_GUIDE.md`                                |
+| Stealth (TLS / fingerprint)                   | `docs/security/STEALTH_GUIDE.md`                                  |
+| Agent protocols (A2A / ACP / Cloud)           | `docs/frameworks/AGENT_PROTOCOLS_GUIDE.md`                        |
+| MCP server                                    | `docs/frameworks/MCP-SERVER.md`                                   |
+| A2A server                                    | `docs/frameworks/A2A-SERVER.md`                                   |
+| API reference + OpenAPI                       | `docs/reference/API_REFERENCE.md` + `docs/reference/openapi.yaml` |
+| Provider catalog (auto-generated)             | `docs/reference/PROVIDER_REFERENCE.md`                            |
+| Release flow                                  | `docs/ops/RELEASE_CHECKLIST.md`                                   |
+| Embedded services                             | `docs/frameworks/EMBEDDED-SERVICES.md`                            |
+| Quality gates (~48 scripts, allowlist policy) | `docs/architecture/QUALITY_GATES.md`                              |

 ---

@@ -388,31 +388,6 @@ Why this matters: fixing bug A while opening bug B is worse than not fixing at a

 ---

-## Planning & Research Artifacts (superpowers, deep-research)
-
-`_tasks/` is a **separate, isolated git repository** that is gitignored by the main
-repo (`.gitignore` → `_tasks/`). It is the canonical home for working artifacts —
-plans, specs/designs, research, hand-offs — so they stay **versioned in their own
-repo** instead of polluting the main OmniRoute tree.
-
-**Hard rule — never write superpowers / planning / research output under `docs/` or
-the repo root.** The superpowers skills ship with defaults that point at `docs/…`
-(`writing-plans` → `docs/superpowers/plans/`, `brainstorming` → `docs/superpowers/specs/`).
-Those defaults are **overridden here**. Whenever you invoke superpowers (or any
-plan/spec/research generator) in this project, save to `_tasks/` instead, using the
-same filename convention:
-
-| Artifact (skill)                   | Default (do NOT use)      | Save here instead                                             |
-| ---------------------------------- | ------------------------- | ------------------------------------------------------------- |
-| Plans (`writing-plans`)            | `docs/superpowers/plans/` | `_tasks/superpowers/plans/YYYY-MM-DD-<feature>.md`            |
-| Specs / design (`brainstorming`)   | `docs/superpowers/specs/` | `_tasks/superpowers/specs/YYYY-MM-DD-<topic>-design.md`       |
-| Research (`deep-research`, ad-hoc) | `docs/research/`          | `_tasks/research/…`                                           |
-| Hand-offs (`/handoff`)             | —                         | `_tasks/hands-off/<YYYY-MM-DD>_<branch>_v<versão>_sess-<id>/` |
-
-When a superpowers skill announces a path like "saved to `docs/superpowers/plans/…`",
-rewrite it to the `_tasks/…` equivalent before writing. Commit those artifacts inside
-the `_tasks/` repo (`git -C _tasks …`), never in the main repo.
-
 ## Git Workflow

 ```bash
@@ -444,36 +419,27 @@ own dedicated branch, and you MUST confirm the base branch with the operator bef
   `AskUserQuestion`, unless they already told you) from which branch the new worktree/branch
   should be cut. Do NOT assume `main` or "whatever I'm on" — the answer is usually the active
   `release/vX.Y.Z`, but it can be another feature/release branch. Get the base explicitly.
-2. **Create an isolated worktree + branch off that base** (never reuse the main checkout).
-   **🔴 MANDATORY PATH: every worktree lives under `.claude/worktrees/` — and nowhere else.**
-   This is the single canonical location (the same dir the native `EnterWorktree` tool uses). It
-   is gitignored AND in the `tsconfig.json` / `.dockerignore` excludes, so worktrees never leak
-   into the build scope. **Never** use `.worktrees/`, repo-root, or any other path — a worktree
-   outside `.claude/worktrees/` (a) escapes the build-scope excludes and poisons `next build` (the
-   `tsconfig` `include: **/*` globs ~70× the codebase → OOM; incident 2026-06-25) and (b) scatters
-   worktrees across two dirs.
+2. **Create an isolated worktree + branch off that base** (never reuse the main checkout):

   ```bash
   BASE_BRANCH="release/vX.Y.Z"          # ← the branch the operator confirmed in step 1
   TASK="feat/your-feature"               # feat/ fix/ refactor/ docs/ test/ chore/
   git fetch origin "$BASE_BRANCH"
-   git worktree add ".claude/worktrees/${TASK##*/}" -b "$TASK" "origin/$BASE_BRANCH"
-   cd ".claude/worktrees/${TASK##*/}"
+   git worktree add ".worktrees/${TASK##*/}" -b "$TASK" "origin/$BASE_BRANCH"
+   cd ".worktrees/${TASK##*/}"
   # symlink node_modules from the main checkout to skip a per-worktree npm install:
   ln -s "$(git -C <main_checkout> rev-parse --show-toplevel)/node_modules" node_modules
   ```

-   In Claude Code prefer the native `EnterWorktree` tool (it already creates worktrees under
-   `.claude/worktrees/`): create the worktree with the command above, then call `EnterWorktree`
-   with its `path`.
-
+   In Claude Code prefer the native `EnterWorktree` tool (create the worktree with the command
+   above, then call `EnterWorktree` with its `path`).
 3. **Work, commit, push, open the PR — all from inside the worktree.** Never `git checkout` a
   different branch inside a worktree another session might share.
 4. **Tear down only your own** worktree + branch when done, from the main checkout:
-   `git worktree remove .claude/worktrees/<dir>` then `git branch -D <task>`. Never blanket-delete
+   `git worktree remove .worktrees/<dir>` then `git branch -D <task>`. Never blanket-delete
   `fix/*`/`feat/*` — other sessions keep their own; delete only the branches you created, by name.
 5. **Never touch another session's worktree, branch, or uncommitted changes.** If `git worktree
-list` shows worktrees you didn't create, leave them alone. End every session with the main
+   list` shows worktrees you didn't create, leave them alone. End every session with the main
   checkout back on the branch it started on (the active `release/vX.Y.Z`, never `main`).

 ---
@@ -534,12 +500,10 @@ the stale-enforcement added in Fase 6A.3.
 13. Never string-interpolate external paths or runtime values into shell scripts passed to `exec()`/`spawn()` — pass via the `env` option instead. Reference: `src/mitm/cert/install.ts::updateNssDatabases`.
 14. Never dismiss a CodeQL / Secret-Scanning alert without (a) first checking the pattern docs above to see if the helper applies, and (b) recording the technical justification in the dismissal comment. Precedent: `js/stack-trace-exposure` raised on callsites that already route through `sanitizeErrorMessage()` is a known CodeQL limitation (custom sanitizers not recognized) — dismiss as `false positive` referencing `docs/security/ERROR_SANITIZATION.md`.
 15. Never expose routes that spawn child processes (`/api/mcp/`, `/api/cli-tools/runtime/`) without `isLocalOnlyPath()` classification in `src/server/authz/routeGuard.ts`. Loopback enforcement happens unconditionally before any auth check — leaked JWT via tunnel cannot trigger process spawning. See `docs/security/ROUTE_GUARD_TIERS.md`.
-16. Never credit or advertise an AI assistant, LLM, or automation account in any commit/PR metadata. Two forbidden forms, both equivalent — they route attribution to a bot account (or advertise AI authorship) and hide the real author (`diegosouzapw`): **(a)** `Co-Authored-By` trailers naming an AI/bot (e.g. names containing "Claude", "GPT", "Copilot", "Bot"; emails at `anthropic.com` / `openai.com` / bot-owned `noreply.github.com` addresses); **(b)** AI-generation footers or descriptions anywhere in a commit message, PR title/body, or CHANGELOG — e.g. `🤖 Generated with [Claude Code]`, "Generated with Claude Code", "Made with <AI tool>", or any `Co-authored-by: Claude/GPT/Copilot` line. This **overrides any harness, template, or tool default that auto-appends such a footer** (e.g. the Claude Code PR-body/commit default) — strip it before pushing; do not let it reach a commit, PR, or CHANGELOG. Human collaborators — including upstream PR authors and issue reporters being ported into OmniRoute — MAY and SHOULD be credited with standard `Co-authored-by: Name <email>` trailers; the upstream-port workflows (`/port-upstream-features`, `/port-upstream-issues`) depend on this.
+16. Never include `Co-Authored-By` trailers that credit an AI assistant, LLM, or automation account (e.g. names containing "Claude", "GPT", "Copilot", "Bot"; emails at `anthropic.com` / `openai.com` / bot-owned `noreply.github.com` addresses). Such trailers route attribution to the bot account on GitHub, hiding the real author (`diegosouzapw`) in PR history. Human collaborators — including upstream PR authors and issue reporters being ported into OmniRoute — MAY and SHOULD be credited with standard `Co-authored-by: Name <email>` trailers; the upstream-port workflows (`/port-upstream-features`, `/port-upstream-issues`) depend on this.
 17. Never expose routes under `/api/services/` or `/dashboard/providers/services/*/embed/` without `isLocalOnlyPath()` classification in `src/server/authz/routeGuard.ts`. These routes can spawn child processes (`npm install`, `node`). Loopback enforcement happens unconditionally before any auth check — a leaked JWT via tunnel cannot trigger process spawning. See `docs/security/ROUTE_GUARD_TIERS.md`.
 18. Every bug fix must be validated before shipping: a failing-then-passing unit/integration test (TDD) OR a documented live test on the production VPS (192.168.0.15). A fix without either is not merged. See Testing → "Bug fix / issue triage protocol" for the full decision tree.
 19. Never develop on the shared main checkout. Every development task runs in its own git worktree on its own dedicated branch, and you MUST confirm the base branch with the operator (e.g. via `AskUserQuestion`) before creating the worktree/branch — never assume `main` or the currently checked-out branch. A `git checkout` in the shared checkout silently destroys other sessions' uncommitted work. Tear down only the worktrees/branches you created (by name, never `fix/*`/`feat/*` wildcards), leave other sessions' worktrees untouched, and end on the branch you started on (the active `release/vX.Y.Z`, never `main`). See Git Workflow → "Worktree isolation".
-20. PII redaction/sanitization is **opt-in — never on by default**. OmniRoute proxies for self-hosted/local LLMs where the operator owns the data, so mutating request/response payloads by default would silently corrupt legitimate traffic. The two data-mutating PII feature flags **MUST** keep `defaultValue: "false"` in `src/shared/constants/featureFlagDefinitions.ts`: `PII_REDACTION_ENABLED` (request-side) and `PII_RESPONSE_SANITIZATION` (response + streaming). All three application points — `src/lib/guardrails/piiMasker.ts` (request guardrail), `src/lib/piiSanitizer.ts` (response), `src/lib/streamingPiiTransform.ts` (SSE) — are gated on these flags; with both off the `pii-masker` guardrail still runs but never mutates payloads (data passes through untouched). Flipping either default to `"true"` requires explicit operator approval. The regression guard is `tests/unit/pii-opt-in-default.test.ts` (asserts both definition defaults + behavioral pass-through). Opt-in is per-operator via env or the settings/DB override (`src/lib/db/featureFlags.ts`), never a silent default. See `docs/security/GUARDRAILS.md`.
-21. **Release-freeze — the release branch is frozen to campaign merges while a `/generate-release` is running.** `/generate-release` opens a marker issue labeled `release-freeze` at the start of reconciliation (Phase 0a) and closes it once the release PR squash-merges to `main`. Before merging **any** PR into the active `release/vX.Y.Z` branch, every campaign workflow (`/review-issues`, `/review-prs`, `/implement-features`, `/green-prs`, `/port-upstream-*`) **MUST** check `gh issue list --repo diegosouzapw/OmniRoute --label release-freeze --state open` — if a freeze is active, **HOLD the merge** (leave the PR ready and open; do NOT merge to the release branch), tell the operator, and resume once the freeze lifts. This is a **coordination signal, not a permission lock**: the release captain and the campaign sessions share the `diegosouzapw` identity, so a GitHub branch-protection lock cannot distinguish them — only this honored marker prevents the mid-release commit races that forced full CHANGELOG re-reconciliation in v3.8.40/v3.8.41 (a parallel campaign advanced `release/vX.Y.Z` by 34 commits mid-run). The release captain's own reconciliation/cycle-open pushes are exempt — they *are* the release. Fixes that must land during a freeze (a homologation finding) follow the post-merge read-only rule: land on `main` first via `fix/release-vX.Y.Z-*`.

 ---

--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -160,31 +160,19 @@ npm run test:protocols:e2e
 # Ecosystem compatibility tests
 npm run test:ecosystem

-# Coverage gate: 60% statements/lines/functions/branches
+# Coverage gate: 75% statements/lines/functions, 70% branches
 npm run test:coverage
 npm run coverage:report

 # Lint + format check
 npm run lint
 npm run check
-
-# Gated real-upstream combo smoke (requires VPS access + real provider credits)
-# Hits REAL providers — costs a little. NEVER runs in CI. Skips cleanly without the gate.
-# Needs: ssh root@192.168.0.15 access (sources a read-only DB snapshot from the VPS).
-RUN_COMBO_LIVE=1 npm run test:combo:live
-
-# Phase-3 VPS live smoke — plain Node ESM scripts, hit the live .15 server directly.
-# Requires: ssh root@192.168.0.15 access (combos created/torn down via SSH sqlite).
-# Hits REAL providers (small cost). Creates/deletes only __live_test__* combos. NEVER runs in CI.
-# REQUIRE_API_KEY=false on .15 so no API key needed, but honors COMBO_LIVE_BASE_URL / COMBO_LIVE_API_KEY if set.
-npm run test:combo:live:vps              # 7 HTTP scenarios (priority/round-robin/weighted/cost/fusion/auto + health)
-npm run test:combo:live:vps:failover     # adds a real cross-provider failover scenario (8 total)
 ```

 Coverage notes:

 - `npm run test:coverage` measures source coverage for the main unit test suite, excludes `tests/**`, and includes `open-sse/**`
- Pull requests must keep the coverage gate at **60%+** statements/lines/functions/branches
+- Pull requests must keep the coverage gate at **75%+** statements/lines/functions and **70%+** branches
 - If a PR changes production code in `src/`, `open-sse/`, `electron/`, or `bin/`, it must add or update automated tests in the same PR
 - `npm run coverage:report` prints the detailed file-by-file report from the latest coverage run
 - `npm run test:coverage:legacy` preserves the older metric for historical comparison
@@ -196,7 +184,7 @@ Before opening or merging a PR:

 - Run `npm run test:unit`
 - Run `npm run test:coverage`
- Ensure the coverage gate stays at **60%+** statements/lines/functions/branches
+- Ensure the coverage gate stays at **75%+** statements/lines/functions, **70%+** branches
 - Include the changed or added test files in the PR description when production code changed
 - Check the SonarQube result on the PR when the project secrets are configured in CI

--- a/DESING.md
+++ b/DESING.md
@@ -1,254 +0,0 @@
-# OmniRoute — Design System & Visual Identity
-
-> **Status:** analysis + standardization plan (no code applied yet — this doc is the spec to approve before implementation).
-> **Date:** 2026-06-16 · **Scope:** unify the OmniRoute dashboard (`src/`) with the marketing site (`_mono_repo/omnirouteSite/`) into **one visual identity** — same graph-paper grid background, same color tokens, standardized components.
-
---
-
-## 1. Purpose
-
-The marketing site (`viral.omniroute.online`, `why.omniroute.online`, `omniroute.online`) and the product dashboard should look like **one product**. The site already borrowed its palette from the dashboard — its `css/tokens.css` even says _"Palette mirrors the OmniRoute dashboard (src/app/globals.css)"_. So the two are already ~80% aligned at the color level. What's missing on the dashboard:
-
-1. The **graph-paper grid wallpaper** the site uses on every page.
-2. A handful of **shared design tokens** the site has but the dashboard lacks (radius scale, brand gradient, `surface-2`, mono font).
-3. **Component-level consistency** — a number of dashboard components bypass the theme tokens with hardcoded hex/rgba.
-
-This document is the analysis and the plan. **Nothing is changed until approved.**
-
---
-
-## 2. Principles
-
- **Single source of truth = `src/app/globals.css`.** The site mirrors the dashboard, never the other way around. New tokens land in `globals.css` first.
- **Tokens, never literals.** Components consume semantic tokens (`bg-surface`, `text-primary`, `border-border`), never raw `#hex`.
- **Subtle, not loud.** The grid is a faint wallpaper that sits behind content — it must never reduce text contrast or fight the UI.
- **Theme-aware.** Everything works in both `.dark` (default-ish, the product's signature look) and light.
- **Surgical rollout.** Ship the grid + tokens first (low risk, high visibility), then component cleanups in waves.
-
---
-
-## 3. Current state — what's already aligned vs. what's not
-
-### 3.1 Colors — already unified ✅
-
-Every brand color and surface already matches the site **by value** (only the names differ — dashboard prefixes with `--color-`). Verified in `src/app/globals.css:30-128`:
-
-| Concept                    | Site token (`tokens.css`)                   | Dashboard token (`globals.css`) | Match        |
-| -------------------------- | ------------------------------------------- | ------------------------------- | ------------ |
-| primary                    | `--primary #e54d5e`                         | `--color-primary #e54d5e`       | ✅           |
-| primary-hover              | `--primary-hover #c93d4e`                   | `--color-primary-hover #c93d4e` | ✅           |
-| accent                     | `--accent #6366f1`                          | `--color-accent #6366f1`        | ✅           |
-| accent-2                   | `--accent-2 #8b5cf6`                        | `--color-accent-hover #8b5cf6`  | ✅ (renamed) |
-| accent-3                   | `--accent-3 #a855f7`                        | `--color-accent-light #a855f7`  | ✅ (renamed) |
-| success / warning / error  | `#22c55e / #f59e0b / #ef4444`               | identical                       | ✅           |
-| traffic lights             | `#ff5f56 / #ffbd2e / #27c93f`               | identical                       | ✅           |
-| dark bg / surface / border | `#0b0e14 / #161b22 / rgba(255,255,255,.08)` | identical                       | ✅           |
-| light bg / surface / text  | `#f9f9fb / #fff / #1a1a2e`                  | identical                       | ✅           |
-
-**Conclusion:** there is no color migration to do. The identity is already shared; we are _finishing_ it, not rebuilding it.
-
-### 3.2 Gaps — what the dashboard is missing
-
-| Gap                     | Site has                                                                       | Dashboard                                                  | Action                 |
-| ----------------------- | ------------------------------------------------------------------------------ | ---------------------------------------------------------- | ---------------------- |
-| **Grid wallpaper**      | `body::before` graph-paper, `--grid-line`, `--grid-size 46px`, `--section-alt` | none (flat `--color-bg`)                                   | **Part A**             |
-| **Radius scale**        | `--radius 14px`, `--radius-sm 9px`                                             | none — primitives use ad-hoc `rounded-md/lg/xl` (6/8/12px) | **Part B**             |
-| **Brand gradient**      | `--grad-brand 135deg primary→accent-3`                                         | none — only a one-off `.bg-hero-gradient`                  | **Part B**             |
-| **Nested surface**      | `--surface-2 #1c2230`                                                          | none                                                       | **Part B**             |
-| **Mono font**           | `--font-mono` (ui-monospace stack)                                             | none (code/terminal areas have no token)                   | **Part B**             |
-| **`text-muted` (dark)** | `#8b8b9e`                                                                      | `#a1a1aa` (zinc-400)                                       | reconcile — **Part B** |
-
-### 3.3 Theming mechanics (so we don't break anything)
-
- **Tailwind v4, CSS-first** (no `tailwind.config.*`). Tokens are defined in `:root`/`.dark` and exposed to utilities via `@theme inline` (`globals.css:130-179`).
- **Dark via `.dark` class** on `<html>` (`@custom-variant dark` at `globals.css:22`), toggled by a custom Zustand store (`src/store/themeStore.ts`), default theme = `system` (`src/shared/constants/appConfig.ts:11`). The site uses `html[data-theme="light"]` instead — **the mechanisms differ but never meet** (separate origins), so no conflict. We keep the dashboard's `.dark` mechanism.
- **Runtime primary override** exists (`themeStore.ts:85-97`, presets in `COLOR_THEMES`) — users can swap `--color-primary`. Any new token (gradient, etc.) that references `--color-primary` will inherit those overrides for free. ✅
-
---
-
-## 4. Part A — The graph-paper grid background (headline ask)
-
-### 4.1 What it is
-
-The exact recipe from the site (`_mono_repo/omnirouteSite/css/base.css`): a **fixed, full-viewport pseudo-element** painting two 1px line gradients, sitting at `z-index:-1` behind all content.
-
-```css
-body::before {
-  content: "";
-  position: fixed;
-  inset: 0;
-  z-index: -1;
-  pointer-events: none;
-  background-image:
-    linear-gradient(to right, var(--grid-line) 1px, transparent 1px),
-    linear-gradient(to bottom, var(--grid-line) 1px, transparent 1px);
-  background-size: var(--grid-size) var(--grid-size);
-}
-```
-
-**Why this works even though `body` has an opaque `background-color`:** a `::before` with `z-index:-1` paints _above_ the element's own background but _below_ its in-flow content. So `--color-bg` is the base fill, the grid is layered on top of it, and the app renders above the grid.
-
-### 4.2 Precedent already in the codebase
-
-`src/app/landing/page.tsx:16-26` **already implements this same grid per-page** — but with **red** lines (`#E54D5E`, opacity `0.06`) at **50px**, plus animated orbs. So the pattern is proven in the product; we are promoting it to a **global, theme-aware** wallpaper and (optionally) retiring the duplicate.
-
-### 4.3 Tokens to add (in `globals.css`)
-
-```css
-:root {
-  /* light */
-  --grid-line: rgba(0, 0, 0, 0.045);
-  --grid-size: 46px;
-  --section-alt: rgba(0, 0, 0, 0.022);
-}
-.dark {
-  /* dark */
-  --grid-line: rgba(255, 255, 255, 0.035);
-  --section-alt: rgba(255, 255, 255, 0.018);
-}
-```
-
-### 4.4 The single blocker
-
-The grid is global by construction (it covers the panel, `auth`/`login`, error pages — every route — at once). Exactly **one** element hides it inside the panel:
-
- `src/shared/components/layouts/DashboardLayout.tsx:62` — the outer wrapper paints an opaque `bg-bg`:
-
-  ```jsx
-  <div className="flex h-dvh min-h-0 w-full overflow-hidden bg-bg">
-  ```
-
-  Everything below it is already transparent — `<main>` (`:93`), the scroll container (`:102`), the `max-w-7xl` inner (`:103`). So **removing `bg-bg` from this one line** lets the body grid show through the entire content area (the body's `--color-bg` remains the base fill underneath the grid).
-
-  ```diff
-  - <div className="flex h-dvh min-h-0 w-full overflow-hidden bg-bg">
-  + <div className="flex h-dvh min-h-0 w-full overflow-hidden">
-  ```
-
-### 4.5 Chrome interaction (sidebar / header)
-
- `Header` (`src/shared/components/Header.tsx:207`, `bg-bg`) and `Sidebar` (`src/shared/components/Sidebar.tsx:430`, `bg-sidebar`) stay **opaque** → the grid shows in the **content area only**, with solid chrome framing it. This is the recommended, calm default and matches how the site separates chrome from canvas.
- _Optional vibrancy variant:_ make the header translucent (`bg-bg/80 backdrop-blur`) so the grid runs behind it. A `.bg-vibrancy` helper already exists (`globals.css:370`). **Decision D3 below.**
-
-### 4.6 Login / auth / error pages
-
-These render directly under `<body>` (no panel chrome) and their page wrappers are mostly transparent — the global grid appears behind them automatically. One exception: `src/app/login/page.tsx:124,139` uses opaque `bg-bg` wrappers; soften the same way if we want the grid there too (minor, **D4**).
-
-### 4.7 Landing page
-
-`landing/page.tsx` keeps its richer animated background (orbs + vignette). Options: (a) leave it as-is (its own splash identity), or (b) align its grid to the global tokens (46px, neutral lines) for consistency. **Recommend (a)** — it's a marketing splash, not a panel screen. **Decision D5.**
-
---
-
-## 5. Part B — Token unification
-
-Add to `globals.css` (`:root` + `@theme inline`) so the dashboard gains the site's missing tokens. None of these change existing colors; they add the _missing_ primitives.
-
-```css
-:root {
-  --surface-2: #f5f5fa; /* light: nested panels */
-  --radius: 14px;
-  --radius-sm: 9px;
-  --grad-brand: linear-gradient(135deg, var(--color-primary), var(--color-accent-light));
-  --font-mono: ui-monospace, "JetBrains Mono", "Fira Code", "SF Mono", monospace;
-}
-.dark {
-  --surface-2: #1c2230;
-}
-
-@theme inline {
-  --color-surface-2: var(--surface-2); /* enables bg-surface-2 */
-  --radius-lg: var(--radius); /* enables rounded-lg = 14px */
-  --radius-md: var(--radius-sm); /* enables rounded-md = 9px */
-  --font-mono: var(--font-mono); /* enables font-mono */
-}
-```
-
-| Token                      | Why                                                             | Consumers                                                   |
-| -------------------------- | --------------------------------------------------------------- | ----------------------------------------------------------- |
-| `--radius` / `--radius-sm` | One radius scale (14/9) instead of 6/8/12 ad-hoc                | Button, Card, Modal, Input, Select                          |
-| `--grad-brand`             | Brand gradient for primary CTAs (red→violet), matching the site | Button `primary`, hero/CTA surfaces                         |
-| `--surface-2`              | Nested panels / table headers / inset rows                      | Card.Section, DataTable header, inputs                      |
-| `--font-mono`              | Code blocks, terminal, IDs, endpoints                           | ConsoleLogViewer, code snippets, `localhost:20128/v1` chips |
-| `--text-muted` reconcile   | Pick one value site↔panel                                       | global                                                      |
-
-**Decision D2 (text-muted):** site `#8b8b9e` vs dashboard `#a1a1aa`. Recommend keeping the **dashboard's `#a1a1aa`** (it's the live product, slightly higher contrast) and updating the _site_ to match. Low priority, cosmetic.
-
---
-
-## 6. Part C — Component standardization
-
-The component layer is **custom** (no shadcn/Radix), Tailwind v4, semantic tokens **mostly** adopted (`bg-surface`, `border-white/10`, `ring-primary`) — good adoption (195 files import the shared barrel). The work is removing the **bypasses**. Home: `src/shared/components/`.
-
-Ranked by impact × reach:
-
-| #   | Item                                       | File(s)                                                                                                                                                                                       | Problem → Target                                                                                                                                                                                                                                 |
-| --- | ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| C1  | **Radius alignment**                       | `Button.tsx:14-18`, `Card.tsx:39`, `Modal.tsx`, `Input.tsx`, `Select.tsx`                                                                                                                     | mixed 6/8/12px → repoint to `--radius`/`--radius-sm` (14/9)                                                                                                                                                                                      |
-| C2  | **Button gradient + `accent` variant**     | `Button.tsx:5-12`                                                                                                                                                                             | primary is flat red→red (`from-primary to-primary-hover`); align to `--grad-brand` (red→violet) and add the missing `accent` variant (indigo `#6366f1` is unused by buttons) — **highest visibility, ~195 importers**. **Decision D1.**          |
-| C3  | **Tables**                                 | `DataTable.tsx:122-176`, `logTableStyles.ts`, `globals.css:405-414` (Ant remnants)                                                                                                            | `DataTable` is 100% inline hardcoded rgba + references non-existent vars (`--text-secondary`, `--bg-table-header`); migrate to tokens, retire the 2 divergent table styles. Tables are everywhere (providers/connections/logs) — worst offender. |
-| C4  | **Centralize status colors**               | `flow/edgeStyles.ts:7-12`, `TokenHealthBadge.tsx:14-19`, `DegradationBadge.tsx`, `ProviderCascadeNode.tsx`, `Badge.tsx`, +5 `statusColor` helpers                                             | 6+ copies of the same `#22c55e/#f59e0b/#ef4444` hex; create one `statusColors` module driven off `--color-success/warning/error`. Critical for circuit-breaker / cooldown / lockout badges to read consistently.                                 |
-| C5  | **Card border**                            | `Card.tsx:39`                                                                                                                                                                                 | uses `border-white/5`; brand border is `/8` → align                                                                                                                                                                                              |
-| C6  | **Focus ring reconcile**                   | `globals.css:183` vs component `ring-primary/30`                                                                                                                                              | global `:focus-visible` is indigo (`--color-accent`), components are red (`ring-primary`) — pick one (recommend **accent/indigo** globally, it reads as the "interactive" color)                                                                 |
-| C7  | **Add `Checkbox` + `Textarea` primitives** | currently raw `<input>`/`<textarea>` with inline `accentColor:#6366f1` (e.g. `ColumnToggle.tsx:91`)                                                                                           | create token-driven primitives                                                                                                                                                                                                                   |
-| C8  | **Hardcoded-hex sweep**                    | `ConsoleLogViewer.tsx:240` (`#161b22`/`#30363d`), `ComboLiveStudio.tsx:306` (`#6366f120`), Modal traffic dots `Modal.tsx:149-159`, ~14 chart/component files with literal `#6366f1`/`#a855f7` | replace literals with `bg-surface`/`border-border`/`text-accent` etc.                                                                                                                                                                            |
-| C9  | **`cn()` → clsx + tailwind-merge**         | `src/shared/utils/cn.ts`                                                                                                                                                                      | current `cn` just joins; conflicting classes stack (a `className="rounded-2xl"` override won't replace a primitive's `rounded-lg`). Needed for C1 overrides to behave.                                                                           |
-
-**Already on-brand (token-driven, only need radius):** `Badge`, `Toggle`, `SegmentedControl`, `Input`, `Select`.
-
---
-
-## 7. Rollout plan (phased, each phase shippable + testable)
-
- **Phase 1 — Grid + tokens (low risk, high visibility).**
-  1. Add grid + identity tokens to `globals.css` (Part A §4.3, Part B §5).
-  2. Add `body::before` grid.
-  3. Remove `bg-bg` from `DashboardLayout.tsx:62`.
-  4. Verify across themes + key screens (dashboard, providers, logs, login, an error page). Confirm contrast unchanged.
-     → _Delivers the headline ask. Reversible in one commit._
-
- **Phase 2 — Primitives radius + Button (C1, C2, C5, C9).** The visible "feel" pass. `cn()` upgrade first so overrides behave.
-
- **Phase 3 — Tables + status colors (C3, C4).** The largest consistency win; touch the data-heavy screens.
-
- **Phase 4 — Cleanup (C6, C7, C8).** Focus ring, new primitives, hardcoded-hex sweep.
-
-Each phase: `npm run lint` + `npm run typecheck:core` + a visual pass. Per repo rule, production-code changes ship with tests where applicable (token/CSS changes are visual — validated by screenshots; component API changes get unit coverage).
-
---
-
-## 8. Open decisions (need your call before/while implementing)
-
- **D1 — Button primary look.** Keep the current **red→red** gradient, or switch the product's primary buttons to the **red→violet `--grad-brand`** (matches the site CTAs)? _(Affects every primary button.)_ Recommend: **red→violet**, with `--grad-brand`.
- **D2 — Grid line color.** **Neutral** lines (site style: faint white/black, `rgba(255,255,255,0.035)`) — calm, content-first — **or** the landing's **brand-red** lines? Recommend: **neutral** (matches the site's interior pages; red is louder and can tint readability). Size **46px** (site) to retire the landing's 50px drift.
- **D3 — Chrome vibrancy.** Sidebar/header stay **solid** (grid in content area only), or go **translucent** so the grid runs behind them? Recommend: **solid** (calmer; less risk).
- **D4 — Auth/login grid.** Soften `login/page.tsx` wrappers so the grid shows there too? Recommend: **yes** (cheap, more cohesive).
- **D5 — Landing page.** Leave its animated splash bg as-is, or align it to the global grid? Recommend: **leave as-is**.
- **D6 — Radius value.** Adopt **14/9** everywhere (bigger, softer, site-matching) — confirm you want this product-wide shift. Recommend: **yes**, it's the single biggest "one identity" signal.
- **D7 — Scope of first PR.** Ship **Phase 1 only** first (grid + tokens), then iterate? Recommend: **yes** — validate the wallpaper live before the component waves.
-
---
-
-## 9. Out of scope / risks
-
- **No palette change** — colors already match; we only add missing tokens. Zero risk of recoloring the product.
- **No theme-engine change** — keep `.dark` + Zustand store; don't migrate to `next-themes` or to the site's `data-theme`.
- **Radius shift is broad** (D6) — it touches every card/button/input; that's the point, but it's the one change worth eyeballing on busy screens (tables, modals) before merge.
- **Tables (C3)** carry the most hardcoded styling and the highest regression surface — isolate in its own PR with before/after screenshots.
- **Worktree isolation (repo hard-rule #19):** implementation runs in a dedicated worktree on a branch cut from the confirmed base (likely `release/v3.8.28`), never on the shared checkout. This doc is the only artifact written to the working tree so far.
-
---
-
-## 10. Reference index
-
-| Area                       | Path                                                                                                                                     |
-| -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
-| Dashboard tokens           | `src/app/globals.css:30-179` (`:root`, `.dark`, `@theme inline`), `body` `:206`                                                          |
-| Theme store                | `src/store/themeStore.ts`, `src/shared/components/ThemeProvider.tsx`, `src/shared/constants/appConfig.ts:9-11`                           |
-| Panel shell (grid blocker) | `src/shared/components/layouts/DashboardLayout.tsx:62`                                                                                   |
-| Chrome                     | `src/shared/components/Header.tsx:207`, `src/shared/components/Sidebar.tsx:430`                                                          |
-| Grid precedent             | `src/app/landing/page.tsx:16-26`                                                                                                         |
-| Primitives                 | `src/shared/components/{Button,Card,Input,Select,Badge,Modal,Toggle,SegmentedControl,Loading,Tooltip,DataTable}.tsx`, barrel `index.tsx` |
-| Status-color sources       | `flow/edgeStyles.ts`, `TokenHealthBadge.tsx`, `DegradationBadge.tsx`, `logTableStyles.ts`                                                |
-| `cn` util                  | `src/shared/utils/cn.ts`                                                                                                                 |
-| Site reference             | `_mono_repo/omnirouteSite/css/tokens.css`, `css/base.css` (grid `body::before`)                                                          |
--- a/42
+++ b/42
@@ -2,28 +2,12 @@
 FROM node:24-trixie-slim AS base
 WORKDIR /app

-# `apt-get upgrade` pulls the security-patched versions of the Debian (trixie)
-# base-image packages at build time — clears the subset of container-scan CVEs
-# (perl / util-linux / systemd / ncurses / zlib / tar / sqlite / shadow / pam …)
-# that already have a fix published in trixie. CVEs without an upstream fix yet
-# (local-only TOCTOU, etc.) remain until the distro patches them and the image
-# is rebuilt; none are reachable from the proxy's request surface at runtime.
 RUN --mount=type=cache,target=/var/cache/apt,sharing=shared \
  --mount=type=cache,target=/var/lib/apt/lists,sharing=shared \
  apt-get update \
-  && apt-get upgrade -y \
  && apt-get install -y --no-install-recommends libsecret-1-0 ca-certificates \
  && rm -rf /var/lib/apt/lists/*

-# Refresh the globally-installed npm so its *bundled* node_modules (undici, tar)
-# ship the patched versions. These are npm's own internals — not application
-# dependencies (our app already resolves undici@8.5.0 / tar@7.5.16, both fixed) —
-# but the container scanner flags the stale copies under
-# /usr/local/lib/node_modules/npm/node_modules. npm is not invoked at runtime in
-# the runner stages, so this is hygiene, not an exploitable runtime path.
-RUN npm install -g npm@latest \
-  && npm cache clean --force
-
 # ── Builder ────────────────────────────────────────────────────────────────
 FROM base AS builder

@@ -36,12 +20,6 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=shared \
  && rm -rf /var/lib/apt/lists/*

 COPY package*.json ./
-# Workspace package manifests MUST be present before `npm ci` so npm materializes
-# the workspace and installs its *workspace-only* deps (e.g. safe-regex,
-# @toon-format/toon — declared in open-sse/package.json, not hoisted to root).
-# Without this, `npm ci` skips them and the application build fails with "Module not
-# found" (root cause of the v3.8.39 Docker build break). workspaces = ["open-sse"].
-COPY open-sse/package.json ./open-sse/package.json
 COPY scripts/build/postinstall.mjs ./scripts/build/postinstall.mjs
 COPY scripts/build/postinstallSupport.mjs ./scripts/build/postinstallSupport.mjs
 COPY scripts/build/native-binary-compat.mjs ./scripts/build/native-binary-compat.mjs
@@ -60,24 +38,8 @@ RUN --mount=type=cache,target=/root/.npm \
  && npm rebuild better-sqlite3 \
  && node -e "require('better-sqlite3')(':memory:').close()"

-# Build with webpack (stable). Turbopack hit a non-recoverable internal panic on this
-# Next.js version during the v3.8.27 release build — TurbopackInternalError "entered
-# unreachable code: there must be a path to a root" in ImportTracer::get_traces, on both
-# linux/amd64 and linux/arm64. Webpack is the proven engine (build:release / VPS / CI Build
-# all green). Re-enable Turbopack (=1) once the upstream tracer bug is fixed.
-# See docs/ops/QUALITY_GATE_PLAYBOOK.md Parte 6.
-ENV OMNIROUTE_USE_TURBOPACK=0
-
-# Raise the V8 heap ceiling for the build. The webpack production optimization
-# pass (forced above since Turbopack panics) needs more than V8's default ceiling
-# (~2 GB) for a codebase this size; a memory-constrained Docker build otherwise
-# dies with "FATAL ERROR: ... JavaScript heap out of memory" during the builder
-# stage (#4076). NODE_OPTIONS propagates to the spawned `next build` child
-# (build-next-isolated.mjs → resolveNextBuildEnv spreads process.env). Build-only;
-# the runtime heap is set separately on the runner stage (OMNIROUTE_MEMORY_MB).
-# Override for hosts with more/less RAM: `--build-arg OMNIROUTE_BUILD_MEMORY_MB=6144`.
-ARG OMNIROUTE_BUILD_MEMORY_MB=4096
-ENV NODE_OPTIONS="--max-old-space-size=${OMNIROUTE_BUILD_MEMORY_MB}"
+# Use Turbopack for significant build speedup
+ENV OMNIROUTE_USE_TURBOPACK=1

 COPY . ./
 RUN --mount=type=cache,target=/app/.build/next/cache \
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@

 # 🚀 OmniRoute — The Free AI Gateway

-### Never stop coding. Connect every AI tool to **236 providers** — **50+ free** — through one endpoint.
+### Never stop coding. Connect every AI tool to **226 providers** — **50+ free** — through one endpoint.

 **Plug Claude Code, Codex, Cursor, Cline, Copilot & Antigravity into FREE Claude / GPT / Gemini. Auto-fallback.**
 <br/>
@@ -15,27 +15,27 @@

 <br/>

-**~1.6B documented free tokens/month** — up to **~2.1B in your first month** with signup credits — aggregated across the free tiers, plus a long tail of permanently-free, no-cap providers, and the compression above stretches every one further. ([how we count →](docs/reference/FREE_TIERS.md#tldr--how-much-free-inference-does-omniroute-actually-aggregate))
+**~1.9B+ documented free tokens/month** — up to **~2.5B in your first month** with signup credits — aggregated across the free tiers, and the compression above stretches every one further. ([how we count →](docs/reference/FREE_TIERS.md#tldr--how-much-free-inference-does-omniroute-actually-aggregate))

 <br/>

-[![231 AI Providers](https://img.shields.io/badge/231-AI_Providers-6C5CE7?style=for-the-badge)](#-231-ai-providers--50-free)
-[![50+ Free](https://img.shields.io/badge/50%2B-Free_Tiers-00B894?style=for-the-badge)](#-231-ai-providers--50-free)
-[![1.6B Free Tokens/mo](https://img.shields.io/badge/1.6B-Free_Tokens%2Fmo-00B894?style=for-the-badge)](docs/reference/FREE_TIERS.md)
+[![226 AI Providers](https://img.shields.io/badge/226-AI_Providers-6C5CE7?style=for-the-badge)](#-226-ai-providers--50-free)
+[![50+ Free](https://img.shields.io/badge/50%2B-Free_Tiers-00B894?style=for-the-badge)](#-226-ai-providers--50-free)
+[![1.9B+ Free Tokens/mo](https://img.shields.io/badge/1.9B%2B-Free_Tokens%2Fmo-00B894?style=for-the-badge)](docs/reference/FREE_TIERS.md)
 [![Token Savings](https://img.shields.io/badge/up_to_95%25-Token_Savings-E17055?style=for-the-badge)](#%EF%B8%8F-save-1595-tokens--automatically)
-[![17 Strategies](https://img.shields.io/badge/17-Routing_Strategies-0984E3?style=for-the-badge)](#-combos--the-flagship)
+[![15 Strategies](https://img.shields.io/badge/15-Routing_Strategies-0984E3?style=for-the-badge)](#-combos--the-flagship)
 [![$0 to start](https://img.shields.io/badge/%240-To_Start-FDCB6E?style=for-the-badge&logoColor=black)](#-quick-start)

 <br/>

 ### 💬 Join the community

-[![Discord](https://img.shields.io/badge/Discord-5865F2?style=for-the-badge&logo=discord&logoColor=white)](https://discord.gg/EkzRkpzKYt)
+[![Discord](https://img.shields.io/badge/Discord-5865F2?style=for-the-badge&logo=discord&logoColor=white)](https://discord.gg/hmexnhgE)
 [![Telegram](https://img.shields.io/badge/Telegram-26A5E4?style=for-the-badge&logo=telegram&logoColor=white)](https://t.me/omnirouteOficial)
 [![WhatsApp Global](https://img.shields.io/badge/WhatsApp_Global-25D366?style=for-the-badge&logo=whatsapp&logoColor=white)](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)
 [![WhatsApp Brasil](https://img.shields.io/badge/WhatsApp_Brasil-25D366?style=for-the-badge&logo=whatsapp&logoColor=white)](https://chat.whatsapp.com/BTGJXIyjeNIIgExvTMGGhI)

-**Questions, provider tips, roadmap & support → [Discord](https://discord.gg/EkzRkpzKYt) · [Telegram](https://t.me/omnirouteOficial) · WhatsApp [🌍 Global](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t) / [🇧🇷 Brasil](https://chat.whatsapp.com/BTGJXIyjeNIIgExvTMGGhI)**
+**Questions, provider tips, roadmap & support → [Discord](https://discord.gg/hmexnhgE) · [Telegram](https://t.me/omnirouteOficial) · WhatsApp [🌍 Global](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t) / [🇧🇷 Brasil](https://chat.whatsapp.com/BTGJXIyjeNIIgExvTMGGhI)**

 <br/>

@@ -59,15 +59,15 @@

 <br/>

-[**🚀 Quick Start**](#-quick-start) • [**🎯 Combos**](#-combos--the-flagship) • [**🌐 Providers**](#-231-ai-providers--50-free) • [**🔌 CLI & MCP**](#-full-cli--a2a--mcp) • [**🗜️ Compression**](#%EF%B8%8F-save-1595-tokens--automatically) • [**🌍 Website**](https://omniroute.online)
+[**🚀 Quick Start**](#-quick-start) • [**🎯 Combos**](#-combos--the-flagship) • [**🌐 Providers**](#-226-ai-providers--50-free) • [**🔌 CLI & MCP**](#-full-cli--a2a--mcp) • [**🗜️ Compression**](#%EF%B8%8F-save-1595-tokens--automatically) • [**🌍 Website**](https://omniroute.online)

 [💥 The Promise](#-the-promise) • [🤔 Why](#-why-omniroute) • [🏆 What Sets Apart](#-what-sets-omniroute-apart) • [🤖 Compatible CLIs](#-compatible-clis--coding-agents) • [🖥️ Where It Runs](#%EF%B8%8F-where-omniroute-runs--anywhere) • [🔒 Private](#-private--local-first) • [🎬 In Action](#-omniroute-in-action) • [📚 Explore More](#-explore-more) • [📧 Support](#-support--community)

 </div>

 <div align="center">
- <b>🌐 Available in 41+ languages</b>
- <table>
+<b>🌐 Available in 40+ languages</b>
+<table>
  <tr>
    <td align="center"><a href="README.md">🇺🇸</a></td>
    <td align="center"><a href="docs/i18n/pt-BR/README.md">🇧🇷</a></td>
@@ -76,7 +76,6 @@
    <td align="center"><a href="docs/i18n/it/README.md">🇮🇹</a></td>
    <td align="center"><a href="docs/i18n/ru/README.md">🇷🇺</a></td>
    <td align="center"><a href="docs/i18n/zh-CN/README.md">🇨🇳</a></td>
-    <td align="center"><a href="docs/i18n/zh-TW/README.md">🇹🇼</a></td>
    <td align="center"><a href="docs/i18n/de/README.md">🇩🇪</a></td>
    <td align="center"><a href="docs/i18n/ja/README.md">🇯🇵</a></td>
    <td align="center"><a href="docs/i18n/ko/README.md">🇰🇷</a></td>
@@ -115,15 +114,14 @@

 <div align="center">

-# 💰 ~1.6B Free Tokens / Month
+# 💰 ~1.9B Free Tokens / Month

 </div>

-> Stacking free tiers by hand is painful — dozens of SDKs, dozens of rate limits, and no idea how much you actually have. OmniRoute aggregates the **documented** free tiers of **40+ provider pools / 500+ models** into one honest number and shows it live on the dashboard (`/dashboard/free-tiers`).
+> Stacking free tiers by hand is painful — dozens of SDKs, dozens of rate limits, and no idea how much you actually have. OmniRoute aggregates the **documented** free tiers of **50+ provider pools / 530 models** into one honest number and shows it live on the dashboard (`/dashboard/free-tiers`).

- **~1.6B free tokens / month** (steady) — and **up to ~2.1B in your first month** with signup credits.
- **Pool-deduped, honest** — we count each shared free pool **once**, so the headline isn't inflated by rate-limit ceilings the way multi-billion competitor claims are. (Counting every rate limit 24/7 would read ~10B; we don't publish that.)
- **Plus the un-countable** — permanently-free, no-token-cap providers (SiliconFlow, Z.AI GLM-Flash, Kilo, OpenCode Zen…) and a **$10 OpenRouter top-up** that unlocks **+24M/mo**, both surfaced separately so they never inflate the headline.
+- **~1.9B free tokens / month** (steady) — and **up to ~2.5B in your first month** with signup credits.
+- **Pool-deduped, honest** — we count each shared free pool **once**, so the headline isn't inflated by rate-limit ceilings the way multi-billion competitor claims are. (The naïve per-model sum would read ~8B; we don't publish that.)
 - **Per-model breakdown**, **live used / remaining** for the current month, and a transparent **terms flag** per provider.

 ![Free-Tier Budget card (preview mockup)](docs/screenshots/free-tier-budget-card.svg)
@@ -138,11 +136,11 @@

 </div>

-> One endpoint. **236 providers.** Never stop building — and let OmniRoute pick the cheapest one that works.
+> One endpoint. **226 providers.** Never stop building — and let OmniRoute pick the cheapest one that works.

 <table>
  <tr>
-    <td width="33%" valign="top"><b>🚫 Never hit limits</b><br/><sub>Auto-fallback across 236 providers in milliseconds. Quota out? Next provider takes over — zero downtime.</sub></td>
+    <td width="33%" valign="top"><b>🚫 Never hit limits</b><br/><sub>Auto-fallback across 226 providers in milliseconds. Quota out? Next provider takes over — zero downtime.</sub></td>
    <td width="33%" valign="top"><b>💸 Save up to 95% tokens</b><br/><sub>RTK + Caveman stacked compression cuts 15–95% of eligible tokens (~89% avg on tool-heavy sessions).</sub></td>
    <td width="33%" valign="top"><b>🆓 $0 to start</b><br/><sub>50+ providers with a free tier, 11 free <i>forever</i> (Kiro, Qoder, Pollinations, LongCat…). No card needed.</sub></td>
  </tr>
@@ -183,7 +181,7 @@
                          ▼
 ┌──────────────────────────────────────────────────────────┐
 │                  OmniRoute — Smart Router                  │
-│  RTK + Caveman compression · 17 routing strategies         │
+│  RTK + Caveman compression · 15 routing strategies         │
 │  Circuit breakers · TLS stealth · MCP · A2A · Guardrails   │
 └─────────────────────────┬──────────────────────────────────┘
        ┌─────────────┬────┴────────┬─────────────┐
@@ -221,7 +219,7 @@ No combo to create. Set your model to `auto` (or a variant) and OmniRoute builds

 ##

-### 🔀 Or build your own — 17 routing strategies
+### 🔀 Or build your own — 15 routing strategies

 | Goal                                    | Strategy / combo                                   |
 | --------------------------------------- | -------------------------------------------------- |
@@ -230,8 +228,6 @@ No combo to create. Set your model to `auto` (or a variant) and OmniRoute builds
 | 💸 Always cheapest viable model         | `cost-optimized` · `auto/cheap`                    |
 | 🧠 Hand off long context between models | `context-relay` · `context-optimized`              |
 | 🎲 Randomized / privacy routing         | `random` · `strict-random`                         |
-| 🧬 Fan out to a panel + judge synthesis | `fusion`                                           |
-| 📊 Route by remaining quota headroom    | `reset-window` · `headroom`                        |
 | 🤖 Just make it smart                   | `auto` (9-factor scoring) · `lkgp` · `reset-aware` |

 <sub>The Auto-Combo engine scores every candidate on **9 factors** (health, quota, cost, latency, success rate, freshness…) — see [`docs/routing/AUTO-COMBO.md`](docs/routing/AUTO-COMBO.md).</sub>
@@ -265,20 +261,20 @@ Result: 4 layers of fallback = zero downtime

 </div>

-| Feature                                | OmniRoute                                                           | Other routers |
-| -------------------------------------- | ------------------------------------------------------------------- | ------------- |
-| 🌐 Providers                           | **231**                                                             | 20–100        |
-| 🆓 Free providers                      | **50+ (11 free forever)**                                           | 1–5           |
-| 🔀 Routing strategies                  | **17** (priority, weighted, cost-optimized, context-relay, fusion…) | 1–3           |
-| 🗜️ Token compression                   | **RTK + Caveman stacked (15–95%)**                                  | None / 20–40% |
-| 🧰 Built-in MCP server                 | **87 tools, 3 transports, 30 scopes**                               | Rare          |
-| 🤝 A2A agent protocol                  | **6 skills, JSON-RPC 2.0**                                          | None          |
-| 🧠 Memory (FTS5 + vector)              | **Yes**                                                             | Rare          |
-| 🛡️ Guardrails (PII, injection, vision) | **Yes**                                                             | Rare          |
-| ☁️ Cloud agents                        | **Codex, Devin, Jules**                                             | None          |
-| 🥷 TLS fingerprint stealth             | **JA3/JA4 via wreq-js**                                             | None          |
-| 🖥️ Multi-platform                      | **Web · Desktop · Termux · PWA**                                    | Web only      |
-| 🌍 i18n                                | **42 locales**                                                      | 0–4           |
+| Feature                                | OmniRoute                                                   | Other routers |
+| -------------------------------------- | ----------------------------------------------------------- | ------------- |
+| 🌐 Providers                           | **226**                                                     | 20–100        |
+| 🆓 Free providers                      | **50+ (11 free forever)**                                   | 1–5           |
+| 🔀 Routing strategies                  | **15** (priority, weighted, cost-optimized, context-relay…) | 1–3           |
+| 🗜️ Token compression                   | **RTK + Caveman stacked (15–95%)**                          | None / 20–40% |
+| 🧰 Built-in MCP server                 | **87 tools, 3 transports, 30 scopes**                       | Rare          |
+| 🤝 A2A agent protocol                  | **6 skills, JSON-RPC 2.0**                                  | None          |
+| 🧠 Memory (FTS5 + vector)              | **Yes**                                                     | Rare          |
+| 🛡️ Guardrails (PII, injection, vision) | **Yes**                                                     | Rare          |
+| ☁️ Cloud agents                        | **Codex, Devin, Jules**                                     | None          |
+| 🥷 TLS fingerprint stealth             | **JA3/JA4 via wreq-js**                                     | None          |
+| 🖥️ Multi-platform                      | **Web · Desktop · Termux · PWA**                            | Web only      |
+| 🌍 i18n                                | **42 locales**                                              | 0–4           |

 <sub>📊 Detailed comparison vs LiteLLM, OpenRouter & Portkey → [`docs/comparison/OMNIROUTE_VS_ALTERNATIVES.md`](docs/comparison/OMNIROUTE_VS_ALTERNATIVES.md)</sub>

@@ -286,28 +282,6 @@ Result: 4 layers of fallback = zero downtime

 <div align="center">

-# ✨ What's New
-
-</div>
-
-> Recent highlights from **v3.8.20 → v3.8.41**. Full history in [`CHANGELOG.md`](CHANGELOG.md).
-
- **⚖️ Quota-Share routing** — a dedicated combo strategy that spreads load across accounts by _available quota_: Deficit-Round-Robin scheduling, per-connection `max_concurrent` with cooldown-wait queueing, multi-window usage buckets (5h / 7d / per-model), per-(key,model) caps, session stickiness for prompt-cache integrity, and proactive saturation from upstream token-usage headers. → [Resilience Guide](docs/architecture/RESILIENCE_GUIDE.md)
- **🤖 One-command CLI/agent setup** — a dedicated `setup-*` command configures each coding tool to route through OmniRoute (Claude Code, Codex, Cline, Continue, Cursor, Roo Code, Kilo Code, Crush, Goose, Qwen Code, Aider, OpenCode); `omniroute launch` / `omniroute launch-codex` are zero-config launchers. → [CLI Integrations](docs/guides/CLI-INTEGRATIONS.md)
- **🛰️ Remote mode** — drive a remote OmniRoute from any machine with scoped access tokens (`omniroute connect` / `omniroute contexts` / `omniroute tokens`), plus an `omniroute login antigravity` helper that runs Google "native/desktop" OAuth on your own machine and pastes a credential blob into a remote/VPS install (where the loopback redirect is unreachable). → [Remote Mode](docs/guides/REMOTE-MODE.md)
- **🧭 Smarter auto-routing** — OpenRouter-style `auto/<category>:<tier>` combos (e.g. `auto/coding:fast`, `auto/reasoning:pro`), a **Fusion** strategy (fan out to a panel of models in parallel, then synthesize via a judge), **task-aware routing** (best-fit connection per task type), per-request `X-Route-Model` override, live Arena-ELO + models.dev model intelligence, per-step account allowlists, provider-wildcard combo steps, nested combo-ref execution, sticky weighted selection, and `web_search`-aware routing. → [Auto-Combo](docs/routing/AUTO-COMBO.md)
- **🗜️ Pluggable compression** — an async pipeline of **9 composable engines** with Compression Studios, an LLMLingua-2 ONNX engine and a heuristic/SLM two-tier **Ultra**, RTK, delegated Anthropic Context Editing, **Output Styles** (output-axis steering: terse-prose / less-code / terse-CJK), an **adaptive context-budget dial** (escalate only as far as needed to fit the context window), per-request `x-omniroute-compression` control, an opt-in offline eval harness, one-click **Headroom** proxy lifecycle management from the dashboard (Docker sidecar supported), a synthetic **compression playground** (Play lanes + A/B Compare with USD-capped fidelity verdicts), an opt-in **per-step fidelity gate** that rejects a lossy engine before it degrades the prompt, a **best-of-N candidate encoder** (GCF vs TOON — keep whichever is shorter, with an A/B bytes/token table in the studio), **CCR ranged/grep/stats retrieval** (pull an exact byte/line slice or summary of a stored block instead of re-expanding it), and a unified panel with named profiles + an active-profile selector. → [Compression](docs/compression/COMPRESSION_ENGINES.md)
- **🕵️ Transparent MITM decrypt (TPROXY)** — capture & translate traffic from CLIs that ignore proxy env vars, with a per-SNI certificate authority and a trust-store installer. → [MITM/TPROXY](docs/security/MITM-TPROXY-DECRYPT.md)
- **💸 Cost telemetry everywhere** — `X-OmniRoute-*` cost/usage headers on every endpoint (including media), a non-token cost engine, a cache-HIT `X-OmniRoute-Cost-Saved` header, and per-key USD spend quotas. → [API Reference](docs/reference/API_REFERENCE.md)
- **🧠 Memory you control** — opt-in int8 vector quantization (Qdrant + sqlite-vec), memory off by default, and a per-request `x-omniroute-no-memory` header. → [Memory](docs/frameworks/MEMORY.md)
- **🛡️ Security** — a prompt-injection guard across every LLM route (backed by a red-team suite), plus a free DuckDuckGo last-resort web search. → [Guardrails](docs/security/GUARDRAILS.md)
- **🤝 More providers & agents** — Cursor Cloud Agent (a 4th cloud agent), CodeBuddy CN (`copilot.tencent.com`), a Google Flow video-generation provider, new gateways **DGrid** and **Pioneer AI** (Fastino Labs), inbound **xAI Grok** translators plus **Grok Build (xAI)** with an OAuth import-token flow, GPT-4 / GPT-4o-mini on the GitHub Copilot provider, multi-model **Factory Droid**, **ZenMux Free** (session-cookie free tier), **Alibaba DashScope** text-to-video (`wan2.7-t2v`), a refreshed 236-provider catalog (OrcaRouter, Wafer AI, OpenAdapter, dit.ai, TokenRouter, …), Vertex AI media generation (speech / transcription / music / video), and one-click account import from CLIProxyAPI (`~/.cli-proxy-api/`). → [Providers](docs/reference/PROVIDER_REFERENCE.md)
- **⚡ Local performance & infra** — a one-click local Redis launcher (`omniroute redis up`, plus a dashboard Redis panel), one-click **Cloudflare Workers** and **Deno Deploy** relay deployers wired into the proxy pool, and an optional Bifrost Go sidecar that offloads the hottest relay path (`BIFROST_BASE_URL`, with automatic fallback to the TypeScript path on timeout) — now with a relay-backend selector (`OMNIROUTE_RELAY_BACKEND=ts|bifrost|auto`) so the `/v1/relay` endpoint stays the stable surface while choosing the fastest backend internally. → [Environment](docs/reference/ENVIRONMENT.md)
-
-<br/>
-
-<div align="center">
-
 # 🤖 Compatible CLIs & Coding Agents

 > One config — `http://localhost:20128/v1` — and **every** AI IDE or CLI runs on free & low-cost models.
@@ -317,6 +291,7 @@ Result: 4 layers of fallback = zero downtime
  <tr>
    <td align="center" width="120"><a href="https://github.com/anthropics/claude-code"><img src="./public/providers/claude.svg" width="52" alt="Claude Code"/><br/><b>Claude Code</b></a></td>
    <td align="center" width="120"><a href="https://github.com/openai/codex"><img src="./public/providers/codex.svg" width="52" alt="Codex CLI"/><br/><b>Codex CLI</b></a></td>
+    <td align="center" width="120"><a href="https://github.com/google-gemini/gemini-cli"><img src="./public/providers/gemini-cli.svg" width="52" alt="Gemini CLI"/><br/><b>Gemini CLI</b></a></td>
    <td align="center" width="120"><img src="./public/providers/cursor.png" width="52" alt="Cursor"/><br/><b>Cursor</b></td>
    <td align="center" width="120"><img src="./public/providers/copilot.png" width="52" alt="Copilot"/><br/><b>Copilot</b></td>
    <td align="center" width="120"><img src="./public/providers/continue.png" width="52" alt="Continue"/><br/><b>Continue</b></td>
@@ -344,11 +319,11 @@ Result: 4 layers of fallback = zero downtime

 <div align="center">

-# 🌐 231 AI Providers — 50+ Free
+# 🌐 226 AI Providers — 50+ Free

 </div>

-> The most complete catalog of any open-source router: **236 providers**, **50+ with a free tier**, **11 free forever**.
+> The most complete catalog of any open-source router: **226 providers**, **50+ with a free tier**, **11 free forever**.

 <div align="center">

@@ -359,10 +334,11 @@ Result: 4 layers of fallback = zero downtime
    <td align="center" width="150"><img src="https://img.shields.io/badge/AgentRouter-FF6600?style=flat-square" alt="AgentRouter"/><br/><sub>GPT-5, Claude, Gemini<br/>$100 free credits</sub></td>
    <td align="center" width="150"><img src="https://img.shields.io/badge/Qoder_AI-6366F1?style=flat-square" alt="Qoder AI"/><br/><sub>Kimi-K2, DeepSeek-R1<br/>Unlimited FREE</sub></td>
    <td align="center" width="150"><img src="https://img.shields.io/badge/Pollinations-10B981?style=flat-square" alt="Pollinations"/><br/><sub>GPT-5, Claude, Llama 4<br/>No key needed</sub></td>
-    <td align="center" width="150"><img src="https://img.shields.io/badge/LongCat-FF7A00?style=flat-square" alt="LongCat"/><br/><sub>LongCat-2.0<br/>10M tokens one-time (KYC) 🔑</sub></td>
+    <td align="center" width="150"><img src="https://img.shields.io/badge/LongCat-FF7A00?style=flat-square" alt="LongCat"/><br/><sub>Flash-Lite<br/>50M tokens/day 🔥</sub></td>
  </tr>
  <tr>
    <td align="center" width="150"><img src="https://img.shields.io/badge/Cloudflare_AI-F38020?style=flat-square&logo=cloudflare&logoColor=white" alt="Cloudflare AI"/><br/><sub>50+ models<br/>10K neurons/day</sub></td>
+    <td align="center" width="150"><img src="https://img.shields.io/badge/Gemini_CLI-8E75B2?style=flat-square&logo=googlegemini&logoColor=white" alt="Gemini CLI"/><br/><sub>gemini-3-flash<br/>180K/mo free</sub></td>
    <td align="center" width="150"><img src="https://img.shields.io/badge/NVIDIA_NIM-76B900?style=flat-square&logo=nvidia&logoColor=white" alt="NVIDIA NIM"/><br/><sub>129 models<br/>~40 RPM free</sub></td>
    <td align="center" width="150"><img src="https://img.shields.io/badge/Cerebras-F15A29?style=flat-square" alt="Cerebras"/><br/><sub>Qwen3 235B<br/>1M tokens/day</sub></td>
  </tr>
@@ -381,16 +357,16 @@ Result: 4 layers of fallback = zero downtime

 > Same app, your machine, your rules. From a global npm install to **your phone** via Termux.

-| Platform                  | Install                                  | Highlights                                                |
-| ------------------------- | ---------------------------------------- | --------------------------------------------------------- |
-| 📦 **npm (global)**       | `npm install -g omniroute`               | One command, any OS                                       |
-| 🐳 **Docker**             | `docker run … diegosouzapw/omniroute`    | Multi-arch **AMD64 + ARM64**                              |
-| 🖥️ **Desktop (Electron)** | `npm run electron:build`                 | Native window + system tray — **Windows / macOS / Linux** |
-| 💪 **ARM**                | native `arm64`                           | Raspberry Pi, ARM servers, Apple Silicon                  |
-| 📱 **Android (Termux)**   | `pkg install nodejs && npx -y omniroute` | Runs **on your phone**, 24/7, no root                     |
-| 📲 **PWA**                | "Add to Home Screen"                     | Fullscreen, offline, installable from browser             |
-| 🧩 **OpenCode plugin**    | `@omniroute/opencode-provider`           | Native OpenCode integration                               |
-| 🛠️ **From source**        | `npm install && npm run dev`             | Hack on it, contribute                                    |
+| Platform                  | Install                                      | Highlights                                                |
+| ------------------------- | -------------------------------------------- | --------------------------------------------------------- |
+| 📦 **npm (global)**       | `npm install -g omniroute`                   | One command, any OS                                       |
+| 🐳 **Docker**             | `docker run … diegosouzapw/omniroute`        | Multi-arch **AMD64 + ARM64**                              |
+| 🖥️ **Desktop (Electron)** | `npm run electron:build`                     | Native window + system tray — **Windows / macOS / Linux** |
+| 💪 **ARM**                | native `arm64`                               | Raspberry Pi, ARM servers, Apple Silicon                  |
+| 📱 **Android (Termux)**   | `pkg install nodejs-lts && npx -y omniroute` | Runs **on your phone**, 24/7, no root                     |
+| 📲 **PWA**                | "Add to Home Screen"                         | Fullscreen, offline, installable from browser             |
+| 🧩 **OpenCode plugin**    | `@omniroute/opencode-provider`               | Native OpenCode integration                               |
+| 🛠️ **From source**        | `npm install && npm run dev`                 | Hack on it, contribute                                    |

 <sub>📖 [Docker Guide](docs/guides/DOCKER_GUIDE.md) · [Desktop](electron/README.md) · [Termux](docs/guides/TERMUX_GUIDE.md) · [PWA](docs/guides/PWA_GUIDE.md) · [OpenCode](docs/frameworks/OPENCODE.md)</sub>

@@ -431,22 +407,6 @@ omniroute setup         # guided first-run wizard
 omniroute doctor        # diagnose providers, ports, native deps
 ```

-### 🛰️ Remote mode — run the CLI here, OmniRoute on a VPS
-
-OmniRoute on a server? Drive it from your laptop with the **same CLI**. Log in once
-with a scoped access token; every command then targets the remote.
-
-```bash
-omniroute connect 192.168.0.15            # password → scoped token, saved as a context
-omniroute models list                     # ← runs against the REMOTE server
-omniroute configure codex                 # ← picks a remote model, writes a local Codex profile
-omniroute tokens create --name ci --scope read   # mint narrower tokens for other machines
-omniroute contexts use default            # ← switch back to the local server
-```
-
-Tokens are scoped `read` / `write` / `admin`; process-spawning routes stay loopback-only.
-<sub>📖 [Remote Mode](docs/guides/REMOTE-MODE.md)</sub>
-
 <div align="center">

 `providers` · `oauth` · `keys` · `combo` · `nodes` · `models` · `cache` · `compression` · `cost` · `usage` · `quota` · `health` · `resilience` · `telemetry` · `logs` · `audit` · `mcp` · `a2a` · `cloud` · `memory` · `skills` · `eval` · `tunnel` · `backup` · `sync` · `webhooks` · `policy` · `pricing` · `translator` · `simulate` …
@@ -485,17 +445,17 @@ claude mcp add-server omniroute --type http --url http://localhost:20128/api/mcp

 Engines run in pipeline order; each is independently toggleable and configurable per combo:

-| #   | Engine            | What it does                                                        |
-| --- | ----------------- | ------------------------------------------------------------------- |
-| 1   | **Session-Dedup** | Drops content repeated across turns (content-addressed, cross-turn) |
-| 2   | **CCR**           | Archives large blocks behind retrieve markers, fetched on demand    |
-| 3   | **RTK**           | Smart tool-result filtering, dedup & truncation (command-aware)     |
-| 4   | **Headroom**      | Lossless tabular compaction of homogeneous JSON arrays (~30%+)      |
-| 5   | **Caveman**       | Rule-based prose compression (~65–75% on output)                    |
-| 6   | **LLMLingua-2**   | ML semantic pruning via MobileBERT ONNX — code-safe, async          |
-| 7   | **Lite**          | Whitespace + image-URL trimming (latency-light baseline)            |
-| 8   | **Aggressive**    | Summarization + progressive aging of old turns                      |
-| 9   | **Ultra**         | Heuristic token pruning with an optional small-model (SLM) tier     |
+| #   | Engine            | What it does                                                              |
+| --- | ----------------- | ------------------------------------------------------------------------ |
+| 1   | **Session-Dedup** | Drops content repeated across turns (content-addressed, cross-turn)      |
+| 2   | **CCR**           | Archives large blocks behind retrieve markers, fetched on demand         |
+| 3   | **RTK**           | Smart tool-result filtering, dedup & truncation (command-aware)          |
+| 4   | **Headroom**      | Lossless tabular compaction of homogeneous JSON arrays (~30%+)           |
+| 5   | **Caveman**       | Rule-based prose compression (~65–75% on output)                         |
+| 6   | **LLMLingua-2**   | ML semantic pruning via MobileBERT ONNX — code-safe, async               |
+| 7   | **Lite**          | Whitespace + image-URL trimming (latency-light baseline)                 |
+| 8   | **Aggressive**    | Summarization + progressive aging of old turns                          |
+| 9   | **Ultra**         | Heuristic token pruning with an optional small-model (SLM) tier          |

 Code blocks, URLs and structured data are **always preserved** byte-perfect. **One-click presets** combine the engines:

@@ -540,20 +500,7 @@ average  = 1 − (1 − 0.80) × (1 − 0.46) = 89.2%
 range    = 78.4 – 94.6%
 ```

-Code blocks, URLs, JSON and structured data are **always protected** by the preservation engine.
-
-### 🎚️ Beyond the engines — output styles, the adaptive dial & per-request control
-
-The 9 engines above shrink what goes **in**. Three more layers shape **how**, **when**, and what comes **out**:
-
- **🪄 Output Styles** _(output-axis steering)_ — inject deterministic, cache-safe response-shaping instructions; combinable, each at `lite` / `full` / `ultra` intensity. Adding a style is a one-line registry entry:
-  - **Terse prose** — drop filler / articles / hedging; keep technical substance exact.
-  - **Less code** — "lazy senior dev" YAGNI: smallest working change, no unrequested scaffolding.
-  - **Terse CJK (文言)** — classical-Chinese ultra-terse style (locale-gated to `zh`).
- **🎯 Adaptive context-budget** _(the dial)_ — instead of one on/off token threshold, escalate the cheapest, most-lossless engines only as far as needed to **fit the model's context window**. Policy: `reserve-output` (default, model-aware) · `percentage` · `absolute`. Mode: `floor` (guarantee fit) · `replace-autotrigger` (your explicit choice wins) · `off` (legacy threshold).
- **🎛️ Where compression is decided** _(precedence, high → low)_ — per-request `x-omniroute-compression` header › routing-combo override › active named profile › adaptive / auto-trigger › panel default › off. The applied plan echoes back in the `X-OmniRoute-Compression: <mode>; source=<source>` response header.
-
-Auto-trigger by token threshold, flip on the adaptive dial, pin a named profile, set a one-off per request, or assign a pipeline per routing combo — whichever fits the workload. An opt-in offline **eval harness** (`npm run eval:compression`) scores fidelity vs. savings on a pinned corpus before you promote a change.
+Code blocks, URLs, JSON and structured data are **always protected** by the preservation engine. Auto-trigger compression by token threshold, or assign a compression pipeline per routing combo.

 📖 [`COMPRESSION_GUIDE.md`](docs/compression/COMPRESSION_GUIDE.md) · [`RTK_COMPRESSION.md`](docs/compression/RTK_COMPRESSION.md) · [`COMPRESSION_ENGINES.md`](docs/compression/COMPRESSION_ENGINES.md)

@@ -576,7 +523,7 @@ Dashboard at `http://localhost:20128` · API at `http://localhost:20128/v1`.

 **2) Connect a FREE provider (no signup)**

-Dashboard → **Providers** → connect **Kiro AI** (free Claude, ~50 credits/month per account) or **OpenCode Free** (no auth) → done.
+Dashboard → **Providers** → connect **Kiro AI** (free Claude unlimited) or **OpenCode Free** (no auth) → done.

 **3) Point your coding tool**

@@ -726,7 +673,7 @@ podman compose --profile base up -d
 | **Qoder**         | `if/`       | kimi-k2-thinking, qwen3-coder-plus, deepseek-r1 | ♾️ Unlimited      |
 | **Qwen**          | `qw/`       | qwen3-coder-plus/flash/next                     | ♾️ Unlimited      |
 | **Pollinations**  | `pol/`      | GPT-5, Claude, Gemini, DeepSeek, Llama 4        | No key needed     |
-| **LongCat**       | `lc/`       | LongCat-2.0                                     | 10M one-time (KYC) |
+| **LongCat**       | `lc/`       | LongCat-Flash-Lite                              | 50M tokens/day 🔥 |
 | **Cloudflare AI** | `cf/`       | 50+ models                                      | 10K neurons/day   |
 | **NVIDIA NIM**    | `nvidia/`   | 129 models                                      | ~40 RPM           |
 | **Cerebras**      | `cerebras/` | Qwen3 235B, GPT-OSS 120B                        | 1M tok/day        |
@@ -745,10 +692,10 @@ podman compose --profile base up -d
 **$0 forever:**

 ```
-1. kr/claude-sonnet-4.5   (Kiro — ~50 credits/mo per acct)
+1. kr/claude-sonnet-4.5   (Kiro — unlimited)
 2. if/kimi-k2-thinking    (Qoder — unlimited)
 3. pol/gpt-5              (Pollinations — no key)
-4. lc/LongCat-2.0         (10M one-time backup, KYC)
+4. lc/longcat-flash-lite  (50M tok/day backup)
 Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
 ```

@@ -802,9 +749,9 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
 | `DATA_DIR`        | `~/.omniroute` | Database & config storage        |

 **Will I be charged by OmniRoute?** No — it's free, open-source software on your machine. You only pay paid providers directly. OmniRoute has no billing system.
-**Are FREE providers really unlimited?** Mostly — Qoder, Pollinations, LongCat, and Cloudflare are free with no per-account credit cap. Kiro is free too but capped at ~50 credits/month per account. Stack multiple free providers in a combo and auto-fallback keeps you serving for $0.
+**Are FREE providers really unlimited?** Yes — Kiro, Qoder, Pollinations, LongCat, Cloudflare. No catch.
 **Will compression hurt quality?** No — it only compresses the **input**; code, URLs, JSON are always protected.
-**Does it work where AI is blocked?** Yes — 3-level proxy + 1proxy marketplace reach all 236 providers.
+**Does it work where AI is blocked?** Yes — 3-level proxy + 1proxy marketplace reach all 226 providers.

 📖 [User Guide](docs/guides/USER_GUIDE.md) · [API Reference](docs/reference/API_REFERENCE.md) · [Environment Config](docs/reference/ENVIRONMENT.md)

@@ -892,14 +839,12 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo

 ### 📘 Getting Started

-| Document                                                       | Description                                                                      |
-| -------------------------------------------------------------- | -------------------------------------------------------------------------------- |
-| [User Guide](docs/guides/USER_GUIDE.md)                        | Providers, combos, CLI integration, deployment                                   |
-| [Setup Guide](docs/guides/SETUP_GUIDE.md)                      | Full install methods, CLI tool configs, protocol setup, timeout tuning           |
-| [CLI Tools Guide](docs/reference/CLI-TOOLS.md)                 | Per-tool setup for Claude Code, Codex, Cursor, Cline, OpenClaw, Kilo, Copilot    |
-| [Remote Mode](docs/guides/REMOTE-MODE.md)                      | Drive a remote OmniRoute (VPS) from your laptop CLI via scoped access tokens     |
-| [Claude Code Config](docs/guides/CLAUDE-CODE-CONFIGURATION.md) | Point Claude Code at OmniRoute (local/remote) with `launch` + per-model profiles |
-| [Quick Start](README.md#-quick-start)                          | 3-step install → connect → configure                                             |
+| Document                                       | Description                                                                   |
+| ---------------------------------------------- | ----------------------------------------------------------------------------- |
+| [User Guide](docs/guides/USER_GUIDE.md)        | Providers, combos, CLI integration, deployment                                |
+| [Setup Guide](docs/guides/SETUP_GUIDE.md)      | Full install methods, CLI tool configs, protocol setup, timeout tuning        |
+| [CLI Tools Guide](docs/reference/CLI-TOOLS.md) | Per-tool setup for Claude Code, Codex, Cursor, Cline, OpenClaw, Kilo, Copilot |
+| [Quick Start](README.md#-quick-start)          | 3-step install → connect → configure                                          |

 ### 🔧 Operations & Deployment

@@ -936,7 +881,7 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
 | Document                                          | Description                                         |
 | ------------------------------------------------- | --------------------------------------------------- |
 | [API Reference](docs/reference/API_REFERENCE.md)  | All endpoints with examples                         |
-| [OpenAPI Spec](docs/openapi.yaml)                 | OpenAPI 3.0 specification                           |
+| [OpenAPI Spec](docs/reference/openapi.yaml)       | OpenAPI 3.0 specification                           |
 | [MCP Server](open-sse/mcp-server/README.md)       | 87 MCP tools, IDE configs, Python/TS/Go clients     |
 | [MCP Server Guide](docs/frameworks/MCP-SERVER.md) | MCP installation, transports, and tool reference    |
 | [A2A Server](src/lib/a2a/README.md)               | JSON-RPC 2.0 protocol, skills, streaming, task mgmt |
@@ -1077,78 +1022,31 @@ gh release create v3.8.2 --title "v3.8.2" --generate-notes

 </div>

-OmniRoute stands on the shoulders of giants. It started as a fork of **[9router](https://github.com/decolua/9router)** and a TypeScript port of the Go project **[CLIProxyAPI](https://github.com/router-for-me/CLIProxyAPI)** — and from there, every subsystem below was inspired by an open-source project that got there first. Each one shaped a concrete piece of OmniRoute. This is our thank-you to all of them. 🙏
+Special thanks to **[9router](https://github.com/decolua/9router)** by **[decolua](https://github.com/decolua)** — the original project that inspired this fork. OmniRoute builds upon that incredible foundation with additional features, multi-modal APIs, and a full TypeScript rewrite.

-> ⭐ star counts as of June 2026 — go give these projects a star.
+Special thanks to **[CLIProxyAPI](https://github.com/router-for-me/CLIProxyAPI)** by **[router-for-me](https://github.com/router-for-me)** — the original Go implementation that inspired this JavaScript port.

-### 🧬 Lineage & gateway
+Special thanks to **[Caveman](https://github.com/JuliusBrussee/caveman)** by **[JuliusBrussee](https://github.com/JuliusBrussee)** (⭐ 51K+) — the viral "why use many token when few token do trick" project whose caveman-speak compression philosophy inspired OmniRoute's standard compression mode and 30+ filler/condensation regex rules.

-| Project                                                                         |    ⭐ | How it inspired OmniRoute                                                                                                             |
-| ------------------------------------------------------------------------------- | ----: | ------------------------------------------------------------------------------------------------------------------------------------- |
-| **[9router](https://github.com/decolua/9router)** · decolua                     | 17.9k | The original project this fork is built on — extended here with multi-modal APIs and a full TypeScript rewrite.                       |
-| **[CLIProxyAPI](https://github.com/router-for-me/CLIProxyAPI)** · router-for-me | 37.8k | The Go implementation that inspired this JavaScript / TypeScript port.                                                                |
-| **[LiteLLM](https://github.com/BerriAI/litellm)** · BerriAI                     | 50.8k | The AI gateway whose public pricing dataset feeds our cost-tracking sync and whose provider-normalization model informed our routing. |
+Special thanks to **[RTK - Rust Token Killer](https://github.com/rtk-ai/rtk)** by **[RTK AI](https://github.com/rtk-ai)** — the high-performance command-output compression project whose terminal, build, test, git, and tool-output filtering model inspired OmniRoute's RTK engine, JSON filter DSL, raw-output recovery, and stacked RTK → Caveman compression pipeline.

-### 🗜️ Context & token compression — engines
+Special thanks to **[Troglodita](https://github.com/leninejunior/troglodita)** by **[Lenine Júnior](https://github.com/leninejunior)** — the PT-BR token compression project ("por que gastar muitos tokens quando poucos resolve?") whose Portuguese-native rules power OmniRoute's pt-BR language pack: pleonasm reduction, filler removal tuned for Brazilian Portuguese grammar, and technical abbreviations for the dev BR community.

-| Project                                                                      |    ⭐ | How it inspired OmniRoute                                                                                                                                                                                |
-| ---------------------------------------------------------------------------- | ----: | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **[Caveman](https://github.com/JuliusBrussee/caveman)** · JuliusBrussee      | 74.5k | The viral "why use many token when few token do trick" project — its caveman-speak philosophy powers our standard compression mode and 30+ filler/condensation rules.                                    |
-| **[RTK – Rust Token Killer](https://github.com/rtk-ai/rtk)** · rtk-ai        | 63.6k | High-performance command-output compression — inspired our RTK engine, JSON filter DSL, raw-output recovery and the stacked RTK → Caveman pipeline.                                                      |
-| **[headroom](https://github.com/chopratejas/headroom)** · chopratejas        | 33.6k | Reversible context-compression (SmartCrusher) — inspired our `headroom` engine and the `ccr` retrieve-marker pattern.                                                                                    |
-| **[LLMLingua](https://github.com/microsoft/LLMLingua)** · Microsoft          |  6.3k | Prompt-compression research (LLMLingua / LLMLingua-2) — inspired our async, code-safe, fail-open `llmlingua` engine.                                                                                     |
-| **[llmlingua-2-js](https://github.com/atjsh/llmlingua-2-js)** · atjsh        |    27 | The JS/ONNX port (MobileBERT / XLM-RoBERTa) used as the worker-thread backend for our LLMLingua engine.                                                                                                  |
-| **[Troglodita](https://github.com/leninejunior/troglodita)** · Lenine Júnior |    15 | PT-BR token compression — powers our pt-BR language pack: pleonasm reduction and filler removal tuned for Brazilian-Portuguese grammar.                                                                  |
-| **[ponytail](https://github.com/DietrichGebert/ponytail)** · DietrichGebert  | 51.4k | The viral "lazy senior dev" YAGNI-coder skill — inspired our **less-code** Output Style: smallest-working-change steering that cuts _generated_ code (the output-axis sibling to Caveman's terse prose). |
+Special thanks to **[headroom](https://github.com/chopratejas/headroom)** by **[chopratejas](https://github.com/chopratejas)** — the reversible context-compression project whose SmartCrusher (per-type routing, reversible block compaction, internal hash cache) directly inspired OmniRoute's `headroom` engine and the `ccr` retrieve-marker pattern.

-### 🧩 Compact formats, token research & code-aware tooling
+Special thanks to **[TOON](https://github.com/toon-format/toon)** by **[toon-format](https://github.com/toon-format)** and **[GCF — Graph Compact Format](https://github.com/blackwell-systems/gcf)** by **[Dayna Blackwell / Blackwell Systems](https://github.com/blackwell-systems)** — the compact, schema-aware "JSON for LLMs" notations whose columnar, header-plus-rows model shaped OmniRoute's `headroom`/SmartCrusher tabular stage: a dependency-free, lossless compaction of homogeneous JSON arrays with an explicit `[N rows]` marker.

-| Project                                                                                        |    ⭐ | How it inspired OmniRoute                                                                                                                                                                                      |
-| ---------------------------------------------------------------------------------------------- | ----: | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **[TOON](https://github.com/toon-format/toon)** · toon-format                                  | 24.6k | Token-Oriented Object Notation — its columnar, header-plus-rows model shaped our tabular compaction stage.                                                                                                     |
-| **[GCF – Graph Compact Format](https://github.com/blackwell-systems/gcf)** · Blackwell Systems |    11 | Schema-aware "JSON for LLMs" notation — co-inspired our lossless homogeneous-array compaction with `[N rows]` markers.                                                                                         |
-| **[token-optimizer-mcp](https://github.com/ooples/token-optimizer-mcp)** · ooples              |   409 | Brotli/SQLite cache + per-session context-delta — inspired our `session-dedup` engine.                                                                                                                         |
-| **[token-savior](https://github.com/Mibayy/token-savior)** · Mibayy                            |   993 | Bash-output compaction + MCP profiles — inspired our compression bail-out discipline and MCP tool-manifest reduction.                                                                                          |
-| **[token-saver](https://github.com/ppgranger/token-saver)** · ppgranger                        |   103 | Content-aware, per-file-type output compression with failure-aware bail-out — validated our per-type dispatch and minimum-gain skip.                                                                           |
-| **[token-optimizer](https://github.com/alexgreensh/token-optimizer)** · alexgreensh            |  1.4k | "Find the ghost tokens" — its offload + recoverable-handle pattern informed our CCR offload thinking.                                                                                                          |
-| **[TokenMizer](https://github.com/Shweta-Mishra-ai/tokenmizer)** · Shweta-Mishra-ai            |     1 | A session-graph + cross-turn line-dedup blueprint that informed our session-dedup design.                                                                                                                      |
-| **[OmniCompress](https://github.com/jessefreitas/OmniCompress)** · jessefreitas                |     2 | Rust columnar-JSON + content-addressed retrieve + cross-message dedup — validated our `headroom`/`ccr`/`session-dedup` engine design and the cache-stable "compressed form is position-independent" invariant. |
-| **[mcp-compressor](https://github.com/atlassian-labs/mcp-compressor)** · Atlassian Labs        |    80 | MCP tool-schema/description compression — informed our MCP tool-manifest cardinality reduction.                                                                                                                |
-| **[RepoMapper](https://github.com/pdavis68/RepoMapper)** · pdavis68                            |   182 | Aider-style repo-map ranking — informed our repo-map / retrieval-ranking exploration.                                                                                                                          |
-| **[quiet-shell-mcp](https://github.com/mrsimpson/quiet-shell-mcp)** · mrsimpson                |     4 | Declarative shell-output reduction over MCP — validated our declarative bash-output compaction.                                                                                                                |
-| **[ts-morph](https://github.com/dsherret/ts-morph)** · David Sherret                           |  6.1k | TypeScript Compiler API toolkit — inspired our parser-based comment removal that preserves string, template and regex literals.                                                                                |
+Special thanks to **[token-optimizer-mcp](https://github.com/ooples/token-optimizer-mcp)** by **[ooples](https://github.com/ooples)** — the Brotli/SQLite cache + per-session context-delta project whose content-addressed delta model inspired OmniRoute's `session-dedup` engine (cross-turn block deduplication with reversible references).

-### 🧠 Memory & RAG
+Special thanks to **[token-savior](https://github.com/Mibayy/token-savior)** by **[Mibayy](https://github.com/Mibayy)** — the Bash-output compaction + MCP-profiles project whose failure-aware bail-out and tool-profile model inspired OmniRoute's compression bail-out discipline and MCP tool-manifest cardinality reduction.

-| Project                                                            |    ⭐ | How it inspired OmniRoute                                                                                           |
-| ------------------------------------------------------------------ | ----: | ------------------------------------------------------------------------------------------------------------------- |
-| **[Mem0](https://github.com/mem0ai/mem0)** · mem0ai                | 58.9k | Universal memory layer — its proxy-as-write/read-boundary model shaped our memory architecture.                     |
-| **[Letta (MemGPT)](https://github.com/letta-ai/letta)** · letta-ai | 23.4k | Stateful agents with tiered memory — inspired our Context Control & Recovery (CCR) tiered model.                    |
-| **[WFGY](https://github.com/onestardao/WFGY)** · onestardao        |  1.8k | The ProblemMap taxonomy of 16 recurring RAG/LLM failure modes — the shared vocabulary in our troubleshooting guide. |
+Special thanks to **[LLMLingua](https://github.com/microsoft/LLMLingua)** by **[Microsoft](https://github.com/microsoft)** — the prompt-compression research (LLMLingua / LLMLingua-2) whose token-level semantic pruning inspired OmniRoute's async `llmlingua` engine (prose-only, code-safe, fail-open), together with the JS/ONNX port **[llmlingua-2-js](https://github.com/atjsh/llmlingua-2-js)** by **[atjsh](https://github.com/atjsh)** (MobileBERT / XLM-RoBERTa ONNX models) as its intended worker-thread backend.

-### 🛰️ Traffic inspection, MITM & transparent proxy
+Special thanks to **[ts-morph](https://github.com/dsherret/ts-morph)** by **[David Sherret](https://github.com/dsherret)** — the TypeScript Compiler API toolkit whose AST approach inspired OmniRoute's parser-based code-comment removal, which correctly preserves string, template, and regex literals where naïve regex stripping corrupts them.

-| Project                                                                           |   ⭐ | How it inspired OmniRoute                                                                                                                                                        |
-| --------------------------------------------------------------------------------- | ---: | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **[llm-interceptor](https://github.com/chouzz/llm-interceptor)** · chouzz         |   46 | MITM interception/analysis of coding-assistant ↔ LLM traffic — our Traffic Inspector ports its SSE merge, conversation normalization, host passthrough and secret masking (MIT). |
-| **[ProxyBridge](https://github.com/InterceptSuite/ProxyBridge)** · InterceptSuite | 5.1k | Transparent per-process proxy routing — inspired our crash-safe MITM teardown, socket idle-timeouts, `/proc` process attribution and TPROXY capture.                             |
+Special thanks to **[React Flow / xyflow](https://github.com/xyflow/xyflow)** by **[xyflow](https://github.com/xyflow)** — the node-based graph library that powers OmniRoute's real-time **Compression Studio** and **Combo/Routing Studio** dashboards.

-### 📚 Model data, observability & UI
-
-| Project                                                                    |    ⭐ | How it inspired OmniRoute                                                                                                  |
-| -------------------------------------------------------------------------- | ----: | -------------------------------------------------------------------------------------------------------------------------- |
-| **[models.dev](https://github.com/anomalyco/models.dev)** · SST / OpenCode |  5.1k | Open database of AI model specs, pricing and capabilities — synced natively into our model catalog.                        |
-| **[React Flow / xyflow](https://github.com/xyflow/xyflow)** · xyflow       | 37.1k | The node-based graph library powering our real-time Compression Studio and Combo/Routing Studio.                           |
-| **[LangGraph](https://github.com/langchain-ai/langgraph)** · LangChain     | 35.1k | LangGraph Studio's live workflow-graph visualization inspired our Studios' real-time cascade view.                         |
-| **[Langfuse](https://github.com/langfuse/langfuse)** · Langfuse            | 29.3k | Its trace → span → generation observability model shaped our Compression Studio waterfall.                                 |
-| **[Kiali](https://github.com/kiali/kiali)** · Kiali                        |  3.6k | Istio service-mesh observability — inspired our circuit-breaker badges and error-edge visuals in the Routing/Combo Studio. |
-| **[lobe-icons](https://github.com/lobehub/lobe-icons)** · LobeHub          |  2.1k | AI/LLM brand logos that render the provider icons across our dashboard.                                                    |
-
-### 🛡️ Security
-
-| Project                                                                                     |  ⭐ | How it inspired OmniRoute                                                                                                                        |
-| ------------------------------------------------------------------------------------------- | --: | ------------------------------------------------------------------------------------------------------------------------------------------------ |
-| **[awesome-secure-defaults](https://github.com/tldrsec/awesome-secure-defaults)** · tldrsec | 708 | A curated list of secure-by-default libraries that guides our security choices (Helmet.js, DOMPurify, ssrf-req-filter, safe-regex, Google Tink). |
+Special thanks to **[LangGraph](https://github.com/langchain-ai/langgraph)** by **[LangChain](https://github.com/langchain-ai)** — the agent-graph framework whose LangGraph Studio live workflow-graph visualization inspired OmniRoute's Compression and Combo Studios: watching compression engines and combo fallbacks cascade in real time.

 ## ❤️ Support

--- a/SECURITY.md
+++ b/SECURITY.md
@@ -113,14 +113,14 @@ PII_REDACTION_ENABLED=true

 ### 🌐 Network Security

-| Feature                  | Description                                                                    |
-| ------------------------ | ------------------------------------------------------------------------------ |
-| **CORS**                 | Explicit cross-origin allowlist (`CORS_ALLOWED_ORIGINS`; legacy `CORS_ORIGIN`) |
-| **IP Filtering**         | Allowlist/blocklist IP ranges in dashboard                                     |
-| **Rate Limiting**        | Per-provider rate limits with automatic backoff                                |
-| **Anti-Thundering Herd** | Mutex + per-connection locking prevents cascading 502s                         |
-| **TLS Fingerprint**      | Browser-like TLS fingerprint spoofing to reduce bot detection                  |
-| **CLI Fingerprint**      | Per-provider header/body ordering to match native CLI signatures               |
+| Feature                  | Description                                                      |
+| ------------------------ | ---------------------------------------------------------------- |
+| **CORS**                 | Configurable origin control (`CORS_ORIGIN` env var, default `*`) |
+| **IP Filtering**         | Allowlist/blocklist IP ranges in dashboard                       |
+| **Rate Limiting**        | Per-provider rate limits with automatic backoff                  |
+| **Anti-Thundering Herd** | Mutex + per-connection locking prevents cascading 502s           |
+| **TLS Fingerprint**      | Browser-like TLS fingerprint spoofing to reduce bot detection    |
+| **CLI Fingerprint**      | Per-provider header/body ordering to match native CLI signatures |

 ### 🔌 Resilience & Availability

--- a/bin/_ops-common.sh
+++ b/bin/_ops-common.sh
@@ -1,70 +0,0 @@
-# bin/_ops-common.sh — shared helpers for the OmniRoute ops runbook scripts.
-#
-# Sourced (not executed) by rollback.sh / snapshot-data.sh / restore-data.sh /
-# restore-policies.sh / cold-start-bench.sh — the self-hoster incident-recovery
-# and cold-start ops tooling. Each script documents its own contract via --help.
-#
-# Path resolution mirrors the app (src/lib/db/core.ts): the SQLite store is
-# $DATA_DIR/storage.sqlite and managed backups go to $DATA_DIR/db_backups
-# (overridable via DB_BACKUPS_DIR), so snapshots created here are interchangeable
-# with the ones the server writes on migrations.
-
-# Recompute the data-dir-derived paths. Called once on source, and again by
-# scripts that accept a --data-dir override.
-ops_set_data_dir() {
-  OMNIROUTE_DATA_DIR="$1"
-  OMNIROUTE_SQLITE="${OMNIROUTE_DATA_DIR}/storage.sqlite"
-  OMNIROUTE_BACKUPS_DIR="${DB_BACKUPS_DIR:-${OMNIROUTE_DATA_DIR}/db_backups}"
-}
-ops_set_data_dir "${DATA_DIR:-$HOME/.omniroute}"
-
-ops_log() { printf '[%s] %s\n' "${SCRIPT_NAME:-ops}" "$*" >&2; }
-ops_die() {
-  printf '[%s] ERROR: %s\n' "${SCRIPT_NAME:-ops}" "$*" >&2
-  exit 1
-}
-
-ops_require_cmd() {
-  command -v "$1" >/dev/null 2>&1 || ops_die "required command not found: $1"
-}
-
-# ops_confirm "<prompt>" — return 0 to proceed. Honors ASSUME_YES=1 (set by the
-# --yes flag) and REFUSES a destructive action on a non-interactive stdin unless
-# ASSUME_YES is set, so an unattended/CI invocation can never silently destroy data.
-ops_confirm() {
-  local prompt="$1" reply
-  if [ "${ASSUME_YES:-0}" = "1" ]; then return 0; fi
-  if [ ! -t 0 ]; then
-    ops_die "refusing a destructive action without a TTY; pass --yes to proceed non-interactively"
-  fi
-  read -r -p "$prompt [y/N] " reply
-  case "$reply" in
-    [yY] | [yY][eE][sS]) return 0 ;;
-    *) return 1 ;;
-  esac
-}
-
-# ops_find_snapshot <id> — resolve a snapshot identifier (a snapshot dir name,
-# a bare timestamp/sha, or an explicit path) to a directory containing
-# storage.sqlite. Echoes the resolved dir or dies.
-ops_find_snapshot() {
-  local id="$1" cand
-  [ -n "$id" ] || ops_die "snapshot id required (a timestamp/sha, dir name, or path)"
-  for cand in \
-    "$id" \
-    "$id/" \
-    "$OMNIROUTE_BACKUPS_DIR/$id" \
-    "$OMNIROUTE_BACKUPS_DIR/snapshot_$id"; do
-    if [ -f "${cand%/}/storage.sqlite" ]; then
-      printf '%s\n' "${cand%/}"
-      return 0
-    fi
-  done
-  # Fall back to a prefix match against snapshot_* dirs (e.g. a short sha/date).
-  if [ -d "$OMNIROUTE_BACKUPS_DIR" ]; then
-    for cand in "$OMNIROUTE_BACKUPS_DIR"/snapshot_*"$id"*; do
-      [ -f "$cand/storage.sqlite" ] && { printf '%s\n' "$cand"; return 0; }
-    done
-  fi
-  ops_die "no snapshot matching '$id' under $OMNIROUTE_BACKUPS_DIR (run bin/snapshot-data.sh first)"
-}
--- a/bin/cli/api-commands/agent-skills.mjs
+++ b/bin/cli/api-commands/agent-skills.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/agentbridge.mjs
+++ b/bin/cli/api-commands/agentbridge.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/api-keys.mjs
+++ b/bin/cli/api-commands/api-keys.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/audio.mjs
+++ b/bin/cli/api-commands/audio.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/chat.mjs
+++ b/bin/cli/api-commands/chat.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/cli-tools.mjs
+++ b/bin/cli/api-commands/cli-tools.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/cloud.mjs
+++ b/bin/cli/api-commands/cloud.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/combos.mjs
+++ b/bin/cli/api-commands/combos.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/compression.mjs
+++ b/bin/cli/api-commands/compression.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/embedded-services.mjs
+++ b/bin/cli/api-commands/embedded-services.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/embeddings.mjs
+++ b/bin/cli/api-commands/embeddings.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/fallback.mjs
+++ b/bin/cli/api-commands/fallback.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/images.mjs
+++ b/bin/cli/api-commands/images.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/memory.mjs
+++ b/bin/cli/api-commands/memory.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/messages.mjs
+++ b/bin/cli/api-commands/messages.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/models.mjs
+++ b/bin/cli/api-commands/models.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/moderations.mjs
+++ b/bin/cli/api-commands/moderations.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/oauth.mjs
+++ b/bin/cli/api-commands/oauth.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/playground.mjs
+++ b/bin/cli/api-commands/playground.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/pricing.mjs
+++ b/bin/cli/api-commands/pricing.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/provider-nodes.mjs
+++ b/bin/cli/api-commands/provider-nodes.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/providers.mjs
+++ b/bin/cli/api-commands/providers.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/quota.mjs
+++ b/bin/cli/api-commands/quota.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/rerank.mjs
+++ b/bin/cli/api-commands/rerank.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/responses.mjs
+++ b/bin/cli/api-commands/responses.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/settings.mjs
+++ b/bin/cli/api-commands/settings.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/system.mjs
+++ b/bin/cli/api-commands/system.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/telemetry.mjs
+++ b/bin/cli/api-commands/telemetry.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/traffic-inspector.mjs
+++ b/bin/cli/api-commands/traffic-inspector.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/translator.mjs
+++ b/bin/cli/api-commands/translator.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api-commands/usage.mjs
+++ b/bin/cli/api-commands/usage.mjs
@@ -1,4 +1,4 @@
-// AUTO-GENERATED from docs/openapi.yaml. Do not edit.
+// AUTO-GENERATED from docs/reference/openapi.yaml. Do not edit.
 import { apiFetch } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { readFileSync } from "node:fs";
--- a/bin/cli/api.mjs
+++ b/bin/cli/api.mjs
@@ -1,6 +1,8 @@
 import { setTimeout as sleep } from "node:timers/promises";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { resolveDataDir } from "./data-dir.mjs";
 import { getCliToken, CLI_TOKEN_HEADER } from "./utils/cliToken.mjs";
-import { resolveActiveContext } from "./contexts.mjs";

 export const RETRY_DEFAULTS = Object.freeze({
  maxAttempts: 3,
@@ -26,12 +28,14 @@ export function getBaseUrl(opts = {}) {
  const envUrl = process.env.OMNIROUTE_BASE_URL;
  if (envUrl) return stripTrailingSlash(envUrl);

-  // Resolve from the active context (canonical store + legacy profile fallback).
-  // This is what makes "remote mode" work: `omniroute contexts use <remote>`
-  // routes every command at the remote server's baseUrl.
  try {
-    const ctx = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT);
-    if (ctx?.baseUrl) return stripTrailingSlash(ctx.baseUrl);
+    const configPath = join(resolveDataDir(), "config.json");
+    if (existsSync(configPath)) {
+      const cfg = JSON.parse(readFileSync(configPath, "utf8"));
+      const profile = cfg.activeProfile && cfg.profiles?.[cfg.activeProfile];
+      if (profile?.baseUrl) return stripTrailingSlash(profile.baseUrl);
+      if (cfg.baseUrl) return stripTrailingSlash(cfg.baseUrl);
+    }
  } catch {
    // Config read failures are not fatal — fall through to default.
  }
@@ -52,40 +56,15 @@ function resolveUrl(path, opts) {
  return `${getBaseUrl(opts)}${path.startsWith("/") ? path : `/${path}`}`;
 }

-export async function buildHeaders(opts) {
+async function buildHeaders(opts) {
  const headers = new Headers(opts.headers || {});
  if (!headers.has("accept")) headers.set("accept", "application/json");
  if (opts.body && !headers.has("content-type") && typeof opts.body !== "string") {
    headers.set("content-type", "application/json");
  }
-  // Auth precedence: explicit key → active-context credential → ambient env key.
-  //
-  // The active context's scoped token MUST win over the ambient OMNIROUTE_API_KEY:
-  // `omniroute connect <remote>` saves the context's token, but users keep
-  // OMNIROUTE_API_KEY in their shell. The global `--api-key` option is bound to
-  // that env var (.env("OMNIROUTE_API_KEY")), so commands that spread
-  // `optsWithGlobals()` into apiFetch carry opts.apiKey === the env value. If that
-  // echoed value outranked the context, every remote management command would send
-  // the local inference key and fail with "Invalid management token" — defeating
-  // remote mode. So an opts.apiKey that merely mirrors the ambient env var is
-  // treated as ambient (a fallback), NOT as an explicit override; only a DISTINCT
-  // key — a real `--api-key <x>` flag or a command-supplied token like
-  // `connect --key` — counts as explicit and wins. Within a context the scoped
-  // accessToken wins over the legacy apiKey.
-  const ambientKey = process.env.OMNIROUTE_API_KEY || null;
-  const explicitKey = opts.apiKey && opts.apiKey !== ambientKey ? opts.apiKey : null;
-  let auth = explicitKey;
-  if (!auth) {
-    try {
-      const ctx = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT);
-      auth = ctx?.accessToken || ctx?.apiKey || null;
-    } catch {
-      // No context credential available — fall through to the ambient fallback.
-    }
-  }
-  if (!auth) auth = opts.apiKey || ambientKey || null;
-  if (auth && !headers.has("authorization")) {
-    headers.set("authorization", `Bearer ${auth}`);
+  const apiKey = opts.apiKey ?? process.env.OMNIROUTE_API_KEY;
+  if (apiKey && !headers.has("authorization")) {
+    headers.set("authorization", `Bearer ${apiKey}`);
  }
  // Inject machine-id derived CLI token; env var override for testing.
  const cliToken = opts.cliToken ?? process.env.OMNIROUTE_CLI_TOKEN ?? (await getCliToken());
--- a/bin/cli/commands/configure.mjs
+++ b/bin/cli/commands/configure.mjs
@@ -1,180 +0,0 @@
-import os from "node:os";
-import path from "node:path";
-import { existsSync, mkdirSync, writeFileSync, copyFileSync } from "node:fs";
-import { apiFetch } from "../api.mjs";
-import { createPrompt, printSuccess, printError, printInfo, printHeading } from "../io.mjs";
-import { t } from "../i18n.mjs";
-
-/**
- * `omniroute configure <cli>` — interactive provider+model picker that writes a
- * local CLI config pointed at the ACTIVE OmniRoute context (local or remote).
- *
- * The model catalog comes from the active context's GET /v1/models, so when you
- * are in remote mode (`omniroute connect ...`) you pick from the remote server's
- * live models and the profile is written on THIS machine.
- *
- * v1 targets the Codex CLI (writes ~/.codex/<name>.config.toml). The credential
- * is referenced by env var (OMNIROUTE_API_KEY) — never written to disk.
- */
-
-const SUPPORTED = ["codex"];
-
-/** Derive a short, filesystem-safe profile name from a model id. */
-export function profileNameFromModel(modelId) {
-  const afterProvider = String(modelId).includes("/")
-    ? String(modelId).split("/").slice(1).join("/")
-    : String(modelId);
-  return afterProvider.replace(/[^a-zA-Z0-9]+/g, "").toLowerCase() || "model";
-}
-
-/** Provider id for a catalog entry: explicit owned_by, else the id prefix. */
-function providerOf(entry) {
-  if (entry && typeof entry.owned_by === "string" && entry.owned_by) return entry.owned_by;
-  const id = typeof entry === "string" ? entry : entry?.id || "";
-  return id.includes("/") ? id.split("/")[0] : "(none)";
-}
-
-function contextWindowOf(entry) {
-  for (const c of [entry?.context_length, entry?.max_context_window_tokens]) {
-    if (typeof c === "number" && Number.isFinite(c) && c > 0) return c;
-  }
-  return null;
-}
-
-async function fetchModels(globalOpts) {
-  const res = await apiFetch("/v1/models", { ...globalOpts, acceptNotOk: true });
-  if (!res.ok) {
-    let msg = `HTTP ${res.status}`;
-    try {
-      const b = await res.json();
-      msg = b?.error?.message || b?.error || msg;
-    } catch {
-      /* ignore */
-    }
-    throw new Error(`Could not fetch models: ${msg}`);
-  }
-  const body = await res.json();
-  const list = Array.isArray(body) ? body : body.data || body.models || [];
-  return list.filter((m) => (typeof m === "string" ? m : m?.id));
-}
-
-function buildCodexProfile(modelId, ctx) {
-  const lines = [
-    `# codex --profile ${profileNameFromModel(modelId)}`,
-    `# ${modelId} — generated by 'omniroute configure codex'`,
-    `model                          = "${modelId}"`,
-    `model_provider                 = "omniroute"`,
-  ];
-  if (ctx && ctx > 0) {
-    const compact = Math.floor(ctx * 0.85);
-    lines.push(`model_context_window           = ${ctx}`);
-    lines.push(`model_auto_compact_token_limit = ${compact}`);
-  }
-  return lines.join("\n") + "\n";
-}
-
-async function configureCodex(modelId, ctxWindow, opts) {
-  const codexHome = opts.codexHome || path.join(os.homedir(), ".codex");
-  if (!existsSync(codexHome)) mkdirSync(codexHome, { recursive: true });
-  const profile = opts.name || profileNameFromModel(modelId);
-  const filePath = path.join(codexHome, `${profile}.config.toml`);
-  if (existsSync(filePath)) {
-    copyFileSync(filePath, `${filePath}.bak`);
-  }
-  writeFileSync(filePath, buildCodexProfile(modelId, ctxWindow), "utf8");
-  printSuccess(`Wrote ${filePath}`);
-  printInfo(`Use it:  codex --profile ${profile}`);
-  printInfo("Prereq: ~/.codex/config.toml must define the [model_providers.omniroute] block");
-  printInfo("        (run the Codex setup once — see docs/guides/CODEX-CLI-CONFIGURATION.md).");
-}
-
-export async function runConfigureCommand(cli, opts = {}, cmd) {
-  const target = String(cli || "").toLowerCase();
-  if (!SUPPORTED.includes(target)) {
-    printError(`Unsupported CLI '${cli}'. Supported: ${SUPPORTED.join(", ")}.`);
-    return 2;
-  }
-  const globalOpts = cmd ? cmd.optsWithGlobals() : {};
-
-  let models;
-  try {
-    models = await fetchModels(globalOpts);
-  } catch (e) {
-    printError(e instanceof Error ? e.message : String(e));
-    return 1;
-  }
-  if (!models.length) {
-    printError("The server returned no models.");
-    return 1;
-  }
-
-  // Resolve model: explicit flags or interactive pick.
-  let chosenId = opts.model;
-  if (chosenId && opts.provider && !chosenId.includes("/")) {
-    chosenId = `${opts.provider}/${chosenId}`;
-  }
-
-  if (!chosenId) {
-    const ids = models.map((m) => (typeof m === "string" ? m : m.id));
-    const providers = [...new Set(models.map(providerOf))].sort();
-    const prompt = createPrompt();
-    try {
-      printHeading("Configure Codex CLI");
-      let providerList = providers;
-      if (opts.provider) {
-        providerList = providers.filter((p) => p === opts.provider);
-      } else {
-        printInfo(`Providers: ${providers.join(", ")}`);
-        const p = await prompt.ask("Provider");
-        if (p) providerList = providers.filter((x) => x === p);
-      }
-      const inProvider = ids.filter((id) => providerList.includes(providerOf(byId(models, id))));
-      const candidates = inProvider.length ? inProvider : ids;
-      printInfo(`Models: ${candidates.slice(0, 40).join(", ")}${candidates.length > 40 ? " …" : ""}`);
-      chosenId = await prompt.ask("Model id");
-    } finally {
-      prompt.close();
-    }
-  }
-
-  if (!chosenId) {
-    printError("No model selected.");
-    return 2;
-  }
-  const entry = byId(models, chosenId);
-  if (!entry) {
-    printError(`Model '${chosenId}' is not in the catalog.`);
-    return 2;
-  }
-  const ctxWindow = contextWindowOf(entry);
-
-  if (target === "codex") {
-    await configureCodex(chosenId, ctxWindow, opts);
-  }
-  return 0;
-}
-
-function byId(models, id) {
-  for (const m of models) {
-    const mid = typeof m === "string" ? m : m.id;
-    if (mid === id) return m;
-  }
-  return null;
-}
-
-export function registerConfigure(program) {
-  program
-    .command("configure <cli>")
-    .description(
-      t("configure.description") ||
-        "Pick a provider+model from the active server and write a local CLI config (v1: codex)"
-    )
-    .option("--provider <id>", "Provider id (skips the interactive provider prompt)")
-    .option("--model <id>", "Model id (skips the interactive model prompt)")
-    .option("--name <name>", "Profile name to write (default: derived from model)")
-    .option("--codex-home <dir>", "Codex home dir (default: ~/.codex)")
-    .action(async (cli, opts, cmd) => {
-      const code = await runConfigureCommand(cli, opts, cmd);
-      if (code !== 0) process.exit(code);
-    });
-}
--- a/bin/cli/commands/connect.mjs
+++ b/bin/cli/commands/connect.mjs
@@ -1,132 +0,0 @@
-import { apiFetch } from "../api.mjs";
-import { loadContexts, saveContexts } from "../contexts.mjs";
-import { createPrompt, printSuccess, printError, printInfo } from "../io.mjs";
-import { t } from "../i18n.mjs";
-
-/**
- * `omniroute connect <host>` — remote mode.
- *
- * Logs into a remote OmniRoute server and saves the result as the active context
- * so every subsequent command targets that server. Two flows:
- *   - password: prompts for the management password → POST /api/cli/connect →
- *     server mints a scoped access token (default scope: admin).
- *   - token:    `--key <oma_...>` validates via GET /api/cli/whoami and saves it.
- */
-
-/** Normalize a host/URL into a server root baseUrl (no trailing path). */
-export function normalizeBaseUrl(host, port) {
-  let value = String(host || "").trim();
-  if (!value) return "";
-  const hadScheme = /^https?:\/\//i.test(value);
-  if (!hadScheme) value = `http://${value}`;
-  try {
-    const u = new URL(value);
-    // Only apply the default port to a bare host; a full URL is taken as-is.
-    if (!hadScheme && !u.port && port) u.port = String(port);
-    return u.origin;
-  } catch {
-    return value;
-  }
-}
-
-/** Derive a clean context name from a host (strip scheme/port). */
-export function hostLabel(host) {
-  let value = String(host || "").trim().replace(/^https?:\/\//i, "");
-  value = value.split("/")[0].split(":")[0];
-  return value || "remote";
-}
-
-async function readErrorMessage(res) {
-  try {
-    const body = await res.json();
-    return body?.error?.message || body?.error || `HTTP ${res.status}`;
-  } catch {
-    return `HTTP ${res.status}`;
-  }
-}
-
-export async function runConnectCommand(host, opts = {}) {
-  const baseUrl = normalizeBaseUrl(host, opts.port || "20128");
-  if (!baseUrl) {
-    printError("A host is required, e.g. omniroute connect 192.168.0.15");
-    return 2;
-  }
-  const name = opts.name || hostLabel(host);
-
-  let accessToken;
-  let scope;
-
-  if (opts.key) {
-    // Validate the pasted token against the remote.
-    const res = await apiFetch("/api/cli/whoami", {
-      baseUrl,
-      apiKey: opts.key,
-      acceptNotOk: true,
-    });
-    if (!res.ok) {
-      printError(`Token rejected by ${baseUrl}: ${await readErrorMessage(res)}`);
-      return res.exitCode || 1;
-    }
-    const body = await res.json();
-    accessToken = opts.key;
-    scope = body.scope || "unknown";
-  } else {
-    const prompt = createPrompt();
-    let password;
-    try {
-      password = await prompt.askSecret(`Management password for ${baseUrl}`);
-    } finally {
-      prompt.close();
-    }
-    if (!password) {
-      printError("Password is required (or use --key <token>).");
-      return 2;
-    }
-    const res = await apiFetch("/api/cli/connect", {
-      baseUrl,
-      method: "POST",
-      body: { password, name, scope: opts.scope },
-      acceptNotOk: true,
-      retry: false,
-    });
-    if (!res.ok) {
-      printError(`Connect failed (${res.status}): ${await readErrorMessage(res)}`);
-      return res.exitCode || 1;
-    }
-    const body = await res.json();
-    accessToken = body.token;
-    scope = body.scope;
-  }
-
-  const cfg = loadContexts();
-  cfg.contexts = cfg.contexts || {};
-  cfg.contexts[name] = {
-    baseUrl,
-    accessToken,
-    scope,
-    description: `Remote OmniRoute (${host})`,
-  };
-  cfg.currentContext = name;
-  saveContexts(cfg);
-
-  printSuccess(`Connected to ${baseUrl} — context '${name}' (scope: ${scope})`);
-  printInfo("All commands now target this server.");
-  printInfo("Switch back to local with: omniroute contexts use default");
-  return 0;
-}
-
-export function registerConnect(program) {
-  program
-    .command("connect <host>")
-    .description(
-      t("connect.description") || "Connect to a remote OmniRoute server and enter remote mode"
-    )
-    .option("--port <port>", "Server port when the host has none", "20128")
-    .option("--key <token>", "Use a pre-generated scoped access token (skips the password prompt)")
-    .option("--name <name>", "Context name to save (default: derived from host)")
-    .option("--scope <scope>", "Requested scope for the password flow (read|write|admin)")
-    .action(async (host, opts) => {
-      const code = await runConnectCommand(host, opts);
-      if (code !== 0) process.exit(code);
-    });
-}
--- a/bin/cli/commands/contexts.mjs
+++ b/bin/cli/commands/contexts.mjs
@@ -1,23 +1,8 @@
 import { t } from "../i18n.mjs";
 import { emit } from "../output.mjs";
-import { loadContexts, saveContexts, resolveActiveContext } from "../contexts.mjs";
+import { loadContexts, saveContexts, configPath } from "../contexts.mjs";

-/** Auth label for a context: prefers the scoped accessToken over the legacy apiKey. */
-function authLabel(c) {
-  if (c?.accessToken) return "token";
-  if (c?.apiKey) return "key";
-  return "✗";
-}
-
-export async function confirm(msg) {
-  // Non-interactive stdin (pipe, CI, EOF) cannot answer a [y/N] prompt. Asking
-  // anyway leaves the readline question pending forever — Node then warns about an
-  // "unsettled top-level await" at exit. Decline cleanly instead and point at the
-  // non-interactive escape hatch so scripted callers fail safe rather than hang.
-  if (!process.stdin.isTTY) {
-    process.stderr.write(`${msg} [y/N] (non-interactive stdin — declined; pass --yes to confirm)\n`);
-    return false;
-  }
+async function confirm(msg) {
  const readline = await import("node:readline");
  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
  const answer = await new Promise((r) => rl.question(`${msg} [y/N] `, r));
@@ -34,7 +19,6 @@ function maskKey(k) {
 export function registerContexts(program) {
  const ctx = program
    .command("contexts")
-    .alias("context") // singular alias — docs/connect output historically said `context current`
    .description(t("config.contexts.description") || "Manage server contexts/profiles");

  ctx
@@ -47,8 +31,7 @@ export function registerContexts(program) {
        active: name === (cfg.currentContext || "default") ? "●" : "",
        name,
        baseUrl: c.baseUrl || "",
-        auth: authLabel(c),
-        scope: c.scope || "",
+        auth: c.apiKey ? "✓" : "✗",
        description: c.description || "",
      }));
      emit(rows, globalOpts, [
@@ -56,7 +39,6 @@ export function registerContexts(program) {
        { key: "name", header: "Name" },
        { key: "baseUrl", header: "Base URL" },
        { key: "auth", header: "Auth" },
-        { key: "scope", header: "Scope" },
        { key: "description", header: "Description" },
      ]);
    });
@@ -65,11 +47,8 @@ export function registerContexts(program) {
    .command("add <name>")
    .description("Add a new context")
    .requiredOption("--url <u>", "Base URL")
-    .option("--api-key <k>", "Legacy inference API key")
+    .option("--api-key <k>", "API key")
    .option("--api-key-stdin", "Read API key from stdin")
-    .option("--access-token <t>", "Scoped CLI access token (preferred over --api-key)")
-    .option("--access-token-stdin", "Read access token from stdin")
-    .option("--scope <s>", "Token scope hint for display (read|write|admin)")
    .option("--description <d>", "Context description")
    .action(async (name, opts) => {
      const cfg = loadContexts();
@@ -78,20 +57,15 @@ export function registerContexts(program) {
        process.exit(2);
      }
      let apiKey = opts.apiKey || null;
-      let accessToken = opts.accessToken || null;
-      if (opts.apiKeyStdin || opts.accessTokenStdin) {
+      if (opts.apiKeyStdin) {
        const chunks = [];
        for await (const c of process.stdin) chunks.push(c);
-        const value = chunks.join("").trim() || null;
-        if (opts.accessTokenStdin) accessToken = value;
-        else apiKey = value;
+        apiKey = chunks.join("").trim() || null;
      }
      cfg.contexts = cfg.contexts || {};
      cfg.contexts[name] = {
        baseUrl: opts.url,
-        accessToken: accessToken || undefined,
        apiKey,
-        scope: opts.scope || undefined,
        description: opts.description || undefined,
      };
      saveContexts(cfg);
@@ -114,27 +88,10 @@ export function registerContexts(program) {

  ctx
    .command("current")
-    .description("Show the active context (server, auth, scope)")
-    .option("--name-only", "Print just the context name (legacy behavior)")
-    .action((opts, cmd) => {
-      const globalOpts = cmd.optsWithGlobals();
+    .description("Show current active context name")
+    .action(() => {
      const cfg = loadContexts();
-      const name = cfg.currentContext || cfg.activeProfile || "default";
-      if (opts.nameOnly) {
-        process.stdout.write(`${name}\n`);
-        return;
-      }
-      const c = resolveActiveContext(name);
-      emit(
-        {
-          name,
-          baseUrl: c.baseUrl || "",
-          auth: authLabel(c),
-          scope: c.scope || "",
-          description: c.description || "",
-        },
-        globalOpts
-      );
+      process.stdout.write(`${cfg.currentContext || "default"}\n`);
    });

  ctx
@@ -151,9 +108,7 @@ export function registerContexts(program) {
      const display = {
        name,
        baseUrl: c.baseUrl,
-        accessToken: maskKey(c.accessToken),
        apiKey: maskKey(c.apiKey),
-        scope: c.scope,
        description: c.description,
      };
      emit(display, globalOpts);
@@ -217,7 +172,6 @@ export function registerContexts(program) {
      if (opts.noSecrets) {
        for (const c of Object.values(out.contexts || {})) {
          c.apiKey = null;
-          delete c.accessToken;
        }
      }
      const json = JSON.stringify(out, null, 2);
@@ -255,9 +209,7 @@ export function registerContexts(program) {
        const c = raw && typeof raw === "object" ? /** @type {Record<string,unknown>} */ (raw) : {};
        cfg.contexts[name] = {
          baseUrl: typeof c.baseUrl === "string" ? c.baseUrl : "http://localhost:20128",
-          accessToken: typeof c.accessToken === "string" ? c.accessToken : undefined,
          apiKey: typeof c.apiKey === "string" ? c.apiKey : null,
-          scope: typeof c.scope === "string" ? c.scope : undefined,
          description: typeof c.description === "string" ? c.description : undefined,
        };
        count++;
--- a/bin/cli/commands/launch-codex.mjs
+++ b/bin/cli/commands/launch-codex.mjs
@@ -1,180 +0,0 @@
-import { spawn } from "node:child_process";
-import { t } from "../i18n.mjs";
-import { resolveActiveContext } from "../contexts.mjs";
-
-/** OpenAI/Codex env keys stripped from the child so a stale OpenAI key/base-url
- *  in the shell can't shadow the omniroute provider (defense-in-depth). Mirrors
- *  free-claude-code's codex adapter. NOTE: this does NOT silence codex's
- *  `refresh_token` log noise — that comes from a stored OpenAI session in
- *  ~/.codex/auth.json, not the env; it is cosmetic and does not block requests. */
-const STRIPPED_CODEX_ENV_KEYS = [
-  "OPENAI_API_KEY",
-  "OPENAI_BASE_URL",
-  "OPENAI_API_BASE",
-  "OPENAI_ORG_ID",
-  "OPENAI_ORGANIZATION",
-  "CODEX_API_KEY",
-];
-
-/** Placeholder so codex's `env_key` is always satisfied when the backend is open. */
-const NO_AUTH_SENTINEL = "omniroute-no-auth";
-
-function stripTrailingSlash(value) {
-  let s = String(value);
-  let end = s.length;
-  while (end > 0 && s.charCodeAt(end - 1) === 47) end--;
-  return end === s.length ? s : s.slice(0, end);
-}
-
-/** TOML assignment for a `-c key=value` codex flag (strings get quoted). */
-function tomlAssign(key, value) {
-  if (typeof value === "boolean" || typeof value === "number") return `${key}=${value}`;
-  return `${key}=${JSON.stringify(String(value))}`;
-}
-
-/**
- * Resolve the OmniRoute root base URL + auth for codex, honouring (in order):
- * explicit flags → active context (remote mode) → localhost:<port>.
- * @returns {{ baseUrl:string, authToken:string|undefined }}
- */
-export function resolveCodexTarget(opts = {}) {
-  const explicit = opts.remote ?? opts.baseUrl;
-  let baseUrl;
-  if (explicit) {
-    baseUrl = stripTrailingSlash(explicit).replace(/\/v1$/, "");
-  } else {
-    let fromCtx;
-    try {
-      fromCtx = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT)?.baseUrl;
-    } catch {
-      /* no context */
-    }
-    baseUrl = fromCtx
-      ? stripTrailingSlash(fromCtx).replace(/\/v1$/, "")
-      : `http://localhost:${Number(opts.port ?? process.env.PORT ?? 20128) || 20128}`;
-  }
-
-  let authToken = opts.apiKey ?? opts["api-key"];
-  if (!authToken) {
-    try {
-      const ctx = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT);
-      authToken = ctx?.accessToken || ctx?.apiKey || undefined;
-    } catch {
-      /* no context auth */
-    }
-  }
-  if (!authToken) authToken = process.env.OMNIROUTE_API_KEY;
-  return { baseUrl, authToken };
-}
-
-/** Health-check an OmniRoute root URL before launching Codex. */
-async function healthCheck(baseUrl, timeoutMs = 3000) {
-  try {
-    const res = await fetch(`${baseUrl}/api/monitoring/health`, {
-      signal: AbortSignal.timeout(timeoutMs),
-    });
-    return res.ok;
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Build the env for the Codex child: strip stale OpenAI/Codex creds, then set
- * OMNIROUTE_API_KEY (the provider env_key) to the resolved token or a sentinel.
- * @param {Record<string,string>} baseEnv
- * @param {string|undefined} authToken
- * @returns {Record<string,string>}
- */
-export function buildCodexEnv(baseEnv, authToken) {
-  const env = { ...baseEnv };
-  for (const key of STRIPPED_CODEX_ENV_KEYS) delete env[key];
-  env.OMNIROUTE_API_KEY = (authToken && String(authToken).trim()) || NO_AUTH_SENTINEL;
-  return env;
-}
-
-/**
- * Codex `-c` flags that define the `omniroute` provider inline, so launch works
- * WITHOUT a pre-existing ~/.codex/config.toml. Mirrors free-claude-code.
- * @param {string} baseUrl  OmniRoute root URL (no /v1)
- * @returns {string[]}
- */
-export function buildCodexProviderArgs(baseUrl) {
-  return [
-    "-c",
-    tomlAssign("model_provider", "omniroute"),
-    "-c",
-    tomlAssign("model_providers.omniroute.name", "OmniRoute"),
-    "-c",
-    tomlAssign("model_providers.omniroute.base_url", `${baseUrl}/v1`),
-    "-c",
-    tomlAssign("model_providers.omniroute.env_key", "OMNIROUTE_API_KEY"),
-    "-c",
-    tomlAssign("model_providers.omniroute.wire_api", "responses"),
-    "-c",
-    tomlAssign("model_providers.omniroute.requires_openai_auth", false),
-  ];
-}
-
-/**
- * @param {{port?:string, remote?:string, profile?:string, apiKey?:string}} opts
- * @param {string[]} codexArgs  pass-through args for the codex binary
- * @returns {Promise<number>} exit code
- */
-export async function runLaunchCodexCommand(opts = {}, codexArgs = []) {
-  const { baseUrl, authToken } = resolveCodexTarget(opts);
-
-  if (!(await healthCheck(baseUrl))) {
-    console.error(
-      (t("launch.notRunning") || "OmniRoute is not reachable at {port}. Start it with 'omniroute serve'.").replace(
-        "{port}",
-        baseUrl
-      )
-    );
-    return 1;
-  }
-
-  // Provider injected via -c (works without config.toml); then the profile (model),
-  // then the user's pass-through args.
-  const providerArgs = buildCodexProviderArgs(baseUrl);
-  const profileArgs = opts.profile ? ["--profile", opts.profile] : [];
-  const extraArgs = [...providerArgs, ...profileArgs, ...codexArgs];
-  const env = buildCodexEnv(process.env, authToken);
-
-  return await new Promise((resolve) => {
-    const child = spawn("codex", extraArgs, { env, stdio: "inherit" });
-    child.on("error", (err) => {
-      if (err?.code === "ENOENT") {
-        console.error(
-          "The 'codex' CLI was not found in PATH. Install with:\n  npm install -g @openai/codex"
-        );
-        resolve(127);
-      } else {
-        console.error(String(err?.message || err));
-        resolve(1);
-      }
-    });
-    child.on("exit", (code) => resolve(code ?? 0));
-  });
-}
-
-export function registerLaunchCodex(program) {
-  program
-    .command("launch-codex")
-    .description(
-      t("launchCodex.description") || "Launch Codex CLI pointed at OmniRoute (local or remote VPS)"
-    )
-    .option("--port <port>", "Local OmniRoute port (ignored when --remote is set)", "20128")
-    .option("--remote <url>", "Remote OmniRoute base URL, e.g. http://192.168.0.15:20128 (overrides --port + context)")
-    .option("--profile <name>", "Codex profile to activate (passed as --profile <name>)")
-    .option("-p, --p <name>", "Alias for --profile")
-    .option("--api-key <key>", "OmniRoute API key (overrides OMNIROUTE_API_KEY env var for this invocation)")
-    .allowUnknownOption(true)
-    .allowExcessArguments(true)
-    .argument("[codexArgs...]", "arguments passed through to the codex binary")
-    .action(async (codexArgs, opts) => {
-      const merged = { ...opts, profile: opts.profile ?? opts.p };
-      const exitCode = await runLaunchCodexCommand(merged, codexArgs ?? []);
-      if (exitCode !== 0) process.exit(exitCode);
-    });
-}
--- a/bin/cli/commands/launch.mjs
+++ b/bin/cli/commands/launch.mjs
@@ -1,155 +0,0 @@
-import { spawn } from "node:child_process";
-import { join } from "node:path";
-import os from "node:os";
-import { t } from "../i18n.mjs";
-import { resolveActiveContext } from "../contexts.mjs";
-
-function stripTrailingSlash(value) {
-  let s = String(value);
-  let end = s.length;
-  while (end > 0 && s.charCodeAt(end - 1) === 47) end--;
-  return end === s.length ? s : s.slice(0, end);
-}
-
-/**
- * Build a clean child env for Claude Code pointed at OmniRoute.
- *
- * Strips inherited ANTHROPIC_* (avoids a stale shell token leaking through), then
- * injects the base URL, gateway model discovery, and auto-compact window.
- *
- * @param {Record<string,string>} baseEnv
- * @param {number|string} baseUrlOrPort  a port (→ http://localhost:<port>) or a full base URL
- * @param {string|undefined} authToken
- * @param {{ configDir?:string, model?:string }} [opts]
- * @returns {Record<string,string>}
- */
-export function buildClaudeEnv(baseEnv, baseUrlOrPort, authToken, opts = {}) {
-  const env = { ...baseEnv };
-  for (const key of Object.keys(env)) {
-    if (key.startsWith("ANTHROPIC_")) delete env[key];
-  }
-
-  // Accept a bare port (number/numeric string → localhost) or a full base URL.
-  // Claude Code wants the ROOT URL (it appends /v1/messages itself) — no /v1 here.
-  let baseUrl;
-  if (typeof baseUrlOrPort === "number" || /^\d+$/.test(String(baseUrlOrPort))) {
-    baseUrl = `http://localhost:${Number(baseUrlOrPort) || 20128}`;
-  } else {
-    baseUrl = stripTrailingSlash(String(baseUrlOrPort)).replace(/\/v1$/, "");
-  }
-
-  env.ANTHROPIC_BASE_URL = baseUrl;
-  // Always set a token: when none is resolved, a sentinel keeps newer Claude Code
-  // from stopping at its local login gate before it ever contacts OmniRoute (an
-  // open backend ignores the value). Mirrors free-claude-code. ANTHROPIC_API_KEY
-  // stays stripped (above) so it can't shadow the Bearer token.
-  env.ANTHROPIC_AUTH_TOKEN = (authToken && String(authToken).trim()) || "omniroute-no-auth";
-  env.CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY = "1";
-  env.CLAUDE_CODE_AUTO_COMPACT_WINDOW = "190000";
-  // Profile isolation (Claude Code has no native profiles — CLAUDE_CONFIG_DIR is
-  // the idiomatic mechanism: separate settings/credentials/history/cache per dir).
-  if (opts.configDir) env.CLAUDE_CONFIG_DIR = opts.configDir;
-  if (opts.model) env.ANTHROPIC_MODEL = opts.model;
-  return env;
-}
-
-/**
- * Resolve the OmniRoute base URL + auth for launch, honouring (in order):
- * explicit flags → the active context (remote mode) → localhost:<port>.
- * @param {{port?:string, remote?:string, baseUrl?:string, token?:string, apiKey?:string, context?:string}} opts
- * @returns {{ baseUrl:string, authToken:string|undefined }}
- */
-export function resolveLaunchTarget(opts = {}) {
-  const explicit = opts.remote ?? opts.baseUrl;
-  let baseUrl;
-  if (explicit) {
-    baseUrl = stripTrailingSlash(explicit).replace(/\/v1$/, "");
-  } else {
-    let fromCtx;
-    try {
-      const ctx = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT);
-      fromCtx = ctx?.baseUrl;
-    } catch {
-      /* no context */
-    }
-    baseUrl = fromCtx
-      ? stripTrailingSlash(fromCtx).replace(/\/v1$/, "")
-      : `http://localhost:${Number(opts.port ?? process.env.PORT ?? 20128) || 20128}`;
-  }
-
-  let authToken = opts.token ?? opts.apiKey ?? opts["api-key"];
-  if (!authToken) {
-    try {
-      const ctx = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT);
-      authToken = ctx?.accessToken || ctx?.apiKey || undefined;
-    } catch {
-      /* no context auth */
-    }
-  }
-  if (!authToken) authToken = process.env.ANTHROPIC_AUTH_TOKEN ?? process.env.OMNIROUTE_API_KEY;
-  return { baseUrl, authToken };
-}
-
-/**
- * @param {{port?:string, remote?:string, token?:string, apiKey?:string, profile?:string, claudeHome?:string}} opts
- * @param {string[]} claudeArgs  pass-through args for the claude binary
- * @returns {Promise<number>} exit code
- */
-export async function runLaunchCommand(opts = {}, claudeArgs = []) {
-  const { baseUrl, authToken } = resolveLaunchTarget(opts);
-
-  // Health check the (possibly remote) proxy before launching.
-  try {
-    const res = await fetch(`${baseUrl}/api/monitoring/health`, {
-      signal: AbortSignal.timeout(3000),
-    });
-    if (!res.ok) throw new Error(`status ${res.status}`);
-  } catch {
-    console.error(
-      (t("launch.notRunning") || "OmniRoute is not reachable at {port}. Start it with 'omniroute serve'.").replace(
-        "{port}",
-        baseUrl
-      )
-    );
-    return 1;
-  }
-
-  const configDir = opts.profile
-    ? join(opts.claudeHome || join(os.homedir(), ".claude"), "profiles", opts.profile)
-    : undefined;
-  const env = buildClaudeEnv(process.env, baseUrl, authToken, { configDir });
-
-  return await new Promise((resolve) => {
-    const child = spawn("claude", claudeArgs, { env, stdio: "inherit" });
-    child.on("error", (err) => {
-      if (err && err.code === "ENOENT") {
-        console.error(t("launch.notFound") || "The 'claude' CLI was not found in PATH.");
-        resolve(127);
-      } else {
-        console.error(String(err?.message || err));
-        resolve(1);
-      }
-    });
-    child.on("exit", (code) => resolve(code ?? 0));
-  });
-}
-
-export function registerLaunch(program) {
-  program
-    .command("launch")
-    .description(
-      t("launch.description") || "Launch Claude Code pointed at OmniRoute (local or remote)"
-    )
-    .option("--port <port>", t("serve.port") || "Proxy port", "20128")
-    .option("--remote <url>", "Remote OmniRoute base URL (overrides --port and the active context)")
-    .option("--profile <name>", "Claude Code profile to use (CLAUDE_CONFIG_DIR ~/.claude/profiles/<name>)")
-    .option("--token <token>", t("launch.token") || "Token Claude sends (ANTHROPIC_AUTH_TOKEN)")
-    .option("--api-key <key>", "Alias for --token (OmniRoute access token / API key)")
-    .allowUnknownOption(true)
-    .allowExcessArguments(true)
-    .argument("[claudeArgs...]", "arguments passed through to the claude binary")
-    .action(async (claudeArgs, opts) => {
-      const exitCode = await runLaunchCommand(opts, claudeArgs ?? []);
-      if (exitCode !== 0) process.exit(exitCode);
-    });
-}
--- a/bin/cli/commands/login.mjs
+++ b/bin/cli/commands/login.mjs
@@ -1,192 +0,0 @@
-import { createServer } from "node:http";
-import { randomUUID } from "node:crypto";
-
-/**
- * `omniroute login antigravity` — local OAuth helper for remote installs.
- *
- * Why this exists: Google's `firstparty/nativeapp` consent for the embedded
- * Antigravity desktop client only releases the authorization code when the
- * loopback redirect (127.0.0.1:<port>) is REACHABLE. On a remote VPS install the
- * loopback is unreachable, so the consent hangs forever and never emits a code —
- * the dashboard's "paste the callback URL" fallback has nothing to paste. (The
- * same flow works locally and over an SSH tunnel, where the loopback IS reachable.)
- *
- * This command runs the OAuth on the user's OWN machine — where 127.0.0.1 works —
- * captures the code on a local loopback server, exchanges it for tokens, and
- * prints a single-line credential blob. The user pastes that blob into the remote
- * dashboard (Antigravity → "Paste credentials"), which decodes it, finalizes the
- * onboarding server-side, and persists the connection.
- *
- * It talks ONLY to Google (no OmniRoute server needed locally), so it works even
- * if the remote VPS is firewalled from the user's machine.
- */
-
-const PROVIDER = "antigravity";
-
-/** Open the system browser; no-op if the optional `open` dependency is missing. */
-async function defaultOpenBrowser(url) {
-  try {
-    const { default: open } = await import("open");
-    await open(url);
-  } catch {
-    // `open` not available — the caller already printed the URL to paste manually.
-  }
-}
-
-/**
- * Start a loopback HTTP server bound to 127.0.0.1 (NOT 0.0.0.0 — we never want to
- * expose the callback to the LAN). Resolves to { port, waitForCallback, close }.
- */
-function defaultStartServer(preferredPort) {
-  return new Promise((resolve, reject) => {
-    let resolveCallback;
-    const callbackPromise = new Promise((r) => {
-      resolveCallback = r;
-    });
-
-    const server = createServer((req, res) => {
-      const url = new URL(req.url, "http://127.0.0.1");
-      if (url.pathname !== "/callback" && url.pathname !== "/auth/callback") {
-        res.writeHead(404).end();
-        return;
-      }
-      const params = Object.fromEntries(url.searchParams.entries());
-      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      res.end(
-        "<!doctype html><meta charset=utf-8><title>OmniRoute</title>" +
-          "<body style=\"font-family:system-ui;padding:2rem\">" +
-          "<h2>✅ Authorization received</h2>" +
-          "<p>Return to your terminal — you can close this tab.</p></body>"
-      );
-      resolveCallback(params);
-    });
-
-    server.on("error", reject);
-    server.listen(preferredPort || 0, "127.0.0.1", () => {
-      const { port } = server.address();
-      resolve({
-        port,
-        waitForCallback: () => callbackPromise,
-        close: () => new Promise((r) => server.close(() => r())),
-      });
-    });
-  });
-}
-
-/** Lazy-load the antigravity provider + blob codec (TS source via tsx). */
-async function loadDeps() {
-  const { antigravity } = await import("../../../src/lib/oauth/providers/antigravity.ts");
-  const { encodeCredentialBlob } = await import("../../../src/lib/oauth/credentialBlob.ts");
-  return { antigravity, encodeCredentialBlob };
-}
-
-/**
- * Build the Google authorization request for a given loopback port. Uses a plain
- * authorization_code grant (NO PKCE code_challenge) — matching the working flow:
- * a code_challenge here would force the exchange to require a code_verifier.
- */
-export async function buildAntigravityAuthRequest(port, makeState = randomUUID) {
-  const { antigravity } = await loadDeps();
-  const redirectUri = `http://127.0.0.1:${port}/callback`;
-  const state = makeState();
-  const authUrl = antigravity.buildAuthUrl(antigravity.config, redirectUri, state);
-  return { redirectUri, state, authUrl };
-}
-
-/** Exchange the captured code for raw Google tokens (no code_verifier — no PKCE). */
-export async function exchangeAntigravityCode(code, redirectUri) {
-  const { antigravity } = await loadDeps();
-  return antigravity.exchangeToken(antigravity.config, code, redirectUri);
-}
-
-/**
- * Orchestrate the local login. Dependencies are injectable for testing; the real
- * path uses a 127.0.0.1 loopback server, the system browser, and a live token
- * exchange against Google. Returns the credential blob string.
- */
-export async function runAntigravityLogin(opts = {}, deps = {}) {
-  const startServer = deps.startServer ?? defaultStartServer;
-  const openBrowser = deps.openBrowser ?? defaultOpenBrowser;
-  const exchange = deps.exchange ?? exchangeAntigravityCode;
-  const makeState = deps.makeState ?? randomUUID;
-  const print = deps.print ?? ((s) => process.stdout.write(s));
-  const log = deps.log ?? ((s) => process.stderr.write(s));
-  const { encodeCredentialBlob } = await loadDeps();
-
-  const server = await startServer(opts.port);
-  const { redirectUri, state, authUrl } = await buildAntigravityAuthRequest(server.port, makeState);
-
-  log(`\nOpen this URL to authorize Antigravity (it will open automatically):\n\n  ${authUrl}\n\n`);
-  if (opts.browser !== false) await openBrowser(authUrl);
-  log("Waiting for Google to redirect back to the local loopback...\n");
-
-  const timeoutMs = opts.timeout ?? 300000;
-  let timer;
-  let params;
-  try {
-    params = await Promise.race([
-      server.waitForCallback(),
-      new Promise((_, reject) => {
-        timer = setTimeout(
-          () => reject(new Error("Timed out waiting for the OAuth callback")),
-          timeoutMs
-        );
-        // Don't keep the event loop alive solely for this timer.
-        if (typeof timer.unref === "function") timer.unref();
-      }),
-    ]);
-  } finally {
-    clearTimeout(timer);
-    await server.close();
-  }
-
-  if (params.error) {
-    throw new Error(`Authorization failed: ${params.error_description || params.error}`);
-  }
-  if (params.state !== state) {
-    throw new Error("State mismatch — aborting (possible CSRF). Please retry the login.");
-  }
-  if (!params.code) {
-    throw new Error("No authorization code returned by Google.");
-  }
-
-  const tokens = await exchange(params.code, redirectUri);
-  const blob = encodeCredentialBlob({ provider: PROVIDER, tokens });
-
-  print(
-    "\n" +
-      "Antigravity authorized. Copy the line below and paste it into your remote\n" +
-      "OmniRoute dashboard: Providers → Antigravity → Connect → \"Paste credentials\".\n" +
-      "(This contains a refresh token — treat it like a password.)\n\n" +
-      blob +
-      "\n\n"
-  );
-  return blob;
-}
-
-async function runLoginAntigravity(opts) {
-  try {
-    await runAntigravityLogin({
-      browser: opts.browser,
-      timeout: opts.timeout,
-      port: opts.port,
-    });
-  } catch (err) {
-    process.stderr.write(`\nLogin failed: ${err?.message || err}\n`);
-    process.exit(1);
-  }
-}
-
-export function registerLogin(program) {
-  const login = program
-    .command("login")
-    .description("Local OAuth helpers for remote OmniRoute installs (run on your own machine)");
-
-  login
-    .command("antigravity")
-    .description("Authorize Antigravity locally and print a credential blob to paste remotely")
-    .option("--no-browser", "Do not auto-open the browser; print the URL instead")
-    .option("--port <n>", "Fixed loopback port (default: OS-assigned)", (v) => parseInt(v, 10))
-    .option("--timeout <ms>", "How long to wait for the callback", (v) => parseInt(v, 10), 300000)
-    .action(runLoginAntigravity);
-}
--- a/bin/cli/commands/logs.mjs
+++ b/bin/cli/commands/logs.mjs
@@ -1,6 +1,5 @@
 import { writeFileSync, appendFileSync, existsSync, unlinkSync } from "node:fs";
 import { t } from "../i18n.mjs";
-import { getBaseUrl, buildHeaders } from "../api.mjs";

 export function registerLogs(program) {
  program
@@ -10,7 +9,7 @@ export function registerLogs(program) {
    .option("--filter <level>", t("logs.filter"))
    .option("--lines <n>", t("logs.lines"), "100")
    .option("--timeout <ms>", t("logs.timeout"), "30000")
-    .option("--base-url <url>", t("logs.baseUrl"))
+    .option("--base-url <url>", t("logs.baseUrl"), "http://localhost:20128")
    .option("--request-id <id>", t("logs.requestId"))
    .option("--api-key <key>", t("logs.apiKey"))
    .option("--combo <name>", t("logs.combo"))
@@ -20,14 +19,7 @@ export function registerLogs(program) {
    .option("--export <path>", t("logs.export"))
    .action(async (opts, cmd) => {
      const globalOpts = cmd.optsWithGlobals();
-      // `--context` and `--output` are global options, so forward them explicitly:
-      // runLogsCommand resolves the base URL via getBaseUrl({ context }), and without
-      // this a user's `--context` would be silently dropped.
-      const exitCode = await runLogsCommand({
-        ...opts,
-        context: globalOpts.context,
-        output: globalOpts.output,
-      });
+      const exitCode = await runLogsCommand({ ...opts, output: globalOpts.output });
      if (exitCode !== 0) process.exit(exitCode);
    });
 }
@@ -75,10 +67,7 @@ function buildLogFilter(opts) {
 }

 export async function runLogsCommand(opts = {}) {
-  // Resolve the base URL the same way every other CLI command does: an explicit
-  // --base-url wins, otherwise fall back to the active context / env / localhost.
-  // Without this, `logs` always hit localhost and ignored a connected remote.
-  const baseUrl = opts.baseUrl || opts["base-url"] || getBaseUrl({ context: opts.context });
+  const baseUrl = opts.baseUrl || opts["base-url"] || "http://localhost:20128";
  const follow = opts.follow ?? false;
  const timeout = parseInt(String(opts.timeout || "30000"), 10);
  const isJson = opts.output === "json";
@@ -93,21 +82,8 @@ export async function runLogsCommand(opts = {}) {
  // Pass only level filters to the stream (server-side); other filters are client-side
  const levelFilters = opts.filter ? opts.filter.split(",").map((f) => f.trim()) : [];

-  // Authenticate the log stream. The /api/cli-tools/logs endpoint requires the
-  // management token; build the same headers (scoped context token + CLI token)
-  // that apiFetch uses, so `logs` works against authenticated/remote servers.
-  // NOTE: --api-key here is a client-side log *filter* (see buildLogFilter), not
-  // an auth credential, so it is deliberately not forwarded to buildHeaders.
-  const headers = await buildHeaders({ baseUrl, context: opts.context });
-
  const { createLogStream } = await import("../../../src/lib/cli-helper/log-streamer.js");
-  const { stream, stop } = createLogStream({
-    baseUrl,
-    filters: levelFilters,
-    follow,
-    timeout,
-    headers,
-  });
+  const { stream, stop } = createLogStream({ baseUrl, filters: levelFilters, follow, timeout });

  const reader = stream.getReader();
  const decoder = new TextDecoder();
--- a/bin/cli/commands/redis.mjs
+++ b/bin/cli/commands/redis.mjs
@@ -1,294 +0,0 @@
-import { spawn } from "node:child_process";
-import { promisify } from "node:util";
-import { execFile as execFileCb } from "node:child_process";
-
-import { t } from "../i18n.mjs";
-
-const execFile = promisify(execFileCb);
-
-const DEFAULT_IMAGE = "docker.io/redis:7-alpine";
-const DEFAULT_NAME = "omniroute-redis";
-const DEFAULT_PORT = "6379";
-const DEFAULT_VOLUME = "omniroute-redis-data";
-
-const RUNTIME_PREFERENCE = ["podman", "docker"];
-
-async function detectRuntime() {
-  for (const candidate of RUNTIME_PREFERENCE) {
-    try {
-      await execFile(candidate, ["--version"], { timeout: 3000 });
-      return candidate;
-    } catch {
-      // try next candidate
-    }
-  }
-  return null;
-}
-
-async function containerExists(runtime, name) {
-  try {
-    const { stdout } = await execFile(runtime, ["ps", "-a", "--filter", `name=^${name}$`, "--format", "{{.Names}}"]);
-    return stdout.trim() === name;
-  } catch {
-    return false;
-  }
-}
-
-async function containerRunning(runtime, name) {
-  try {
-    const { stdout } = await execFile(runtime, ["ps", "--filter", `name=^${name}$`, "--format", "{{.Names}}"]);
-    return stdout.trim() === name;
-  } catch {
-    return false;
-  }
-}
-
-async function pingRedis(port) {
-  // Minimal TCP probe via /dev/tcp — works in bash/zsh but Node has no
-  // native equivalent, so spawn a short-lived `redis-cli` if available,
-  // otherwise fall back to a raw socket connect.
-  return new Promise((resolve) => {
-    import("node:net").then(({ createConnection }) => {
-      const socket = createConnection({ port: Number(port), host: "127.0.0.1" });
-      const timeout = setTimeout(() => {
-        socket.destroy();
-        resolve(false);
-      }, 1500);
-      socket.once("connect", () => {
-        clearTimeout(timeout);
-        socket.end();
-        resolve(true);
-      });
-      socket.once("error", () => {
-        clearTimeout(timeout);
-        resolve(false);
-      });
-    });
-  });
-}
-
-function colorize(text, code) {
-  if (process.stdout.isTTY === false) return text;
-  return `\x1b[${code}m${text}\x1b[0m`;
-}
-
-function info(msg) {
-  console.log(colorize("•", "36") + " " + msg);
-}
-
-function success(msg) {
-  console.log(colorize("✓", "32") + " " + msg);
-}
-
-function warn(msg) {
-  console.error(colorize("!", "33") + " " + msg);
-}
-
-function fail(msg) {
-  console.error(colorize("✗", "31") + " " + msg);
-}
-
-export function registerRedis(program) {
-  const redis = program
-    .command("redis")
-    .description(
-      t("redis.description") ||
-        "Launch a 1-click local Redis container (Podman or Docker) for OmniRoute caching and quota tracking"
-    );
-
-  redis
-    .command("up")
-    .description("Start the local Redis container")
-    .option("-p, --port <port>", "Host port to expose", DEFAULT_PORT)
-    .option("-n, --name <name>", "Container name", DEFAULT_NAME)
-    .option("-i, --image <image>", "Container image", DEFAULT_IMAGE)
-    .option("--no-pull", "Skip pulling the image if it is missing")
-    .option("--runtime <runtime>", "Force a specific runtime (podman|docker)")
-    .option("--password <password>", "Set a Redis password (AUTH)")
-    .action(async (opts, cmd) => {
-      const globalOpts = cmd.parent.optsWithGlobals();
-      const exitCode = await runRedisUpCommand({ ...opts, output: globalOpts.output });
-      if (exitCode !== 0) process.exit(exitCode);
-    });
-
-  redis
-    .command("down")
-    .description("Stop and remove the local Redis container")
-    .option("-n, --name <name>", "Container name", DEFAULT_NAME)
-    .option("--keep-data", "Keep the named volume for next start")
-    .option("--runtime <runtime>", "Force a specific runtime (podman|docker)")
-    .action(async (opts, cmd) => {
-      const globalOpts = cmd.parent.optsWithGlobals();
-      const exitCode = await runRedisDownCommand({ ...opts, output: globalOpts.output });
-      if (exitCode !== 0) process.exit(exitCode);
-    });
-
-  redis
-    .command("status")
-    .description("Show status of the local Redis container")
-    .option("-n, --name <name>", "Container name", DEFAULT_NAME)
-    .option("-p, --port <port>", "Host port", DEFAULT_PORT)
-    .option("--runtime <runtime>", "Force a specific runtime (podman|docker)")
-    .action(async (opts, cmd) => {
-      const globalOpts = cmd.parent.optsWithGlobals();
-      const exitCode = await runRedisStatusCommand({ ...opts, output: globalOpts.output });
-      if (exitCode !== 0) process.exit(exitCode);
-    });
-}
-
-async function pickRuntime(forced) {
-  if (forced) {
-    try {
-      await execFile(forced, ["--version"], { timeout: 3000 });
-      return forced;
-    } catch (err) {
-      fail(`Forced runtime '${forced}' not available: ${err.message}`);
-      return null;
-    }
-  }
-  const detected = await detectRuntime();
-  if (!detected) {
-    fail("Neither podman nor docker found on PATH. Install one or pass --runtime.");
-    return null;
-  }
-  return detected;
-}
-
-export async function runRedisUpCommand(opts = {}) {
-  const runtime = await pickRuntime(opts.runtime);
-  if (!runtime) return 1;
-
-  const name = opts.name || DEFAULT_NAME;
-  const port = opts.port || DEFAULT_PORT;
-  const image = opts.image || DEFAULT_IMAGE;
-
-  const exists = await containerExists(runtime, name);
-  const running = exists && (await containerRunning(runtime, name));
-
-  if (running) {
-    success(`Container '${name}' is already running on port ${port}.`);
-    return 0;
-  }
-
-  if (exists && !opts.pull) {
-    info(`Starting existing container '${name}'…`);
-    try {
-      await execFile(runtime, ["start", name]);
-      success(`Container '${name}' started on port ${port}.`);
-      return 0;
-    } catch (err) {
-      fail(`Failed to start existing container: ${err.message}`);
-      return 1;
-    }
-  }
-
-  if (!opts.pull) {
-    info(`Checking if image '${image}' is present locally…`);
-    let present = false;
-    try {
-      const { stdout } = await execFile(runtime, ["images", "--format", "{{.Repository}}:{{.Tag}}"]);
-      present = stdout.split("\n").some((line) => line.trim() === image);
-    } catch {
-      // ignore — fall through to pull
-    }
-    if (!present) {
-      info(`Image not found locally — pulling '${image}'…`);
-      try {
-        await execFile(runtime, ["pull", image]);
-      } catch (err) {
-        fail(`Failed to pull image: ${err.message}`);
-        return 1;
-      }
-    }
-  }
-
-  const args = [
-    "run",
-    "-d",
-    "--name", name,
-    "--restart", "unless-stopped",
-    "-p", `${port}:6379`,
-    "-v", `${DEFAULT_VOLUME}:/data`,
-  ];
-  if (opts.password) {
-    args.push("-e", `REDIS_PASSWORD=${opts.password}`);
-  }
-  args.push(image, "redis-server", "--appendonly", "yes");
-  if (opts.password) args.push("--requirepass", opts.password);
-
-  info(`Launching ${runtime} run ${args.join(" ")}`);
-  try {
-    await execFile(runtime, args);
-    success(`Container '${name}' is now running on redis://127.0.0.1:${port}`);
-    info(`Set OMNIROUTE_REDIS_URL=redis://127.0.0.1:${port} in your .env to wire OmniRoute to it.`);
-    return 0;
-  } catch (err) {
-    fail(`Failed to launch container: ${err.message}`);
-    return 1;
-  }
-}
-
-export async function runRedisDownCommand(opts = {}) {
-  const runtime = await pickRuntime(opts.runtime);
-  if (!runtime) return 1;
-
-  const name = opts.name || DEFAULT_NAME;
-
-  if (!(await containerExists(runtime, name))) {
-    info(`Container '${name}' does not exist — nothing to do.`);
-    return 0;
-  }
-
-  try {
-    await execFile(runtime, ["rm", "-f", name]);
-    success(`Removed container '${name}'.`);
-  } catch (err) {
-    fail(`Failed to remove container: ${err.message}`);
-    return 1;
-  }
-
-  if (!opts.keepData) {
-    try {
-      await execFile(runtime, ["volume", "rm", DEFAULT_VOLUME]);
-      success(`Removed volume '${DEFAULT_VOLUME}'.`);
-    } catch (err) {
-      warn(`Could not remove volume '${DEFAULT_VOLUME}': ${err.message}`);
-    }
-  }
-  return 0;
-}
-
-export async function runRedisStatusCommand(opts = {}) {
-  const runtime = await pickRuntime(opts.runtime);
-  if (!runtime) return 1;
-
-  const name = opts.name || DEFAULT_NAME;
-  const port = opts.port || DEFAULT_PORT;
-
-  const exists = await containerExists(runtime, name);
-  if (!exists) {
-    console.log(JSON.stringify({ runtime, name, port, exists: false, running: false, reachable: false }, null, 2));
-    return 0;
-  }
-
-  const running = await containerRunning(runtime, name);
-  const reachable = running ? await pingRedis(port) : false;
-
-  if (opts.json || opts.output === "json") {
-    console.log(JSON.stringify({ runtime, name, port, exists, running, reachable }, null, 2));
-    return 0;
-  }
-
-  console.log(`\n\x1b[1m\x1b[36mRedis (${runtime})\x1b[0m\n`);
-  console.log(`  Container:   ${name}`);
-  console.log(`  Exists:      ${exists ? "yes" : "no"}`);
-  console.log(`  Running:     ${running ? "yes" : "no"}`);
-  console.log(`  Reachable:   ${reachable ? "yes" : "no"} (port ${port})`);
-  if (running && !reachable) {
-    warn("Container is running but the port is not reachable. Is REDIS_PASSWORD set or another process bound?");
-  }
-  if (!running) {
-    info(`Run 'omniroute redis up' to launch it.`);
-  }
-  return 0;
-}
--- a/bin/cli/commands/registry.mjs
+++ b/bin/cli/commands/registry.mjs
@@ -2,7 +2,6 @@ import { registerMemory } from "./memory.mjs";
 import { registerSkills } from "./skills.mjs";
 import { registerAudit } from "./audit.mjs";
 import { registerOAuth } from "./oauth.mjs";
-import { registerLogin } from "./login.mjs";
 import { registerCloud } from "./cloud.mjs";
 import { registerEval } from "./eval.mjs";
 import { registerWebhooks } from "./webhooks.mjs";
@@ -46,7 +45,6 @@ import { registerBackup, registerRestore } from "./backup.mjs";
 import { registerHealth } from "./health.mjs";
 import { registerQuota } from "./quota.mjs";
 import { registerCache } from "./cache.mjs";
-import { registerRedis } from "./redis.mjs";
 import { registerMcp } from "./mcp.mjs";
 import { registerA2a } from "./a2a.mjs";
 import { registerTunnel } from "./tunnel.mjs";
@@ -57,24 +55,6 @@ import { registerRuntime } from "./runtime.mjs";
 import { registerTray } from "./tray.mjs";
 import { registerAutostart } from "./autostart.mjs";
 import { registerRepl } from "./repl.mjs";
-import { registerLaunch } from "./launch.mjs";
-import { registerLaunchCodex } from "./launch-codex.mjs";
-import { registerSetupCodex } from "./setup-codex.mjs";
-import { registerSetupClaude } from "./setup-claude.mjs";
-import { registerSetupOpencode } from "./setup-opencode.mjs";
-import { registerSetupCline } from "./setup-cline.mjs";
-import { registerSetupKilo } from "./setup-kilo.mjs";
-import { registerSetupContinue } from "./setup-continue.mjs";
-import { registerSetupCursor } from "./setup-cursor.mjs";
-import { registerSetupRoo } from "./setup-roo.mjs";
-import { registerSetupCrush } from "./setup-crush.mjs";
-import { registerSetupGoose } from "./setup-goose.mjs";
-import { registerSetupQwen } from "./setup-qwen.mjs";
-import { registerSetupAider } from "./setup-aider.mjs";
-import { registerConnect } from "./connect.mjs";
-import { registerContexts } from "./contexts.mjs";
-import { registerTokens } from "./tokens.mjs";
-import { registerConfigure } from "./configure.mjs";
 import { registerApiCommands } from "../api-commands/registry.mjs";
 import { registerPlugin } from "./plugin.mjs";

@@ -83,7 +63,6 @@ export function registerCommands(program) {
  registerSkills(program);
  registerAudit(program);
  registerOAuth(program);
-  registerLogin(program);
  registerCloud(program);
  registerEval(program);
  registerWebhooks(program);
@@ -128,7 +107,6 @@ export function registerCommands(program) {
  registerHealth(program);
  registerQuota(program);
  registerCache(program);
-  registerRedis(program);
  registerMcp(program);
  registerA2a(program);
  registerTunnel(program);
@@ -139,24 +117,6 @@ export function registerCommands(program) {
  registerTray(program);
  registerAutostart(program);
  registerRepl(program);
-  registerLaunch(program);
-  registerLaunchCodex(program);
-  registerSetupCodex(program);
-  registerSetupClaude(program);
-  registerSetupOpencode(program);
-  registerSetupCline(program);
-  registerSetupKilo(program);
-  registerSetupContinue(program);
-  registerSetupCursor(program);
-  registerSetupRoo(program);
-  registerSetupCrush(program);
-  registerSetupGoose(program);
-  registerSetupQwen(program);
-  registerSetupAider(program);
-  registerConnect(program);
-  registerContexts(program);
-  registerTokens(program);
-  registerConfigure(program);
  registerApiCommands(program);
  registerPlugin(program);
 }
--- a/bin/cli/commands/serve.mjs
+++ b/bin/cli/commands/serve.mjs
@@ -2,24 +2,13 @@ import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
-import { platform, totalmem } from "node:os";
+import { platform } from "node:os";
 import { t } from "../i18n.mjs";
 import { writePidFile, cleanupPidFile, waitForServer } from "../utils/pid.mjs";
 import { ServerSupervisor, detectMitmCrash } from "../runtime/processSupervisor.mjs";
 import { isTermux } from "../../../scripts/build/postinstallSupport.mjs";
-import {
-  resolveMaxOldSpaceMb,
-  calibrateHeapFallbackMb,
-  buildServerNodeOptions,
-  buildNodeHeapArgs,
-} from "../../../scripts/build/runtime-env.mjs";
-import { resolveTlsOptions } from "../../../scripts/dev/tls-options.mjs";

 const __dirname = dirname(fileURLToPath(import.meta.url));
-
-// URL scheme for the "OmniRoute is running" banner — flipped to https when
-// opt-in TLS (#5242) is active. Process-scoped: one `serve` run = one scheme.
-let urlScheme = "http";
 const ROOT = join(__dirname, "..", "..", "..");
 // The standalone bundle ships in `dist/` (since the build-output-isolation
 // refactor). Fall back to the legacy `app/` location so an upgrade over a
@@ -46,14 +35,6 @@ export function registerServe(program) {
    .option("--max-restarts <n>", t("serve.max_restarts"), parseInt, 2)
    .option("--tray", t("serve.tray") || "Show system tray icon (desktop only)")
    .option("--no-tray", t("serve.no_tray") || "Disable system tray icon")
-    .option(
-      "--tls-cert <path>",
-      t("serve.tls_cert") || "Path to a TLS certificate (PEM) to serve HTTPS (also OMNIROUTE_TLS_CERT)"
-    )
-    .option(
-      "--tls-key <path>",
-      t("serve.tls_key") || "Path to the TLS private key (PEM) to serve HTTPS (also OMNIROUTE_TLS_KEY)"
-    )
    .action(async (opts) => {
      await runServe(opts);
    });
@@ -145,18 +126,9 @@ export async function runServe(opts = {}) {

  console.log(`  \x1b[2m⏳ Starting server...\x1b[0m\n`);

-  // #5172/#5160/#5152: default the V8 heap to ~35% of physical RAM (clamped
-  // [512, 4096]) instead of a fixed 512MB, which OOM-crashed boxes with plenty
-  // of RAM under load. An explicit OMNIROUTE_MEMORY_MB still wins.
-  const memoryLimit = resolveMaxOldSpaceMb(
-    process.env.OMNIROUTE_MEMORY_MB,
-    calibrateHeapFallbackMb(totalmem())
-  );
-
-  // #5242: opt-in native HTTPS. CLI flags take precedence over env; the child
-  // server (server-ws.mjs) reads these and terminates TLS on the same listener.
-  const tlsCert = opts.tlsCert ?? process.env.OMNIROUTE_TLS_CERT;
-  const tlsKey = opts.tlsKey ?? process.env.OMNIROUTE_TLS_KEY;
+  const rawMemory = parseInt(process.env.OMNIROUTE_MEMORY_MB || "512", 10);
+  const memoryLimit =
+    Number.isFinite(rawMemory) && rawMemory >= 64 && rawMemory <= 16384 ? rawMemory : 512;

  const env = {
    ...process.env,
@@ -164,21 +136,11 @@ export async function runServe(opts = {}) {
    PORT: String(dashboardPort),
    DASHBOARD_PORT: String(dashboardPort),
    API_PORT: String(apiPort),
-    HOSTNAME: process.env.HOSTNAME || "0.0.0.0",
+    HOSTNAME: "0.0.0.0",
    NODE_ENV: "production",
-    // #5238: preserve a user-set NODE_OPTIONS (incl. their own
-    // `--max-old-space-size=…`) instead of clobbering it with the calibrated
-    // default — mirror the Electron/standalone launchers.
-    NODE_OPTIONS: buildServerNodeOptions(process.env, memoryLimit),
-    ...(tlsCert ? { OMNIROUTE_TLS_CERT: tlsCert } : {}),
-    ...(tlsKey ? { OMNIROUTE_TLS_KEY: tlsKey } : {}),
+    NODE_OPTIONS: `--max-old-space-size=${memoryLimit}`,
  };

-  // Validate the TLS pair up front so the operator sees a clear warning in the
-  // CLI (the child re-validates authoritatively). Drives the banner scheme;
-  // when null we fall through to identical plain-HTTP behavior as before.
-  urlScheme = resolveTlsOptions(env) ? "https" : "http";
-
  const isDaemon = opts.daemon === true;
  const useTray = opts.tray === true;

@@ -204,9 +166,7 @@ export async function runServe(opts = {}) {
 }

 function runDaemon(serverJs, env, memoryLimit, dashboardPort, apiPort) {
-  // #5238: skip the explicit CLI --max-old-space-size when the user pinned the
-  // heap via NODE_OPTIONS (a CLI arg would shadow/override their value).
-  const server = spawn("node", [...buildNodeHeapArgs(process.env, memoryLimit), serverJs], {
+  const server = spawn("node", [`--max-old-space-size=${memoryLimit}`, serverJs], {
    cwd: APP_DIR,
    env,
    stdio: "ignore",
@@ -215,14 +175,12 @@ function runDaemon(serverJs, env, memoryLimit, dashboardPort, apiPort) {
  writePidFile("server", server.pid);
  server.unref();
  console.log(`\x1b[32m✔ OmniRoute started in background (PID: ${server.pid})\x1b[0m`);
-  console.log(`  \x1b[1mDashboard:\x1b[0m  ${urlScheme}://localhost:${dashboardPort}`);
-  console.log(`  \x1b[1mAPI Base:\x1b[0m   ${urlScheme}://localhost:${apiPort}/v1`);
+  console.log(`  \x1b[1mDashboard:\x1b[0m  http://localhost:${dashboardPort}`);
+  console.log(`  \x1b[1mAPI Base:\x1b[0m   http://localhost:${apiPort}/v1`);
 }

 function runWithoutRecovery(serverJs, env, memoryLimit, dashboardPort, apiPort, noOpen) {
-  // #5238: skip the explicit CLI --max-old-space-size when the user pinned the
-  // heap via NODE_OPTIONS (a CLI arg would shadow/override their value).
-  const server = spawn("node", [...buildNodeHeapArgs(process.env, memoryLimit), serverJs], {
+  const server = spawn("node", [`--max-old-space-size=${memoryLimit}`, serverJs], {
    cwd: APP_DIR,
    env,
    stdio: "pipe",
@@ -346,8 +304,8 @@ async function maybeStartTray(port, apiPort, supervisor) {
    const { initTray, isTraySupported } = await import("../tray/index.mjs");
    if (!isTraySupported()) return;
    const { default: open } = await import("open").catch(() => ({ default: null }));
-    const dashboardUrl = `${urlScheme}://localhost:${port}`;
-    const tray = await initTray({
+    const dashboardUrl = `http://localhost:${port}`;
+    const tray = initTray({
      port,
      onQuit: () => {
        killTrayIfActive();
@@ -363,18 +321,14 @@ async function maybeStartTray(port, apiPort, supervisor) {
      const { killTray } = await import("../tray/index.mjs");
      _killTray = killTray;
    }
-  } catch (err) {
-    // tray is optional — do not fail the server, but surface why it failed so
-    // "--tray shows nothing" is diagnosable instead of silent (#4605).
-    process.stderr.write(
-      `[omniroute][tray] failed to start: ${err?.message ?? String(err)}\n`
-    );
+  } catch {
+    // tray is optional — do not fail the server
  }
 }

 async function onReady(dashboardPort, apiPort, noOpen) {
-  const dashboardUrl = `${urlScheme}://localhost:${dashboardPort}`;
-  const apiUrl = `${urlScheme}://localhost:${apiPort}`;
+  const dashboardUrl = `http://localhost:${dashboardPort}`;
+  const apiUrl = `http://localhost:${apiPort}`;

  console.log(`
  \x1b[32m✔ OmniRoute is running!\x1b[0m
--- a/bin/cli/commands/setup-aider.mjs
+++ b/bin/cli/commands/setup-aider.mjs
@@ -1,146 +0,0 @@
-/**
- * omniroute setup-aider — configure Aider (aider.chat) for OmniRoute.
- *
- * Aider (LiteLLM under the hood) talks to an OpenAI-compatible endpoint via env
- * `OPENAI_API_BASE` (ROOT url — LiteLLM appends /v1/chat/completions) + the model
- * flag `--model openai/<model>`. This writes ~/.aider.conf.yml (openai-api-base +
- * model) — the key stays in OPENAI_API_KEY (env, never the file) — and prints the
- * guaranteed env recipe + headless command. Remote-aware.
- */
-
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import os from "node:os";
-import { printHeading, printInfo, printSuccess, printError, createPrompt } from "../io.mjs";
-import { resolveActiveContext } from "../contexts.mjs";
-
-function stripToRoot(url) {
-  const s = String(url || "").replace(/\/+$/, "");
-  return s.endsWith("/v1") ? s.slice(0, -3) : s;
-}
-
-/** Resolve OPENAI_API_BASE (ROOT, no /v1 — LiteLLM appends) + apiKey. */
-export function resolveAiderTarget(opts = {}) {
-  let root;
-  if (opts.remote) root = stripToRoot(opts.remote);
-  else {
-    try {
-      root = stripToRoot(resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT)?.baseUrl);
-    } catch {
-      /* none */
-    }
-    if (!root) root = `http://localhost:${Number(opts.port ?? process.env.PORT ?? 20128) || 20128}`;
-  }
-  let apiKey = opts.apiKey ?? opts["api-key"];
-  if (!apiKey) {
-    try {
-      const c = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT);
-      apiKey = c?.accessToken || c?.apiKey;
-    } catch {
-      /* none */
-    }
-  }
-  if (!apiKey) apiKey = process.env.OMNIROUTE_API_KEY || "";
-  return { apiBase: root, apiKey };
-}
-
-/** Merge openai-api-base + model into an .aider.conf.yml object (preserve rest). */
-export function buildAiderConfig(existing, { apiBase, model }) {
-  const cfg = existing && typeof existing === "object" ? { ...existing } : {};
-  cfg["openai-api-base"] = apiBase;
-  if (model) cfg.model = `openai/${model}`;
-  return cfg;
-}
-
-/** The guaranteed env + run recipe (pure → testable). */
-export function buildAiderRecipe({ apiBase, model }) {
-  return [
-    `export OPENAI_API_BASE=${apiBase}`,
-    "export OPENAI_API_KEY=$OMNIROUTE_API_KEY",
-    `aider --model openai/${model}`,
-    `# headless:  aider --model openai/${model} --message "reply OK" --yes`,
-  ].join("\n");
-}
-
-function readYamlSafe(yaml, path) {
-  try {
-    if (existsSync(path)) return yaml.load(readFileSync(path, "utf8")) || {};
-  } catch {
-    /* corrupt/missing */
-  }
-  return {};
-}
-
-async function fetchModelIds(apiBase, apiKey) {
-  try {
-    const headers = { "Content-Type": "application/json" };
-    if (apiKey) headers["Authorization"] = `Bearer ${apiKey}`;
-    const res = await fetch(`${apiBase}/v1/models`, { headers, signal: AbortSignal.timeout(8000) });
-    if (!res.ok) return [];
-    const body = await res.json();
-    const list = Array.isArray(body) ? body : body.data ?? body.models ?? [];
-    return list.map((m) => (typeof m === "string" ? m : m?.id)).filter(Boolean);
-  } catch {
-    return [];
-  }
-}
-
-export async function runSetupAiderCommand(opts = {}) {
-  const { apiBase, apiKey } = resolveAiderTarget(opts);
-  const dryRun = Boolean(opts.dryRun ?? opts["dry-run"]);
-  const configPath = opts.configPath ?? opts["config-path"] ?? join(os.homedir(), ".aider.conf.yml");
-
-  printHeading("OmniRoute → Aider (openai-compatible via LiteLLM)");
-  printInfo(`OPENAI_API_BASE: ${apiBase}   (no /v1 — LiteLLM appends it)`);
-
-  let model = opts.model;
-  if (!model) {
-    const ids = await fetchModelIds(apiBase, apiKey);
-    if (ids.length && !opts.yes) {
-      printInfo(`Examples: ${ids.slice(0, 20).join(", ")}${ids.length > 20 ? " …" : ""}`);
-      const prompt = createPrompt();
-      try {
-        model = await prompt.ask("Model id for Aider (without the openai/ prefix)");
-      } finally {
-        prompt.close();
-      }
-    }
-  }
-  if (!model) {
-    printError("A model is required. Pass --model <id> (the openai/ prefix is added automatically).");
-    return 2;
-  }
-
-  const yaml = await import("js-yaml");
-  const merged = buildAiderConfig(readYamlSafe(yaml, configPath), { apiBase, model });
-  const out = yaml.dump(merged, { lineWidth: -1 });
-
-  if (dryRun) {
-    console.log("\n" + out);
-    printInfo(`[dry-run] → ${configPath}`);
-  } else {
-    mkdirSync(join(configPath, ".."), { recursive: true });
-    writeFileSync(configPath, out, "utf8");
-    printSuccess(`Wrote ${configPath}`);
-  }
-  printInfo("\nProvide the key + run (the key stays in the env, never the file):");
-  console.log(buildAiderRecipe({ apiBase, model }));
-  return 0;
-}
-
-export function registerSetupAider(program) {
-  program
-    .command("setup-aider")
-    .description("Configure Aider for OmniRoute: write ~/.aider.conf.yml + print the env recipe")
-    .option("--port <port>", "Local OmniRoute port (ignored when --remote is set)", "20128")
-    .option("--remote <url>", "Remote OmniRoute URL, e.g. http://192.168.0.15:20128")
-    .option("--api-key <key>", "OmniRoute API key (defaults to OMNIROUTE_API_KEY env var)")
-    .option("--model <id>", "Model id (the openai/ prefix is added automatically)")
-    .option("--config-path <path>", ".aider.conf.yml path (default: ~/.aider.conf.yml)")
-    .option("--yes", "Non-interactive: do not prompt (requires --model)")
-    .option("--dry-run", "Print what would be written without touching the filesystem")
-    .action(async (opts) => {
-      const code = await runSetupAiderCommand(opts);
-      if (code !== 0) process.exit(code);
-    });
-}
--- a/bin/cli/commands/setup-claude.mjs
+++ b/bin/cli/commands/setup-claude.mjs
@@ -1,152 +0,0 @@
-/**
- * omniroute setup-claude — Remote-aware Claude Code profile generator.
- *
- * Claude Code has no native profile files (unlike Codex). The idiomatic way to
- * keep multiple named configs is `CLAUDE_CONFIG_DIR` — a separate config dir per
- * profile (its own settings.json, credentials, history, cache). This command
- * fetches the live /v1/models catalog from a (possibly remote) OmniRoute and
- * writes `~/.claude/profiles/<name>/settings.json` for each supported model,
- * reusing the SAME profile names as `setup-codex` (glm52, kimi-k27, …).
- *
- * Launch a profile with:  omniroute launch --profile <name>
- * (which injects ANTHROPIC_AUTH_TOKEN from the active context — the token is
- * never written to disk). Or export ANTHROPIC_AUTH_TOKEN and run:
- *   CLAUDE_CONFIG_DIR=~/.claude/profiles/<name> claude
- *
- * Idempotent: re-running overwrites each profile's settings.json in place.
- */
-
-import { existsSync, mkdirSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import os from "node:os";
-import { printHeading, printInfo, printSuccess, printError } from "../io.mjs";
-import { categoriseModel } from "./setup-codex.mjs";
-
-/** Map a Codex-style effort to a Claude Code settings.json effortLevel. */
-function effortLevelFor(cfg) {
-  // Codex categories use xhigh/high/low/undefined; Claude Code accepts the same
-  // names (low|medium|high|xhigh). Pass through, omit for the "simple" tier.
-  return cfg.effort || undefined;
-}
-
-/** Build the settings.json content for one Claude Code profile. */
-export function buildProfileSettings(modelId, baseUrl, cfg) {
-  const env = {
-    ANTHROPIC_BASE_URL: baseUrl,
-    ANTHROPIC_MODEL: modelId,
-    CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY: "1",
-    CLAUDE_CODE_AUTO_COMPACT_WINDOW: "190000",
-  };
-  const settings = {
-    $schema: "https://json.schemastore.org/claude-code-settings.json",
-    model: modelId,
-    env,
-  };
-  const effort = effortLevelFor(cfg);
-  if (effort) settings.effortLevel = effort;
-  // NOTE: ANTHROPIC_AUTH_TOKEN is intentionally NOT written here — `omniroute
-  // launch --profile` injects it from the active context, keeping the secret off
-  // disk. For direct `CLAUDE_CONFIG_DIR=… claude` use, export it in your shell.
-  return JSON.stringify(settings, null, 2) + "\n";
-}
-
-/**
- * @param {{remote?:string, port?:string, apiKey?:string, claudeHome?:string, dryRun?:boolean, only?:string}} opts
- * @returns {Promise<number>}
- */
-export async function runSetupClaudeCommand(opts = {}) {
-  const port = Number(opts.port ?? process.env.PORT ?? 20128) || 20128;
-  const baseUrl = (opts.remote ?? `http://localhost:${port}`).replace(/\/+$/, "").replace(/\/v1$/, "");
-  const apiKey = opts.apiKey ?? opts["api-key"] ?? process.env.OMNIROUTE_API_KEY ?? "";
-  const claudeHome = opts.claudeHome ?? opts["claude-home"] ?? join(os.homedir(), ".claude");
-  const profilesRoot = join(claudeHome, "profiles");
-  const dryRun = Boolean(opts.dryRun ?? opts["dry-run"]);
-  const onlyFilter = opts.only ? opts.only.split(",").map((s) => s.trim()) : null;
-
-  printHeading("OmniRoute → Claude Code profile generator");
-  printInfo(`Connecting to ${baseUrl} …`);
-
-  // ── Fetch model catalog ───────────────────────────────────────────────────
-  let models;
-  try {
-    const headers = { "Content-Type": "application/json" };
-    if (apiKey) headers["Authorization"] = `Bearer ${apiKey}`;
-    const res = await fetch(`${baseUrl}/v1/models`, {
-      headers,
-      signal: AbortSignal.timeout(10000),
-    });
-    if (!res.ok) throw new Error(`HTTP ${res.status} ${res.statusText}`);
-    const body = await res.json();
-    models = body.data ?? body.models ?? [];
-  } catch (err) {
-    printError(`Failed to fetch models: ${err.message}`);
-    printInfo(
-      "Make sure OmniRoute is running and the --remote URL is correct.\n" +
-        "You may also need --api-key if OmniRoute requires authentication."
-    );
-    return 1;
-  }
-
-  printInfo(`Received ${models.length} models from ${baseUrl}`);
-
-  if (!dryRun && !existsSync(profilesRoot)) {
-    mkdirSync(profilesRoot, { recursive: true });
-  }
-
-  let written = 0;
-  for (const m of models) {
-    const id = typeof m === "string" ? m : m.id ?? "";
-    if (!id) continue;
-    if (onlyFilter && !onlyFilter.some((f) => id.includes(f))) continue;
-
-    const cfg = categoriseModel(id);
-    if (!cfg) continue;
-
-    const dir = join(profilesRoot, cfg.name);
-    const filePath = join(dir, "settings.json");
-    const content = buildProfileSettings(id, baseUrl, cfg);
-
-    if (dryRun) {
-      console.log(`\n── [dry-run] ${filePath} ──`);
-      console.log(content);
-    } else {
-      mkdirSync(dir, { recursive: true });
-      writeFileSync(filePath, content, "utf8");
-      printSuccess(`  ✓ profiles/${cfg.name}/settings.json  (${id})`);
-    }
-    written++;
-  }
-
-  const skipped = models.length - written;
-  if (!dryRun) {
-    console.log("");
-    printSuccess(`${written} Claude Code profiles written to ${profilesRoot}`);
-    if (skipped > 0) printInfo(`${skipped} models skipped (no matching profile pattern)`);
-    console.log("\nTo use a profile:");
-    console.log("  omniroute launch --profile <name>     # e.g. omniroute launch --profile glm52");
-    console.log("  # or: CLAUDE_CONFIG_DIR=~/.claude/profiles/<name> claude  (export ANTHROPIC_AUTH_TOKEN first)");
-  } else {
-    console.log(`\n[dry-run] ${written} profiles would be written (${skipped} skipped)`);
-  }
-
-  return 0;
-}
-
-export function registerSetupClaude(program) {
-  program
-    .command("setup-claude")
-    .description(
-      "Fetch the live model catalog from OmniRoute (local or remote VPS) and generate " +
-        "~/.claude/profiles/<name>/ Claude Code profiles (CLAUDE_CONFIG_DIR) for each model"
-    )
-    .option("--port <port>", "Local OmniRoute port (ignored when --remote is set)", "20128")
-    .option("--remote <url>", "Remote OmniRoute URL, e.g. http://192.168.0.15:20128")
-    .option("--api-key <key>", "OmniRoute API key (defaults to OMNIROUTE_API_KEY env var)")
-    .option("--claude-home <dir>", "Claude home dir (default: ~/.claude)")
-    .option("--only <patterns>", "Comma-separated substrings — only matching model IDs (e.g. glm,kimi)")
-    .option("--dry-run", "Print what would be written without touching the filesystem")
-    .action(async (opts) => {
-      const exitCode = await runSetupClaudeCommand(opts);
-      if (exitCode !== 0) process.exit(exitCode);
-    });
-}
--- a/bin/cli/commands/setup-cline.mjs
+++ b/bin/cli/commands/setup-cline.mjs
@@ -1,160 +0,0 @@
-/**
- * omniroute setup-cline — configure the Cline AI coding agent to use OmniRoute.
- *
- * Cline's VS Code extension keeps its config in VS Code's opaque globalStorage
- * (not file-writable). Its CLI/standalone mode reads ~/.cline/data/. This command
- * writes the CLI-mode files (matching the OmniRoute dashboard) AND prints the
- * Base URL / model to paste into the VS Code extension UI.
- *
- * Cline uses the OpenAI-compatible provider: openAiBaseUrl is the ROOT URL
- * (no /v1 — Cline appends /v1/chat/completions). Plan + Act modes are set to the
- * same provider/model. The key goes in secrets.json (Cline has no env ref).
- */
-
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import os from "node:os";
-import { printHeading, printInfo, printSuccess, printError, createPrompt } from "../io.mjs";
-import { resolveActiveContext } from "../contexts.mjs";
-
-function stripToRoot(url) {
-  let s = String(url || "").replace(/\/+$/, "");
-  return s.endsWith("/v1") ? s.slice(0, -3) : s;
-}
-
-/** Resolve baseUrl (ROOT, no /v1) + apiKey from flags → active context → localhost. */
-export function resolveClineTarget(opts = {}) {
-  let baseUrl;
-  if (opts.remote) baseUrl = stripToRoot(opts.remote);
-  else {
-    try {
-      baseUrl = stripToRoot(resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT)?.baseUrl);
-    } catch {
-      /* none */
-    }
-    if (!baseUrl) baseUrl = `http://localhost:${Number(opts.port ?? process.env.PORT ?? 20128) || 20128}`;
-  }
-  let apiKey = opts.apiKey ?? opts["api-key"];
-  if (!apiKey) {
-    try {
-      const c = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT);
-      apiKey = c?.accessToken || c?.apiKey;
-    } catch {
-      /* none */
-    }
-  }
-  if (!apiKey) apiKey = process.env.OMNIROUTE_API_KEY || "";
-  return { baseUrl, apiKey };
-}
-
-/** Merge OmniRoute openai-compatible settings into Cline's globalState (Plan + Act). */
-export function buildClineGlobalState(existing, { baseUrl, model }) {
-  const gs = { ...(existing || {}) };
-  gs.actModeApiProvider = "openai";
-  gs.planModeApiProvider = "openai";
-  gs.openAiBaseUrl = baseUrl; // ROOT — Cline appends /v1/chat/completions
-  if (model) {
-    gs.openAiModelId = model;
-    gs.planModeOpenAiModelId = model;
-  }
-  return gs;
-}
-
-/** Merge the API key into Cline's secrets (Cline has no env-var reference). */
-export function buildClineSecrets(existing, { apiKey }) {
-  return { ...(existing || {}), openAiApiKey: apiKey || "sk_omniroute" };
-}
-
-function readJson(path) {
-  try {
-    if (existsSync(path)) return JSON.parse(readFileSync(path, "utf8"));
-  } catch {
-    /* corrupt/missing → start fresh */
-  }
-  return {};
-}
-
-async function fetchModelIds(baseUrl, apiKey) {
-  try {
-    const headers = { "Content-Type": "application/json" };
-    if (apiKey) headers["Authorization"] = `Bearer ${apiKey}`;
-    const res = await fetch(`${baseUrl}/v1/models`, { headers, signal: AbortSignal.timeout(8000) });
-    if (!res.ok) return [];
-    const body = await res.json();
-    const list = Array.isArray(body) ? body : body.data ?? body.models ?? [];
-    return list.map((m) => (typeof m === "string" ? m : m?.id)).filter(Boolean);
-  } catch {
-    return [];
-  }
-}
-
-export async function runSetupClineCommand(opts = {}) {
-  const { baseUrl, apiKey } = resolveClineTarget(opts);
-  const dryRun = Boolean(opts.dryRun ?? opts["dry-run"]);
-  const clineDir = opts.clineDir ?? opts["cline-dir"] ?? join(os.homedir(), ".cline", "data");
-
-  printHeading("OmniRoute → Cline (OpenAI-compatible)");
-  printInfo(`Server: ${baseUrl}`);
-
-  // Resolve the model (Cline needs one explicit id — no auto-discovery).
-  let model = opts.model;
-  if (!model) {
-    const ids = await fetchModelIds(baseUrl, apiKey);
-    if (ids.length && !opts.yes) {
-      printInfo(`Examples: ${ids.slice(0, 20).join(", ")}${ids.length > 20 ? " …" : ""}`);
-      const prompt = createPrompt();
-      try {
-        model = await prompt.ask("Model id for Cline");
-      } finally {
-        prompt.close();
-      }
-    }
-  }
-  if (!model) {
-    printError("A model is required. Pass --model <id> (Cline has no model auto-discovery).");
-    return 2;
-  }
-
-  const gsPath = join(clineDir, "globalState.json");
-  const secPath = join(clineDir, "secrets.json");
-  const globalState = buildClineGlobalState(readJson(gsPath), { baseUrl, model });
-  const secrets = buildClineSecrets(readJson(secPath), { apiKey });
-
-  if (dryRun) {
-    console.log(`\n── [dry-run] ${gsPath} ──`);
-    console.log(JSON.stringify({ actModeApiProvider: globalState.actModeApiProvider, planModeApiProvider: globalState.planModeApiProvider, openAiBaseUrl: globalState.openAiBaseUrl, openAiModelId: globalState.openAiModelId }, null, 2));
-    console.log(`\n── [dry-run] ${secPath} ── (openAiApiKey: ${apiKey ? "set" : "sk_omniroute"})`);
-  } else {
-    if (!existsSync(clineDir)) mkdirSync(clineDir, { recursive: true });
-    writeFileSync(gsPath, JSON.stringify(globalState, null, 2) + "\n", "utf8");
-    writeFileSync(secPath, JSON.stringify(secrets, null, 2) + "\n", "utf8");
-    printSuccess(`Wrote ${gsPath}`);
-    printSuccess(`Wrote ${secPath}`);
-  }
-
-  // The VS Code extension uses opaque globalStorage — can't be file-written.
-  printInfo("\nFor the Cline VS Code extension, set these in its Settings → API (OpenAI Compatible):");
-  printInfo(`  Base URL:  ${baseUrl}        (NOT /v1 — Cline appends it)`);
-  printInfo(`  API Key:   <your OMNIROUTE_API_KEY>`);
-  printInfo(`  Model:     ${model}`);
-  return 0;
-}
-
-export function registerSetupCline(program) {
-  program
-    .command("setup-cline")
-    .description(
-      "Configure Cline for OmniRoute: write ~/.cline/data (CLI mode) + print VS Code extension settings"
-    )
-    .option("--port <port>", "Local OmniRoute port (ignored when --remote is set)", "20128")
-    .option("--remote <url>", "Remote OmniRoute URL, e.g. http://192.168.0.15:20128")
-    .option("--api-key <key>", "OmniRoute API key (defaults to OMNIROUTE_API_KEY env var)")
-    .option("--model <id>", "Model id for Cline (required unless picked interactively)")
-    .option("--cline-dir <dir>", "Cline data dir (default: ~/.cline/data)")
-    .option("--yes", "Non-interactive: do not prompt (requires --model)")
-    .option("--dry-run", "Print what would be written without touching the filesystem")
-    .action(async (opts) => {
-      const code = await runSetupClineCommand(opts);
-      if (code !== 0) process.exit(code);
-    });
-}
--- a/bin/cli/commands/setup-codex.mjs
+++ b/bin/cli/commands/setup-codex.mjs
@@ -1,226 +0,0 @@
-/**
- * omniroute setup-codex — Remote-aware Codex CLI profile generator.
- *
- * Connects to a running OmniRoute instance (local or remote VPS), fetches the
- * live model catalog via GET /v1/models, then generates ~/.codex/<name>.config.toml
- * profile files for each model — so you can switch providers with a single flag
- * (`codex --profile glm52`) without editing config files by hand.
- *
- * Primary use-case: configure a local Codex CLI to use models from a VPS.
- *   omniroute setup-codex --remote http://100.67.86.91:20128 --api-key sk-xxx
- *
- * The command is idempotent: re-running updates existing profile files in place.
- */
-
-import { existsSync, mkdirSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import os from "node:os";
-import { printHeading, printInfo, printSuccess, printError } from "../io.mjs";
-import { t } from "../i18n.mjs";
-
-// ── Model categorisation ──────────────────────────────────────────────────────
-
-/**
- * Map a model ID (as returned by /v1/models) to a Codex profile configuration.
- * Returns null for models that should not get their own profile (e.g. aliases).
- *
- * Exported so the Claude Code profile generator (`setup-claude`) reuses the SAME
- * profile names (glm52, kimi-k27, …) for cross-CLI consistency.
- *
- * @param {string} modelId
- * @returns {{ name:string, ctx:number, compact:number, effort?:string, summary?:boolean, toolLimit:number }|null}
- */
-export function categoriseModel(modelId) {
-  const id = modelId.toLowerCase();
-
-  // ── Thinking models (max effort, detailed summary) ────────────────────────
-  const thinkingPatterns = [
-    { re: /kmc\/kimi-k2\.7/, name: "kimi-k27", ctx: 131072, compact: 112000, toolLimit: 32768 },
-    { re: /kmc\/kimi-k2\.6/, name: "kimi-k26", ctx: 131072, compact: 112000, toolLimit: 32768 },
-    { re: /glm\/glm-5\.2-max/, name: "glm52max", ctx: 131072, compact: 112000, toolLimit: 32768 },
-    { re: /glm\/glm-5\.2$/, name: "glm52", ctx: 131072, compact: 112000, toolLimit: 32768 },
-    { re: /opencode-go\/mimo-v2\.5-pro/, name: "mimo-pro", ctx: 131072, compact: 112000, toolLimit: 32768 },
-    { re: /opencode-go\/qwen3\.7-plus/, name: "qwen37plus", ctx: 32768, compact: 28000, toolLimit: 16384 },
-  ];
-
-  // ── Good models (high effort) ─────────────────────────────────────────────
-  const goodPatterns = [
-    { re: /ollamacloud\/deepseek-v4-pro/, name: "deepseek-pro", ctx: 131072, compact: 112000, toolLimit: 32768 },
-    { re: /opencode-go\/mimo-v2\.5$/, name: "mimo", ctx: 131072, compact: 112000, toolLimit: 32768 },
-  ];
-
-  // ── Simple models (no effort) ─────────────────────────────────────────────
-  const simplePatterns = [
-    { re: /ollamacloud\/gemma4:31b/, name: "gemma4", ctx: 32768, compact: 28000, toolLimit: 16384 },
-    { re: /ollamacloud\/nemotron-3-super/, name: "nemotron", ctx: 32768, compact: 28000, toolLimit: 16384 },
-    { re: /ollamacloud\/gpt-oss:20b/, name: "gptoss", ctx: 32768, compact: 28000, toolLimit: 16384 },
-  ];
-
-  // ── Fast models (low effort) ──────────────────────────────────────────────
-  const fastPatterns = [
-    { re: /ollamacloud\/deepseek-v4-flash/, name: "deepseek-flash", ctx: 65536, compact: 56000, toolLimit: 16384 },
-    { re: /ollamacloud\/gemini-3-flash/, name: "gemini-flash", ctx: 1000000, compact: 850000, toolLimit: 32768 },
-    { re: /glm\/glm-5-turbo/, name: "glm5turbo", ctx: 131072, compact: 112000, toolLimit: 16384 },
-    { re: /glm\/glm-4\.7-flash/, name: "glm47flash", ctx: 131072, compact: 112000, toolLimit: 16384 },
-  ];
-
-  for (const p of thinkingPatterns) {
-    if (p.re.test(id)) return { ...p, effort: "xhigh", summary: true };
-  }
-  for (const p of goodPatterns) {
-    if (p.re.test(id)) return { ...p, effort: "high", summary: false };
-  }
-  for (const p of simplePatterns) {
-    if (p.re.test(id)) return { ...p, effort: undefined, summary: false };
-  }
-  for (const p of fastPatterns) {
-    if (p.re.test(id)) return { ...p, effort: "low", summary: false };
-  }
-
-  return null;
-}
-
-/** Build the TOML content for a single profile. */
-function buildProfileToml(modelId, cfg) {
-  const lines = [
-    `# codex --profile ${cfg.name}`,
-    `# ${modelId}`,
-    `model                          = "${modelId}"`,
-    `model_provider                 = "omniroute"`,
-  ];
-
-  if (cfg.effort) {
-    lines.push(`model_reasoning_effort         = "${cfg.effort}"`);
-  }
-  if (cfg.summary) {
-    lines.push(`model_reasoning_summary        = "detailed"`);
-  }
-
-  lines.push(
-    `model_context_window           = ${cfg.ctx}`,
-    `model_auto_compact_token_limit = ${cfg.compact}`,
-    `tool_output_token_limit        = ${cfg.toolLimit}`
-  );
-
-  return lines.join("\n") + "\n";
-}
-
-// ── Command ───────────────────────────────────────────────────────────────────
-
-/**
- * @param {{remote?:string, port?:string, apiKey?:string, codexHome?:string, dryRun?:boolean, only?:string}} opts
- * @returns {Promise<number>}
- */
-export async function runSetupCodexCommand(opts = {}) {
-  const port = Number(opts.port ?? process.env.PORT ?? 20128) || 20128;
-  const baseUrl = (opts.remote ?? `http://localhost:${port}`).replace(/\/v1$/, "");
-  const apiKey = opts.apiKey ?? opts["api-key"] ?? process.env.OMNIROUTE_API_KEY ?? "";
-  const codexHome = opts.codexHome ?? opts["codex-home"] ?? join(os.homedir(), ".codex");
-  const dryRun = Boolean(opts.dryRun ?? opts["dry-run"]);
-  const onlyFilter = opts.only ? opts.only.split(",").map((s) => s.trim()) : null;
-
-  printHeading(`OmniRoute → Codex CLI profile generator`);
-  printInfo(`Connecting to ${baseUrl} …`);
-
-  // ── Fetch model catalog ───────────────────────────────────────────────────
-  let models;
-  try {
-    const headers = { "Content-Type": "application/json" };
-    if (apiKey) headers["Authorization"] = `Bearer ${apiKey}`;
-
-    const res = await fetch(`${baseUrl}/v1/models`, {
-      headers,
-      signal: AbortSignal.timeout(10000),
-    });
-    if (!res.ok) throw new Error(`HTTP ${res.status} ${res.statusText}`);
-    const body = await res.json();
-    models = body.data ?? body.models ?? [];
-  } catch (err) {
-    printError(`Failed to fetch models: ${err.message}`);
-    printInfo(
-      "Make sure OmniRoute is running and the --remote URL is correct.\n" +
-        "You may also need --api-key if OmniRoute requires authentication."
-    );
-    return 1;
-  }
-
-  printInfo(`Received ${models.length} models from ${baseUrl}`);
-
-  // ── Ensure codex home exists ──────────────────────────────────────────────
-  if (!dryRun && !existsSync(codexHome)) {
-    mkdirSync(codexHome, { recursive: true });
-  }
-
-  // ── Generate profiles ─────────────────────────────────────────────────────
-  let written = 0;
-  let skipped = 0;
-
-  for (const m of models) {
-    const id = typeof m === "string" ? m : (m.id ?? "");
-    if (!id) continue;
-    if (onlyFilter && !onlyFilter.some((f) => id.includes(f))) continue;
-
-    const cfg = categoriseModel(id);
-    if (!cfg) continue;
-
-    const filePath = join(codexHome, `${cfg.name}.config.toml`);
-    const content = buildProfileToml(id, cfg);
-
-    if (dryRun) {
-      console.log(`\n── [dry-run] ${filePath} ──`);
-      console.log(content);
-    } else {
-      writeFileSync(filePath, content, "utf8");
-      printSuccess(`  ✓ ${cfg.name}.config.toml  (${id})`);
-    }
-    written++;
-  }
-
-  skipped = models.length - written;
-
-  if (!dryRun) {
-    console.log("");
-    printSuccess(`${written} profiles written to ${codexHome}`);
-    if (skipped > 0) {
-      printInfo(`${skipped} models skipped (no matching profile pattern)`);
-    }
-    console.log("\nTo use a profile:");
-    console.log("  codex --profile <name>    # e.g. codex --profile glm52");
-    console.log("  codex -p <name>           # short form");
-  } else {
-    console.log(`\n[dry-run] ${written} profiles would be written (${skipped} skipped)`);
-  }
-
-  return 0;
-}
-
-export function registerSetupCodex(program) {
-  program
-    .command("setup-codex")
-    .description(
-      "Fetch the live model catalog from OmniRoute (local or remote VPS) and generate " +
-        "~/.codex/<name>.config.toml profiles for each supported model"
-    )
-    .option("--port <port>", "Local OmniRoute port (ignored when --remote is set)", "20128")
-    .option(
-      "--remote <url>",
-      "Remote OmniRoute URL, e.g. http://100.67.86.91:20128 — fetches models from there"
-    )
-    .option(
-      "--api-key <key>",
-      "OmniRoute API key for the remote instance (defaults to OMNIROUTE_API_KEY env var)"
-    )
-    .option(
-      "--codex-home <dir>",
-      "Directory where profile files are written (default: ~/.codex)"
-    )
-    .option(
-      "--only <patterns>",
-      "Comma-separated substrings — only generate profiles for matching model IDs (e.g. glm,kimi)"
-    )
-    .option("--dry-run", "Print what would be written without touching the filesystem")
-    .action(async (opts) => {
-      const exitCode = await runSetupCodexCommand(opts);
-      if (exitCode !== 0) process.exit(exitCode);
-    });
-}
--- a/bin/cli/commands/setup-continue.mjs
+++ b/bin/cli/commands/setup-continue.mjs
@@ -1,173 +0,0 @@
-/**
- * omniroute setup-continue — configure Continue (continue.dev) for OmniRoute.
- *
- * Continue uses a file-based, mergeable ~/.continue/config.yaml shared by the VS
- * Code / JetBrains extensions AND the `cn` CLI. Models use `provider: openai`
- * with a custom `apiBase` (WITH /v1 — Continue appends /chat/completions) and an
- * `apiKey: ${{ secrets.OMNIROUTE_API_KEY }}` reference (secret never written to
- * config.yaml). Remote-aware; curated model set with Continue roles.
- */
-
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import os from "node:os";
-import { printHeading, printInfo, printSuccess, printError } from "../io.mjs";
-import { resolveActiveContext } from "../contexts.mjs";
-import { categoriseModel } from "./setup-codex.mjs";
-
-const SECRET_REF = "${{ secrets.OMNIROUTE_API_KEY }}";
-
-function ensureV1(url) {
-  const s = String(url || "").replace(/\/+$/, "");
-  return s.endsWith("/v1") ? s : `${s}/v1`;
-}
-
-/** Resolve apiBase (WITH /v1) + apiKey from flags → active context → localhost. */
-export function resolveContinueTarget(opts = {}) {
-  let root;
-  if (opts.remote) root = String(opts.remote).replace(/\/+$/, "");
-  else {
-    try {
-      root = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT)?.baseUrl;
-    } catch {
-      /* none */
-    }
-    if (!root) root = `http://localhost:${Number(opts.port ?? process.env.PORT ?? 20128) || 20128}`;
-  }
-  let apiKey = opts.apiKey ?? opts["api-key"];
-  if (!apiKey) {
-    try {
-      const c = resolveActiveContext(opts.context ?? process.env.OMNIROUTE_CONTEXT);
-      apiKey = c?.accessToken || c?.apiKey;
-    } catch {
-      /* none */
-    }
-  }
-  if (!apiKey) apiKey = process.env.OMNIROUTE_API_KEY || "";
-  return { apiBase: ensureV1(root), apiKey };
-}
-
-/** Build Continue model entries (provider: openai) for the given catalog ids. */
-export function buildContinueModels(modelIds, apiBase) {
-  const out = [];
-  for (const id of modelIds) {
-    const cfg = categoriseModel(id);
-    if (!cfg) continue;
-    const roles = ["chat", "edit", "apply"];
-    if (cfg.effort === "low") roles.push("autocomplete"); // fast tier → autocomplete
-    out.push({
-      name: `OmniRoute: ${id}`,
-      provider: "openai",
-      model: id,
-      apiBase,
-      apiKey: SECRET_REF,
-      roles,
-    });
-  }
-  return out;
-}
-
-/**
- * Merge OmniRoute models into an existing Continue config object: drop any prior
- * models pointing at this apiBase, keep everything else, append the new set.
- */
-export function mergeContinueConfig(existing, newModels, apiBase) {
-  const cfg = existing && typeof existing === "object" ? { ...existing } : {};
-  const prior = Array.isArray(cfg.models) ? cfg.models : [];
-  const kept = prior.filter((m) => !m || m.apiBase !== apiBase);
-  cfg.models = [...kept, ...newModels];
-  if (!cfg.name) cfg.name = "OmniRoute Config";
-  if (!cfg.version) cfg.version = "1.0";
-  if (!cfg.schema) cfg.schema = "v1";
-  return cfg;
-}
-
-async function fetchModelIds(apiBase, apiKey) {
-  try {
-    const headers = { "Content-Type": "application/json" };
-    if (apiKey) headers["Authorization"] = `Bearer ${apiKey}`;
-    const res = await fetch(`${apiBase.replace(/\/v1$/, "")}/v1/models`, {
-      headers,
-      signal: AbortSignal.timeout(10000),
-    });
-    if (!res.ok) throw new Error(`HTTP ${res.status}`);
-    const body = await res.json();
-    const list = Array.isArray(body) ? body : body.data ?? body.models ?? [];
-    return list.map((m) => (typeof m === "string" ? m : m?.id)).filter(Boolean);
-  } catch (e) {
-    throw new Error(`Could not fetch models: ${e.message}`);
-  }
-}
-
-export async function runSetupContinueCommand(opts = {}) {
-  const { apiBase, apiKey } = resolveContinueTarget(opts);
-  const dryRun = Boolean(opts.dryRun ?? opts["dry-run"]);
-  const only = opts.only ? opts.only.split(",").map((s) => s.trim()).filter(Boolean) : null;
-  const configPath = opts.configPath ?? opts["config-path"] ?? join(os.homedir(), ".continue", "config.yaml");
-
-  printHeading("OmniRoute → Continue (config.yaml)");
-  printInfo(`apiBase: ${apiBase}`);
-
-  let ids;
-  try {
-    ids = await fetchModelIds(apiBase, apiKey);
-  } catch (e) {
-    printError(e.message);
-    printInfo("Make sure OmniRoute is running and --remote/--api-key are correct.");
-    return 1;
-  }
-  if (only) ids = ids.filter((id) => only.some((f) => id.includes(f)));
-
-  const models = buildContinueModels(ids, apiBase);
-  if (!models.length) {
-    printError("No matching curated models in the catalog (try --only or check the server).");
-    return 1;
-  }
-
-  const yaml = await import("js-yaml");
-  let existing = {};
-  if (existsSync(configPath)) {
-    try {
-      existing = yaml.load(readFileSync(configPath, "utf8")) || {};
-    } catch {
-      printInfo("Existing config.yaml unparseable — starting fresh (a .bak is kept).");
-      if (!dryRun) writeFileSync(`${configPath}.bak`, readFileSync(configPath));
-      existing = {};
-    }
-  }
-  const merged = mergeContinueConfig(existing, models, apiBase);
-  const out = yaml.dump(merged, { lineWidth: -1 });
-
-  if (dryRun) {
-    console.log("\n" + (out.length > 3500 ? out.slice(0, 3500) + "\n… (truncated)" : out));
-    printInfo(`[dry-run] ${models.length} OmniRoute model(s) → ${configPath}`);
-    return 0;
-  }
-
-  mkdirSync(join(configPath, ".."), { recursive: true });
-  writeFileSync(configPath, out, "utf8");
-  printSuccess(`Wrote ${configPath} (${models.length} OmniRoute models)`);
-  printInfo("\nProvide the key (config.yaml references it, not stores it):");
-  printInfo("  cn CLI:  export OMNIROUTE_API_KEY=...   (read from your shell)");
-  printInfo("  IDE:     echo 'OMNIROUTE_API_KEY=...' >> ~/.continue/.env");
-  printInfo("Run:  cn -p \"reply OK\"");
-  return 0;
-}
-
-export function registerSetupContinue(program) {
-  program
-    .command("setup-continue")
-    .description(
-      "Generate ~/.continue/config.yaml (Continue / cn CLI) from the OmniRoute model catalog"
-    )
-    .option("--port <port>", "Local OmniRoute port (ignored when --remote is set)", "20128")
-    .option("--remote <url>", "Remote OmniRoute URL, e.g. http://192.168.0.15:20128")
-    .option("--api-key <key>", "OmniRoute API key (defaults to OMNIROUTE_API_KEY env var)")
-    .option("--only <patterns>", "Comma-separated substrings — keep only matching model IDs")
-    .option("--config-path <path>", "config.yaml path (default: ~/.continue/config.yaml)")
-    .option("--dry-run", "Print what would be written without touching the filesystem")
-    .action(async (opts) => {
-      const code = await runSetupContinueCommand(opts);
-      if (code !== 0) process.exit(code);
-    });
-}
--- a/Show More
+++ b/Show More