feat(release): v2.3.13 — tiered quota scoring, model fallback, auth fixes, pnpm fix

- Tiered quota scoring (Ultra>Pro>Free) as 7th Auto-Combo factor - Intra-family model fallback on 404/400/403 errors - Configurable API bridge timeout (API_BRIDGE_PROXY_TIMEOUT_MS) - INITIAL_PASSWORD accepted on first login with timingSafeEqual - README </details> truncation fix (affects all GitHub renders) - pnpm @swc/helpers override conflict removed - CLI path injection hardening (isSafePath validator) - 429 retry, Gemini CLI headers, Claude response_format injection - deepseek-3.1/3.2, qwen3-coder-next pricing added - starchart.cc star widget in all 30 READMEs
fix(ci): regenerate package-lock.json after removing @swc/helpers override
2026-07-29 03:12:10 +03:00 · 2026-03-12 18:18:53 -03:00 · 2026-03-12 18:17:45 -03:00 · 2026-03-12 18:15:38 -03:00 · 2026-03-12 18:06:53 -03:00 · 2026-03-12 18:06:27 -03:00
47 changed files with 524 additions and 261 deletions
--- a/.env.example
+++ b/.env.example
@@ -166,6 +166,8 @@ GEMINI_CLI_USER_AGENT=google-api-nodejs-client/9.15.1
 # Timeout settings
 # FETCH_TIMEOUT_MS=120000
 # STREAM_IDLE_TIMEOUT_MS=60000
+# API bridge timeout for /v1 proxy requests (default: 30000)
+# API_BRIDGE_PROXY_TIMEOUT_MS=120000

 # CORS configuration (default: * allows all origins)
 # CORS_ORIGINS=*
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,34 @@
 # Changelog

-## [2.3.12] - 2026-03-12
+## [2.3.13] - 2026-03-12
+
+### ✨ New Features
+
+- **Tiered Quota Scoring (Auto-Combo)**: Added `tierPriority` as a 7th scoring factor — accounts with Ultra/Pro tiers are now preferred over Free tiers when other factors are equal. New optional fields `accountTier` and `quotaResetIntervalSecs` on `ProviderCandidate`. All 4 mode packs updated (`ship-fast`, `cost-saver`, `quality-first`, `offline-friendly`).
+- **Intra-Family Model Fallback (T5)**: When a model is unavailable (404/400/403), OmniRoute now automatically falls back to sibling models from the same family before returning an error (`modelFamilyFallback.ts`).
+- **Configurable API Bridge Timeout**: `API_BRIDGE_PROXY_TIMEOUT_MS` env var lets operators tune the proxy timeout (default 30s). Fixes 504 errors on slow upstream responses. (#332)
+- **Star History**: Replaced star-history.com widget with starchart.cc (`?variant=adaptive`) in all 30 READMEs — adapts to light/dark theme, real-time updates.
+
+### 🐛 Bug Fixes
+
+- **Auth — First-time password**: `INITIAL_PASSWORD` env var is now accepted when setting the first dashboard password. Uses `timingSafeEqual` for constant-time comparison, preventing timing attacks. (#333)
+- **README Truncation**: Fixed a missing `</details>` closing tag in the Troubleshooting section that caused GitHub to stop rendering everything below it (Tech Stack, Docs, Roadmap, Contributors).
+- **pnpm install**: Removed redundant `@swc/helpers` override from `package.json` that conflicted with the direct dependency, causing `EOVERRIDE` errors on pnpm. Added `pnpm.onlyBuiltDependencies` config.
+- **CLI Path Injection (T12)**: Added `isSafePath()` validator in `cliRuntime.ts` to block path traversal and shell metacharacters in `CLI_*_BIN` env vars.
+- **CI**: Regenerated `package-lock.json` after override removal to fix `npm ci` failures on GitHub Actions.
+
+### 🔧 Improvements
+
+- **Response Format (T1)**: `response_format` (json_schema/json_object) now injected as a system prompt for Claude, enabling structured output compatibility.
+- **429 Retry (T2)**: Intra-URL retry for 429 responses (2× attempts with 2s delay) before falling back to next URL.
+- **Gemini CLI Headers (T3)**: Added `User-Agent` and `X-Goog-Api-Client` fingerprint headers for Gemini CLI compatibility.
+- **Pricing Catalog (T9)**: Added `deepseek-3.1`, `deepseek-3.2`, and `qwen3-coder-next` pricing entries.
+
+### 📁 New Files
+
+| File                                       | Purpose                                                  |
+| ------------------------------------------ | -------------------------------------------------------- |
+| `open-sse/services/modelFamilyFallback.ts` | Model family definitions and intra-family fallback logic |

 ### Fixed

--- a/README.md
+++ b/README.md
@@ -711,6 +711,14 @@ npm install -g omniroute
 omniroute
 ```

+> **pnpm users:** Run `pnpm approve-builds -g` after install to enable native build scripts required by `better-sqlite3` and `@swc/core`:
+>
+> ```bash
+> pnpm install -g omniroute
+> pnpm approve-builds -g   # Select all packages → approve
+> omniroute
+> ```
+
 Dashboard opens at `http://localhost:20128` and API base URL is `http://localhost:20128/v1`.

 | Command                 | Description                                                 |
@@ -1694,6 +1702,8 @@ Se não quiser criar credenciais próprias agora, ainda é possível usar o flux

 ---

+</details>
+
 ## 🛠️ Tech Stack

 <details>
@@ -1788,17 +1798,9 @@ gh release create v2.0.0 --title "v2.0.0" --generate-notes

 ## 📊 Star History

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

-> 📈 **[View live star history on star-history.com](https://star-history.com/#diegosouzapw/OmniRoute&Date)** — The embedded chart may be cached. Click the link for real-time data.
-
---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 Acknowledgments

--- a/docs/i18n/ar/README.md
+++ b/docs/i18n/ar/README.md
@@ -1651,15 +1651,9 @@ gh release create v2.0.0 --title "v2.0.0" --generate-notes

 ## 📊 تاريخ النجوم

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 شكر وتقدير

--- a/docs/i18n/bg/README.md
+++ b/docs/i18n/bg/README.md
@@ -1659,15 +1659,9 @@ gh release create v2.0.0 --title "v2.0.0" --generate-notes

 ## 📊 Звездна история

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 Благодарности

--- a/docs/i18n/da/README.md
+++ b/docs/i18n/da/README.md
@@ -1660,15 +1660,9 @@ gh release create v2.0.0 --title "v2.0.0" --generate-notes

 ## 📊 Stjernehistorie

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 Tak

--- a/docs/i18n/de/README.md
+++ b/docs/i18n/de/README.md
@@ -1664,15 +1664,9 @@ gh release create v2.0.0 --title "v2.0.0" --generate-notes

 ## 📊 Sterngeschichte

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 Danksagungen

--- a/docs/i18n/es/README.md
+++ b/docs/i18n/es/README.md
@@ -1405,15 +1405,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 Historial de Stars

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 Agradecimientos

--- a/docs/i18n/fi/README.md
+++ b/docs/i18n/fi/README.md
@@ -1555,15 +1555,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 Tähtihistoria

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 Kiitokset

--- a/docs/i18n/fr/README.md
+++ b/docs/i18n/fr/README.md
@@ -1404,15 +1404,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 Historique des Stars

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 Remerciements

--- a/docs/i18n/he/README.md
+++ b/docs/i18n/he/README.md
@@ -1555,15 +1555,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 היסטוריית כוכבים

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 תודות

--- a/docs/i18n/hu/README.md
+++ b/docs/i18n/hu/README.md
@@ -1555,15 +1555,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 Csillagtörténet

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 Köszönetnyilvánítás

--- a/docs/i18n/id/README.md
+++ b/docs/i18n/id/README.md
@@ -1555,15 +1555,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 Sejarah Bintang

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 Ucapan Terima Kasih

--- a/docs/i18n/in/README.md
+++ b/docs/i18n/in/README.md
@@ -1198,15 +1198,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 सितारा इतिहास

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
-  
-    
-    
-    
-  
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 आभार

--- a/docs/i18n/it/README.md
+++ b/docs/i18n/it/README.md
@@ -1403,15 +1403,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 Cronologia Stelle

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 Ringraziamenti

--- a/docs/i18n/ja/README.md
+++ b/docs/i18n/ja/README.md
@@ -1556,15 +1556,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 スターの歴史

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 謝辞

--- a/docs/i18n/ko/README.md
+++ b/docs/i18n/ko/README.md
@@ -1555,15 +1555,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 스타 히스토리

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 감사의 말씀

--- a/docs/i18n/ms/README.md
+++ b/docs/i18n/ms/README.md
@@ -1556,15 +1556,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 Sejarah Bintang

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 Ucapan terima kasih

--- a/docs/i18n/nl/README.md
+++ b/docs/i18n/nl/README.md
@@ -1555,15 +1555,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 Sterrengeschiedenis

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 Dankbetuigingen

--- a/docs/i18n/no/README.md
+++ b/docs/i18n/no/README.md
@@ -1555,15 +1555,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 Stjernehistorie

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 Anerkjennelser

--- a/docs/i18n/phi/README.md
+++ b/docs/i18n/phi/README.md
@@ -1556,15 +1556,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 Kasaysayan ng Bituin

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 Pasasalamat

--- a/docs/i18n/pl/README.md
+++ b/docs/i18n/pl/README.md
@@ -1555,15 +1555,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 Historia gwiazd

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 Podziękowania

--- a/docs/i18n/pt-BR/README.md
+++ b/docs/i18n/pt-BR/README.md
@@ -1468,15 +1468,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 Histórico de Stars

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 Agradecimentos

--- a/docs/i18n/pt/README.md
+++ b/docs/i18n/pt/README.md
@@ -1555,15 +1555,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 História das Estrelas

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 Agradecimentos

--- a/docs/i18n/ro/README.md
+++ b/docs/i18n/ro/README.md
@@ -1557,15 +1557,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 Istoria stelelor

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 Mulțumiri

--- a/docs/i18n/ru/README.md
+++ b/docs/i18n/ru/README.md
@@ -1402,15 +1402,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 История звёзд

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 Благодарности

--- a/docs/i18n/sk/README.md
+++ b/docs/i18n/sk/README.md
@@ -1559,15 +1559,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 História hviezd

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 Poďakovanie

--- a/docs/i18n/sv/README.md
+++ b/docs/i18n/sv/README.md
@@ -1556,15 +1556,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 Stjärnhistorik

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 Tack

--- a/docs/i18n/th/README.md
+++ b/docs/i18n/th/README.md
@@ -1546,15 +1546,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 ประวัติดารา

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏ขอบพระคุณ

--- a/docs/i18n/uk-UA/README.md
+++ b/docs/i18n/uk-UA/README.md
@@ -1561,15 +1561,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 Зоряна історія

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 Подяка

--- a/docs/i18n/vi/README.md
+++ b/docs/i18n/vi/README.md
@@ -1555,15 +1555,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 Lịch sử ngôi sao

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 Lời cảm ơn

--- a/docs/i18n/zh-CN/README.md
+++ b/docs/i18n/zh-CN/README.md
@@ -1401,15 +1401,9 @@ gh release create v1.0.6 --title "v1.0.6" --generate-notes

 ## 📊 Star 历史

-<a href="https://star-history.com/#diegosouzapw/OmniRoute&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=diegosouzapw/OmniRoute&type=Date" />
- </picture>
-</a>
+## Stargazers over time

---
+## [![Stargazers over time](https://starchart.cc/diegosouzapw/OmniRoute.svg?variant=adaptive)](https://starchart.cc/diegosouzapw/OmniRoute)

 ## 🙏 致谢

--- a/open-sse/executors/base.ts
+++ b/open-sse/executors/base.ts
@@ -158,6 +158,9 @@ export class BaseExecutor {
    return status === HTTP_STATUS.RATE_LIMITED && urlIndex + 1 < this.getFallbackCount();
  }

+  // Intra-URL retry config: retry same URL before falling back to next node
+  static readonly RETRY_CONFIG = { maxAttempts: 2, delayMs: 2000 };
+
  // Override in subclass for provider-specific refresh
  async refreshCredentials(credentials: ProviderCredentials, log: ExecutorLog | null) {
    void credentials;
@@ -179,6 +182,8 @@ export class BaseExecutor {
    const fallbackCount = this.getFallbackCount();
    let lastError: unknown = null;
    let lastStatus = 0;
+    // Track per-URL intra-retry attempts to avoid infinite loops
+    const retryAttemptsByUrl: Record<number, number> = {};

    for (let urlIndex = 0; urlIndex < fallbackCount; urlIndex++) {
      const url = this.buildUrl(model, stream, urlIndex, credentials);
@@ -236,6 +241,22 @@ export class BaseExecutor {

        const response = await fetch(url, fetchOptions);

+        // Intra-URL retry: if 429 and we haven't exhausted per-URL retries, wait and retry the same URL
+        if (
+          response.status === HTTP_STATUS.RATE_LIMITED &&
+          (retryAttemptsByUrl[urlIndex] ?? 0) < BaseExecutor.RETRY_CONFIG.maxAttempts
+        ) {
+          retryAttemptsByUrl[urlIndex] = (retryAttemptsByUrl[urlIndex] ?? 0) + 1;
+          const attempt = retryAttemptsByUrl[urlIndex];
+          log?.debug?.(
+            "RETRY",
+            `429 intra-retry ${attempt}/${BaseExecutor.RETRY_CONFIG.maxAttempts} on ${url} — waiting ${BaseExecutor.RETRY_CONFIG.delayMs}ms`
+          );
+          await new Promise((resolve) => setTimeout(resolve, BaseExecutor.RETRY_CONFIG.delayMs));
+          urlIndex--; // re-run this urlIndex on the next loop iteration
+          continue;
+        }
+
        if (this.shouldRetry(response.status, urlIndex)) {
          log?.debug?.("RETRY", `${response.status} on ${url}, trying fallback ${urlIndex + 1}`);
          lastStatus = response.status;
--- a/open-sse/executors/gemini-cli.ts
+++ b/open-sse/executors/gemini-cli.ts
@@ -2,6 +2,8 @@ import { BaseExecutor } from "./base.ts";
 import { PROVIDERS, OAUTH_ENDPOINTS } from "../config/constants.ts";

 export class GeminiCLIExecutor extends BaseExecutor {
+  private _currentModel: string = "";
+
  constructor() {
    super("gemini-cli", PROVIDERS["gemini-cli"]);
  }
@@ -15,11 +17,17 @@ export class GeminiCLIExecutor extends BaseExecutor {
    return {
      "Content-Type": "application/json",
      Authorization: `Bearer ${credentials.accessToken}`,
+      // Fingerprint headers matching native GeminiCLI client (prevents upstream rejection)
+      "User-Agent": `GeminiCLI/0.31.0/${this._currentModel || "unknown"} (linux; x64)`,
+      "X-Goog-Api-Client": "google-genai-sdk/1.41.0 gl-node/v22.19.0",
      ...(stream && { Accept: "text/event-stream" }),
    };
  }

  transformRequest(model, body, stream, credentials) {
+    // Capture model so buildHeaders (called after transformRequest) can include it in User-Agent
+    this._currentModel = model || "";
+
    const allowBodyProjectOverride = process.env.OMNIROUTE_ALLOW_BODY_PROJECT_OVERRIDE === "1";

    // Default: prefer OAuth-stored projectId. Incoming body.project can be stale
--- a/open-sse/handlers/chatCore.ts
+++ b/open-sse/handlers/chatCore.ts
@@ -40,6 +40,7 @@ import {
 } from "@/lib/semanticCache";
 import { getIdempotencyKey, checkIdempotency, saveIdempotency } from "@/lib/idempotencyLayer";
 import { createProgressTransform, wantsProgress } from "../utils/progressTracker.ts";
+import { isModelUnavailableError, getNextFamilyFallback } from "../services/modelFamilyFallback.ts";

 /**
 * Core chat handler - shared between SSE and Worker
@@ -248,6 +249,10 @@ export async function handleChatCore({
  // Track pending request
  trackPendingRequest(model, provider, connectionId, true);

+  // T5: track which models we've tried for intra-family fallback
+  const triedModels = new Set<string>([model]);
+  let currentModel = model;
+
  // Log start
  appendRequestLog({ model, provider, connectionId, status: "PENDING" }).catch(() => {});

@@ -421,7 +426,53 @@ export async function handleChatCore({
    // Update rate limiter from error response headers
    updateFromHeaders(provider, connectionId, providerResponse.headers, statusCode, model);

-    return createErrorResult(statusCode, errMsg, retryAfterMs);
+    // ── T5: Intra-family model fallback ──────────────────────────────────────
+    // Before returning a model-unavailable error upstream, try sibling models
+    // from the same family. This keeps the request alive on the same account
+    // instead of failing the entire combo.
+    if (isModelUnavailableError(statusCode, message)) {
+      const nextModel = getNextFamilyFallback(currentModel, triedModels);
+      if (nextModel) {
+        triedModels.add(nextModel);
+        currentModel = nextModel;
+        translatedBody.model = nextModel;
+        log?.info?.("MODEL_FALLBACK", `${model} unavailable (${statusCode}) → trying ${nextModel}`);
+        // Re-execute with the fallback model
+        try {
+          const fallbackResult = await withRateLimit(provider, connectionId, nextModel, () =>
+            executor.execute({
+              model: nextModel,
+              body: translatedBody,
+              stream,
+              credentials,
+              signal: streamController.signal,
+              log,
+              extendedContext,
+            })
+          );
+          if (fallbackResult.response.ok) {
+            providerResponse = fallbackResult.response;
+            providerUrl = fallbackResult.url;
+            providerHeaders = fallbackResult.headers;
+            finalBody = fallbackResult.transformedBody;
+            // Continue processing with the fallback response — skip error return
+            log?.info?.("MODEL_FALLBACK", `Serving ${nextModel} as fallback for ${model}`);
+            // Jump to streaming/non-streaming handling below
+            // We fall through by NOT returning here
+          } else {
+            // Fallback also failed — return original error
+            return createErrorResult(statusCode, errMsg, retryAfterMs);
+          }
+        } catch {
+          return createErrorResult(statusCode, errMsg, retryAfterMs);
+        }
+      } else {
+        return createErrorResult(statusCode, errMsg, retryAfterMs);
+      }
+    } else {
+      return createErrorResult(statusCode, errMsg, retryAfterMs);
+    }
+    // ── End T5 ───────────────────────────────────────────────────────────────
  }

  // Non-streaming response
--- a/open-sse/services/autoCombo/index.ts
+++ b/open-sse/services/autoCombo/index.ts
@@ -3,6 +3,7 @@
 */
 export {
  calculateScore,
+  calculateTierScore,
  scorePool,
  validateWeights,
  DEFAULT_WEIGHTS,
--- a/open-sse/services/autoCombo/modePacks.ts
+++ b/open-sse/services/autoCombo/modePacks.ts
@@ -11,37 +11,45 @@
 import type { ScoringWeights } from "./scoring";

 export const MODE_PACKS: Record<string, ScoringWeights> = {
+  // Prioritize latency → health. tierPriority replaces 0.05 from stability.
  "ship-fast": {
    quota: 0.15,
    health: 0.3,
    costInv: 0.05,
    latencyInv: 0.35,
    taskFit: 0.1,
-    stability: 0.05,
+    stability: 0.0,
+    tierPriority: 0.05,
  },
+  // Prioritize cost. tierPriority replaces 0.05 from stability.
  "cost-saver": {
    quota: 0.15,
    health: 0.2,
    costInv: 0.4,
    latencyInv: 0.05,
    taskFit: 0.1,
-    stability: 0.1,
+    stability: 0.05,
+    tierPriority: 0.05,
  },
+  // Prioritize task fitness. tierPriority replaces 0.05 from latencyInv.
  "quality-first": {
    quota: 0.1,
    health: 0.2,
    costInv: 0.05,
-    latencyInv: 0.1,
+    latencyInv: 0.05,
    taskFit: 0.4,
    stability: 0.15,
+    tierPriority: 0.05,
  },
+  // Prioritize quota availability. tierPriority replaces 0.05 from taskFit.
  "offline-friendly": {
    quota: 0.4,
    health: 0.3,
    costInv: 0.1,
    latencyInv: 0.05,
-    taskFit: 0.05,
+    taskFit: 0.0,
    stability: 0.1,
+    tierPriority: 0.05,
  },
 };

--- a/open-sse/services/autoCombo/scoring.ts
+++ b/open-sse/services/autoCombo/scoring.ts
@@ -17,6 +17,7 @@ export interface ScoringFactors {
  latencyInv: number;
  taskFit: number;
  stability: number;
+  tierPriority: number; // T10: Ultra > Pro > Free account tier boost
 }

 export interface ScoringWeights {
@@ -26,15 +27,18 @@ export interface ScoringWeights {
  latencyInv: number;
  taskFit: number;
  stability: number;
+  tierPriority: number; // T10
 }

+// T10: Rebalanced — stability 0.10→0.05, tierPriority 0.05 added. Sum = 1.0.
 export const DEFAULT_WEIGHTS: ScoringWeights = {
  quota: 0.2,
  health: 0.25,
  costInv: 0.2,
  latencyInv: 0.15,
  taskFit: 0.1,
-  stability: 0.1,
+  stability: 0.05,
+  tierPriority: 0.05,
 };

 export interface ProviderCandidate {
@@ -47,6 +51,10 @@ export interface ProviderCandidate {
  p95LatencyMs: number;
  latencyStdDev: number;
  errorRate: number;
+  /** T10: Optional account tier for priority boosting (Ultra > Pro > Free) */
+  accountTier?: "ultra" | "pro" | "standard" | "free";
+  /** T10: Optional quota reset interval in seconds (shorter = higher priority when same quota) */
+  quotaResetIntervalSecs?: number;
 }

 export interface ScoredProvider {
@@ -70,6 +78,38 @@ export function calculateScore(factors: ScoringFactors, weights: ScoringWeights)
  );
 }

+/**
+ * T10: Convert account tier string to a normalized score [0..1].
+ * Ultra = 1.0 (most quota, fastest reset)
+ * Pro   = 0.67
+ * Standard = 0.33
+ * Free  = 0.0
+ * Accounts with faster reset cycles (shorter quotaResetIntervalSecs) also get
+ * a small adjustment: monthly accounts are penalized vs. daily accounts.
+ */
+export function calculateTierScore(
+  tier: string | undefined,
+  quotaResetIntervalSecs: number | undefined
+): number {
+  const BASE_TIER_SCORES: Record<string, number> = {
+    ultra: 1.0,
+    pro: 0.67,
+    standard: 0.33,
+    free: 0.0,
+  };
+  const baseScore = BASE_TIER_SCORES[tier?.toLowerCase() ?? ""] ?? 0.33; // unknown defaults to standard
+
+  // Bonus for faster reset intervals (daily quota > weekly > monthly)
+  // maxInterval ~ 30 days (2_592_000s). Normalize: [0..1] where 0=monthly, 1=per-minute
+  const resetBonus =
+    quotaResetIntervalSecs != null && quotaResetIntervalSecs > 0
+      ? Math.max(0, 1 - quotaResetIntervalSecs / 2_592_000)
+      : 0;
+
+  // Blend: 80% tier level, 20% reset frequency
+  return Math.min(1, baseScore * 0.8 + resetBonus * 0.2);
+}
+
 /**
 * Calculate individual factors for a provider within its pool.
 */
@@ -96,6 +136,7 @@ export function calculateFactors(
    latencyInv: 1 - candidate.p95LatencyMs / maxLatency,
    taskFit: getTaskFitness(candidate.model, taskType),
    stability: 1 - candidate.latencyStdDev / maxStdDev,
+    tierPriority: calculateTierScore(candidate.accountTier, candidate.quotaResetIntervalSecs),
  };
 }

--- a/open-sse/services/modelFamilyFallback.ts
+++ b/open-sse/services/modelFamilyFallback.ts
@@ -0,0 +1,157 @@
+/**
+ * Model Family Fallback — Phase 2 Feature (T5)
+ *
+ * Implements two-phase model resolution:
+ *   Phase 1 (static, pre-request): already done by model.ts alias resolution.
+ *   Phase 2 (dynamic, post-error): when a provider returns a model-not-available
+ *   error (400 with specific message or 404), we try sibling models within the
+ *   same "family" before giving up.
+ *
+ * Inspired by Antigravity Manager's account-aware dynamic model remapping
+ * (commit 6cea566, Mar 8 2026).
+ */
+
+// ── Model Family Definitions ─────────────────────────────────────────────────
+
+/**
+ * Ordered candidate lists per model family.
+ * First entry is the most preferred; fallback proceeds in order.
+ */
+const MODEL_FAMILIES: Record<string, string[]> = {
+  // Gemini 3 / 3.1 Pro family — ordered by preference
+  "gemini-3-pro": [
+    "gemini-3.1-pro-preview",
+    "gemini-3-pro-preview",
+    "gemini-3.1-pro-high",
+    "gemini-3-pro-high",
+    "gemini-3.1-pro-low",
+    "gemini-3-pro-low",
+  ],
+  "gemini-3.1-pro": [
+    "gemini-3.1-pro-preview",
+    "gemini-3-pro-preview",
+    "gemini-3.1-pro-high",
+    "gemini-3-pro-high",
+    "gemini-3.1-pro-low",
+    "gemini-3-pro-low",
+  ],
+  "gemini-3-pro-preview": [
+    "gemini-3.1-pro-preview",
+    "gemini-3-pro-high",
+    "gemini-3.1-pro-high",
+    "gemini-3-pro-low",
+    "gemini-3.1-pro-low",
+  ],
+  "gemini-3.1-pro-preview": [
+    "gemini-3-pro-preview",
+    "gemini-3.1-pro-high",
+    "gemini-3-pro-high",
+    "gemini-3.1-pro-low",
+    "gemini-3-pro-low",
+  ],
+  "gemini-3-pro-high": [
+    "gemini-3.1-pro-high",
+    "gemini-3-pro-preview",
+    "gemini-3.1-pro-preview",
+    "gemini-3-pro-low",
+    "gemini-3.1-pro-low",
+  ],
+  "gemini-3.1-pro-high": [
+    "gemini-3-pro-high",
+    "gemini-3.1-pro-preview",
+    "gemini-3-pro-preview",
+    "gemini-3.1-pro-low",
+    "gemini-3-pro-low",
+  ],
+
+  // Gemini 2.5 Pro family
+  "gemini-2.5-pro": ["gemini-2.5-pro-preview-06-05", "gemini-2.5-pro-exp-03-25"],
+  "gemini-2.5-pro-preview-06-05": ["gemini-2.5-pro", "gemini-2.5-pro-exp-03-25"],
+
+  // Claude Opus family
+  "claude-opus-4-6": ["claude-opus-4-6-thinking", "claude-opus-4-5-20251101", "claude-sonnet-4-6"],
+  "claude-opus-4-6-thinking": ["claude-opus-4-6", "claude-opus-4-5-20251101"],
+
+  // Claude Sonnet family
+  "claude-sonnet-4-6": ["claude-sonnet-4-5-20250929", "claude-sonnet-4-20250514"],
+  "claude-sonnet-4-5-20250929": ["claude-sonnet-4-6", "claude-sonnet-4-20250514"],
+
+  // GPT-5 family
+  "gpt-5": ["gpt-5-mini", "gpt-4o"],
+  "gpt-5.1": ["gpt-5.1-mini", "gpt-5", "gpt-4o"],
+};
+
+// ── Error Detection ──────────────────────────────────────────────────────────
+
+/**
+ * Error message fragments that indicate the requested model is unavailable
+ * for the current account/provider, as opposed to a transient error.
+ */
+const MODEL_UNAVAILABLE_FRAGMENTS = [
+  "model not found",
+  "model_not_found",
+  "model not available",
+  "model is not available",
+  "no such model",
+  "unsupported model",
+  "unknown model",
+  "this model does not exist",
+  "invalid model",
+  "model not supported",
+  "does not support",
+  "not enabled for",
+  "access to model",
+];
+
+/**
+ * Returns true if the HTTP status + error message indicates the model
+ * itself is not available, not a transient server error.
+ */
+export function isModelUnavailableError(status: number, errorMessage: string): boolean {
+  if (status === 404) return true;
+  if (status !== 400 && status !== 403) return false;
+
+  const msg = errorMessage.toLowerCase();
+  return MODEL_UNAVAILABLE_FRAGMENTS.some((fragment) => msg.includes(fragment));
+}
+
+// ── Fallback Resolution ──────────────────────────────────────────────────────
+
+/**
+ * Get the next fallback model from the same family.
+ *
+ * @param currentModel  The model that just failed
+ * @param triedModels   Set of model IDs already tried (to avoid cycles)
+ * @returns             Next model to try, or null if family exhausted
+ */
+export function getNextFamilyFallback(
+  currentModel: string,
+  triedModels: Set<string>
+): string | null {
+  const family = MODEL_FAMILIES[currentModel];
+  if (!family) return null;
+
+  for (const candidate of family) {
+    if (!triedModels.has(candidate)) {
+      return candidate;
+    }
+  }
+
+  return null; // family exhausted
+}
+
+/**
+ * Check if a model belongs to any registered family.
+ */
+export function isInModelFamily(model: string): boolean {
+  return model in MODEL_FAMILIES;
+}
+
+/**
+ * Get all members of a model's family (including itself).
+ */
+export function getModelFamily(model: string): string[] {
+  const family = MODEL_FAMILIES[model];
+  if (!family) return [model];
+  return [model, ...family];
+}
--- a/open-sse/translator/request/openai-to-claude.ts
+++ b/open-sse/translator/request/openai-to-claude.ts
@@ -24,6 +24,7 @@ type ClaudeTool = {
  description: string;
  input_schema: Record<string, unknown>;
  cache_control?: { type: string; ttl?: string };
+  defer_loading?: boolean;
 };

 // Convert OpenAI request to Claude format
@@ -193,6 +194,23 @@ export function openaiToClaudeRequest(model, body, stream) {
    result.tool_choice = convertOpenAIToolChoice(body.tool_choice);
  }

+  // response_format: inject JSON structured output instruction into system prompt.
+  // Claude doesn't natively support response_format, so we insert a system-level instruction.
+  // NOTE: systemParts are consumed later (after this block) — they're accumulated here.
+  if (body.response_format) {
+    const fmt = body.response_format;
+    if (fmt.type === "json_schema" && fmt.json_schema?.schema) {
+      const schemaJson = JSON.stringify(fmt.json_schema.schema, null, 2);
+      systemParts.push(
+        `You must respond with valid JSON that strictly follows this JSON schema:\n\`\`\`json\n${schemaJson}\n\`\`\`\nRespond ONLY with the JSON object, no other text.`
+      );
+    } else if (fmt.type === "json_object") {
+      systemParts.push(
+        "You must respond with valid JSON. Respond ONLY with a JSON object, no other text."
+      );
+    }
+  }
+
  // Thinking configuration
  if (body.thinking) {
    result.thinking = {
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
  "name": "omniroute",
-  "version": "2.3.3",
+  "version": "2.3.12",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "omniroute",
-      "version": "2.3.3",
+      "version": "2.3.12",
      "hasInstallScript": true,
      "license": "MIT",
      "workspaces": [
@@ -8979,6 +8979,15 @@
        }
      }
    },
+    "node_modules/next/node_modules/@swc/helpers": {
+      "version": "0.5.15",
+      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.15.tgz",
+      "integrity": "sha512-JQ5TuMi45Owi4/BIMAJBoSQoOJu12oOk/gADqlcUL9JEdHB8vyjUSsxqeNXnmXHjYKMi2WcYtezGEEhqUI/E2g==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "tslib": "^2.8.0"
+      }
+    },
    "node_modules/next/node_modules/postcss": {
      "version": "8.4.31",
      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.31.tgz",
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
  "name": "omniroute",
-  "version": "2.3.12",
+  "version": "2.3.13",
  "description": "Smart AI Router with auto fallback — route to FREE & cheap models, zero downtime. Works with Cursor, Cline, Claude Desktop, Codex, and any OpenAI-compatible tool.",
  "type": "module",
  "bin": {
@@ -143,7 +143,14 @@
      "prettier --write"
    ]
  },
-  "overrides": {
-    "@swc/helpers": "0.5.19"
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "@parcel/watcher",
+      "@swc/core",
+      "better-sqlite3",
+      "esbuild",
+      "omniroute",
+      "sharp"
+    ]
  }
 }
--- a/src/app/api/settings/route.ts
+++ b/src/app/api/settings/route.ts
@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { getSettings, updateSettings } from "@/lib/localDb";
 import { clearHealthCheckLogCache } from "@/lib/tokenHealthCheck";
 import bcrypt from "bcryptjs";
+import { timingSafeEqual } from "node:crypto";
 import { getRuntimePorts } from "@/lib/runtime/ports";
 import { updateSettingsSchema } from "@/shared/validation/settingsSchemas";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
@@ -60,10 +61,32 @@ export async function PATCH(request) {
          return NextResponse.json({ error: "Invalid current password" }, { status: 401 });
        }
      } else {
-        // First time setting password, no current password needed
-        // Allow empty currentPassword or default "123456"
-        if (body.currentPassword && body.currentPassword !== "123456") {
-          return NextResponse.json({ error: "Invalid current password" }, { status: 401 });
+        // First-time password set (no DB hash yet).
+        const LEGACY_DEFAULT_PASSWORD = "123456";
+        const initialPassword = process.env.INITIAL_PASSWORD;
+        const currentPassword = body.currentPassword || "";
+
+        if (initialPassword) {
+          // If deploy is configured with INITIAL_PASSWORD, require explicit match.
+          if (!currentPassword) {
+            return NextResponse.json({ error: "Current password required" }, { status: 400 });
+          }
+
+          const providedBuffer = Buffer.from(currentPassword, "utf8");
+          const expectedBuffer = Buffer.from(initialPassword, "utf8");
+          const isValidInitialPassword =
+            providedBuffer.length === expectedBuffer.length &&
+            timingSafeEqual(providedBuffer, expectedBuffer);
+
+          if (!isValidInitialPassword) {
+            return NextResponse.json({ error: "Invalid current password" }, { status: 401 });
+          }
+        } else {
+          // Legacy compatibility: instances without INITIAL_PASSWORD may still use old default.
+          const allowedWithoutHash = ["", LEGACY_DEFAULT_PASSWORD];
+          if (!allowedWithoutHash.includes(currentPassword)) {
+            return NextResponse.json({ error: "Invalid current password" }, { status: 401 });
+          }
        }
      }

--- a/src/lib/apiBridgeServer.ts
+++ b/src/lib/apiBridgeServer.ts
@@ -2,7 +2,23 @@ import http from "node:http";
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { getRuntimePorts } from "@/lib/runtime/ports";

-const PROXY_TIMEOUT_MS = 30_000; // 30s timeout to prevent resource exhaustion
+const DEFAULT_PROXY_TIMEOUT_MS = 30_000;
+
+function parseProxyTimeoutMs(raw: string | undefined): number {
+  if (raw == null || raw.trim() === "") return DEFAULT_PROXY_TIMEOUT_MS;
+  const parsed = Number(raw);
+
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    console.warn(
+      `[API Bridge] Invalid API_BRIDGE_PROXY_TIMEOUT_MS=\"${raw}\". Using default ${DEFAULT_PROXY_TIMEOUT_MS}ms.`
+    );
+    return DEFAULT_PROXY_TIMEOUT_MS;
+  }
+
+  return Math.floor(parsed);
+}
+
+const PROXY_TIMEOUT_MS = parseProxyTimeoutMs(process.env.API_BRIDGE_PROXY_TIMEOUT_MS);

 const OPENAI_COMPAT_PATHS = [
  /^\/v1(?:\/|$)/,
--- a/src/shared/constants/pricing.ts
+++ b/src/shared/constants/pricing.ts
@@ -138,6 +138,14 @@ export const DEFAULT_PRICING = {
      reasoning: 6.0,
      cache_creation: 1.0,
    },
+    // Next-generation Qwen Coder tier (added Mar 2026 from decolua/9router catalog)
+    "qwen3-coder-next": {
+      input: 2.0,
+      output: 8.0,
+      cached: 1.0,
+      reasoning: 12.0,
+      cache_creation: 2.0,
+    },
    "qwen3-coder-flash": {
      input: 0.5,
      output: 2.0,
@@ -198,6 +206,21 @@ export const DEFAULT_PRICING = {
      reasoning: 4.5,
      cache_creation: 0.75,
    },
+    // Short-form aliases used by decolua/9router catalog (Mar 2026)
+    "deepseek-3.1": {
+      input: 0.27,
+      output: 1.1,
+      cached: 0.07,
+      reasoning: 2.2,
+      cache_creation: 0.27,
+    },
+    "deepseek-3.2": {
+      input: 0.27,
+      output: 1.1,
+      cached: 0.07,
+      reasoning: 2.2,
+      cache_creation: 0.27,
+    },
    "minimax-m2": {
      input: 0.5,
      output: 2.0,
--- a/src/shared/services/cliRuntime.ts
+++ b/src/shared/services/cliRuntime.ts
@@ -198,7 +198,26 @@ const resolveToolCommands = (toolId: string): string[] => {
  return tool.defaultCommand ? [tool.defaultCommand] : [];
 };

+/**
+ * T12: Validate a CLI executable path to prevent shell injection.
+ * Enforces: absolute path, no dangerous shell metacharacters, must exist and be a file.
+ * Inspired by Antigravity Manager commit 96732c2 (Mar 11, 2026).
+ */
+const DANGEROUS_PATH_CHARS = ["&", "|", ";", "<", ">", "(", ")", "`", "$", "^", "%", "!"];
+
+const isSafePath = (execPath: string): boolean => {
+  if (!execPath || !path.isAbsolute(execPath)) return false;
+  if (DANGEROUS_PATH_CHARS.some((c) => execPath.includes(c))) return false;
+  // Allow path.sep and path.delimiter — no further character filtering needed
+  return true;
+};
+
 const checkExplicitPath = async (commandPath: string) => {
+  // Reject paths that look like injection attempts
+  if (!isSafePath(commandPath)) {
+    return { installed: false, commandPath: null, reason: "unsafe_path" };
+  }
+
  try {
    await fs.access(commandPath, fs.constants.F_OK);
  } catch {
--- a/src/shared/validation/schemas.ts
+++ b/src/shared/validation/schemas.ts
@@ -785,10 +785,13 @@ export const updateProviderConnectionSchema = z
 export const providersBatchTestSchema = z
  .object({
    mode: z.enum(["provider", "oauth", "free", "apikey", "compatible", "all"]),
-    providerId: z.string().trim().min(1).optional(),
+    // Frontend may send null when mode != 'provider' — accept and treat as missing
+    providerId: z.string().trim().min(1).nullable().optional(),
  })
  .superRefine((value, ctx) => {
-    if (value.mode === "provider" && !value.providerId) {
+    // Treat null same as undefined
+    const pid = value.providerId ?? null;
+    if (value.mode === "provider" && !pid) {
      ctx.addIssue({
        code: z.ZodIssueCode.custom,
        message: "providerId is required when mode=provider",
Author	SHA1	Message	Date
diegosouzapw	f6c0744d67	feat(release): v2.3.13 — tiered quota scoring, model fallback, auth fixes, pnpm fix - Tiered quota scoring (Ultra>Pro>Free) as 7th Auto-Combo factor - Intra-family model fallback on 404/400/403 errors - Configurable API bridge timeout (API_BRIDGE_PROXY_TIMEOUT_MS) - INITIAL_PASSWORD accepted on first login with timingSafeEqual - README </details> truncation fix (affects all GitHub renders) - pnpm @swc/helpers override conflict removed - CLI path injection hardening (isSafePath validator) - 429 retry, Gemini CLI headers, Claude response_format injection - deepseek-3.1/3.2, qwen3-coder-next pricing added - starchart.cc star widget in all 30 READMEs	2026-03-12 18:18:53 -03:00
diegosouzapw	639b49fc5b	fix(ci): regenerate package-lock.json after removing @swc/helpers override The @swc/helpers override removal changed dependency resolution. npm ci was failing with 'Missing: @swc/helpers@0.5.15 from lock file'. Updated lock file with npm install --package-lock-only.	2026-03-12 18:17:45 -03:00
diegosouzapw	c0252f7b13	docs: replace star-history.com widget with starchart.cc in all READMEs star-history.com embeds are often cached and slow to update. The new starchart.cc widget (variant=adaptive) renders better on both light and dark themes and updates in real-time. Updated: README.md + 29 i18n locale READMEs	2026-03-12 18:15:38 -03:00
diegosouzapw	a87d64372f	feat: Phase 1 & 2 implementation plan — T1-T10, T12 T1 (openai-to-claude.ts): response_format injection for json_schema/json_object T2 (base.ts): intra-URL retry for 429 errors (2x, 2s delay) T3 (gemini-cli.ts): CLI fingerprint headers (User-Agent, X-Goog-Api-Client) T5 (modelFamilyFallback.ts + chatCore.ts): intra-family model fallback on 400/404 T9 (pricing.ts): deepseek-3.1, deepseek-3.2, qwen3-coder-next pricing T10 (scoring.ts + modePacks.ts): tierPriority as 7th scoring factor (Ultra>Pro>Free) T12 (cliRuntime.ts): isSafePath() guard for CLI_*_BIN env var paths	2026-03-12 18:06:53 -03:00
diegosouzapw	02b19e63e8	fix(pnpm): remove @swc/helpers override conflict, add pnpm build-scripts config (#328 ) The @swc/helpers override in package.json duplicated the direct dependency at the exact same version (0.5.19), causing 'EOVERRIDE' errors when pnpm users tried to rebuild native modules like better-sqlite3. Fixes: - Remove redundant 'overrides' block (direct dep already pins 0.5.19) - Add pnpm.onlyBuiltDependencies for @parcel/watcher, @swc/core, better-sqlite3, esbuild, omniroute, sharp (replaces pnpm approve-builds) - Add pnpm usage note to README Quick Start Closes #328	2026-03-12 18:06:27 -03:00
diegosouzapw	dba16363b7	fix(api-bridge): make proxy timeout configurable via env (#332 ) Add API_BRIDGE_PROXY_TIMEOUT_MS env var to configure the api-bridge proxy timeout. Default remains 30000ms for backward compatibility. Handles invalid values with a warning log. Co-authored-by: hijak <54431520+hijak@users.noreply.github.com>	2026-03-12 18:04:44 -03:00
diegosouzapw	d20a2b3e44	fix(auth): accept INITIAL_PASSWORD when changing first password (#333 ) - Use timingSafeEqual for constant-time password comparison - Require non-empty currentPassword when INITIAL_PASSWORD env is set - Legacy fallback: allow empty or '123456' when no INITIAL_PASSWORD Co-authored-by: hijak <54431520+hijak@users.noreply.github.com>	2026-03-12 18:04:20 -03:00
diegosouzapw	677f5f8713	fix(docs): add missing </details> closing tag in Troubleshooting section The outer <details> block at line 1459 was never closed, causing GitHub to stop rendering everything below Troubleshooting (Tech Stack, Docs, Roadmap, Contributors, etc.). Fixes: README truncation on GitHub	2026-03-12 18:03:43 -03:00
diegosouzapw	7da23a90d4	feat: Make `providerId` nullable in `providersBatchTestSchema` and update validation to treat `null` as an absent value.	2026-03-12 17:08:26 -03:00
jack	55a9e31932	fix(auth): use timing-safe compare for INITIAL_PASSWORD check	2026-03-12 17:28:04 +00:00
jack	e62be7e6b3	fix(auth): require explicit INITIAL_PASSWORD match on first password change	2026-03-12 17:04:26 +00:00
jack	7f9ec724ae	fix(api-bridge): validate configured proxy timeout value	2026-03-12 17:02:30 +00:00
jack	daaa3a8782	fix(auth): allow INITIAL_PASSWORD when updating first password	2026-03-12 17:00:01 +00:00
jack	d1c62420bf	fix(api-bridge): make proxy timeout configurable via env	2026-03-12 16:59:10 +00:00