docs(3.0.0-rc.5): comprehensive CHANGELOG and README vs v2.9.5

- CHANGELOG: [3.0.0-rc.5] section now serves as full 'What's New vs v2.9.5': * 2 new providers (OpenCode Zen/Go via PR #530) * 3 new features: Registered Keys API (#464), provider icons (#529), model auto-sync (#488) * 10 bug fixes (#521, #522, #524, #527, #532, #535, #536, #537, #489, #510, #492) * 16 issues resolved total, DB migration 008 - README: added 'What's New in v3.0.0' table section after badges
feat(3.0.0-rc.5): Registered Keys Provisioning API (#464 )
2026-07-26 09:52:11 +03:00 · 2026-03-22 15:51:54 -03:00 · 2026-03-22 15:33:45 -03:00 · 2026-03-22 15:23:00 -03:00 · 2026-03-22 15:22:38 -03:00 · 2026-03-22 15:22:38 -03:00
23 changed files with 9170 additions and 97 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,163 @@

 ## [Unreleased]

+> **Coming next** — see [3.0.0-rc branch](https://github.com/diegosouzapw/OmniRoute/tree/3.0.0-rc).
+
+---
+
+## [3.0.0-rc.5] — 2026-03-22 _(What's New vs v2.9.5 — will be released as v3.0.0)_
+
+> **Upgrade from v2.9.5:** 16 issues resolved · 2 community PRs merged · 2 new providers · 7 new API endpoints · 3 new features · DB migration 008 · 832 tests passing.
+
+### 🆕 New Providers
+
+| Provider         | Alias          | Tier | Notes                                                          |
+| ---------------- | -------------- | ---- | -------------------------------------------------------------- |
+| **OpenCode Zen** | `opencode-zen` | Free | 3 models via `opencode.ai/zen/v1` (PR #530 by @kang-heewon)    |
+| **OpenCode Go**  | `opencode-go`  | Paid | 4 models via `opencode.ai/zen/go/v1` (PR #530 by @kang-heewon) |
+
+Both providers use the new `OpencodeExecutor` with multi-format routing (`/chat/completions`, `/messages`, `/responses`, `/models/{model}:generateContent`).
+
+---
+
+### ✨ New Features
+
+#### 🔑 Registered Keys Provisioning API (#464)
+
+Auto-generate and issue OmniRoute API keys programmatically with per-provider and per-account quota enforcement.
+
+| Endpoint                              | Method    | Description                                      |
+| ------------------------------------- | --------- | ------------------------------------------------ |
+| `/api/v1/registered-keys`             | `POST`    | Issue a new key — raw key returned **once only** |
+| `/api/v1/registered-keys`             | `GET`     | List registered keys (masked)                    |
+| `/api/v1/registered-keys/{id}`        | `GET`     | Get key metadata                                 |
+| `/api/v1/registered-keys/{id}`        | `DELETE`  | Revoke a key                                     |
+| `/api/v1/registered-keys/{id}/revoke` | `POST`    | Revoke (for clients without DELETE support)      |
+| `/api/v1/quotas/check`                | `GET`     | Pre-validate quota before issuing                |
+| `/api/v1/providers/{id}/limits`       | `GET/PUT` | Configure per-provider issuance limits           |
+| `/api/v1/accounts/{id}/limits`        | `GET/PUT` | Configure per-account issuance limits            |
+| `/api/v1/issues/report`               | `POST`    | Report quota events to GitHub Issues             |
+
+**DB — Migration 008:** Three new tables: `registered_keys`, `provider_key_limits`, `account_key_limits`.
+**Security:** Keys stored as SHA-256 hashes. Raw key shown once on creation, never retrievable again.
+**Quota types:** `maxActiveKeys`, `dailyIssueLimit`, `hourlyIssueLimit` per provider and per account.
+**Idempotency:** `idempotency_key` field prevents duplicate issuance. Returns `409 IDEMPOTENCY_CONFLICT` if key was already used.
+**Budget per key:** `dailyBudget` / `hourlyBudget` — limits how many requests a key can route per window.
+**GitHub reporting:** Optional. Set `GITHUB_ISSUES_REPO` + `GITHUB_ISSUES_TOKEN` to auto-create GitHub issues on quota exceeded or issuance failures.
+
+#### 🎨 Provider Icons — @lobehub/icons (#529)
+
+All provider icons in the dashboard now use `@lobehub/icons` React components (130+ providers with SVG).
+Fallback chain: **Lobehub SVG → existing `/providers/{id}.png` → generic icon**. Uses a proper React `ErrorBoundary` pattern.
+
+#### 🔄 Model Auto-Sync Scheduler (#488)
+
+OmniRoute now automatically refreshes model lists for connected providers every **24 hours**.
+
+- Runs on server startup via the existing `/api/sync/initialize` hook
+- Configurable via `MODEL_SYNC_INTERVAL_HOURS` environment variable
+- Covers 16 major providers
+- Records last sync time in the settings database
+
+---
+
+### 🔧 Bug Fixes
+
+#### OAuth & Auth
+
+- **#537 — Gemini CLI OAuth:** Clear actionable error when `GEMINI_OAUTH_CLIENT_SECRET` is missing in Docker/self-hosted deployments. Previously showed cryptic `client_secret is missing` from Google. Now provides specific `docker-compose.yml` and `~/.omniroute/.env` instructions.
+
+#### Providers & Routing
+
+- **#536 — LongCat AI:** Fixed `baseUrl` (`api.longcat.chat/openai`) and `authHeader` (`Authorization: Bearer`).
+- **#535 — Pinned model override:** `body.model` is now correctly set to `pinnedModel` when context-cache protection is active.
+- **#532 — OpenCode Go key validation:** Now uses the `zen/v1` test endpoint (`testKeyBaseUrl`) — same key works for both tiers.
+
+#### CLI & Tools
+
+- **#527 — Claude Code + Codex loop:** `tool_result` blocks are now converted to text instead of dropped, stopping infinite tool-result loops.
+- **#524 — OpenCode config save:** Added `saveOpenCodeConfig()` handler (XDG_CONFIG_HOME aware, writes TOML).
+- **#521 — Login stuck:** Login no longer freezes after skipping password setup — redirects correctly to onboarding.
+- **#522 — API Manager:** Removed misleading "Copy masked key" button (replaced with a lock icon tooltip).
+- **#532 — OpenCode Go config:** Guide settings handler now handles `opencode` toolId.
+
+#### Developer Experience
+
+- **#489 — Antigravity:** Missing `googleProjectId` returns a structured 422 error with reconnect guidance instead of a cryptic crash.
+- **#510 — Windows paths:** MSYS2/Git-Bash paths (`/c/Program Files/...`) are now normalized to `C:\\Program Files\\...` automatically.
+- **#492 — CLI startup:** `omniroute` CLI now detects `mise`/`nvm`-managed Node when `app/server.js` is missing and shows targeted fix instructions.
+
+---
+
+### 📖 Documentation Updates
+
+- **#513** — Docker password reset: `INITIAL_PASSWORD` env var workaround documented
+- **#520** — pnpm: `pnpm approve-builds better-sqlite3` step documented
+
+---
+
+### ✅ Issues Resolved in v3.0.0
+
+`#464` `#488` `#489` `#492` `#510` `#513` `#520` `#521` `#522` `#524` `#527` `#529` `#532` `#535` `#536` `#537`
+
+---
+
+### 🔀 Community PRs Merged
+
+| PR       | Author       | Summary                                                                |
+| -------- | ------------ | ---------------------------------------------------------------------- |
+| **#530** | @kang-heewon | OpenCode Zen + Go providers with `OpencodeExecutor` and improved tests |
+
+---
+
+## [3.0.0-rc.5] - 2026-03-22
+
+### ✨ New Features
+
+- **#464** — Registered Keys Provisioning API: auto-issue API keys with per-provider & per-account quota enforcement
+  - `POST /api/v1/registered-keys` — issue keys with idempotency support
+  - `GET /api/v1/registered-keys` — list (masked) registered keys
+  - `GET /api/v1/registered-keys/{id}` — get key metadata
+  - `DELETE /api/v1/registered-keys/{id}` / `POST ../{id}/revoke` — revoke keys
+  - `GET /api/v1/quotas/check` — pre-validate before issuing
+  - `PUT /api/v1/providers/{id}/limits` — set provider issuance limits
+  - `PUT /api/v1/accounts/{id}/limits` — set account issuance limits
+  - `POST /api/v1/issues/report` — optional GitHub issue reporting
+  - DB migration 008: `registered_keys`, `provider_key_limits`, `account_key_limits` tables
+
+---
+
+## [3.0.0-rc.4] - 2026-03-22
+
+### ✨ New Features
+
+- **#530 (PR)** — OpenCode Zen and OpenCode Go providers added (by @kang-heewon)
+  - New `OpencodeExecutor` with multi-format routing (`/chat/completions`, `/messages`, `/responses`)
+  - 7 models across both tiers
+
+---
+
+## [3.0.0-rc.3] - 2026-03-22
+
+### ✨ New Features
+
+- **#529** — Provider icons now use [@lobehub/icons](https://github.com/lobehub/lobe-icons) with graceful PNG fallback and a `ProviderIcon` component (130+ providers supported)
+- **#488** — Auto-update model lists every 24h via `modelSyncScheduler` (configurable via `MODEL_SYNC_INTERVAL_HOURS`)
+
+### 🔧 Bug Fixes
+
+- **#537** — Gemini CLI OAuth: now shows clear actionable error when `GEMINI_OAUTH_CLIENT_SECRET` is missing in Docker/self-hosted deployments
+
+---
+
+## [3.0.0-rc.2] - 2026-03-22
+
+### 🔧 Bug Fixes
+
+- **#536** — LongCat AI key validation: fixed baseUrl (`api.longcat.chat/openai`) and authHeader (`Authorization: Bearer`)
+- **#535** — Pinned model override: `body.model` is now set to `pinnedModel` when context-cache protection detects a pinned model
+- **#524** — OpenCode config now saved correctly: added `saveOpenCodeConfig()` handler (XDG_CONFIG_HOME aware, writes TOML)
+
 ---

 ## [3.0.0-rc.1] - 2026-03-22
--- a/README.md
+++ b/README.md
@@ -26,6 +26,25 @@ _Your universal API proxy — one endpoint, 44+ providers, zero downtime. Now wi

 ---

+## 🆕 What's New in v3.0.0
+
+> **Upgrading from v2.9.5?** — See the [full CHANGELOG](CHANGELOG.md#300--2026-03-22-release-candidate--not-yet-merged-to-main) for all changes.
+
+| Area                         | Change                                                                                                                                                                    |
+| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| 🔑 **Registered Keys API**   | Auto-provision API keys via `POST /api/v1/registered-keys` with per-provider/account quota enforcement, idempotency, SHA-256 storage, and optional GitHub issue reporting |
+| 🎨 **Provider Icons**        | 130+ provider logos via `@lobehub/icons` (SVG) with PNG → generic fallback chain                                                                                          |
+| 🔄 **Model Auto-Sync**       | 24h scheduler refreshes model lists for 16 providers on startup — configurable via `MODEL_SYNC_INTERVAL_HOURS`                                                            |
+| 🌐 **OpenCode Zen/Go**       | Two new providers from @kang-heewon via PR #530: free tier + subscription tier via `OpencodeExecutor`                                                                     |
+| 🐛 **Gemini CLI OAuth**      | Actionable error when `GEMINI_OAUTH_CLIENT_SECRET` is missing in Docker (was cryptic Google error)                                                                        |
+| 🐛 **OpenCode config**       | `saveOpenCodeConfig()` now correctly writes TOML to `XDG_CONFIG_HOME`                                                                                                     |
+| 🐛 **Pinned model override** | `body.model` correctly set to `pinnedModel` on context-cache protection                                                                                                   |
+| 🐛 **Codex/Claude loop**     | `tool_result` blocks now converted to text to stop infinite loops                                                                                                         |
+| 🐛 **Login redirect**        | Login no longer freezes after skipping password setup                                                                                                                     |
+| 🐛 **Windows paths**         | MSYS2/Git-Bash paths (`/c/...`) normalized to `C:\...` automatically                                                                                                      |
+
+---
+
 ## 🖼️ Main Dashboard

 <div align="center">
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
  title: OmniRoute API
-  version: 3.0.0-rc.1
+  version: 3.0.0-rc.5
  description: |
    OmniRoute is a local-first AI API proxy router. It provides an OpenAI-compatible
    endpoint that routes requests to multiple AI providers with load balancing,
--- a/open-sse/config/providerRegistry.ts
+++ b/open-sse/config/providerRegistry.ts
@@ -1205,9 +1205,13 @@ export const REGISTRY: Record<string, RegistryEntry> = {
    alias: "lc",
    format: "openai",
    executor: "default",
-    baseUrl: "https://longcat.chat/api/v1/chat/completions",
+    // (#536) Correct OpenAI-compatible base URL — was longcat.chat/api/v1/chat/completions
+    // which is the chat endpoint directly, not the base. Key validation and routing must
+    // use https://api.longcat.chat/openai which resolves /v1/models and /v1/chat/completions
+    baseUrl: "https://api.longcat.chat/openai",
    authType: "apikey",
-    authHeader: "bearer",
+    authHeader: "Authorization",
+    authPrefix: "Bearer",
    // Free tier: 50M tokens/day (Flash-Lite) + 500K/day (Chat/Thinking) — 100% free while public beta
    models: [
      { id: "LongCat-Flash-Lite", name: "LongCat Flash-Lite (50M tok/day 🆓)" },
--- a/open-sse/services/comboAgentMiddleware.ts
+++ b/open-sse/services/comboAgentMiddleware.ts
@@ -169,7 +169,11 @@ export function applyComboAgentMiddleware(
  if (comboConfig.context_cache_protection) {
    pinnedModel = extractPinnedModel(messages);
    if (pinnedModel) {
-      // Model is pinned — caller should override model selection
+      // (#535) Model is pinned via <omniModel> tag — override body.model so the combo
+      // router uses exactly this model instead of picking a different one. Without this,
+      // the extracted pinnedModel is returned but body.model is unchanged, breaking
+      // context cache sessions by sending subsequent turns to a different model.
+      body = { ...body, model: pinnedModel };
    }
  }

--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
  "name": "omniroute",
-  "version": "3.0.0-rc.1",
+  "version": "3.0.0-rc.5",
  "description": "Smart AI Router with auto fallback — route to FREE & cheap models, zero downtime. Works with Cursor, Cline, Claude Desktop, Codex, and any OpenAI-compatible tool.",
  "type": "module",
  "bin": {
@@ -81,8 +81,10 @@
    "system-info": "node scripts/system-info.mjs"
  },
  "dependencies": {
+    "@lobehub/icons": "^5.0.1",
    "@modelcontextprotocol/sdk": "^1.27.1",
    "@monaco-editor/react": "^4.7.0",
+    "@swc/helpers": "0.5.19",
    "bcryptjs": "^3.0.3",
    "better-sqlite3": "^12.6.2",
    "bottleneck": "^2.19.5",
@@ -110,8 +112,7 @@
    "uuid": "^13.0.0",
    "wreq-js": "^2.0.1",
    "zod": "^4.3.6",
-    "zustand": "^5.0.10",
-    "@swc/helpers": "0.5.19"
+    "zustand": "^5.0.10"
  },
  "devDependencies": {
    "@playwright/test": "^1.58.2",
--- a/src/app/(dashboard)/dashboard/providers/page.tsx
+++ b/src/app/(dashboard)/dashboard/providers/page.tsx
@@ -2,6 +2,7 @@

 import { useState, useEffect } from "react";
 import Image from "next/image";
+import ProviderIcon from "@/shared/components/ProviderIcon";
 import PropTypes from "prop-types";
 import {
  Card,
@@ -490,16 +491,8 @@ function ProviderCard({ providerId, provider, stats, authType, onToggle }) {
  const t = useTranslations("providers");
  const tc = useTranslations("common");
  const { connected, error, errorCode, errorTime, allDisabled } = stats;
-  const [imgSrc, setImgSrc] = useState(`/providers/${provider.id}.png`);
-  const [imgError, setImgError] = useState(false);

-  const handleImgError = () => {
-    if (imgSrc.endsWith(".png")) {
-      setImgSrc(`/providers/${provider.id}.svg`);
-    } else {
-      setImgError(true);
-    }
-  };
+  // (#529) Icon state replaced by ProviderIcon component (Lobehub + PNG + generic fallback)

  const dotColors = {
    free: "bg-green-500",
@@ -526,21 +519,8 @@ function ProviderCard({ providerId, provider, stats, authType, onToggle }) {
              className="size-8 rounded-lg flex items-center justify-center"
              style={{ backgroundColor: `${provider.color}15` }}
            >
-              {imgError ? (
-                <span className="text-xs font-bold" style={{ color: provider.color }}>
-                  {provider.textIcon || provider.id.slice(0, 2).toUpperCase()}
-                </span>
-              ) : (
-                <Image
-                  src={imgSrc}
-                  alt={provider.name}
-                  width={30}
-                  height={30}
-                  className="object-contain rounded-lg max-w-[32px] max-h-[32px]"
-                  sizes="32px"
-                  onError={handleImgError}
-                />
-              )}
+              {/* (#529) ProviderIcon: Lobehub icons → PNG fallback → generic icon */}
+              <ProviderIcon providerId={provider.id} size={28} type="color" />
            </div>
            <div>
              <h3 className="font-semibold flex items-center gap-1.5">
@@ -633,28 +613,15 @@ function ApiKeyProviderCard({ providerId, provider, stats, authType, onToggle })
    compatible: t("compatibleLabel"),
  };

-  // Determine icon path: OpenAI Compatible providers use specialized icons
-  const getIconPath = () => {
+  // (#529) Icon state replaced by ProviderIcon component
+  // For compatible/anthropic providers, continue using static PNGs via the icon path
+  const staticIconPath = (() => {
    if (isCompatible) {
      return provider.apiType === "responses" ? "/providers/oai-r.png" : "/providers/oai-cc.png";
    }
-    if (isAnthropicCompatible) {
-      return "/providers/anthropic-m.png"; // Use Anthropic icon as base
-    }
-    return `/providers/${provider.id}.png`;
-  };
-
-  const [imgSrc, setImgSrc] = useState<string>(() => getIconPath());
-  const [imgError, setImgError] = useState(false);
-
-  const handleImgError = () => {
-    const basePath = getIconPath();
-    if (imgSrc.endsWith(".png") && !isCompatible && !isAnthropicCompatible) {
-      setImgSrc(`/providers/${provider.id}.svg`);
-    } else {
-      setImgError(true);
-    }
-  };
+    if (isAnthropicCompatible) return "/providers/anthropic-m.png";
+    return null; // ProviderIcon will handle it
+  })();

  return (
    <Link href={`/dashboard/providers/${providerId}`} className="group">
@@ -668,20 +635,18 @@ function ApiKeyProviderCard({ providerId, provider, stats, authType, onToggle })
              className="size-8 rounded-lg flex items-center justify-center"
              style={{ backgroundColor: `${provider.color}15` }}
            >
-              {imgError ? (
-                <span className="text-xs font-bold" style={{ color: provider.color }}>
-                  {provider.textIcon || provider.id.slice(0, 2).toUpperCase()}
-                </span>
-              ) : (
+              {/* (#529) ProviderIcon with static override for compatible providers */}
+              {staticIconPath ? (
                <Image
-                  src={imgSrc || getIconPath()}
+                  src={staticIconPath}
                  alt={provider.name}
                  width={30}
                  height={30}
                  className="object-contain rounded-lg max-w-[30px] max-h-[30px]"
                  sizes="30px"
-                  onError={handleImgError}
                />
+              ) : (
+                <ProviderIcon providerId={provider.id} size={28} type="color" />
              )}
            </div>
            <div>
--- a/src/app/api/cli-tools/guide-settings/[toolId]/route.ts
+++ b/src/app/api/cli-tools/guide-settings/[toolId]/route.ts
@@ -39,6 +39,10 @@ export async function POST(request, { params }) {
    switch (toolId) {
      case "continue":
        return await saveContinueConfig({ baseUrl, apiKey, model });
+      case "opencode":
+        // (#524) OpenCode config was never saved because only 'continue' was handled here.
+        // opencode reads ~/.config/opencode/config.toml — write the OmniRoute settings there.
+        return await saveOpenCodeConfig({ baseUrl, apiKey, model });
      default:
        return NextResponse.json(
          { error: `Direct config save not supported for: ${toolId}` },
@@ -125,3 +129,56 @@ async function saveContinueConfig({ baseUrl, apiKey, model }) {
    configPath,
  });
 }
+
+/**
+ * Save OpenCode config to ~/.config/opencode/config.toml (XDG_CONFIG_HOME aware).
+ * (#524) OpenCode was silently failing because this handler was missing.
+ */
+async function saveOpenCodeConfig({ baseUrl, apiKey, model }) {
+  const { apiPort } = getRuntimePorts();
+  // Honour $XDG_CONFIG_HOME if set, otherwise use ~/.config per the XDG Base Directory spec
+  const xdgConfigHome = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config");
+  const configPath = path.join(xdgConfigHome, "opencode", "config.toml");
+  const configDir = path.dirname(configPath);
+
+  // Ensure ~/.config/opencode/ exists
+  await fs.mkdir(configDir, { recursive: true });
+
+  const normalizedBaseUrl = String(baseUrl || "")
+    .trim()
+    .replace(/\/+$/, "");
+
+  // Read existing TOML to preserve any user settings outside our block
+  let existingContent = "";
+  try {
+    existingContent = await fs.readFile(configPath, "utf-8");
+  } catch {
+    // File doesn't exist yet — start fresh
+  }
+
+  // Build the OmniRoute TOML block.
+  // opencode config.toml uses the [provider.X] table format.
+  void apiPort; // available for future port-based detection
+  const omniBlock = `
+# OmniRoute managed — updated automatically by OmniRoute CLI Tools
+[provider.omniroute]
+api_key = "${apiKey || "sk_omniroute"}"
+base_url = "${normalizedBaseUrl}"
+model = "${model}"
+`;
+
+  // Remove old OmniRoute-managed block (if any) then append fresh one
+  const cleanedContent = existingContent
+    .replace(/\n?# OmniRoute managed[\s\S]*?(?=\n\[|$)/, "")
+    .trimEnd();
+
+  const newContent = (cleanedContent ? cleanedContent + "\n" : "") + omniBlock;
+
+  await fs.writeFile(configPath, newContent, "utf-8");
+
+  return NextResponse.json({
+    success: true,
+    message: `OpenCode config saved to ${configPath}`,
+    configPath,
+  });
+}
--- a/src/app/api/sync/initialize/route.ts
+++ b/src/app/api/sync/initialize/route.ts
@@ -1,7 +1,9 @@
 import { NextResponse } from "next/server";
 import initializeCloudSync from "@/shared/services/initializeCloudSync";
+import { startModelSyncScheduler } from "@/shared/services/modelSyncScheduler";

 let syncInitialized = false;
+let modelSyncInitialized = false;

 // POST /api/sync/initialize - Initialize cloud sync scheduler
 export async function POST(request) {
@@ -15,9 +17,17 @@ export async function POST(request) {
    await initializeCloudSync();
    syncInitialized = true;

+    // (#488) Start model auto-sync scheduler (24h, configurable via MODEL_SYNC_INTERVAL_HOURS)
+    if (!modelSyncInitialized) {
+      const origin = request.headers.get("origin") || "http://localhost:20128";
+      startModelSyncScheduler(origin);
+      modelSyncInitialized = true;
+    }
+
    return NextResponse.json({
      success: true,
      message: "Cloud sync initialized successfully",
+      modelSyncEnabled: true,
    });
  } catch (error) {
    console.log("Error initializing cloud sync:", error);
@@ -34,6 +44,7 @@ export async function POST(request) {
 export async function GET(request) {
  return NextResponse.json({
    initialized: syncInitialized,
+    modelSyncInitialized,
    message: syncInitialized ? "Cloud sync is running" : "Cloud sync not initialized",
  });
 }
--- a/src/app/api/v1/accounts/[id]/limits/route.ts
+++ b/src/app/api/v1/accounts/[id]/limits/route.ts
@@ -0,0 +1,49 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { isAuthenticated } from "@/shared/utils/apiAuth";
+import { setAccountKeyLimit, getAccountKeyLimit } from "@/lib/db/registeredKeys";
+
+const limitsSchema = z.object({
+  maxActiveKeys: z.number().int().positive().nullable().optional(),
+  dailyIssueLimit: z.number().int().positive().nullable().optional(),
+  hourlyIssueLimit: z.number().int().positive().nullable().optional(),
+});
+
+/**
+ * GET /api/v1/accounts/[id]/limits
+ * Get the current issuance limits for an account.
+ */
+export async function GET(request: Request, { params }: { params: { id: string } }) {
+  if (!(await isAuthenticated(request))) {
+    return NextResponse.json({ error: { message: "Authentication required" } }, { status: 401 });
+  }
+
+  const limits = getAccountKeyLimit(params.id);
+  return NextResponse.json({ accountId: params.id, limits: limits ?? null });
+}
+
+/**
+ * PUT /api/v1/accounts/[id]/limits
+ * Configure issuance limits for an account.
+ */
+export async function PUT(request: Request, { params }: { params: { id: string } }) {
+  if (!(await isAuthenticated(request))) {
+    return NextResponse.json({ error: { message: "Authentication required" } }, { status: 401 });
+  }
+
+  let body: unknown;
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
+  }
+
+  const parsed = limitsSchema.safeParse(body);
+  if (!parsed.success) {
+    return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 });
+  }
+
+  setAccountKeyLimit(params.id, parsed.data);
+  const updated = getAccountKeyLimit(params.id);
+  return NextResponse.json({ accountId: params.id, limits: updated });
+}
--- a/src/app/api/v1/issues/report/route.ts
+++ b/src/app/api/v1/issues/report/route.ts
@@ -0,0 +1,123 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { isAuthenticated } from "@/shared/utils/apiAuth";
+
+const reportSchema = z.object({
+  title: z.string().min(1).max(300),
+  provider: z.string().max(80).optional(),
+  accountId: z.string().max(120).optional(),
+  requestId: z.string().max(200).optional(),
+  errorCode: z.string().max(100).optional(),
+  details: z.record(z.unknown()).optional(),
+  labels: z.array(z.string().max(50)).optional(),
+});
+
+/**
+ * POST /api/v1/issues/report
+ *
+ * Optionally report a quota-exceeded or key-issuance failure event to GitHub.
+ *
+ * Requires GITHUB_ISSUES_REPO (format: owner/repo) and GITHUB_ISSUES_TOKEN
+ * environment variables to be set. If not configured, returns 202 (accepted but
+ * logged only).
+ */
+export async function POST(request: Request) {
+  if (!(await isAuthenticated(request))) {
+    return NextResponse.json({ error: { message: "Authentication required" } }, { status: 401 });
+  }
+
+  let body: unknown;
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
+  }
+
+  const parsed = reportSchema.safeParse(body);
+  if (!parsed.success) {
+    return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 });
+  }
+
+  const { title, provider, accountId, requestId, errorCode, details, labels = [] } = parsed.data;
+
+  const repo = process.env.GITHUB_ISSUES_REPO;
+  const token = process.env.GITHUB_ISSUES_TOKEN;
+
+  // ── Structured body for the GitHub issue ──
+  const issueBody = [
+    `## ${errorCode ?? "Key Issuance Event"}`,
+    "",
+    "| Field | Value |",
+    "|-------|-------|",
+    provider ? `| Provider | \`${provider}\` |` : null,
+    accountId ? `| Account ID | \`${accountId}\` |` : null,
+    requestId ? `| Request ID | \`${requestId}\` |` : null,
+    errorCode ? `| Error Code | \`${errorCode}\` |` : null,
+    `| Reported At | ${new Date().toISOString()} |`,
+    "",
+    details ? "### Details\n```json\n" + JSON.stringify(details, null, 2) + "\n```" : null,
+    "",
+    "_Auto-reported by OmniRoute Registered Key Issuer_",
+  ]
+    .filter(Boolean)
+    .join("\n");
+
+  // ── Log locally regardless ──
+  console.log(
+    `[issues/report] title="${title}" errorCode=${errorCode ?? "—"} provider=${provider ?? "—"} accountId=${accountId ?? "—"}`
+  );
+
+  if (!repo || !token) {
+    // No GitHub config — log only
+    return NextResponse.json(
+      {
+        logged: true,
+        githubIssueCreated: false,
+        reason: !repo ? "GITHUB_ISSUES_REPO not configured" : "GITHUB_ISSUES_TOKEN not configured",
+      },
+      { status: 202 }
+    );
+  }
+
+  // ── Create GitHub issue ──
+  try {
+    const [owner, repoName] = repo.split("/");
+    const ghRes = await fetch(`https://api.github.com/repos/${owner}/${repoName}/issues`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/vnd.github+json",
+        "X-GitHub-Api-Version": "2022-11-28",
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({
+        title: `[Key Issuer] ${title}`,
+        body: issueBody,
+        labels: ["key-issuer", "automated", ...labels],
+      }),
+    });
+
+    if (!ghRes.ok) {
+      const errText = await ghRes.text();
+      console.error(`[issues/report] GitHub API error ${ghRes.status}: ${errText}`);
+      return NextResponse.json(
+        { logged: true, githubIssueCreated: false, githubError: ghRes.status },
+        { status: 207 }
+      );
+    }
+
+    const ghData = await ghRes.json();
+    return NextResponse.json({
+      logged: true,
+      githubIssueCreated: true,
+      githubIssueUrl: ghData.html_url,
+      githubIssueNumber: ghData.number,
+    });
+  } catch (err) {
+    console.error("[issues/report] GitHub fetch failed:", err);
+    return NextResponse.json(
+      { logged: true, githubIssueCreated: false, error: "GitHub request failed" },
+      { status: 207 }
+    );
+  }
+}
--- a/src/app/api/v1/providers/[id]/limits/route.ts
+++ b/src/app/api/v1/providers/[id]/limits/route.ts
@@ -0,0 +1,49 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { isAuthenticated } from "@/shared/utils/apiAuth";
+import { setProviderKeyLimit, getProviderKeyLimit } from "@/lib/db/registeredKeys";
+
+const limitsSchema = z.object({
+  maxActiveKeys: z.number().int().positive().nullable().optional(),
+  dailyIssueLimit: z.number().int().positive().nullable().optional(),
+  hourlyIssueLimit: z.number().int().positive().nullable().optional(),
+});
+
+/**
+ * GET /api/v1/providers/[id]/limits
+ * Get the current issuance limits for a provider.
+ */
+export async function GET(request: Request, { params }: { params: { id: string } }) {
+  if (!(await isAuthenticated(request))) {
+    return NextResponse.json({ error: { message: "Authentication required" } }, { status: 401 });
+  }
+
+  const limits = getProviderKeyLimit(params.id);
+  return NextResponse.json({ provider: params.id, limits: limits ?? null });
+}
+
+/**
+ * PUT /api/v1/providers/[id]/limits
+ * Configure issuance limits for a provider.
+ */
+export async function PUT(request: Request, { params }: { params: { id: string } }) {
+  if (!(await isAuthenticated(request))) {
+    return NextResponse.json({ error: { message: "Authentication required" } }, { status: 401 });
+  }
+
+  let body: unknown;
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
+  }
+
+  const parsed = limitsSchema.safeParse(body);
+  if (!parsed.success) {
+    return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 });
+  }
+
+  setProviderKeyLimit(params.id, parsed.data);
+  const updated = getProviderKeyLimit(params.id);
+  return NextResponse.json({ provider: params.id, limits: updated });
+}
--- a/src/app/api/v1/quotas/check/route.ts
+++ b/src/app/api/v1/quotas/check/route.ts
@@ -0,0 +1,33 @@
+import { NextResponse } from "next/server";
+import { isAuthenticated } from "@/shared/utils/apiAuth";
+import { checkQuota } from "@/lib/db/registeredKeys";
+
+/**
+ * GET /api/v1/quotas/check?provider=&accountId=
+ *
+ * Check if a new registered key can be issued for the given provider/account
+ * without actually issuing one. Use this to pre-validate before POST /registered-keys.
+ */
+export async function GET(request: Request) {
+  if (!(await isAuthenticated(request))) {
+    return NextResponse.json({ error: { message: "Authentication required" } }, { status: 401 });
+  }
+
+  const { searchParams } = new URL(request.url);
+  const provider = searchParams.get("provider") ?? "";
+  const accountId = searchParams.get("accountId") ?? "";
+
+  try {
+    const result = checkQuota(provider, accountId);
+    return NextResponse.json({
+      allowed: result.allowed,
+      ...(result.errorCode ? { errorCode: result.errorCode, reason: result.errorMessage } : {}),
+      provider: provider || null,
+      accountId: accountId || null,
+      checkedAt: new Date().toISOString(),
+    });
+  } catch (err) {
+    console.error("[quotas/check] error:", err);
+    return NextResponse.json({ error: "Quota check failed" }, { status: 500 });
+  }
+}
--- a/src/app/api/v1/registered-keys/[id]/revoke/route.ts
+++ b/src/app/api/v1/registered-keys/[id]/revoke/route.ts
@@ -0,0 +1,21 @@
+import { NextResponse } from "next/server";
+import { isAuthenticated } from "@/shared/utils/apiAuth";
+import { revokeRegisteredKey } from "@/lib/db/registeredKeys";
+
+/**
+ * POST /api/v1/registered-keys/[id]/revoke
+ *
+ * Explicit revoke endpoint (supports clients that cannot issue DELETE requests).
+ */
+export async function POST(request: Request, { params }: { params: { id: string } }) {
+  if (!(await isAuthenticated(request))) {
+    return NextResponse.json({ error: { message: "Authentication required" } }, { status: 401 });
+  }
+
+  const revoked = revokeRegisteredKey(params.id);
+  if (!revoked) {
+    return NextResponse.json({ error: "Key not found or already revoked" }, { status: 404 });
+  }
+
+  return NextResponse.json({ success: true, id: params.id, revokedAt: new Date().toISOString() });
+}
--- a/src/app/api/v1/registered-keys/[id]/route.ts
+++ b/src/app/api/v1/registered-keys/[id]/route.ts
@@ -0,0 +1,33 @@
+import { NextResponse } from "next/server";
+import { isAuthenticated } from "@/shared/utils/apiAuth";
+import { getRegisteredKey, revokeRegisteredKey } from "@/lib/db/registeredKeys";
+
+// ─── GET /api/v1/registered-keys/[id] ────────────────────────────────────────
+
+export async function GET(request: Request, { params }: { params: { id: string } }) {
+  if (!(await isAuthenticated(request))) {
+    return NextResponse.json({ error: { message: "Authentication required" } }, { status: 401 });
+  }
+
+  const key = getRegisteredKey(params.id);
+  if (!key) {
+    return NextResponse.json({ error: "Key not found" }, { status: 404 });
+  }
+
+  return NextResponse.json({ key });
+}
+
+// ─── DELETE /api/v1/registered-keys/[id] ─────────────────────────────────────
+
+export async function DELETE(request: Request, { params }: { params: { id: string } }) {
+  if (!(await isAuthenticated(request))) {
+    return NextResponse.json({ error: { message: "Authentication required" } }, { status: 401 });
+  }
+
+  const revoked = revokeRegisteredKey(params.id);
+  if (!revoked) {
+    return NextResponse.json({ error: "Key not found or already revoked" }, { status: 404 });
+  }
+
+  return NextResponse.json({ success: true, id: params.id, revokedAt: new Date().toISOString() });
+}
--- a/src/app/api/v1/registered-keys/route.ts
+++ b/src/app/api/v1/registered-keys/route.ts
@@ -0,0 +1,118 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { isAuthenticated } from "@/shared/utils/apiAuth";
+import { issueRegisteredKey, checkQuota, listRegisteredKeys } from "@/lib/db/registeredKeys";
+
+// ─── Validation ───────────────────────────────────────────────────────────────
+
+const issueKeySchema = z.object({
+  name: z.string().min(1).max(120),
+  provider: z.string().max(80).optional().default(""),
+  accountId: z.string().max(120).optional().default(""),
+  idempotencyKey: z.string().max(256).optional(),
+  expiresAt: z.string().datetime({ offset: true }).optional(),
+  dailyBudget: z.number().int().positive().optional(),
+  hourlyBudget: z.number().int().positive().optional(),
+});
+
+// ─── GET /api/v1/registered-keys ─────────────────────────────────────────────
+
+/**
+ * List registered keys (masked — no raw key material returned after creation).
+ * Optional query params: ?provider=&accountId=
+ */
+export async function GET(request: Request) {
+  if (!(await isAuthenticated(request))) {
+    return NextResponse.json({ error: { message: "Authentication required" } }, { status: 401 });
+  }
+
+  const { searchParams } = new URL(request.url);
+  const provider = searchParams.get("provider") ?? undefined;
+  const accountId = searchParams.get("accountId") ?? undefined;
+
+  try {
+    const keys = listRegisteredKeys({ provider, accountId });
+    return NextResponse.json({ keys, total: keys.length });
+  } catch (err) {
+    console.error("[registered-keys] GET failed:", err);
+    return NextResponse.json({ error: "Failed to list registered keys" }, { status: 500 });
+  }
+}
+
+// ─── POST /api/v1/registered-keys ────────────────────────────────────────────
+
+/**
+ * Issue a new registered key.
+ *
+ * Checks provider + account quotas before issuing.
+ * Returns the raw key ONCE — it is never stored in plain text.
+ * Subsequent fetches will only return the masked prefix.
+ */
+export async function POST(request: Request) {
+  if (!(await isAuthenticated(request))) {
+    return NextResponse.json({ error: { message: "Authentication required" } }, { status: 401 });
+  }
+
+  let body: unknown;
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
+  }
+
+  const parsed = issueKeySchema.safeParse(body);
+  if (!parsed.success) {
+    return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 });
+  }
+
+  const { provider, accountId } = parsed.data;
+
+  // ── Quota check ──
+  try {
+    const quota = checkQuota(provider, accountId);
+    if (!quota.allowed) {
+      return NextResponse.json(
+        { error: quota.errorMessage, errorCode: quota.errorCode },
+        { status: 429 }
+      );
+    }
+  } catch (err) {
+    console.error("[registered-keys] quota check failed:", err);
+    return NextResponse.json({ error: "Quota check failed" }, { status: 500 });
+  }
+
+  // ── Issue ──
+  try {
+    const result = issueRegisteredKey(parsed.data);
+
+    if ("idempotencyConflict" in result) {
+      return NextResponse.json(
+        {
+          error: "Idempotency key already used",
+          errorCode: "IDEMPOTENCY_CONFLICT",
+          existing: result.existing,
+        },
+        { status: 409 }
+      );
+    }
+
+    const { rawKey, ...keyMeta } = result;
+    return NextResponse.json(
+      {
+        key: rawKey, // ← shown ONCE only
+        keyId: keyMeta.id,
+        keyPrefix: keyMeta.keyPrefix,
+        name: keyMeta.name,
+        provider: keyMeta.provider,
+        accountId: keyMeta.accountId,
+        expiresAt: keyMeta.expiresAt,
+        createdAt: keyMeta.createdAt,
+        warning: "Store this key securely — it will not be shown again.",
+      },
+      { status: 201 }
+    );
+  } catch (err) {
+    console.error("[registered-keys] issue failed:", err);
+    return NextResponse.json({ error: "Failed to issue key" }, { status: 500 });
+  }
+}
--- a/src/lib/db/migrations/008_registered_keys.sql
+++ b/src/lib/db/migrations/008_registered_keys.sql
@@ -0,0 +1,65 @@
+-- Migration 008: Registered Keys Provisioning API (#464)
+--
+-- Adds three tables:
+--   registered_keys      — auto-provisioned API keys with quota metadata
+--   provider_key_limits  — per-provider issuance limits
+--   account_key_limits   — per-account issuance limits
+
+-- --------------------------------------------------------------------------
+-- Table: registered_keys
+-- --------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS registered_keys (
+  id            TEXT PRIMARY KEY,           -- UUID
+  key           TEXT NOT NULL UNIQUE,       -- hashed key material (sha256)
+  key_prefix    TEXT NOT NULL,              -- first 8 chars for display (e.g. "ork_abc1")
+  name          TEXT NOT NULL,
+  provider      TEXT NOT NULL DEFAULT '',   -- associated provider (optional)
+  account_id    TEXT NOT NULL DEFAULT '',   -- account/tenant identifier
+  is_active     INTEGER NOT NULL DEFAULT 1,
+  revoked_at    TEXT,                       -- ISO timestamp, null if active
+  expires_at    TEXT,                       -- ISO timestamp, null = no expiry
+  idempotency_key TEXT UNIQUE,             -- prevents duplicate issue requests
+  daily_budget  INTEGER,                   -- max requests per day (null = unlimited)
+  hourly_budget INTEGER,                   -- max requests per hour (null = unlimited)
+  daily_used    INTEGER NOT NULL DEFAULT 0,
+  hourly_used   INTEGER NOT NULL DEFAULT 0,
+  last_reset_day  TEXT NOT NULL DEFAULT '',  -- YYYY-MM-DD for daily reset tracking
+  last_reset_hour TEXT NOT NULL DEFAULT '',  -- YYYY-MM-DDTHH for hourly reset tracking
+  created_at    TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at    TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_registered_keys_provider  ON registered_keys(provider);
+CREATE INDEX IF NOT EXISTS idx_registered_keys_account   ON registered_keys(account_id);
+CREATE INDEX IF NOT EXISTS idx_registered_keys_active    ON registered_keys(is_active);
+CREATE INDEX IF NOT EXISTS idx_registered_keys_idempotency ON registered_keys(idempotency_key);
+
+-- --------------------------------------------------------------------------
+-- Table: provider_key_limits  (per-provider issuance limits)
+-- --------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS provider_key_limits (
+  provider         TEXT PRIMARY KEY,
+  max_active_keys  INTEGER,   -- null = unlimited
+  daily_issue_limit  INTEGER, -- max keys per day
+  hourly_issue_limit INTEGER, -- max keys per hour
+  daily_issued     INTEGER NOT NULL DEFAULT 0,
+  hourly_issued    INTEGER NOT NULL DEFAULT 0,
+  last_reset_day   TEXT NOT NULL DEFAULT '',
+  last_reset_hour  TEXT NOT NULL DEFAULT '',
+  updated_at       TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+-- --------------------------------------------------------------------------
+-- Table: account_key_limits  (per-account issuance limits)
+-- --------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS account_key_limits (
+  account_id       TEXT PRIMARY KEY,
+  max_active_keys  INTEGER,
+  daily_issue_limit  INTEGER,
+  hourly_issue_limit INTEGER,
+  daily_issued     INTEGER NOT NULL DEFAULT 0,
+  hourly_issued    INTEGER NOT NULL DEFAULT 0,
+  last_reset_day   TEXT NOT NULL DEFAULT '',
+  last_reset_hour  TEXT NOT NULL DEFAULT '',
+  updated_at       TEXT NOT NULL DEFAULT (datetime('now'))
+);
--- a/src/lib/db/registeredKeys.ts
+++ b/src/lib/db/registeredKeys.ts
@@ -0,0 +1,531 @@
+/**
+ * db/registeredKeys.ts — Registered Keys Provisioning (#464)
+ *
+ * Handles:
+ *   - Issuing registered keys with idempotency
+ *   - Per-provider and per-account quota enforcement
+ *   - Key revocation
+ *   - Quota status queries for rate-limiting decisions
+ */
+
+import { createHash, randomBytes } from "crypto";
+import { v4 as uuidv4 } from "uuid";
+import { getDbInstance, rowToCamel } from "./core";
+
+// ─── Types ───────────────────────────────────────────────────────────────────
+
+export interface RegisteredKey {
+  id: string;
+  keyPrefix: string;
+  name: string;
+  provider: string;
+  accountId: string;
+  isActive: boolean;
+  revokedAt: string | null;
+  expiresAt: string | null;
+  idempotencyKey: string | null;
+  dailyBudget: number | null;
+  hourlyBudget: number | null;
+  dailyUsed: number;
+  hourlyUsed: number;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface RegisteredKeyWithSecret extends RegisteredKey {
+  /** Raw key material — only returned once on creation */
+  rawKey: string;
+}
+
+export interface ProviderKeyLimit {
+  provider: string;
+  maxActiveKeys: number | null;
+  dailyIssueLimit: number | null;
+  hourlyIssueLimit: number | null;
+  dailyIssued: number;
+  hourlyIssued: number;
+  updatedAt: string;
+}
+
+export interface AccountKeyLimit {
+  accountId: string;
+  maxActiveKeys: number | null;
+  dailyIssueLimit: number | null;
+  hourlyIssueLimit: number | null;
+  dailyIssued: number;
+  hourlyIssued: number;
+  updatedAt: string;
+}
+
+export interface QuotaCheckResult {
+  allowed: boolean;
+  errorCode?: string;
+  errorMessage?: string;
+  provider?: string;
+  accountId?: string;
+  providerActiveKeys?: number;
+  accountActiveKeys?: number;
+}
+
+export interface IssueKeyParams {
+  name: string;
+  provider?: string;
+  accountId?: string;
+  idempotencyKey?: string;
+  expiresAt?: string;
+  dailyBudget?: number;
+  hourlyBudget?: number;
+}
+
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+
+function nowDay(): string {
+  return new Date().toISOString().slice(0, 10); // YYYY-MM-DD
+}
+
+function nowHour(): string {
+  return new Date().toISOString().slice(0, 13); // YYYY-MM-DDTHH
+}
+
+function hashKey(raw: string): string {
+  return createHash("sha256").update(raw).digest("hex");
+}
+
+function generateRawKey(): string {
+  // ork_ prefix so users can easily identify these keys
+  return "ork_" + randomBytes(24).toString("base64url");
+}
+
+/** Reset window counters if the tracking period has changed. */
+function maybeResetWindow(
+  db: ReturnType<typeof getDbInstance>,
+  table: string,
+  idField: string,
+  idValue: string
+): void {
+  const today = nowDay();
+  const hour = nowHour();
+
+  db.prepare(
+    `
+    UPDATE ${table}
+    SET daily_issued = CASE WHEN last_reset_day <> ? THEN 0 ELSE daily_issued END,
+        hourly_issued = CASE WHEN last_reset_hour <> ? THEN 0 ELSE hourly_issued END,
+        last_reset_day = ?,
+        last_reset_hour = ?
+    WHERE ${idField} = ?
+  `
+  ).run(today, hour, today, hour, idValue);
+}
+
+// ─── Public API ──────────────────────────────────────────────────────────────
+
+/**
+ * Check if a new registered key can be issued for the given provider/account.
+ * Returns { allowed: true } or { allowed: false, errorCode, errorMessage }.
+ */
+export function checkQuota(provider = "", accountId = ""): QuotaCheckResult {
+  const db = getDbInstance();
+  const today = nowDay();
+  const hour = nowHour();
+
+  // ── provider-level check ──
+  if (provider) {
+    maybeResetWindow(db, "provider_key_limits", "provider", provider);
+
+    const limits = db
+      .prepare("SELECT * FROM provider_key_limits WHERE provider = ?")
+      .get(provider) as ProviderKeyLimitRow | undefined;
+
+    if (limits) {
+      if (limits.hourly_issue_limit !== null && limits.hourly_issued >= limits.hourly_issue_limit) {
+        return {
+          allowed: false,
+          errorCode: "PROVIDER_QUOTA_EXCEEDED",
+          errorMessage: `Hourly issue limit (${limits.hourly_issue_limit}) reached for provider '${provider}'`,
+          provider,
+        };
+      }
+      if (limits.daily_issue_limit !== null && limits.daily_issued >= limits.daily_issue_limit) {
+        return {
+          allowed: false,
+          errorCode: "PROVIDER_QUOTA_EXCEEDED",
+          errorMessage: `Daily issue limit (${limits.daily_issue_limit}) reached for provider '${provider}'`,
+          provider,
+        };
+      }
+      if (limits.max_active_keys !== null) {
+        const { activeCount } = db
+          .prepare(
+            "SELECT COUNT(*) as activeCount FROM registered_keys WHERE provider = ? AND is_active = 1"
+          )
+          .get(provider) as { activeCount: number };
+        if (activeCount >= limits.max_active_keys) {
+          return {
+            allowed: false,
+            errorCode: "MAX_ACTIVE_KEYS_EXCEEDED",
+            errorMessage: `Max active keys (${limits.max_active_keys}) reached for provider '${provider}'`,
+            provider,
+            providerActiveKeys: activeCount,
+          };
+        }
+      }
+    }
+  }
+
+  // ── account-level check ──
+  if (accountId) {
+    maybeResetWindow(db, "account_key_limits", "account_id", accountId);
+
+    const limits = db
+      .prepare("SELECT * FROM account_key_limits WHERE account_id = ?")
+      .get(accountId) as AccountKeyLimitRow | undefined;
+
+    if (limits) {
+      if (limits.hourly_issue_limit !== null && limits.hourly_issued >= limits.hourly_issue_limit) {
+        return {
+          allowed: false,
+          errorCode: "ACCOUNT_QUOTA_EXCEEDED",
+          errorMessage: `Hourly issue limit (${limits.hourly_issue_limit}) reached for account '${accountId}'`,
+          accountId,
+        };
+      }
+      if (limits.daily_issue_limit !== null && limits.daily_issued >= limits.daily_issue_limit) {
+        return {
+          allowed: false,
+          errorCode: "ACCOUNT_QUOTA_EXCEEDED",
+          errorMessage: `Daily issue limit (${limits.daily_issue_limit}) reached for account '${accountId}'`,
+          accountId,
+        };
+      }
+      if (limits.max_active_keys !== null) {
+        const { activeCount } = db
+          .prepare(
+            "SELECT COUNT(*) as activeCount FROM registered_keys WHERE account_id = ? AND is_active = 1"
+          )
+          .get(accountId) as { activeCount: number };
+        if (activeCount >= limits.max_active_keys) {
+          return {
+            allowed: false,
+            errorCode: "MAX_ACTIVE_KEYS_EXCEEDED",
+            errorMessage: `Max active keys (${limits.max_active_keys}) reached for account '${accountId}'`,
+            accountId,
+            accountActiveKeys: activeCount,
+          };
+        }
+      }
+    }
+  }
+
+  return { allowed: true };
+}
+
+/**
+ * Issue a new registered key.
+ * Returns the key with rawKey (only on creation) or null if idempotency_key already exists.
+ */
+export function issueRegisteredKey(
+  params: IssueKeyParams
+): RegisteredKeyWithSecret | { idempotencyConflict: true; existing: RegisteredKey } {
+  const db = getDbInstance();
+  const {
+    name,
+    provider = "",
+    accountId = "",
+    idempotencyKey,
+    expiresAt,
+    dailyBudget,
+    hourlyBudget,
+  } = params;
+
+  // ── idempotency check ──
+  if (idempotencyKey) {
+    const existing = db
+      .prepare("SELECT * FROM registered_keys WHERE idempotency_key = ?")
+      .get(idempotencyKey) as RegisteredKeyRow | undefined;
+    if (existing) {
+      return {
+        idempotencyConflict: true,
+        existing: rowToCamel(existing) as unknown as RegisteredKey,
+      };
+    }
+  }
+
+  const rawKey = generateRawKey();
+  const id = uuidv4();
+  const keyHash = hashKey(rawKey);
+  const keyPrefix = rawKey.slice(0, 12); // "ork_" + 8 chars
+
+  db.prepare(
+    `
+    INSERT INTO registered_keys
+      (id, key, key_prefix, name, provider, account_id, idempotency_key, expires_at, daily_budget, hourly_budget, last_reset_day, last_reset_hour)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `
+  ).run(
+    id,
+    keyHash,
+    keyPrefix,
+    name,
+    provider,
+    accountId,
+    idempotencyKey ?? null,
+    expiresAt ?? null,
+    dailyBudget ?? null,
+    hourlyBudget ?? null,
+    nowDay(),
+    nowHour()
+  );
+
+  // Increment provider/account issuance counters
+  if (provider) {
+    maybeResetWindow(db, "provider_key_limits", "provider", provider);
+    db.prepare(
+      `
+      INSERT INTO provider_key_limits (provider, daily_issued, hourly_issued, last_reset_day, last_reset_hour)
+      VALUES (?, 1, 1, ?, ?)
+      ON CONFLICT(provider) DO UPDATE SET
+        daily_issued = daily_issued + 1,
+        hourly_issued = hourly_issued + 1,
+        updated_at = datetime('now')
+    `
+    ).run(provider, nowDay(), nowHour());
+  }
+  if (accountId) {
+    maybeResetWindow(db, "account_key_limits", "account_id", accountId);
+    db.prepare(
+      `
+      INSERT INTO account_key_limits (account_id, daily_issued, hourly_issued, last_reset_day, last_reset_hour)
+      VALUES (?, 1, 1, ?, ?)
+      ON CONFLICT(account_id) DO UPDATE SET
+        daily_issued = daily_issued + 1,
+        hourly_issued = hourly_issued + 1,
+        updated_at = datetime('now')
+    `
+    ).run(accountId, nowDay(), nowHour());
+  }
+
+  const created = db
+    .prepare("SELECT * FROM registered_keys WHERE id = ?")
+    .get(id) as RegisteredKeyRow;
+  return { ...(rowToCamel(created) as unknown as RegisteredKey), rawKey };
+}
+
+/**
+ * Get a registered key by ID (without the raw key — only prefix is returned).
+ */
+export function getRegisteredKey(id: string): RegisteredKey | null {
+  const db = getDbInstance();
+  const row = db.prepare("SELECT * FROM registered_keys WHERE id = ?").get(id) as
+    | RegisteredKeyRow
+    | undefined;
+  return row ? (rowToCamel(row) as unknown as RegisteredKey) : null;
+}
+
+/**
+ * List all registered keys (optionally filtered by provider/accountId).
+ */
+export function listRegisteredKeys(
+  opts: { provider?: string; accountId?: string } = {}
+): RegisteredKey[] {
+  const db = getDbInstance();
+  let sql = "SELECT * FROM registered_keys WHERE 1=1";
+  const args: string[] = [];
+  if (opts.provider) {
+    sql += " AND provider = ?";
+    args.push(opts.provider);
+  }
+  if (opts.accountId) {
+    sql += " AND account_id = ?";
+    args.push(opts.accountId);
+  }
+  sql += " ORDER BY created_at DESC LIMIT 500";
+  const rows = db.prepare(sql).all(...args) as RegisteredKeyRow[];
+  return rows.map((r) => rowToCamel(r) as unknown as RegisteredKey);
+}
+
+/**
+ * Revoke a registered key by ID.
+ */
+export function revokeRegisteredKey(id: string): boolean {
+  const db = getDbInstance();
+  const result = db
+    .prepare(
+      `
+    UPDATE registered_keys
+    SET is_active = 0, revoked_at = datetime('now'), updated_at = datetime('now')
+    WHERE id = ? AND is_active = 1
+  `
+    )
+    .run(id);
+  return result.changes > 0;
+}
+
+/**
+ * Validate a raw registered key against stored hashes.
+ * Returns the key metadata if valid, null otherwise.
+ */
+export function validateRegisteredKey(rawKey: string): RegisteredKey | null {
+  const db = getDbInstance();
+  const hash = hashKey(rawKey);
+  const row = db
+    .prepare(
+      `
+    SELECT * FROM registered_keys
+    WHERE key = ? AND is_active = 1
+      AND (expires_at IS NULL OR expires_at > datetime('now'))
+  `
+    )
+    .get(hash) as RegisteredKeyRow | undefined;
+  if (!row) return null;
+
+  // Auto-reset budget windows if needed
+  const today = nowDay();
+  const hour = nowHour();
+  if (row.last_reset_day !== today || row.last_reset_hour !== hour) {
+    db.prepare(
+      `
+      UPDATE registered_keys
+      SET daily_used = CASE WHEN last_reset_day <> ? THEN 0 ELSE daily_used END,
+          hourly_used = CASE WHEN last_reset_hour <> ? THEN 0 ELSE hourly_used END,
+          last_reset_day = ?, last_reset_hour = ?
+      WHERE id = ?
+    `
+    ).run(today, hour, today, hour, row.id);
+  }
+
+  // Budget check
+  if (row.daily_budget !== null && row.daily_used >= row.daily_budget) return null;
+  if (row.hourly_budget !== null && row.hourly_used >= row.hourly_budget) return null;
+
+  return rowToCamel(row) as unknown as RegisteredKey;
+}
+
+/**
+ * Increment usage counters for a registered key (called by request pipeline).
+ */
+export function incrementRegisteredKeyUsage(id: string): void {
+  const db = getDbInstance();
+  db.prepare(
+    `
+    UPDATE registered_keys
+    SET daily_used = daily_used + 1, hourly_used = hourly_used + 1, updated_at = datetime('now')
+    WHERE id = ?
+  `
+  ).run(id);
+}
+
+// ─── Provider / Account Limit Management ──────────────────────────────────────
+
+export function setProviderKeyLimit(
+  provider: string,
+  limits: Partial<Omit<ProviderKeyLimit, "provider" | "dailyIssued" | "hourlyIssued" | "updatedAt">>
+): void {
+  const db = getDbInstance();
+  db.prepare(
+    `
+    INSERT INTO provider_key_limits (provider, max_active_keys, daily_issue_limit, hourly_issue_limit, last_reset_day, last_reset_hour)
+    VALUES (?, ?, ?, ?, ?, ?)
+    ON CONFLICT(provider) DO UPDATE SET
+      max_active_keys = excluded.max_active_keys,
+      daily_issue_limit = excluded.daily_issue_limit,
+      hourly_issue_limit = excluded.hourly_issue_limit,
+      updated_at = datetime('now')
+  `
+  ).run(
+    provider,
+    limits.maxActiveKeys ?? null,
+    limits.dailyIssueLimit ?? null,
+    limits.hourlyIssueLimit ?? null,
+    nowDay(),
+    nowHour()
+  );
+}
+
+export function setAccountKeyLimit(
+  accountId: string,
+  limits: Partial<Omit<AccountKeyLimit, "accountId" | "dailyIssued" | "hourlyIssued" | "updatedAt">>
+): void {
+  const db = getDbInstance();
+  db.prepare(
+    `
+    INSERT INTO account_key_limits (account_id, max_active_keys, daily_issue_limit, hourly_issue_limit, last_reset_day, last_reset_hour)
+    VALUES (?, ?, ?, ?, ?, ?)
+    ON CONFLICT(account_id) DO UPDATE SET
+      max_active_keys = excluded.max_active_keys,
+      daily_issue_limit = excluded.daily_issue_limit,
+      hourly_issue_limit = excluded.hourly_issue_limit,
+      updated_at = datetime('now')
+  `
+  ).run(
+    accountId,
+    limits.maxActiveKeys ?? null,
+    limits.dailyIssueLimit ?? null,
+    limits.hourlyIssueLimit ?? null,
+    nowDay(),
+    nowHour()
+  );
+}
+
+export function getProviderKeyLimit(provider: string): ProviderKeyLimit | null {
+  const db = getDbInstance();
+  const row = db.prepare("SELECT * FROM provider_key_limits WHERE provider = ?").get(provider) as
+    | ProviderKeyLimitRow
+    | undefined;
+  return row ? (rowToCamel(row) as unknown as ProviderKeyLimit) : null;
+}
+
+export function getAccountKeyLimit(accountId: string): AccountKeyLimit | null {
+  const db = getDbInstance();
+  const row = db.prepare("SELECT * FROM account_key_limits WHERE account_id = ?").get(accountId) as
+    | AccountKeyLimitRow
+    | undefined;
+  return row ? (rowToCamel(row) as unknown as AccountKeyLimit) : null;
+}
+
+// ─── Internal types (raw DB rows) ─────────────────────────────────────────────
+
+interface RegisteredKeyRow {
+  id: string;
+  key: string;
+  key_prefix: string;
+  name: string;
+  provider: string;
+  account_id: string;
+  is_active: number;
+  revoked_at: string | null;
+  expires_at: string | null;
+  idempotency_key: string | null;
+  daily_budget: number | null;
+  hourly_budget: number | null;
+  daily_used: number;
+  hourly_used: number;
+  last_reset_day: string;
+  last_reset_hour: string;
+  created_at: string;
+  updated_at: string;
+}
+
+interface ProviderKeyLimitRow {
+  provider: string;
+  max_active_keys: number | null;
+  daily_issue_limit: number | null;
+  hourly_issue_limit: number | null;
+  daily_issued: number;
+  hourly_issued: number;
+  last_reset_day: string;
+  last_reset_hour: string;
+  updated_at: string;
+}
+
+interface AccountKeyLimitRow {
+  account_id: string;
+  max_active_keys: number | null;
+  daily_issue_limit: number | null;
+  hourly_issue_limit: number | null;
+  daily_issued: number;
+  hourly_issued: number;
+  last_reset_day: string;
+  last_reset_hour: string;
+  updated_at: string;
+}
--- a/src/lib/localDb.ts
+++ b/src/lib/localDb.ts
@@ -138,3 +138,27 @@ export {
  getCachedProviderConnections,
  invalidateDbCache,
 } from "./db/readCache";
+
+export {
+  // Registered Keys Provisioning (#464)
+  issueRegisteredKey,
+  getRegisteredKey,
+  listRegisteredKeys,
+  revokeRegisteredKey,
+  validateRegisteredKey,
+  incrementRegisteredKeyUsage,
+  checkQuota,
+  setProviderKeyLimit,
+  setAccountKeyLimit,
+  getProviderKeyLimit,
+  getAccountKeyLimit,
+} from "./db/registeredKeys";
+
+export type {
+  RegisteredKey,
+  RegisteredKeyWithSecret,
+  ProviderKeyLimit,
+  AccountKeyLimit,
+  QuotaCheckResult,
+  IssueKeyParams,
+} from "./db/registeredKeys";
--- a/src/lib/oauth/providers/gemini.ts
+++ b/src/lib/oauth/providers/gemini.ts
@@ -25,6 +25,18 @@ export const gemini = {

    if (config.clientSecret) {
      bodyParams.client_secret = config.clientSecret;
+    } else {
+      // (#537) Google's OAuth2 token endpoint always requires client_secret for
+      // non-PKCE flows. Without it we get a cryptic "client_secret is missing" error.
+      // This typically happens in self-hosted / Docker deployments where
+      // GEMINI_OAUTH_CLIENT_SECRET is not set in the container environment.
+      throw new Error(
+        "Gemini CLI OAuth requires GEMINI_OAUTH_CLIENT_SECRET to be set.\n" +
+          "In Docker: add 'GEMINI_OAUTH_CLIENT_SECRET=<your-secret>' to your docker-compose.yml env.\n" +
+          "In npm: add it to ~/.omniroute/.env\n" +
+          "Obtain the client secret from https://console.cloud.google.com/apis/credentials\n" +
+          "for the same OAuth 2.0 Client ID configured as GEMINI_OAUTH_CLIENT_ID."
+      );
    }

    const response = await fetch(config.tokenUrl, {
--- a/src/shared/components/ProviderIcon.tsx
+++ b/src/shared/components/ProviderIcon.tsx
@@ -0,0 +1,167 @@
+"use client";
+
+/**
+ * ProviderIcon — Renders a provider logo using @lobehub/icons with PNG fallback.
+ *
+ * Strategy (#529):
+ * 1. Try @lobehub/icons ProviderIcon (130+ providers, React components)
+ * 2. Fall back to /providers/{id}.png (existing static assets)
+ * 3. Fall back to a generic AI icon
+ *
+ * Usage:
+ *   <ProviderIcon providerId="openai" size={24} />
+ *   <ProviderIcon providerId="anthropic" size={28} type="color" />
+ */
+
+import { memo, useState, Component, type ReactNode } from "react";
+import Image from "next/image";
+import { ProviderIcon as LobehubProviderIcon } from "@lobehub/icons";
+
+// Mapping from OmniRoute provider IDs → Lobehub icon IDs
+// Lobehub uses lowercase IDs matching ModelProvider enum values
+const LOBEHUB_PROVIDER_MAP: Record<string, string> = {
+  openai: "openai",
+  anthropic: "anthropic",
+  claude: "anthropic",
+  gemini: "google",
+  google: "google",
+  deepseek: "deepseek",
+  groq: "groq",
+  mistral: "mistral",
+  cohere: "cohere",
+  perplexity: "perplexity",
+  xai: "xai",
+  grok: "xai",
+  together: "togetherai",
+  fireworks: "fireworks",
+  "fireworks-ai": "fireworks",
+  cerebras: "cerebras",
+  huggingface: "huggingface",
+  "hugging-face": "huggingface",
+  openrouter: "openrouter",
+  "open-router": "openrouter",
+  ollama: "ollama",
+  minimax: "minimax",
+  qwen: "qwen",
+  alibaba: "qwen",
+  moonshot: "moonshot",
+  kimi: "moonshot",
+  baidu: "baidu",
+  ernie: "baidu",
+  spark: "iflytek",
+  "zhipu-ai": "zhipu",
+  zhipu: "zhipu",
+  lmsys: "lmsys",
+  "stability-ai": "stability",
+  stability: "stability",
+  replicate: "replicate",
+  ai21: "ai21",
+  nvidia: "nvidia",
+  cloudflare: "cloudflare",
+  "cloudflare-ai": "cloudflare",
+  "aws-bedrock": "bedrock",
+  bedrock: "bedrock",
+  azure: "azure",
+  "azure-openai": "azure",
+  copilot: "githubcopilot",
+  "github-copilot": "githubcopilot",
+  mistralai: "mistral",
+  codex: "openai",
+  blackbox: "blackboxai",
+  blackboxai: "blackboxai",
+  pollinations: "pollinations",
+};
+
+interface ProviderIconProps {
+  providerId: string;
+  size?: number;
+  type?: "mono" | "color";
+  className?: string;
+  style?: React.CSSProperties;
+}
+
+/** Error boundary to catch Lobehub component render errors gracefully. */
+class LobehubErrorBoundary extends Component<
+  { children: ReactNode; onError: () => void },
+  { hasError: boolean }
+> {
+  constructor(props) {
+    super(props);
+    this.state = { hasError: false };
+  }
+
+  static getDerivedStateFromError() {
+    return { hasError: true };
+  }
+
+  componentDidCatch() {
+    this.props.onError();
+  }
+
+  render() {
+    if (this.state.hasError) return null;
+    return this.props.children;
+  }
+}
+
+function GenericProviderIcon({ size }: { size: number }) {
+  return (
+    <svg width={size} height={size} viewBox="0 0 24 24" fill="none" style={{ flex: "none" }}>
+      <circle cx="12" cy="12" r="10" stroke="currentColor" strokeWidth="1.5" opacity="0.4" />
+      <path d="M8 12h8M12 8v8" stroke="currentColor" strokeWidth="1.5" strokeLinecap="round" />
+    </svg>
+  );
+}
+
+const ProviderIcon = memo(function ProviderIcon({
+  providerId,
+  size = 24,
+  type = "color",
+  className,
+  style,
+}: ProviderIconProps) {
+  const lobehubId = LOBEHUB_PROVIDER_MAP[providerId.toLowerCase()] ?? null;
+  const [useLobehub, setUseLobehub] = useState(lobehubId !== null);
+  const [usePng, setUsePng] = useState(true);
+
+  if (useLobehub && lobehubId) {
+    return (
+      <span
+        className={className}
+        style={{ display: "inline-flex", alignItems: "center", ...style }}
+      >
+        <LobehubErrorBoundary onError={() => setUseLobehub(false)}>
+          <LobehubProviderIcon provider={lobehubId} size={size} type={type} />
+        </LobehubErrorBoundary>
+      </span>
+    );
+  }
+
+  if (usePng) {
+    return (
+      <span
+        className={className}
+        style={{ display: "inline-flex", alignItems: "center", ...style }}
+      >
+        <Image
+          src={`/providers/${providerId}.png`}
+          alt={providerId}
+          width={size}
+          height={size}
+          style={{ objectFit: "contain" }}
+          onError={() => setUsePng(false)}
+          unoptimized
+        />
+      </span>
+    );
+  }
+
+  return (
+    <span className={className} style={{ display: "inline-flex", alignItems: "center", ...style }}>
+      <GenericProviderIcon size={size} />
+    </span>
+  );
+});
+
+export default ProviderIcon;
+export type { ProviderIconProps };
--- a/src/shared/services/modelSyncScheduler.ts
+++ b/src/shared/services/modelSyncScheduler.ts
@@ -0,0 +1,145 @@
+/**
+ * Model Auto-Sync Scheduler (#488)
+ *
+ * Automatically refreshes model lists for all providers with autoSync enabled
+ * at a configurable interval (default: 24h).
+ *
+ * Pattern mirrors cloudSyncScheduler.ts for consistency.
+ */
+
+import { getSettings, updateSettings } from "@/lib/localDb";
+
+const DEFAULT_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
+const MODEL_SYNC_SETTING_KEY = "model_sync_last_run";
+
+/** Providers that support live model list fetching via /v1/models */
+const AUTO_SYNC_PROVIDERS = [
+  "openai",
+  "anthropic",
+  "google",
+  "gemini",
+  "deepseek",
+  "groq",
+  "mistral",
+  "cohere",
+  "openrouter",
+  "together",
+  "fireworks",
+  "perplexity",
+  "xai",
+  "cerebras",
+  "ollama",
+  "nvidia",
+];
+
+let schedulerTimer: NodeJS.Timeout | null = null;
+let isRunning = false;
+
+/**
+ * Fetch and cache models for a single provider.
+ * Calls the internal /api/providers/{id}/sync-models endpoint (if it exists)
+ * or falls back to /v1/models from the provider registry.
+ */
+async function syncProviderModels(providerId: string, baseUrl: string): Promise<void> {
+  try {
+    const res = await fetch(`${baseUrl}/api/provider-nodes/sync-models`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "x-internal": "model-sync-scheduler" },
+      body: JSON.stringify({ provider: providerId }),
+    });
+    if (!res.ok) {
+      console.warn(`[ModelSync] Provider ${providerId}: sync returned ${res.status}`);
+    } else {
+      console.log(`[ModelSync] Provider ${providerId}: ✓ updated`);
+    }
+  } catch (err) {
+    console.warn(`[ModelSync] Provider ${providerId}: fetch failed —`, (err as Error).message);
+  }
+}
+
+/**
+ * Run one full model-sync cycle across all auto-sync providers.
+ */
+async function runSyncCycle(apiBaseUrl: string): Promise<void> {
+  if (isRunning) {
+    console.log("[ModelSync] Skipping cycle — previous run still in progress");
+    return;
+  }
+  isRunning = true;
+  const start = Date.now();
+  console.log(
+    `[ModelSync] Starting 24h model sync cycle — ${AUTO_SYNC_PROVIDERS.length} providers`
+  );
+
+  const results = await Promise.allSettled(
+    AUTO_SYNC_PROVIDERS.map((id) => syncProviderModels(id, apiBaseUrl))
+  );
+
+  const succeeded = results.filter((r) => r.status === "fulfilled").length;
+  console.log(
+    `[ModelSync] Cycle complete: ${succeeded}/${AUTO_SYNC_PROVIDERS.length} providers synced in ${Date.now() - start}ms`
+  );
+
+  // Record last sync time
+  try {
+    await updateSettings({ [MODEL_SYNC_SETTING_KEY]: new Date().toISOString() });
+  } catch {
+    // Non-critical
+  }
+  isRunning = false;
+}
+
+/**
+ * Start the model sync scheduler.
+ * @param apiBaseUrl — internal base URL to call OmniRoute's own API
+ * @param intervalMs — sync interval in milliseconds (default: 24h)
+ */
+export function startModelSyncScheduler(
+  apiBaseUrl = "http://localhost:20128",
+  intervalMs = DEFAULT_INTERVAL_MS
+): void {
+  if (schedulerTimer) {
+    console.log("[ModelSync] Scheduler already running — skipping start");
+    return;
+  }
+
+  // Read MODEL_SYNC_INTERVAL_HOURS env override
+  const envHours = parseInt(process.env.MODEL_SYNC_INTERVAL_HOURS ?? "", 10);
+  const effectiveIntervalMs =
+    !isNaN(envHours) && envHours > 0 ? envHours * 60 * 60 * 1000 : intervalMs;
+
+  console.log(
+    `[ModelSync] Scheduler started — interval: ${effectiveIntervalMs / 3_600_000}h, providers: ${AUTO_SYNC_PROVIDERS.length}`
+  );
+
+  // Run immediately on startup (staggered by 5s to avoid startup congestion)
+  const startupDelay = setTimeout(() => runSyncCycle(apiBaseUrl), 5_000);
+  startupDelay.unref?.();
+
+  // Then run on the regular interval
+  schedulerTimer = setInterval(() => runSyncCycle(apiBaseUrl), effectiveIntervalMs);
+  schedulerTimer.unref?.();
+}
+
+/**
+ * Stop the model sync scheduler.
+ */
+export function stopModelSyncScheduler(): void {
+  if (schedulerTimer) {
+    clearInterval(schedulerTimer);
+    schedulerTimer = null;
+    console.log("[ModelSync] Scheduler stopped");
+  }
+}
+
+/**
+ * Get last sync timestamp from settings DB.
+ */
+export async function getLastModelSyncTime(): Promise<string | null> {
+  try {
+    const settings = await getSettings();
+    return (settings as Record<string, string>)[MODEL_SYNC_SETTING_KEY] ?? null;
+  } catch {
+    return null;
+  }
+}
Author	SHA1	Message	Date
diegosouzapw	4fb9687782	docs(3.0.0-rc.5): comprehensive CHANGELOG and README vs v2.9.5 - CHANGELOG: [3.0.0-rc.5] section now serves as full 'What's New vs v2.9.5': * 2 new providers (OpenCode Zen/Go via PR #530) * 3 new features: Registered Keys API (#464), provider icons (#529), model auto-sync (#488) * 10 bug fixes (#521, #522, #524, #527, #532, #535, #536, #537, #489, #510, #492) * 16 issues resolved total, DB migration 008 - README: added 'What's New in v3.0.0' table section after badges	2026-03-22 15:51:54 -03:00
diegosouzapw	95ffc21b60	feat(3.0.0-rc.5): Registered Keys Provisioning API (#464 ) Complete implementation of auto-provisioning API: - DB migration 008: registered_keys, provider_key_limits, account_key_limits - src/lib/db/registeredKeys.ts: full quota enforcement, idempotency, sha256 hashing, budget tracking, window auto-reset - POST /api/v1/registered-keys — issue with quota check - GET /api/v1/registered-keys — list (masked) - GET\|DELETE /api/v1/registered-keys/[id] — get/revoke - POST /api/v1/registered-keys/[id]/revoke — explicit revoke - GET /api/v1/quotas/check — pre-validate without issuing - GET\|PUT /api/v1/providers/[id]/limits — provider limits CRUD - GET\|PUT /api/v1/accounts/[id]/limits — account limits CRUD - POST /api/v1/issues/report — optional GitHub issue reporting (requires GITHUB_ISSUES_REPO + GITHUB_ISSUES_TOKEN env vars) - Exported all from localDb.ts	2026-03-22 15:33:45 -03:00
diegosouzapw	f3c5e55b26	feat(3.0.0-rc.4): merge PR #530 — OpenCode Zen and Go providers Includes all commits from @kang-heewon's PR #530: - OpencodeExecutor with multi-format routing - opencode-zen + opencode-go registered in provider registry - UI metadata added to providers.ts - Unit tests for OpencodeExecutor (improved to avoid state coupling) Cherry-picked from add-opencode-providers into 3.0.0-rc. Conflicts resolved: executors/index.ts (merged pollinations+cloudflare-ai), providerRegistry.ts (kept testKeyBaseUrl from rc.2 + PR's authType/models).	2026-03-22 15:23:00 -03:00
kang-heewon	40183c6a5c	test(providers): improve OpencodeExecutor tests to avoid internal state coupling	2026-03-22 15:22:38 -03:00
kang-heewon	457c59e38a	test(providers): add unit tests for OpencodeExecutor	2026-03-22 15:22:38 -03:00
diegosouzapw	aa93a3f2e2	feat(3.0.0-rc.3): provider icons, model auto-sync, Gemini OAuth fix feat(ui): ProviderIcon component with @lobehub/icons + PNG fallback (#529) - 130+ providers covered by Lobehub SVG components via LobehubErrorBoundary - Falls back to existing /providers/{id}.png, then generic icon - Replaces manual img state machine in ProviderCard + ApiKeyProviderCard feat(scheduler): modelSyncScheduler — 24h model list auto-update (#488) - Syncs 16 major providers every 24h (MODEL_SYNC_INTERVAL_HOURS configurable) - Wired into POST /api/sync/initialize startup hook fix(oauth): Gemini CLI — clear error when client_secret missing in Docker (#537)	2026-03-22 15:01:38 -03:00
diegosouzapw	8b9abcb6cc	fix(3.0.0-rc.2): resolve issues #536 , #535 , #524 fix(providers): LongCat AI key validation — correct base URL and auth header (#536) - baseUrl: longcat.chat/api/v1/chat/completions -> api.longcat.chat/openai - authHeader: 'bearer' -> 'Authorization' + authPrefix: 'Bearer' fix(combo): implement pinnedModel override in comboAgentMiddleware (#535) - Previously: pinnedModel was detected but body.model was never updated - Now: body = { ...body, model: pinnedModel } when context_cache_protection fires fix(cli-tools): add OpenCode config save to guide-settings endpoint (#524) - Added 'opencode' case to switch in guide-settings/[toolId]/route.ts - saveOpenCodeConfig(): XDG_CONFIG_HOME aware, writes [provider.omniroute] TOML block	2026-03-22 13:31:56 -03:00