Merge pull request #616 from diegosouzapw/release/v3.0.3

chore(release): v3.0.3 — Target Fixes & Feature Rollup

.agents/workflows/deploy-vps-akamai.md

@@ -0,0 +1,39 @@
+---
+description: Deploy the latest OmniRoute code to the Akamai VPS (69.164.221.35)
+---
+
+# Deploy to Akamai VPS Workflow
+
+Deploy OmniRoute to the Akamai VPS using `npm pack + scp` + PM2.
+
+**Akamai VPS:** `69.164.221.35`
+**Process manager:** PM2 (`omniroute`)
+**Port:** `20128`
+
+## Steps
+
+### 1. Build + pack locally
+
+// turbo
+
+```bash
+cd /home/diegosouzapw/dev/proxys/9router && npm run build:cli && npm pack --ignore-scripts
+```
+
+### 2. Copy to Akamai VPS and install
+
+// turbo-all
+
+```bash
+scp omniroute-*.tgz root@69.164.221.35:/tmp/
+```
+
+```bash
+ssh root@69.164.221.35 "npm install -g /tmp/omniroute-*.tgz --ignore-scripts && cd /usr/lib/node_modules/omniroute/app && npm rebuild better-sqlite3 && pm2 delete omniroute 2>/dev/null; pm2 start /root/.omniroute/ecosystem.config.cjs --update-env && pm2 save && echo '✅ Akamai done'"
+```
+
+### 3. Verify the deployment
+
+```bash
+curl -s -o /dev/null -w 'AKAMAI HTTP %{http_code}\n' http://69.164.221.35:20128/
+```

.agents/workflows/deploy-vps-both.md

@@ -0,0 +1,49 @@
+---
+description: Deploy the latest OmniRoute code to BOTH the Akamai VPS and the Local VPS
+---
+
+# Deploy to VPS (Both) Workflow
+
+Deploy OmniRoute to the production VPSs using `npm pack + scp` + PM2.
+
+**Akamai VPS:** `69.164.221.35`
+**Local VPS:** `192.168.0.15`
+**Process manager:** PM2 (`omniroute`)
+**Port:** `20128`
+**PM2 entry:** `/usr/lib/node_modules/omniroute/app/server.js`
+
+> [!IMPORTANT]
+> The npm registry rejects packages > 100MB, so deployment uses **npm pack + scp**.
+
+## Steps
+
+### 1. Build + pack locally
+
+// turbo
+
+```bash
+cd /home/diegosouzapw/dev/proxys/9router && npm run build:cli && npm pack --ignore-scripts
+```
+
+### 2. Copy to both VPS and install
+
+// turbo-all
+
+```bash
+scp omniroute-*.tgz root@69.164.221.35:/tmp/ && scp omniroute-*.tgz root@192.168.0.15:/tmp/
+```
+
+```bash
+ssh root@69.164.221.35 "npm install -g /tmp/omniroute-*.tgz --ignore-scripts && cd /usr/lib/node_modules/omniroute/app && npm rebuild better-sqlite3 && pm2 delete omniroute 2>/dev/null; pm2 start /root/.omniroute/ecosystem.config.cjs --update-env && pm2 save && echo '✅ Akamai done'"
+```
+
+```bash
+ssh root@192.168.0.15 "npm install -g /tmp/omniroute-*.tgz --ignore-scripts && cd /usr/lib/node_modules/omniroute/app && npm rebuild better-sqlite3 && pm2 delete omniroute 2>/dev/null; pm2 start /root/.omniroute/ecosystem.config.cjs --update-env && pm2 save && echo '✅ Local done'"
+```
+
+### 3. Verify the deployment
+
+```bash
+curl -s -o /dev/null -w 'AKAMAI HTTP %{http_code}\n' http://69.164.221.35:20128/
+curl -s -o /dev/null -w 'LOCAL HTTP %{http_code}\n' http://192.168.0.15:20128/
+```

.agents/workflows/deploy-vps-local.md

@@ -0,0 +1,39 @@
+---
+description: Deploy the latest OmniRoute code to the Local VPS (192.168.0.15)
+---
+
+# Deploy to Local VPS Workflow
+
+Deploy OmniRoute to the Local VPS using `npm pack + scp` + PM2.
+
+**Local VPS:** `192.168.0.15`
+**Process manager:** PM2 (`omniroute`)
+**Port:** `20128`
+
+## Steps
+
+### 1. Build + pack locally
+
+// turbo
+
+```bash
+cd /home/diegosouzapw/dev/proxys/9router && npm run build:cli && npm pack --ignore-scripts
+```
+
+### 2. Copy to Local VPS and install
+
+// turbo-all
+
+```bash
+scp omniroute-*.tgz root@192.168.0.15:/tmp/
+```
+
+```bash
+ssh root@192.168.0.15 "npm install -g /tmp/omniroute-*.tgz --ignore-scripts && cd /usr/lib/node_modules/omniroute/app && npm rebuild better-sqlite3 && pm2 delete omniroute 2>/dev/null; pm2 start /root/.omniroute/ecosystem.config.cjs --update-env && pm2 save && echo '✅ Local done'"
+```
+
+### 3. Verify the deployment
+
+```bash
+curl -s -o /dev/null -w 'LOCAL HTTP %{http_code}\n' http://192.168.0.15:20128/
+```

.agents/workflows/deploy-vps.md

@@ -1,102 +0,0 @@
----
-description: Deploy the latest OmniRoute code to the Akamai VPS (69.164.221.35) via npm
----
-
-# Deploy to VPS Workflow
-
-Deploy OmniRoute to the production VPS using `npm pack + scp` + PM2.
-
-**VPS:** `69.164.221.35` (Akamai, Ubuntu 24.04, 1GB RAM + 2.5GB swap)
-**Local VPS:** `192.168.0.15` (same setup)
-**Process manager:** PM2 (`omniroute`)
-**Port:** `20128`
-**PM2 entry:** `/usr/lib/node_modules/omniroute/app/server.js`
-
-> [!IMPORTANT]
-> PM2 runs from the global npm package at `/usr/lib/node_modules/omniroute`.
-> The Next.js standalone build is at `app/server.js` inside that directory.
-> The npm registry rejects packages > 100MB, so deployment uses **npm pack + scp**.
-
-> [!CAUTION]
-> **NEVER** use `pm2 restart omniroute` after `npm install -g`. This drops env vars.
-> Always use `pm2 delete omniroute && pm2 start <ecosystem.config.cjs> --update-env`.
-> After `npm install -g`, always rebuild better-sqlite3: `cd .../app && npm rebuild better-sqlite3`
-
-## Steps
-
-### 1. Build + pack locally
-
-Run the full build (includes hash-strip patch) and create the .tgz:
-
-// turbo
-
-```bash
-cd /home/diegosouzapw/dev/proxys/9router && npm run build:cli && npm pack --ignore-scripts
-```
-
-### 2. Copy to both VPS and install
-
-// turbo-all
-
-```bash
-scp omniroute-*.tgz root@69.164.221.35:/tmp/ && scp omniroute-*.tgz root@192.168.0.15:/tmp/
-```
-
-```bash
-ssh root@69.164.221.35 "npm install -g /tmp/omniroute-*.tgz --ignore-scripts && cd /usr/lib/node_modules/omniroute/app && npm rebuild better-sqlite3 && pm2 delete omniroute 2>/dev/null; pm2 start /root/.omniroute/ecosystem.config.cjs --update-env && pm2 save && echo '✅ Akamai done'"
-```
-
-```bash
-ssh root@192.168.0.15 "npm install -g /tmp/omniroute-*.tgz --ignore-scripts && cd /usr/lib/node_modules/omniroute/app && npm rebuild better-sqlite3 && pm2 delete omniroute 2>/dev/null; pm2 start /root/.omniroute/ecosystem.config.cjs --update-env && pm2 save && echo '✅ Local done'"
-```
-
-### 3. Verify the deployment
-
-```bash
-ssh root@69.164.221.35 "pm2 list && cat \$(npm root -g)/omniroute/app/package.json | grep version | head -1 && curl -s -o /dev/null -w 'HTTP %{http_code}' http://localhost:20128/"
-```
-
-```bash
-ssh root@192.168.0.15 "pm2 list && cat \$(npm root -g)/omniroute/app/package.json | grep version | head -1 && curl -s -X POST http://localhost:20128/api/auth/login -H 'Content-Type: application/json' -d '{\"password\":\"123456\"}'"
-```
-
-Expected: PM2 shows `online`, version matches, login returns `{"success":true}`.
-
-## How it works
-
-1. `npm run build:cli` builds Next.js standalone → `app/` and strips Turbopack hashed require() calls from chunks
-2. `npm pack --ignore-scripts` packages without re-running the build
-3. `scp` transfers the .tgz to each VPS (~286MB)
-4. `npm install -g /tmp/omniroute-*.tgz --ignore-scripts` installs pre-built package
-5. `npm rebuild better-sqlite3` recompiles native bindings for the VPS Node.js version
-6. `pm2 delete` + `pm2 start ecosystem.config.cjs --update-env` restarts with env vars
-7. `pm2 save` persists the process list for reboot survival
-
-## Ecosystem Config
-
-Both VPSs have `ecosystem.config.cjs` at `/root/.omniroute/ecosystem.config.cjs`.
-This file defines env vars (PORT, DATA_DIR, INITIAL_PASSWORD, OAuth secrets, etc.)
-that `pm2 restart` does NOT inject — only `pm2 start --update-env` does.
-
-## PM2 Setup (one-time — if reconfiguring from scratch)
-
-```bash
-ssh root@<VPS> "
-  pm2 delete omniroute 2>/dev/null;
-  cd /usr/lib/node_modules/omniroute/app && npm rebuild better-sqlite3 &&
-  pm2 start /root/.omniroute/ecosystem.config.cjs --update-env &&
-  pm2 save && pm2 startup
-"
-```
-
-> [!NOTE]
-> Ensure `/root/.omniroute/ecosystem.config.cjs` exists with all required env vars.
-> For fresh installs, copy from the existing VPS or create from the template in `.env`.
-
-## Notes
-
-- Env vars are in `/root/.omniroute/ecosystem.config.cjs` (NOT `.env` in app dir)
-- PM2 is configured with `pm2 startup` to auto-restart on reboot
-- Nginx proxies `omniroute.online` → `localhost:20128`
-- The VPS has only 1GB RAM — builds happen locally, never on the VPS
-- After `npm install -g`, `better-sqlite3` MUST be rebuilt in the `app/` subdir

CHANGELOG.md

@@ -4,6 +4,23 @@
 
 ---
 
+## [3.0.3] — 2026-03-25
+
+### ✨ New Features
+
+- **Auto-Sync Models:** Added a UI toggle and `sync-models` endpoint to automatically synchronise model lists per provider using a scheduled interval scheduler (PR #597)
+
+### 🐛 Bug Fixes
+
+- **Timeouts:** Elevated default proxies `FETCH_TIMEOUT_MS` and `STREAM_IDLE_TIMEOUT_MS` to 10 minutes to properly support deep reasoning models (like o1) without aborting requests (Fixes #609)
+- **CLI Tool Detection:** Improved cross-platform detection handling NVM paths, Windows `PATHEXT` (preventing `.cmd` wrappers issue), and custom NPM prefixes (PR #598)
+- **Streaming Logs:** Implemented `tool_calls` delta accumulation in streaming response logs so function calls are tracked and persisted accurately in DB (PR #603)
+- **Model Catalog:** Removed auth exemption, properly hiding `comfyui` and `sdwebui` models when no provider is explicitly configured (PR #599)
+
+### 🌐 Translations
+
+- **cs:** Improved Czech translation strings across the app (PR #601)
+
 ## [3.0.2] — 2026-03-25
 
 ### 🚀 Enhancements & Features

README.md

@@ -32,12 +32,12 @@ _Your universal API proxy — one endpoint, 67+ providers, zero downtime. Now wi
 
 | Area                         | Change                                                                                                                                                                    |
 | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| 🔒 **CodeQL Security**       | Fixed 10+ CodeQL alerts: polynomial-redos, insecure-randomness, shell-injection remediation                                                                              |
-| ✅ **Route Validation**       | All 176 API routes now validated with Zod schemas + `validateBody()` — CI `check:route-validation:t06` passes                                                            |
-| 🐛 **omniModel Tag Leak**    | Internal `<omniModel>` tags no longer leak to clients in SSE streaming responses (#585)                                                                                  |
+| 🔒 **CodeQL Security**       | Fixed 10+ CodeQL alerts: polynomial-redos, insecure-randomness, shell-injection remediation                                                                               |
+| ✅ **Route Validation**      | All 176 API routes now validated with Zod schemas + `validateBody()` — CI `check:route-validation:t06` passes                                                             |
+| 🐛 **omniModel Tag Leak**    | Internal `<omniModel>` tags no longer leak to clients in SSE streaming responses (#585)                                                                                   |
 | 🔑 **Registered Keys API**   | Auto-provision API keys via `POST /api/v1/registered-keys` with per-provider/account quota enforcement, idempotency, SHA-256 storage, and optional GitHub issue reporting |
 | 🎨 **Provider Icons**        | 130+ provider logos via `@lobehub/icons` (SVG) with PNG → generic fallback chain                                                                                          |
-| 🔄 **Model Auto-Sync**       | 24h scheduler refreshes model lists for 16 providers on startup — configurable via `MODEL_SYNC_INTERVAL_HOURS`                                                            |
+| 🔄 **Model Auto-Sync**       | 24h scheduler and manual UI toggle to sync model lists for built-in and custom OpenAI-compatible providers                                                                |
 | 🌐 **OpenCode Zen/Go**       | Two new providers from @kang-heewon via PR #530: free tier + subscription tier via `OpencodeExecutor`                                                                     |
 | 🐛 **Gemini CLI OAuth**      | Actionable error when `GEMINI_OAUTH_CLIENT_SECRET` is missing in Docker (was cryptic Google error)                                                                        |
 | 🐛 **OpenCode config**       | `saveOpenCodeConfig()` now correctly writes TOML to `XDG_CONFIG_HOME`                                                                                                     |

docs/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OmniRoute API
-  version: 3.0.2
+  version: 3.0.3
   description: |
     OmniRoute is a local-first AI API proxy router. It provides an OpenAI-compatible
     endpoint that routes requests to multiple AI providers with load balancing,

open-sse/config/constants.ts

@@ -1,12 +1,12 @@
 import { loadProviderCredentials } from "./credentialLoader.ts";
 
 // Timeout for non-streaming fetch requests (ms). Prevents stalled connections.
-export const FETCH_TIMEOUT_MS = parseInt(process.env.FETCH_TIMEOUT_MS || "120000", 10);
+export const FETCH_TIMEOUT_MS = parseInt(process.env.FETCH_TIMEOUT_MS || "600000", 10);
 
 // Idle timeout for SSE streams (ms). Closes stream if no data for this duration.
 // Default: 120s balances deep-reasoning pauses with fast zombie stream detection (#473).
 // Extended-thinking models rarely pause >90s between chunks. Override with STREAM_IDLE_TIMEOUT_MS env var.
-export const STREAM_IDLE_TIMEOUT_MS = parseInt(process.env.STREAM_IDLE_TIMEOUT_MS || "120000", 10);
+export const STREAM_IDLE_TIMEOUT_MS = parseInt(process.env.STREAM_IDLE_TIMEOUT_MS || "600000", 10);
 
 // Provider configurations
 // OAuth credentials read from env vars with hardcoded fallbacks for backward compatibility.

open-sse/services/comboConfig.ts

@@ -9,7 +9,7 @@ const DEFAULT_COMBO_CONFIG = {
   strategy: "priority",
   maxRetries: 1,
   retryDelayMs: 2000,
-  timeoutMs: 120000,
+  timeoutMs: 600000,
   concurrencyPerModel: 3, // max simultaneous requests per model (round-robin)
   queueTimeoutMs: 30000, // max wait time in semaphore queue (round-robin)
   healthCheckEnabled: true,

open-sse/utils/stream.ts

@@ -57,6 +57,13 @@ type TranslateState = ReturnType<typeof initState> & {
   accumulatedContent?: string;
 };
 
+type ToolCall = {
+  id: string | null;
+  index: number;
+  type: string;
+  function: { name: string; arguments: string };
+};
+
 type UsageTokenRecord = Record<string, number>;
 
 function getOpenAIIntermediateChunks(value: unknown): unknown[] {
@@ -113,6 +120,9 @@ export function createSSEStream(options: StreamOptions = {}) {
   let usage: UsageTokenRecord | null = null;
   /** Passthrough (OpenAI CC shape): saw tool_calls in stream before finish_reason */
   let passthroughHasToolCalls = false;
+  /** Passthrough: accumulate tool_calls deltas for call log responseBody */
+  const passthroughToolCalls = new Map<string, ToolCall>();
+  let passthroughToolCallSeq = 0;
 
   // State for translate mode (accumulatedContent for call log response body)
   const state: TranslateState | null =
@@ -268,9 +278,39 @@ export function createSSEStream(options: StreamOptions = {}) {
                     }
                   }
 
-                  // T18: Track if we saw tool calls
+                  // T18: Track if we saw tool calls & accumulate for call log
                   if (delta?.tool_calls && delta.tool_calls.length > 0) {
                     passthroughHasToolCalls = true;
+                    for (const tc of delta.tool_calls) {
+                      // Key by index first — id only appears on the first delta in OpenAI streaming
+                      let key: string;
+                      if (Number.isInteger(tc?.index)) {
+                        key = `idx:${tc.index}`;
+                      } else if (tc?.id) {
+                        key = `id:${tc.id}`;
+                      } else {
+                        key = `seq:${++passthroughToolCallSeq}`;
+                      }
+                      const existing = passthroughToolCalls.get(key);
+                      const deltaArgs =
+                        typeof tc?.function?.arguments === "string" ? tc.function.arguments : "";
+                      if (!existing) {
+                        passthroughToolCalls.set(key, {
+                          id: tc?.id ?? null,
+                          index: Number.isInteger(tc?.index) ? tc.index : passthroughToolCalls.size,
+                          type: tc?.type || "function",
+                          function: {
+                            name: tc?.function?.name || "",
+                            arguments: deltaArgs,
+                          },
+                        });
+                      } else {
+                        if (tc?.id) existing.id = existing.id || tc.id;
+                        if (tc?.function?.name && !existing.function.name)
+                          existing.function.name = tc.function.name;
+                        existing.function.arguments += deltaArgs;
+                      }
+                    }
                   }
 
                   const content = delta?.content || delta?.reasoning_content;
@@ -516,13 +556,20 @@ export function createSSEStream(options: StreamOptions = {}) {
                 const prompt = Number(u?.prompt_tokens ?? u?.input_tokens ?? 0);
                 const completion = Number(u?.completion_tokens ?? u?.output_tokens ?? 0);
                 const content = passthroughAccumulatedContent.trim() || "";
+                const message: Record<string, unknown> = {
+                  role: "assistant",
+                  content: content || null,
+                };
+                if (passthroughToolCalls.size > 0) {
+                  message.tool_calls = [...passthroughToolCalls.values()].sort(
+                    (a, b) => a.index - b.index
+                  );
+                }
                 const responseBody = {
                   choices: [
                     {
-                      message: {
-                        role: "assistant",
-                        content,
-                      },
+                      message,
+                      finish_reason: passthroughHasToolCalls ? "tool_calls" : "stop",
                     },
                   ],
                   usage: {
@@ -643,13 +690,32 @@ export function createSSEStream(options: StreamOptions = {}) {
               const prompt = Number(u?.prompt_tokens ?? u?.input_tokens ?? 0);
               const completion = Number(u?.completion_tokens ?? u?.output_tokens ?? 0);
               const content = (state?.accumulatedContent ?? "").trim() || "";
+              const message: Record<string, unknown> = {
+                role: "assistant",
+                content: content || null,
+              };
+              const hasToolCalls = state?.toolCalls?.size > 0;
+              if (hasToolCalls) {
+                // Normalize shape — translators may store different structures
+                message.tool_calls = [...state.toolCalls.values()]
+                  .map(
+                    (tc: Record<string, unknown>): ToolCall => ({
+                      id: (tc.id as string) ?? null,
+                      index: (tc.index as number) ?? (tc.blockIndex as number) ?? 0,
+                      type: (tc.type as string) ?? "function",
+                      function: (tc.function as ToolCall["function"]) ?? {
+                        name: (tc.name as string) ?? "",
+                        arguments: "",
+                      },
+                    })
+                  )
+                  .sort((a, b) => a.index - b.index);
+              }
               const responseBody = {
                 choices: [
                   {
-                    message: {
-                      role: "assistant",
-                      content,
-                    },
+                    message,
+                    finish_reason: hasToolCalls ? "tool_calls" : "stop",
                   },
                 ],
                 usage: {

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "omniroute",
-  "version": "3.0.2",
+  "version": "3.0.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omniroute",
-      "version": "3.0.2",
+      "version": "3.0.3",
       "hasInstallScript": true,
       "license": "MIT",
       "workspaces": [

package.json

@@ -1,6 +1,6 @@
 {
   "name": "omniroute",
-  "version": "3.0.2",
+  "version": "3.0.3",
   "description": "Smart AI Router with auto fallback — route to FREE & cheap models, zero downtime. Works with Cursor, Cline, Claude Desktop, Codex, and any OpenAI-compatible tool.",
   "type": "module",
   "bin": {

src/app/(dashboard)/dashboard/providers/[id]/page.tsx

@@ -1513,6 +1513,35 @@ export default function ProviderDetailPage() {
 
   const canImportModels = connections.some((conn) => conn.isActive !== false);
 
+  // Auto-sync toggle state: read from first active connection's providerSpecificData
+  const autoSyncConnection = connections.find((conn: any) => conn.isActive !== false);
+  const isAutoSyncEnabled = !!(autoSyncConnection as any)?.providerSpecificData?.autoSync;
+  const [togglingAutoSync, setTogglingAutoSync] = useState(false);
+
+  const handleToggleAutoSync = async () => {
+    if (!autoSyncConnection || togglingAutoSync) return;
+    setTogglingAutoSync(true);
+    try {
+      const newValue = !isAutoSyncEnabled;
+      await fetch(`/api/providers/${(autoSyncConnection as any).id}`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          providerSpecificData: { autoSync: newValue },
+        }),
+      });
+      await fetchConnections();
+      notify[newValue ? "success" : "info"](
+        newValue ? t("autoSyncEnabled") : t("autoSyncDisabled")
+      );
+    } catch (error) {
+      console.log("Error toggling auto-sync:", error);
+      notify.error(t("autoSyncToggleFailed"));
+    } finally {
+      setTogglingAutoSync(false);
+    }
+  };
+
   const customMap = useMemo(() => buildCompatMap(modelMeta.customModels), [modelMeta.customModels]);
   const overrideMap = useMemo(
     () => buildCompatMap(modelMeta.modelCompatOverrides),
@@ -1604,29 +1633,50 @@ export default function ProviderDetailPage() {
   };
 
   const renderModelsSection = () => {
+    const autoSyncToggle = canImportModels && (
+      <button
+        onClick={handleToggleAutoSync}
+        disabled={togglingAutoSync}
+        className="flex items-center gap-1.5 px-2.5 py-1 rounded-lg border border-border bg-transparent cursor-pointer text-[12px] disabled:opacity-50 disabled:cursor-not-allowed"
+        title={t("autoSyncTooltip")}
+      >
+        <span
+          className="material-symbols-outlined text-[16px]"
+          style={{ color: isAutoSyncEnabled ? "#22c55e" : "var(--color-text-muted)" }}
+        >
+          {isAutoSyncEnabled ? "toggle_on" : "toggle_off"}
+        </span>
+        <span className="text-text-main">{t("autoSync")}</span>
+      </button>
+    );
+
     if (isCompatible) {
       return (
-        <CompatibleModelsSection
-          providerStorageAlias={providerStorageAlias}
-          providerDisplayAlias={providerDisplayAlias}
-          modelAliases={modelAliases}
-          copied={copied}
-          onCopy={copy}
-          onSetAlias={handleSetAlias}
-          onDeleteAlias={handleDeleteAlias}
-          connections={connections}
-          isAnthropic={isAnthropicCompatible}
-          onImportWithProgress={handleCompatibleImportWithProgress}
-          t={t}
-          effectiveModelNormalize={effectiveModelNormalize}
-          effectiveModelPreserveDeveloper={effectiveModelPreserveDeveloper}
-          getUpstreamHeadersRecord={getUpstreamHeadersRecordForModel}
-          saveModelCompatFlags={saveModelCompatFlags}
-          compatSavingModelId={compatSavingModelId}
-          onModelsChanged={fetchProviderModelMeta}
-        />
+        <div>
+          <div className="flex items-center gap-2 mb-4">{autoSyncToggle}</div>
+          <CompatibleModelsSection
+            providerStorageAlias={providerStorageAlias}
+            providerDisplayAlias={providerDisplayAlias}
+            modelAliases={modelAliases}
+            copied={copied}
+            onCopy={copy}
+            onSetAlias={handleSetAlias}
+            onDeleteAlias={handleDeleteAlias}
+            connections={connections}
+            isAnthropic={isAnthropicCompatible}
+            onImportWithProgress={handleCompatibleImportWithProgress}
+            t={t}
+            effectiveModelNormalize={effectiveModelNormalize}
+            effectiveModelPreserveDeveloper={effectiveModelPreserveDeveloper}
+            getUpstreamHeadersRecord={getUpstreamHeadersRecordForModel}
+            saveModelCompatFlags={saveModelCompatFlags}
+            compatSavingModelId={compatSavingModelId}
+            onModelsChanged={fetchProviderModelMeta}
+          />
+        </div>
       );
     }
+
     if (providerInfo.passthroughModels) {
       return (
         <div>
@@ -1640,6 +1690,7 @@ export default function ProviderDetailPage() {
             >
               {importingModels ? t("importingModels") : t("importFromModels")}
             </Button>
+            {autoSyncToggle}
             {!canImportModels && (
               <span className="text-xs text-text-muted">{t("addConnectionToImport")}</span>
             )}
@@ -1673,6 +1724,7 @@ export default function ProviderDetailPage() {
         >
           {importingModels ? t("importingModels") : t("importFromModels")}
         </Button>
+        {autoSyncToggle}
         {!canImportModels && (
           <span className="text-xs text-text-muted">{t("addConnectionToImport")}</span>
         )}

src/app/api/providers/[id]/sync-models/route.ts

@@ -0,0 +1,125 @@
+import { NextResponse } from "next/server";
+import { getProviderConnectionById } from "@/models";
+import { replaceCustomModels } from "@/lib/db/models";
+import { saveCallLog } from "@/lib/usage/callLogs";
+import { isAuthenticated } from "@/shared/utils/apiAuth";
+
+/**
+ * POST /api/providers/[id]/sync-models
+ *
+ * Fetches the model list from a provider's /models endpoint and replaces the
+ * full custom models list for that provider. Logs the operation to call_logs.
+ *
+ * Used by:
+ * - modelSyncScheduler (auto-sync on interval)
+ * - Manual trigger from UI
+ */
+export async function POST(request: Request, { params }: { params: Promise<{ id: string }> }) {
+  const start = Date.now();
+  const { id } = await params;
+
+  try {
+    if (!(await isAuthenticated(request))) {
+      return NextResponse.json(
+        { error: { message: "Authentication required", type: "invalid_api_key" } },
+        { status: 401 }
+      );
+    }
+
+    const connection = await getProviderConnectionById(id);
+    if (!connection) {
+      return NextResponse.json({ error: "Connection not found" }, { status: 404 });
+    }
+
+    // Use a human-readable provider name for logs
+    const providerLabel = connection.name || connection.provider || "unknown";
+
+    // Fetch models from the existing /api/providers/[id]/models endpoint
+    const origin = new URL(request.url).origin;
+    const modelsUrl = `${origin}/api/providers/${id}/models`;
+    const modelsRes = await fetch(modelsUrl, {
+      method: "GET",
+      headers: {
+        cookie: request.headers.get("cookie") || "",
+        "x-internal": "model-sync",
+      },
+    });
+
+    const duration = Date.now() - start;
+    const modelsData = await modelsRes.json();
+
+    if (!modelsRes.ok) {
+      // Log the failed attempt
+      await saveCallLog({
+        method: "GET",
+        path: `/api/providers/${id}/models`,
+        status: modelsRes.status,
+        model: "model-sync",
+        provider: providerLabel,
+        sourceFormat: "-",
+        connectionId: id,
+        duration,
+        error: modelsData.error || `HTTP ${modelsRes.status}`,
+        requestType: "model-sync",
+      });
+
+      return NextResponse.json(
+        { error: modelsData.error || "Failed to fetch models" },
+        { status: modelsRes.status }
+      );
+    }
+
+    const fetchedModels = modelsData.models || [];
+
+    // Replace the full model list
+    const models = fetchedModels
+      .map((m: any) => ({
+        id: m.id || m.name || m.model,
+        name: m.name || m.displayName || m.id || m.model,
+        source: "auto-sync",
+      }))
+      .filter((m: any) => m.id);
+
+    const replaced = await replaceCustomModels(connection.provider, models);
+
+    // Log the successful sync
+    await saveCallLog({
+      method: "GET",
+      path: `/api/providers/${id}/models`,
+      status: 200,
+      model: "model-sync",
+      provider: providerLabel,
+      sourceFormat: "-",
+      connectionId: id,
+      duration: Date.now() - start,
+      requestType: "model-sync",
+      responseBody: {
+        syncedModels: models.length,
+        provider: connection.provider,
+      },
+    });
+
+    return NextResponse.json({
+      ok: true,
+      provider: connection.provider,
+      syncedModels: replaced.length,
+      models: replaced,
+    });
+  } catch (error: any) {
+    // Log error
+    await saveCallLog({
+      method: "POST",
+      path: `/api/providers/${id}/sync-models`,
+      status: 500,
+      model: "model-sync",
+      provider: "unknown",
+      sourceFormat: "-",
+      connectionId: id,
+      duration: Date.now() - start,
+      error: error.message || "Sync failed",
+      requestType: "model-sync",
+    }).catch(() => {});
+
+    return NextResponse.json({ error: error.message || "Failed to sync models" }, { status: 500 });
+  }
+}

src/app/api/v1/models/catalog.ts

@@ -14,8 +14,8 @@ import { getAllImageModels } from "@omniroute/open-sse/config/imageRegistry.ts";
 import { getAllRerankModels } from "@omniroute/open-sse/config/rerankRegistry.ts";
 import { getAllAudioModels } from "@omniroute/open-sse/config/audioRegistry.ts";
 import { getAllModerationModels } from "@omniroute/open-sse/config/moderationRegistry.ts";
-import { getAllVideoModels, getVideoProvider } from "@omniroute/open-sse/config/videoRegistry.ts";
-import { getAllMusicModels, getMusicProvider } from "@omniroute/open-sse/config/musicRegistry.ts";
+import { getAllVideoModels } from "@omniroute/open-sse/config/videoRegistry.ts";
+import { getAllMusicModels } from "@omniroute/open-sse/config/musicRegistry.ts";
 import { REGISTRY } from "@omniroute/open-sse/config/providerRegistry.ts";
 
 const FALLBACK_ALIAS_TO_PROVIDER = {
@@ -315,10 +315,9 @@ export async function getUnifiedModelsResponse(
       });
     }
 
-    // Add video models (local providers always listed, cloud filtered by active)
+    // Add video models (filtered by active providers)
     for (const videoModel of getAllVideoModels()) {
-      const vConfig = getVideoProvider(videoModel.provider);
-      if (vConfig?.authType !== "none" && !isProviderActive(videoModel.provider)) continue;
+      if (!isProviderActive(videoModel.provider)) continue;
       models.push({
         id: videoModel.id,
         object: "model",
@@ -328,10 +327,9 @@ export async function getUnifiedModelsResponse(
       });
     }
 
-    // Add music models (local providers always listed, cloud filtered by active)
+    // Add music models (filtered by active providers)
     for (const musicModel of getAllMusicModels()) {
-      const mConfig = getMusicProvider(musicModel.provider);
-      if (mConfig?.authType !== "none" && !isProviderActive(musicModel.provider)) continue;
+      if (!isProviderActive(musicModel.provider)) continue;
       models.push({
         id: musicModel.id,
         object: "model",

src/i18n/messages/en.json

@@ -1378,6 +1378,11 @@
     "chatCompletions": "Chat Completions",
     "importingModels": "Importing...",
     "importFromModels": "Import from /models",
+    "autoSync": "Auto-Sync",
+    "autoSyncTooltip": "Automatically refresh model list every 24h (configurable via MODEL_SYNC_INTERVAL_HOURS)",
+    "autoSyncEnabled": "Auto-sync enabled — models will refresh periodically",
+    "autoSyncDisabled": "Auto-sync disabled",
+    "autoSyncToggleFailed": "Failed to toggle auto-sync",
     "addConnectionToImport": "Add a connection to enable importing.",
     "noModelsConfigured": "No models configured",
     "connectionCount": "{count} connection(s)",

src/i18n/messages/zh-CN.json

@@ -1378,6 +1378,11 @@
     "chatCompletions": "聊天完成",
     "importingModels": "正在导入...",
     "importFromModels": "从 /models 导入",
+    "autoSync": "自动同步",
+    "autoSyncTooltip": "每24小时自动刷新模型列表（可通过 MODEL_SYNC_INTERVAL_HOURS 配置）",
+    "autoSyncEnabled": "已启用自动同步 — 模型列表将定期刷新",
+    "autoSyncDisabled": "已禁用自动同步",
+    "autoSyncToggleFailed": "切换自动同步失败",
     "addConnectionToImport": "添加连接以启用导入。",
     "noModelsConfigured": "尚未配置模型",
     "connectionCount": "{count} 连接",

src/lib/db/models.ts

@@ -360,6 +360,76 @@ export async function addCustomModel(
   return model;
 }
 
+/**
+ * Replace the entire custom models list for a provider (used by auto-sync).
+ * Preserves per-model compatibility overrides for models that still exist.
+ */
+export async function replaceCustomModels(
+  providerId: string,
+  models: Array<{
+    id: string;
+    name?: string;
+    source?: string;
+    apiFormat?: string;
+    supportedEndpoints?: string[];
+  }>
+) {
+  const db = getDbInstance();
+  const existing = await getCustomModels(providerId);
+  const existingMap = new Map<string, JsonRecord>();
+  if (Array.isArray(existing)) {
+    for (const m of existing) {
+      if (m && typeof m === "object" && m.id) existingMap.set(m.id, m);
+    }
+  }
+
+  // Merge: keep existing per-model compat flags if model still exists
+  const merged = models.map((m) => {
+    const prev = existingMap.get(m.id);
+    return {
+      id: m.id,
+      name: m.name || m.id,
+      source: m.source || "auto-sync",
+      apiFormat: m.apiFormat || (prev as any)?.apiFormat || "chat-completions",
+      supportedEndpoints: m.supportedEndpoints || (prev as any)?.supportedEndpoints || ["chat"],
+      // Preserve existing compat flags
+      ...(prev && (prev as any).normalizeToolCallId !== undefined
+        ? { normalizeToolCallId: (prev as any).normalizeToolCallId }
+        : {}),
+      ...(prev && (prev as any).preserveOpenAIDeveloperRole !== undefined
+        ? { preserveOpenAIDeveloperRole: (prev as any).preserveOpenAIDeveloperRole }
+        : {}),
+      ...(prev && (prev as any).compatByProtocol
+        ? { compatByProtocol: (prev as any).compatByProtocol }
+        : {}),
+      ...(prev && (prev as any).upstreamHeaders
+        ? { upstreamHeaders: (prev as any).upstreamHeaders }
+        : {}),
+    };
+  });
+
+  if (merged.length === 0) {
+    db.prepare("DELETE FROM key_value WHERE namespace = 'customModels' AND key = ?").run(
+      providerId
+    );
+  } else {
+    db.prepare(
+      "INSERT OR REPLACE INTO key_value (namespace, key, value) VALUES ('customModels', ?, ?)"
+    ).run(providerId, JSON.stringify(merged));
+  }
+
+  // Remove compat overrides for models that no longer exist
+  const newIds = new Set(models.map((m) => m.id));
+  const compatList = readCompatList(providerId);
+  const filteredCompat = compatList.filter((e) => newIds.has(e.id));
+  if (filteredCompat.length !== compatList.length) {
+    writeCompatList(providerId, filteredCompat);
+  }
+
+  backupDbFile("pre-write");
+  return merged;
+}
+
 export async function removeCustomModel(providerId, modelId) {
   const db = getDbInstance();
   const row = db

src/lib/localDb.ts

@@ -48,6 +48,7 @@ export {
   getCustomModels,
   getAllCustomModels,
   addCustomModel,
+  replaceCustomModels,
   removeCustomModel,
   updateCustomModel,
   getModelCompatOverrides,

src/shared/services/cliRuntime.ts

@@ -1,7 +1,8 @@
 import fs from "fs/promises";
+import fsSync from "fs";
 import os from "os";
 import path from "path";
-import { spawn } from "child_process";
+import { spawn, execFileSync } from "child_process";
 
 const VALID_RUNTIME_MODES = new Set(["auto", "host", "container"]);
 const FALSE_VALUES = new Set(["0", "false", "no", "off"]);
@@ -258,6 +259,42 @@ const validateEnvPath = (value: string | undefined, allowedParents: string[]): s
   return normalized;
 };
 
+/**
+ * Detect the npm global bin directory.
+ * Cached on first call — `execFileSync` is expensive, only run once.
+ */
+let _npmGlobalPrefix: string | undefined;
+const getNpmGlobalPrefix = (): string => {
+  if (_npmGlobalPrefix !== undefined) return _npmGlobalPrefix;
+
+  const envPrefix = String(process.env.npm_config_prefix || "").trim();
+  if (envPrefix && path.isAbsolute(envPrefix)) {
+    _npmGlobalPrefix = envPrefix;
+    return _npmGlobalPrefix;
+  }
+
+  try {
+    const result = execFileSync("npm", ["config", "get", "prefix"], {
+      timeout: 5000,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      ...(isWindows() ? { shell: true } : {}),
+    });
+    const prefix = result.trim();
+    if (
+      prefix &&
+      path.isAbsolute(prefix) &&
+      !DANGEROUS_PATH_CHARS.some((c) => prefix.includes(c))
+    ) {
+      _npmGlobalPrefix = prefix;
+      return _npmGlobalPrefix;
+    }
+  } catch {}
+
+  _npmGlobalPrefix = "";
+  return _npmGlobalPrefix;
+};
+
 /**
  * Pre-compute expected parent directories at module startup for performance.
  * These are the allowed directories for CLI binary installation locations.
@@ -281,6 +318,8 @@ const getExpectedParentPaths = (): string[] => {
     "C:\\Program Files (x86)",
   ]);
 
+  const npmPrefix = getNpmGlobalPrefix();
+
   return [
     home,
     userProfile,
@@ -288,6 +327,7 @@ const getExpectedParentPaths = (): string[] => {
     validatedLocalAppData,
     validatedProgramFiles,
     validatedProgramFilesX86,
+    npmPrefix,
   ].filter(Boolean);
 };
 
@@ -310,86 +350,94 @@ const getExtraPaths = () =>
     });
 
 /**
- * Get known installation paths for a specific CLI tool on Windows.
- * Returns ONLY verified, tool-specific paths - NOT generic user bin directories.
- * This is more secure than searching PATH as it checks known locations only.
+ * Get known installation paths for a specific CLI tool.
+ * Checks npm global prefix, NVM locations, standalone installer paths.
+ * Works on all platforms — Windows checks .cmd wrappers, Linux/macOS checks bare names.
  */
 const getKnownToolPaths = (toolId: string): string[] => {
-  if (!isWindows()) return [];
-
   const home = os.homedir();
-  const userProfile = process.env.USERPROFILE || home;
+  const paths: string[] = [];
 
-  // Validate environment paths against allowed parent directories
-  const appData = validateEnvPath(process.env.APPDATA, [home, userProfile]);
-  const localAppData = validateEnvPath(process.env.LOCALAPPDATA, [
-    path.join(home, "AppData", "Local"),
-    path.join(userProfile, "AppData", "Local"),
-    userProfile,
-  ]);
-
-  // Cache nvm node path to avoid duplicate detection calls
+  const npmPrefix = getNpmGlobalPrefix();
   const nvmNodePath = getNvmNodePath();
 
-  // Tool-specific known installation paths (verified locations only)
-  const knownPaths: Record<string, string[]> = {
+  const toolBins: Record<string, [string, string][]> = {
     claude: [
-      // Official Claude Code standalone installer locations
-      path.join(home, ".local", "bin", "claude.exe"),
-      ...(localAppData ? [path.join(localAppData, "Programs", "Claude", "claude.exe")] : []),
-      ...(localAppData ? [path.join(localAppData, "claude-code", "claude.exe")] : []),
-      // npm global (only if nvm-windows is detected)
-      ...(nvmNodePath ? [path.join(nvmNodePath, "claude-code.cmd")] : []),
-    ],
-    codex: [
-      path.join(home, ".local", "bin", "codex"),
-      // npm global (only if nvm-windows is detected)
-      ...(nvmNodePath ? [path.join(nvmNodePath, "codex.cmd")] : []),
-      ...(appData ? [path.join(appData, "npm", "codex.cmd")] : []),
-    ],
-    droid: [
-      path.join(home, ".local", "bin", "droid"),
-      // npm global (only if nvm-windows is detected)
-      ...(nvmNodePath ? [path.join(nvmNodePath, "droid.cmd")] : []),
-      ...(appData ? [path.join(appData, "npm", "droid.cmd")] : []),
-    ],
-    openclaw: [
-      path.join(home, ".local", "bin", "openclaw"),
-      // npm global (only if nvm-windows is detected)
-      ...(nvmNodePath ? [path.join(nvmNodePath, "openclaw.cmd")] : []),
-      ...(appData ? [path.join(appData, "npm", "openclaw.cmd")] : []),
+      ["claude.cmd", "claude"],
+      ["claude.exe", "claude"],
     ],
+    codex: [["codex.cmd", "codex"]],
+    droid: [["droid.cmd", "droid"]],
+    openclaw: [["openclaw.cmd", "openclaw"]],
     cursor: [
-      path.join(home, ".local", "bin", "agent"),
-      path.join(home, ".local", "bin", "cursor"),
-      // npm global (only if nvm-windows is detected)
-      ...(nvmNodePath ? [path.join(nvmNodePath, "agent.cmd")] : []),
-      ...(nvmNodePath ? [path.join(nvmNodePath, "cursor.cmd")] : []),
-      ...(appData ? [path.join(appData, "npm", "agent.cmd")] : []),
-      ...(appData ? [path.join(appData, "npm", "cursor.cmd")] : []),
+      ["agent.cmd", "agent"],
+      ["cursor.cmd", "cursor"],
     ],
-    cline: [
-      path.join(home, ".local", "bin", "cline"),
-      // npm global (only if nvm-windows is detected)
-      ...(nvmNodePath ? [path.join(nvmNodePath, "cline.cmd")] : []),
-      ...(appData ? [path.join(appData, "npm", "cline.cmd")] : []),
-    ],
-    kilo: [
-      path.join(home, ".local", "bin", "kilocode"),
-      // npm global (only if nvm-windows is detected)
-      ...(nvmNodePath ? [path.join(nvmNodePath, "kilocode.cmd")] : []),
-      ...(appData ? [path.join(appData, "npm", "kilocode.cmd")] : []),
-    ],
-    opencode: [
-      path.join(home, ".local", "bin", "opencode"),
-      // npm global (only if nvm-windows is detected)
-      ...(nvmNodePath ? [path.join(nvmNodePath, "opencode.cmd")] : []),
-      ...(appData ? [path.join(appData, "npm", "opencode.cmd")] : []),
-    ],
-    // Add other tools as needed with their specific known paths
+    cline: [["cline.cmd", "cline"]],
+    kilo: [["kilocode.cmd", "kilocode"]],
+    opencode: [["opencode.cmd", "opencode"]],
   };
 
-  return knownPaths[toolId] || [];
+  const bins = toolBins[toolId] || [];
+
+  if (isWindows()) {
+    const userProfile = process.env.USERPROFILE || home;
+    const appData = validateEnvPath(process.env.APPDATA, [home, userProfile]);
+    const localAppData = validateEnvPath(process.env.LOCALAPPDATA, [
+      path.join(home, "AppData", "Local"),
+      path.join(userProfile, "AppData", "Local"),
+      userProfile,
+    ]);
+
+    if (toolId === "claude") {
+      paths.push(path.join(home, ".local", "bin", "claude.exe"));
+      if (localAppData) {
+        paths.push(path.join(localAppData, "Programs", "Claude", "claude.exe"));
+        paths.push(path.join(localAppData, "claude-code", "claude.exe"));
+      }
+    }
+
+    for (const [winName] of bins) {
+      if (npmPrefix) paths.push(path.join(npmPrefix, winName));
+      if (appData) {
+        const appDataPath = path.join(appData, "npm", winName);
+        if (
+          !npmPrefix ||
+          path.normalize(appDataPath) !== path.normalize(path.join(npmPrefix, winName))
+        ) {
+          paths.push(appDataPath);
+        }
+      }
+      if (nvmNodePath) paths.push(path.join(nvmNodePath, winName));
+    }
+  } else {
+    for (const [, posixName] of bins) {
+      const nodeBinDir = path.dirname(process.execPath);
+      paths.push(path.join(nodeBinDir, posixName));
+
+      if (npmPrefix) {
+        paths.push(path.join(npmPrefix, "bin", posixName));
+      }
+
+      paths.push(path.join(home, ".local", "bin", posixName));
+      // Only add system paths if they exist (avoids unnecessary stat calls)
+      if (fsSync.existsSync("/usr/local/bin")) {
+        paths.push(path.join("/usr", "local", "bin", posixName));
+      }
+      if (fsSync.existsSync("/usr/bin")) {
+        paths.push(path.join("/usr", "bin", posixName));
+      }
+
+      if (toolId === "opencode") {
+        paths.push(path.join(home, ".opencode", "bin", posixName));
+      }
+      if (toolId === "claude") {
+        paths.push(path.join(home, ".claude", "bin", posixName));
+      }
+    }
+  }
+
+  return paths;
 };
 
 /**
@@ -492,7 +540,7 @@ const locateCommand = async (command: string, env: Record<string, string | undef
  * Security hardening:
  * - Resolves symlinks and verifies target stays within expected directories
  * - Verifies file is a regular file (not directory, pipe, or device)
- * - Checks file size bounds (1KB - 100MB) to detect suspicious binaries
+ * - Checks file size bounds (30B - 100MB) to detect suspicious binaries
  */
 const checkKnownPath = async (commandPath: string) => {
   if (!path.isAbsolute(commandPath)) {
@@ -521,9 +569,10 @@ const checkKnownPath = async (commandPath: string) => {
       return { installed: false, commandPath: null, reason: "not_file" };
     }
 
-    // CLI binaries should be > 1KB and < 100MB
-    // This catches suspicious files while allowing for wrapper scripts
-    if (stat.size < 1024 || stat.size > 100 * 1024 * 1024) {
+    // CLI binaries should be > 30 bytes and < 100MB
+    // npm .cmd wrappers on Windows are ~300-500 bytes, JS wrappers on Linux can be ~44 bytes
+    // Minimum catches empty/suspicious files while allowing legitimate thin wrappers
+    if (stat.size < 30 || stat.size > 100 * 1024 * 1024) {
       return { installed: false, commandPath: null, reason: "suspicious_size" };
     }
   } catch (error) {
@@ -556,7 +605,7 @@ const locateCommandCandidate = async (
 
   // SECURITY: First check known installation paths for this specific tool
   // This avoids searching PATH and reduces attack surface
-  if (toolId && isWindows()) {
+  if (toolId) {
     const knownPaths = getKnownToolPaths(toolId);
     for (const knownPath of knownPaths) {
       const result = await checkKnownPath(knownPath);
@@ -592,6 +641,7 @@ const checkRunnable = async (
     PATH: env.PATH,
     HOME: env.HOME || env.USERPROFILE,
     SystemRoot: env.SystemRoot, // Windows needs this
+    PATHEXT: env.PATHEXT, // Windows cmd.exe needs this to resolve .cmd/.bat/.exe extensions
   };
 
   for (const args of [["--version"], ["-v"]]) {

src/shared/services/modelSyncScheduler.ts

@@ -1,8 +1,9 @@
 /**
  * Model Auto-Sync Scheduler (#488)
  *
- * Automatically refreshes model lists for all providers with autoSync enabled
- * at a configurable interval (default: 24h).
+ * Automatically refreshes model lists for provider connections that have
+ * autoSync enabled in their providerSpecificData, at a configurable
+ * interval (default: 24h).
  *
  * Pattern mirrors cloudSyncScheduler.ts for consistency.
  */
@@ -12,53 +13,67 @@ import { getSettings, updateSettings } from "@/lib/localDb";
 const DEFAULT_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
 const MODEL_SYNC_SETTING_KEY = "model_sync_last_run";
 
-/** Providers that support live model list fetching via /v1/models */
-const AUTO_SYNC_PROVIDERS = [
-  "openai",
-  "anthropic",
-  "google",
-  "gemini",
-  "deepseek",
-  "groq",
-  "mistral",
-  "cohere",
-  "openrouter",
-  "together",
-  "fireworks",
-  "perplexity",
-  "xai",
-  "cerebras",
-  "ollama",
-  "nvidia",
-];
-
 let schedulerTimer: NodeJS.Timeout | null = null;
 let isRunning = false;
 
 /**
- * Fetch and cache models for a single provider.
- * Calls the internal /api/providers/{id}/sync-models endpoint (if it exists)
- * or falls back to /v1/models from the provider registry.
+ * Fetch all provider connections that have autoSync enabled.
  */
-async function syncProviderModels(providerId: string, baseUrl: string): Promise<void> {
+async function getAutoSyncConnections(): Promise<
+  Array<{ id: string; provider: string; name?: string }>
+> {
   try {
-    const res = await fetch(`${baseUrl}/api/provider-nodes/sync-models`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", "x-internal": "model-sync-scheduler" },
-      body: JSON.stringify({ provider: providerId }),
+    const { getProviderConnections } = await import("@/lib/localDb");
+    const connections = await getProviderConnections();
+    return connections.filter((conn: any) => {
+      if (!conn.isActive && conn.isActive !== undefined) return false;
+      const psd =
+        conn.providerSpecificData && typeof conn.providerSpecificData === "object"
+          ? conn.providerSpecificData
+          : {};
+      return psd.autoSync === true;
     });
-    if (!res.ok) {
-      console.warn(`[ModelSync] Provider ${providerId}: sync returned ${res.status}`);
-    } else {
-      console.log(`[ModelSync] Provider ${providerId}: ✓ updated`);
-    }
   } catch (err) {
-    console.warn(`[ModelSync] Provider ${providerId}: fetch failed —`, (err as Error).message);
+    console.warn("[ModelSync] Failed to load connections:", (err as Error).message);
+    return [];
   }
 }
 
 /**
- * Run one full model-sync cycle across all auto-sync providers.
+ * Sync models for a single connection via the internal sync-models endpoint.
+ */
+async function syncConnectionModels(
+  connectionId: string,
+  provider: string,
+  baseUrl: string
+): Promise<boolean> {
+  try {
+    const res = await fetch(`${baseUrl}/api/providers/${connectionId}/sync-models`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "x-internal": "model-sync-scheduler" },
+    });
+    if (!res.ok) {
+      console.warn(
+        `[ModelSync] ${provider} (${connectionId.slice(0, 8)}): sync returned ${res.status}`
+      );
+      return false;
+    }
+    const data = await res.json();
+    console.log(
+      `[ModelSync] ${provider} (${connectionId.slice(0, 8)}): ✓ ${data.syncedModels || 0} models`
+    );
+    return true;
+  } catch (err) {
+    console.warn(
+      `[ModelSync] ${provider} (${connectionId.slice(0, 8)}): fetch failed —`,
+      (err as Error).message
+    );
+    return false;
+  }
+}
+
+/**
+ * Run one full model-sync cycle across all auto-sync connections.
  */
 async function runSyncCycle(apiBaseUrl: string): Promise<void> {
   if (isRunning) {
@@ -67,26 +82,37 @@ async function runSyncCycle(apiBaseUrl: string): Promise<void> {
   }
   isRunning = true;
   const start = Date.now();
-  console.log(
-    `[ModelSync] Starting 24h model sync cycle — ${AUTO_SYNC_PROVIDERS.length} providers`
-  );
 
-  const results = await Promise.allSettled(
-    AUTO_SYNC_PROVIDERS.map((id) => syncProviderModels(id, apiBaseUrl))
-  );
-
-  const succeeded = results.filter((r) => r.status === "fulfilled").length;
-  console.log(
-    `[ModelSync] Cycle complete: ${succeeded}/${AUTO_SYNC_PROVIDERS.length} providers synced in ${Date.now() - start}ms`
-  );
-
-  // Record last sync time
   try {
-    await updateSettings({ [MODEL_SYNC_SETTING_KEY]: new Date().toISOString() });
-  } catch {
-    // Non-critical
+    const connections = await getAutoSyncConnections();
+
+    if (connections.length === 0) {
+      console.log("[ModelSync] No connections with autoSync enabled — skipping cycle");
+      return;
+    }
+
+    console.log(`[ModelSync] Starting model sync cycle — ${connections.length} connection(s)`);
+
+    const results = await Promise.allSettled(
+      connections.map((conn) =>
+        syncConnectionModels(conn.id, conn.name || conn.provider, apiBaseUrl)
+      )
+    );
+
+    const succeeded = results.filter((r) => r.status === "fulfilled" && r.value === true).length;
+    console.log(
+      `[ModelSync] Cycle complete: ${succeeded}/${connections.length} synced in ${Date.now() - start}ms`
+    );
+
+    // Record last sync time
+    try {
+      await updateSettings({ [MODEL_SYNC_SETTING_KEY]: new Date().toISOString() });
+    } catch {
+      // Non-critical
+    }
+  } finally {
+    isRunning = false;
   }
-  isRunning = false;
 }
 
 /**
@@ -108,9 +134,7 @@ export function startModelSyncScheduler(
   const effectiveIntervalMs =
     !isNaN(envHours) && envHours > 0 ? envHours * 60 * 60 * 1000 : intervalMs;
 
-  console.log(
-    `[ModelSync] Scheduler started — interval: ${effectiveIntervalMs / 3_600_000}h, providers: ${AUTO_SYNC_PROVIDERS.length}`
-  );
+  console.log(`[ModelSync] Scheduler started — interval: ${effectiveIntervalMs / 3_600_000}h`);
 
   // Run immediately on startup (staggered by 5s to avoid startup congestion)
   const startupDelay = setTimeout(() => runSyncCycle(apiBaseUrl), 5_000);

tests/unit/cli-runtime-detection.test.mjs

@@ -0,0 +1,202 @@
+/**
+ * Tests for CLI tool detection: cross-platform known paths, size threshold,
+ * npm prefix deduplication, and env var overrides.
+ */
+
+import { describe, it, before, after } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const { getCliRuntimeStatus, CLI_TOOL_IDS } =
+  await import("../../src/shared/services/cliRuntime.ts");
+
+// ─── Helpers ──────────────────────────────────────────────────
+
+function createTempDir() {
+  return fs.mkdtempSync(path.join(os.tmpdir(), "cli-test-"));
+}
+
+function createFile(dir, name, content) {
+  const filePath = path.join(dir, name);
+  fs.writeFileSync(filePath, content);
+  if (process.platform !== "win32") {
+    fs.chmodSync(filePath, 0o755);
+  }
+  return filePath;
+}
+
+// ─── CLI_TOOL_IDS ─────────────────────────────────────────────
+
+describe("CLI_TOOL_IDS", () => {
+  it("should include all expected tools", () => {
+    const expected = [
+      "claude",
+      "codex",
+      "droid",
+      "openclaw",
+      "cursor",
+      "cline",
+      "kilo",
+      "continue",
+      "opencode",
+    ];
+    for (const id of expected) {
+      assert.ok(CLI_TOOL_IDS.includes(id), `Missing tool: ${id}`);
+    }
+  });
+});
+
+// ─── Size Threshold (30 bytes) ────────────────────────────────
+
+describe("Size threshold — checkKnownPath", () => {
+  let tmpDir;
+
+  before(() => {
+    tmpDir = createTempDir();
+  });
+
+  after(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  it("should detect files >= 30 bytes via env var", async () => {
+    const prev = process.env.CLI_DROID_BIN;
+    // Create a valid 30-byte+ script
+    const content =
+      process.platform === "win32"
+        ? "@echo off\r\necho 1.0.0\r\nexit 0\r\n"
+        : "#!/bin/sh\r\necho 1.0.0\r\nexit 0\r\n";
+    const script = createFile(tmpDir, "droid-valid", content);
+    // Verify it's at least 30 bytes
+    const stat = fs.statSync(script);
+    assert.ok(stat.size >= 30, `File should be >= 30 bytes, got ${stat.size}`);
+
+    process.env.CLI_DROID_BIN = script;
+    try {
+      const result = await getCliRuntimeStatus("droid");
+      assert.ok(result.installed, `Expected installed=true, got reason=${result.reason}`);
+      assert.ok(result.commandPath === script, `Expected commandPath=${script}`);
+    } finally {
+      if (prev !== undefined) process.env.CLI_DROID_BIN = prev;
+      else delete process.env.CLI_DROID_BIN;
+    }
+  });
+
+  it("should detect a valid CLI script (>= 30 bytes) via env var", async () => {
+    const prev = process.env.CLI_DROID_BIN;
+    const script =
+      process.platform === "win32"
+        ? createFile(tmpDir, "droid.cmd", "@echo off\necho 1.0.0\n")
+        : createFile(tmpDir, "droid", "#!/bin/sh\necho 1.0.0\n");
+
+    process.env.CLI_DROID_BIN = script;
+    try {
+      const result = await getCliRuntimeStatus("droid");
+      assert.ok(result.installed, `Expected installed=true, got reason=${result.reason}`);
+      assert.ok(
+        result.commandPath === script,
+        `Expected commandPath=${script}, got ${result.commandPath}`
+      );
+    } finally {
+      if (prev !== undefined) process.env.CLI_DROID_BIN = prev;
+      else delete process.env.CLI_DROID_BIN;
+    }
+  });
+});
+
+// ─── Healthcheck with --version ───────────────────────────────
+
+describe("Healthcheck — checkRunnable", () => {
+  let tmpDir;
+
+  before(() => {
+    tmpDir = createTempDir();
+  });
+
+  after(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  it("should report runnable=true for a script that outputs version", async () => {
+    const prev = process.env.CLI_CLINE_BIN;
+    const script =
+      process.platform === "win32"
+        ? createFile(tmpDir, "good.cmd", "@echo off\necho 1.0.0\n")
+        : createFile(tmpDir, "good", "#!/bin/sh\necho 1.0.0\n");
+
+    process.env.CLI_CLINE_BIN = script;
+    try {
+      const result = await getCliRuntimeStatus("cline");
+      assert.ok(result.installed, `Expected installed=true, got reason=${result.reason}`);
+      if (result.runnable) {
+        assert.ok(result.reason === null, `Expected no reason, got ${result.reason}`);
+      }
+    } finally {
+      if (prev !== undefined) process.env.CLI_CLINE_BIN = prev;
+      else delete process.env.CLI_CLINE_BIN;
+    }
+  });
+});
+
+// ─── Unknown tool ─────────────────────────────────────────────
+
+describe("Unknown tool", () => {
+  it("should return unknown_tool for non-existent tool", async () => {
+    const result = await getCliRuntimeStatus("nonexistent-tool-xyz");
+    assert.equal(result.installed, false);
+    assert.equal(result.reason, "unknown_tool");
+  });
+});
+
+// ─── continue tool (requiresBinary: false) ────────────────────
+
+describe("continue tool — no binary required", () => {
+  it("should report installed=true without checking binary", async () => {
+    const result = await getCliRuntimeStatus("continue");
+    assert.equal(result.installed, true);
+    assert.equal(result.reason, "not_required");
+  });
+});
+
+// ─── resolveOpencodeConfigPath — cross-platform ─────────────────
+
+const { resolveOpencodeConfigPath: resolveOpencodeConfigPathFn } =
+  await import("../../src/shared/services/cliRuntime.ts");
+
+describe("resolveOpencodeConfigPath — cross-platform", () => {
+  it("should resolve on Linux with XDG_CONFIG_HOME", () => {
+    const result = resolveOpencodeConfigPathFn(
+      "linux",
+      { XDG_CONFIG_HOME: "/tmp/xdg" },
+      "/home/dev"
+    );
+    assert.equal(result, path.join("/tmp/xdg", "opencode", "opencode.json"));
+  });
+
+  it("should resolve on Linux with default .config", () => {
+    const result = resolveOpencodeConfigPathFn("linux", {}, "/home/dev");
+    assert.equal(result, path.join("/home/dev", ".config", "opencode", "opencode.json"));
+  });
+
+  it("should resolve on Windows with APPDATA", () => {
+    const result = resolveOpencodeConfigPathFn(
+      "win32",
+      { APPDATA: "C:\\Users\\dev\\AppData\\Roaming" },
+      "C:\\Users\\dev"
+    );
+    assert.equal(
+      result,
+      path.join("C:\\Users\\dev\\AppData\\Roaming", "opencode", "opencode.json")
+    );
+  });
+
+  it("should fallback to home/AppData/Roaming on Windows without APPDATA", () => {
+    const result = resolveOpencodeConfigPathFn("win32", {}, "C:\\Users\\dev");
+    assert.equal(
+      result,
+      path.join("C:\\Users\\dev", "AppData", "Roaming", "opencode", "opencode.json")
+    );
+  });
+});