docs(readme): use local SVG flags + convert doc-link tables to lists (#8317)

Flag emoji (regional-indicator) do not render on Windows and several
Safari/WebKit configs, breaking the 'In 42+ languages' table there.
Replace each emoji with a local SVG <img> from flag-icons (MIT), served
from docs/assets/flags/ so the language selector renders everywhere.

Also convert the 5 'Document | Description' reference tables to definition
lists — full-width and scroll-free on GitHub (tables are capped at
width:max-content and scroll horizontally on narrow viewports).

.dockerignore

@@ -125,3 +125,4 @@ app.__qa_backup/
 .worktrees
 .next-playwright/
 cloud/
+electron/dist-electron

.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.sh]
+indent_size = 4

.env.example

@@ -73,16 +73,25 @@ DISABLE_SQLITE_AUTO_BACKUP=false
 # Default: 20128
 PORT=20128
 
+# Base path (URL subpath) when serving OmniRoute behind a reverse proxy under a subpath.
+# Used by: next.config.mjs — sets Next.js `basePath`; auth redirects are basePath-aware.
+# Default: "" (served at the domain root). Example: /omniroute to serve under https://host/omniroute
+# OMNIROUTE_BASE_PATH=
+
 # Split-port mode: serve Dashboard and API on separate ports for network isolation.
 # Used by: src/lib/runtime/ports.ts — overrides PORT for each service.
 # API_PORT=20129
 # API_HOST=0.0.0.0
 # DASHBOARD_PORT=20128
 
+# Connection backpressure: cap concurrent in-flight chat connections (503 + Retry-After when full).
+# Used by: src/sse/utils/backpressure.ts — disabled when unset/0.
+# OMNI_MAX_CONCURRENT_CONNECTIONS=0
+
 # Port for the real-time WebSocket live monitoring server.
 # Used by: src/server/ws/liveServer.ts, src/app/api/v1/ws/route.ts
-# Default: 20129
-# LIVE_WS_PORT=20129
+# Default: 20132
+# LIVE_WS_PORT=20132
 
 # Bind address for the live WebSocket server.
 # Default: 127.0.0.1 (loopback only). Set to 0.0.0.0 to expose on LAN —
@@ -92,11 +101,29 @@ PORT=20128
 # Comma-separated extra origins allowed to open a live WebSocket. The
 # loopback dashboard origins are already permitted by default; use this
 # var when fronting the server with a domain (e.g. https://omni.local).
+# ⚠️  When using NEXT_PUBLIC_LIVE_WS_PUBLIC_URL or exposing the WS server
+# beyond loopback, this MUST include the public origin(s) — otherwise
+# the Origin allow-list check will reject all browser connections.
+# Example: LIVE_WS_ALLOWED_ORIGINS=https://omni.local,https://dashboard.example.com,https://ws.my-ai.com
 # LIVE_WS_ALLOWED_ORIGINS=https://omni.local,https://dashboard.example.com
 
-# Disable the standalone live WebSocket helper used by scripts/start-ws-server.mjs.
-# Used by: scripts/start-ws-server.mjs (CI/embedded harness toggle).
-# OMNIROUTE_DISABLE_LIVE_WS=0
+# Comma-separated extra hostnames allowed to open a live WebSocket (LAN/Tailscale).
+# Unlike LIVE_WS_ALLOWED_ORIGINS (which matches full origin URLs), this matches
+# only the host portion — useful for wildcard-ish LAN/Tailscale setups.
+# Used by: src/server/ws/liveServerAllowList.ts
+# Example: LIVE_WS_ALLOWED_HOSTS=omni.local,tailscale-host,192.168.1.50
+# LIVE_WS_ALLOWED_HOSTS=omni.local,tailscale-host,192.168.1.50
+
+# Public URL for the live dashboard WebSocket (client-side, browser only).
+# Set this when fronting the WS server with a reverse proxy or Cloudflare Tunnel.
+# The browser will connect to this URL instead of ws://hostname:20132.
+# The path portion of this URL (e.g. ws://localhost:20132/live-ws -> /live-ws) is also used by the dev proxy
+# (scripts/dev/standalone-server-ws.mjs) and the handshake response to route
+# WebSocket upgrades. Default path: /live-ws.
+# Used by: src/hooks/useLiveDashboard.ts, src/app/api/v1/ws/route.ts,
+# scripts/dev/standalone-server-ws.mjs, and scripts/start-ws-server.mjs.
+# Example: NEXT_PUBLIC_LIVE_WS_PUBLIC_URL=wss://ws.my-ai.com/live-ws
+# NEXT_PUBLIC_LIVE_WS_PUBLIC_URL=ws://localhost:20132/live-ws
 
 # Enable the real-time dashboard WebSocket server.
 # Used by: src/server/ws/liveServer.ts, scripts/start-ws-server.mjs
@@ -149,6 +176,12 @@ OMNIROUTE_USE_TURBOPACK=1
 # hints in production logs.
 # OMNIROUTE_PROXY_FETCH_DEBUG=true
 
+# Set to any non-empty value to emit `[omniroute completion]` diagnostics from
+# the CLI shell-completion cache paths (read/refresh/write) in
+# bin/cli/commands/completion.mjs. Off by default — these caches fail silently
+# so a missing/corrupt cache never breaks tab-completion.
+# OMNIROUTE_DEBUG_COMPLETION=1
+
 # Docker production port mappings (docker-compose.prod.yml only).
 # These set the HOST-side published ports. Container ports use PORT/API_PORT.
 # PROD_DASHBOARD_PORT=20130
@@ -162,8 +195,13 @@ OMNIROUTE_USE_TURBOPACK=1
 # Hostname/bind address for the Next.js server.
 # Used by: scripts/dev/run-next.mjs (HOST), Playwright runner (HOSTNAME).
 # Default: 0.0.0.0 (HOST) / 127.0.0.1 (HOSTNAME inside tests).
-#HOST=0.0.0.0
-#HOSTNAME=127.0.0.1
+# NOTE: Do NOT use `HOSTNAME` — it is a POSIX shell variable automatically set to
+# the machine name by bash/zsh. The .env loader cannot override it (first-wins
+# semantics). Use OMNIROUTE_SERVER_HOST instead for `omniroute serve`.
+# See: https://github.com/diegosouzapw/OmniRoute/issues/6194
+# HOST=0.0.0.0
+# HOSTNAME=127.0.0.1
+# OMNIROUTE_SERVER_HOST=0.0.0.0
 
 # Environment mode — affects Next.js behavior, logging verbosity, and caching.
 # Values: production | development  |  Default: production
@@ -175,6 +213,17 @@ NODE_ENV=production
 # gives the correct fix instructions (podman unshare chown vs sudo chown).
 CONTAINER_HOST=docker
 
+# Container runtime override for skill sandboxing.
+# Used by: src/lib/skills/sandbox.ts + src/lib/skills/containerProvider.ts
+# Values: auto | docker | apple | wsl | orbstack | podman
+# - auto:    OS-aware auto-detect (apple/orbstack on macOS, wsl on Windows, podman on Linux)
+# - apple:   Apple Container (native OCI on macOS 26+)
+# - wsl:     WSL Container CLI (wslc.exe on Windows)
+# - orbstack: OrbStack (high-perf Linux VM + docker shim on macOS)
+# - podman:  Podman (rootless, daemonless)
+# - docker:  Docker (default fallback)
+SKILLS_SANDBOX_RUNTIME=auto
+
 # ═══════════════════════════════════════════════════════════════════════════════
 # 4. SECURITY & AUTHENTICATION
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -239,10 +288,30 @@ ALLOW_API_KEY_REVEAL=false
 # Default: 10485760 (10 MB)
 # MAX_BODY_SIZE_BYTES=10485760
 
+# Heap-pressure-aware admission for POST /v1/chat/completions (#5152). A large
+# coding-agent "compact" body amplifies into hundreds of MB of transient JS objects
+# on the combo path; concurrent compacts can stack past the V8 heap ceiling and OOM
+# the process. These shed a LARGE body with 503 (Retry-After) only while the heap is
+# already under pressure — healthy heap admits every body untouched.
+# Used by: src/shared/middleware/chatBodyAdmission.ts
+# Bodies below this size skip the guard entirely (heap not even sampled). Default 262144 (256 KB).
+# OMNIROUTE_CHAT_LARGE_BODY_BYTES=262144
+# Hard cap — bodies above this are rejected with 413 before any clone/parse. Default 52428800 (50 MB).
+# OMNIROUTE_CHAT_HARD_MAX_BODY_BYTES=52428800
+# Shed large bodies once heapUsed/heap_size_limit reaches this ratio (0<r<1). Default 0.75.
+# OMNIROUTE_CHAT_HEAP_SHED_RATIO=0.75
+
+# Hard cap (bytes) for a non-streaming upstream response buffered fully into memory
+# (#5152). Past this the upstream reader is cancelled and the request fails fast
+# instead of growing an unbounded string until the V8 heap is exhausted.
+# Used by: open-sse/handlers/chatCore/nonStreamingResponseBody.ts
+# Default: 67108864 (64 MB)
+# OMNIROUTE_MAX_NONSTREAMING_RESPONSE_BYTES=67108864
+
 # CORS configuration — controls which cross-origin browser clients can call the API.
 # Used by: src/server/cors/origins.ts — sets Access-Control-Allow-Origin.
-# Same-origin dashboard requests behind a reverse proxy do not need CORS; set
-# NEXT_PUBLIC_BASE_URL instead. No wildcard is sent unless CORS_ALLOW_ALL=true.
+# Same-origin dashboard requests behind a reverse proxy do not need CORS; they
+# use session-bound CSRF protection. No wildcard is sent unless CORS_ALLOW_ALL=true.
 # CORS_ALLOWED_ORIGINS=https://your-frontend.example.com
 # CORS_ORIGIN=https://your-frontend.example.com  # legacy single-origin alias
 # CORS_ALLOW_ALL=false
@@ -349,29 +418,39 @@ CLOUD_URL=
 # Default: 12000 (12 seconds)
 # CLOUD_SYNC_TIMEOUT_MS=12000
 
-# Public-facing base URL — CRITICAL for reverse proxy / OAuth callback setups.
-# Used by: OAuth redirect_uri computation, Dashboard UI links, generated public
-# URLs, and same-origin browser mutation checks.
-# Set to your public URL when behind nginx/Caddy (e.g., https://omniroute.example.com).
+# Public-facing base URL — required for stable reverse proxy / OAuth callback setups.
+# Used by: OAuth redirect_uri computation, Dashboard UI links, and generated public URLs.
+# Set to your stable public URL when OAuth callbacks or generated browser links need a
+# canonical host behind nginx/Caddy (e.g., https://omniroute.example.com).
 #
 # Dashboard display behavior: when this variable is unset, the dashboard
 # auto-detects the base URL shown in curl examples and CLI tool snippets
 # from window.location.origin (the host the user is browsing). Setting it
 # explicitly is only required when running behind a reverse proxy with a
-# different public hostname, or when OAuth callbacks must point to a
-# canonical URL.
+# different public hostname, or when OAuth callbacks / generated browser links must point
+# to a canonical URL. Authenticated dashboard writes use same-origin requests plus
+# session-bound CSRF protection and do not require a static public base URL.
 #
 # Default: http://localhost:20128
 NEXT_PUBLIC_BASE_URL=http://localhost:20128
 
 # Browser-facing OmniRoute origin for generated assets in API responses.
-# Highest-priority public origin override; also used by public-origin validation.
+# Highest-priority public origin override; also used by non-dashboard public-origin validation.
 # Used by: chatgpt-web image generation cache URLs (/v1/chatgpt-web/image/<id>).
 # Set this when OpenWebUI or another relay reaches OmniRoute by an internal URL
 # but the user's browser must fetch images from a LAN, tunnel, or public origin.
 # Do not include /v1; if included accidentally it will be normalized away.
 # OMNIROUTE_PUBLIC_BASE_URL=http://192.168.0.15:20128
 
+# Absolute provider plugin manifest URL advertised to sidecar clients.
+# Used by: open-sse/config/providerPluginManifestUrl.ts. When unset, OmniRoute
+# derives the URL from request origin or HOST/PORT using OMNIROUTE_PUBLIC_PROTOCOL.
+# OMNIROUTE_PROVIDER_MANIFEST_URL=https://omniroute.example.com/api/v1/provider-plugin-manifest
+
+# Protocol used when deriving provider plugin manifest URLs without a request origin.
+# Used by: open-sse/config/providerPluginManifestUrl.ts. Defaults to http.
+# OMNIROUTE_PUBLIC_PROTOCOL=http
+
 # Max wait time for an async chatgpt-web image to land via the celsius
 # WebSocket, in milliseconds. Default 180000 (3 minutes). Increase during
 # upstream queue-deep windows ("Lots of people are creating images right now").
@@ -426,7 +505,9 @@ NEXT_PUBLIC_CLOUD_URL=
 #OMNIROUTE_CROF_USAGE_URL=https://crof.ai/usage_api/
 #OMNIROUTE_CODEWHISPERER_BASE_URL=https://codewhisperer.us-east-1.amazonaws.com
 #OMNIROUTE_OPENCODE_QUOTA_URL=https://opencode.ai/zen/go/v1/quota
-#OMNIROUTE_OPENCODE_GO_QUOTA_URL=https://api.z.ai/api/monitor/usage/quota/limit
+# OpenCode Go has no public quota API — this has no default and stays
+# unset unless you explicitly opt in to a self-hosted/mirrored endpoint:
+#OMNIROUTE_OPENCODE_GO_QUOTA_URL=
 #OMNIROUTE_OPENCODE_GO_DASHBOARD_URL=https://opencode.ai/workspace
 #OMNIROUTE_OLLAMA_CLOUD_USAGE_URL=https://ollama.com/settings
 
@@ -438,6 +519,18 @@ NEXT_PUBLIC_CLOUD_URL=
 #OPENCODE_GO_AUTH_COOKIE=auth=...
 #OMNIROUTE_OPENCODE_GO_AUTH_COOKIE=auth=...
 
+# OpenCode Go/Zen VPS egress (#5997): on a datacenter VPS, Cloudflare in front of
+# opencode.ai/zen/go 403s chat requests that lack OpenCode CLI identity headers.
+# When your clients don't already send them, set this to synthesize the CLI headers
+# (User-Agent, x-opencode-client, x-opencode-project, fresh request/session UUIDs) on
+# absent keys. OFF by default — forward-only is safer when clients already send them.
+# Values are overridable via OPENCODE_GO_USER_AGENT / OPENCODE_USER_AGENT / OPENCODE_CLIENT /
+# OPENCODE_PROJECT (defaults: opencode-cli/1.0.0 / cli / default).
+#OPENCODE_SYNTHESIZE_CLI_HEADERS=true
+#OPENCODE_USER_AGENT=opencode-cli/1.0.0
+#OPENCODE_CLIENT=cli
+#OPENCODE_PROJECT=default
+
 # Ollama Cloud quota scraping. Prefer configuring this per connection in
 # Dashboard → Providers → Ollama Cloud. The cookie is sensitive.
 #OLLAMA_USAGE_COOKIE=__Secure-session=...
@@ -509,6 +602,14 @@ NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
 # Allow OmniRoute to write CLI config files (token refresh, etc.).
 # CLI_ALLOW_CONFIG_WRITES=true
 
+# Auto-sync CLI profile files after provider model discovery changes. OPT-IN, default OFF for
+# both. When enabled, writes only the tool's profile files (~/.codex/*.config.toml or
+# ~/.claude/profiles/<name>/settings.json); never changes the active/default config. Both also
+# require CLI_ALLOW_CONFIG_WRITES (default on). Toggle from the CLI Code dashboard, or set here.
+# Leave unset to disable. (Feature flags — a DB/dashboard override takes precedence over env.)
+# OMNIROUTE_AUTO_SYNC_CODEX_PROFILES=true
+# OMNIROUTE_AUTO_SYNC_CLAUDE_PROFILES=true
+
 # Override binary paths for individual CLI tools.
 # CLI_CLAUDE_BIN=claude
 # CLI_CODEX_BIN=codex
@@ -519,6 +620,8 @@ NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
 # CLI_CONTINUE_BIN=cn
 # CLI_QODER_BIN=qoder
 # CLI_QWEN_BIN=qwen
+# CLI_AUGGIE_BIN=auggie
+# AUGGIE_BIN=auggie
 
 # Override the Hermes Agent home directory (where OmniRoute reads/writes the
 # Hermes CLI config). Matches the env var the Hermes PowerShell installer sets
@@ -586,6 +689,14 @@ PROVIDER_LIMITS_SYNC_INTERVAL_MINUTES=70
 # to opt out (restores fully concurrent fetches). Default: 1500
 PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 
+# Min interval (ms) between consecutive UPSTREAM quota fetches on the per-request
+# preflight/monitor path (e.g. Codex /wham/usage), complementing the bulk-sync
+# spacing above. Many accounts on one IP fetching quota in the same second can look
+# like automation to the upstream and get an OAuth token revoked (#6009). This gate
+# serializes genuine network calls (cache hits are unaffected). Set to 0 to disable.
+# Default: 250 (clamped 0..5000).
+# OMNIROUTE_QUOTA_FETCH_MIN_INTERVAL_MS=250
+
 # Delay (ms) before refreshing provider limits after a real usage event (e.g. a
 # completed request). Gives the upstream quota API time to register the consumption
 # before the dashboard polls. Default: 5000
@@ -654,6 +765,25 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # Used by: open-sse/services/compression/engines/rtk/filterLoader.ts.  Default: 0.
 #OMNIROUTE_RTK_TRUST_PROJECT_FILTERS=0
 
+# T02 stacked-pipeline engine circuit-breaker (OPT-IN, default off). When enabled, a compression
+# engine that throws repeatedly across requests is skipped (fail-open) for a cooldown.
+# Used by: open-sse/services/compression/pipelineEngineBreaker.ts.
+#COMPRESSION_PIPELINE_BREAKER_ENABLED=false       # master switch (default false)
+#COMPRESSION_PIPELINE_BREAKER_THRESHOLD=3         # consecutive failures before the engine opens
+#COMPRESSION_PIPELINE_BREAKER_COOLDOWN_MS=30000   # ms the engine stays skipped before a probe
+
+# T08/H8 — CCR retrieval-feedback ramp factor. Each prior retrieval of a stored block raises its
+# effective minChars linearly, so frequently-retrieved content is compressed progressively less
+# (>= 3 retrievals = never compressed). 1 disables the ramp (binary skip at the threshold only).
+# Used by: open-sse/services/compression/engines/ccr/index.ts.  Default: 2.
+#COMPRESSION_CCR_RETRIEVAL_RAMP_FACTOR=2
+# T08/H5 — usage-observed prefix freeze (OPT-IN, default off). When enabled, a system prompt seen
+# >= THRESHOLD times is treated as a stable cacheable prefix and preserved from compression even
+# for providers the static cache-aware heuristic does not recognize (freeze = preserve, never
+# mutates). Used by: open-sse/services/compression/prefixFreeze.ts.
+#COMPRESSION_PREFIX_FREEZE_ENABLED=false     # master switch (default false)
+#COMPRESSION_PREFIX_FREEZE_THRESHOLD=3       # observations before a prefix is frozen
+
 # Skip the postinstall native-runtime warm-up (useful in CI / headless installs). Default: 0.
 # Used by: scripts/postinstall.mjs.
 #OMNIROUTE_SKIP_POSTINSTALL=0
@@ -756,7 +886,7 @@ GITHUB_OAUTH_CLIENT_ID=Iv1.b507a08c87ecfe98
 # ── GitLab Duo ──
 # Register an OAuth app at: https://gitlab.com/-/profile/applications
 # Set redirect URI to: http://localhost:20128/callback (or your NEXT_PUBLIC_BASE_URL + /callback)
-# Required scopes: api, read_user, openid, profile, email
+# Required scopes: ai_features, read_user (matches GITLAB_DUO_CONFIG.scope in src/lib/oauth/constants/oauth.ts)
 # GITLAB_DUO_OAUTH_CLIENT_ID=***
 # GITLAB_DUO_OAUTH_CLIENT_SECRET=***  # optional — PKCE flow does not require a secret
 #
@@ -801,6 +931,8 @@ GITHUB_OAUTH_CLIENT_ID=Iv1.b507a08c87ecfe98
 # QODER_PERSONAL_ACCESS_TOKEN=
 # QODER_CLI_WORKSPACE=
 # OMNIROUTE_QODER_WORKSPACE=
+# Override the Qoder CLI config dir (isolated PAT session, avoids clobbering a browser login).
+# QODER_CLI_CONFIG_DIR=
 
 # ── Blackbox Web validated-token override (issue #2252) ──
 # Used by: open-sse/executors/blackbox-web.ts. Blackbox `/api/chat` rejects
@@ -855,7 +987,7 @@ GITHUB_OAUTH_CLIENT_ID=Iv1.b507a08c87ecfe98
 # Used by: open-sse/executors/base.ts — buildHeaders() dynamic lookup.
 # Update these when providers release new CLI versions to avoid blocks.
 
-CLAUDE_USER_AGENT="claude-cli/2.1.195 (external, cli)"
+CLAUDE_USER_AGENT="claude-cli/2.1.207 (external, cli)"
 
 # Disable the deterministic tool-name cloak applied on both Anthropic-bound paths
 # (executors/base.ts native OAuth + executors/cliproxyapi.ts CLIProxyAPI) —
@@ -864,7 +996,7 @@ CLAUDE_USER_AGENT="claude-cli/2.1.195 (external, cli)"
 # stream with a misleading 400 out-of-extra-usage placeholder. Set to true to
 # forward the original names verbatim (debugging only).
 # CLAUDE_DISABLE_TOOL_NAME_CLOAK=false
-CODEX_USER_AGENT="codex-cli/0.142.0 (Windows 10.0.26200; x64)"
+CODEX_USER_AGENT="codex-cli/0.144.1 (Windows 10.0.26200; x64)"
 GITHUB_USER_AGENT="GitHubCopilotChat/0.54.0"
 ANTIGRAVITY_USER_AGENT="antigravity/2.0.1 linux/arm64 google-api-nodejs-client/10.3.0"
 KIRO_USER_AGENT="AWS-SDK-JS/3.0.0 kiro-ide/1.0.0"
@@ -885,7 +1017,7 @@ CURSOR_USER_AGENT="Cursor/3.4"
 
 # Override Codex client version sent in headers independently of the
 # CODEX_USER_AGENT string. Used by: open-sse/config/codexClient.ts.
-# CODEX_CLIENT_VERSION=0.142.0
+# CODEX_CLIENT_VERSION=0.144.1
 
 # Kill-switch to strip non-standard `codex.*` SSE events (e.g. codex.rate_limits)
 # from the Codex Responses stream. These frames break the OpenAI SDK's
@@ -969,6 +1101,12 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # fallback when FETCH_TIMEOUT_MS is unset. Default: 120000 (2 min).
 # OMNIROUTE_DEFAULT_FETCH_TIMEOUT_MS=120000
 
+# ── Firecrawl web-fetch executor ──
+# Point at a self-hosted Firecrawl instance (defaults to the public cloud API).
+# When set to a non-cloud base URL, the API key becomes optional.
+# FIRECRAWL_BASE_URL=https://api.firecrawl.dev
+# FIRECRAWL_TIMEOUT_MS=30000            # Per-request timeout (default: 30000 = 30s)
+
 # ── ChatGPT TLS sidecar (Firefox-fingerprinted client) ──
 # Used by: open-sse/services/chatgptTlsClient.ts — wire-level timeout for
 # the bogdanfinn/tls-client koffi binding and the JS-side grace window
@@ -1035,6 +1173,17 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # STREAM_IDLE_TIMEOUT_MS=600000      # Max silence between SSE chunks (default: 600000)
 #                                     # Extended-thinking models rarely pause >90s.
 # STREAM_READINESS_TIMEOUT_MS=80000  # Time to receive the first non-ping SSE event
+# STREAM_READINESS_MAX_TIMEOUT_MS=180000 # Cap for adaptive first-event extensions
+#                                         # (large/tool-heavy/high-reasoning requests).
+# OMNIROUTE_AGENT_GOAL_POLICY_ENABLED=true             # Kill-switch for the /goal heuristic below.
+#                                                       # Set to false to fully disable detection —
+#                                                       # readiness timeouts and stream recovery are
+#                                                       # never elevated by request body/headers when off.
+# OMNIROUTE_AGENT_GOAL_READINESS_MAX_TIMEOUT_MS=600000 # Auto cap for detected /goal agent runs
+# OMNIROUTE_AGENT_GOAL_STREAM_RECOVERY=true            # Auto early stream recovery for /goal runs.
+#                                                       # NOTE: this can only ADD recovery on top of the
+#                                                       # operator default — it never overrides an explicit
+#                                                       # STREAM_RECOVERY_ENABLED / DB settings opt-out.
 
 # ── TLS client (wreq-js fingerprint proxy) ──
 # TLS_CLIENT_TIMEOUT_MS=600000       # Inherits from FETCH_TIMEOUT_MS by default
@@ -1070,7 +1219,7 @@ CURSOR_USER_AGENT="Cursor/3.4"
 APP_LOG_TO_FILE=true
 
 # Path to the application log file.
-# Default: logs/application/app.log (relative to project root / DATA_DIR)
+# Default: <DATA_DIR>/logs/application/app.log (DATA_DIR defaults to ~/.omniroute)
 # APP_LOG_FILE_PATH=logs/application/app.log
 
 # Maximum single log file size before rotation.
@@ -1245,6 +1394,13 @@ APP_LOG_TO_FILE=true
 # Default: 86400 (24 hours)
 # MODELS_DEV_SYNC_INTERVAL=86400
 
+# Self-correcting context-window reconciler interval in seconds (feature 5004).
+# Pins provider-declared windows from /models discovery as auto:discovery overrides
+# when they diverge from the catalog. Set to 0 to disable. Never overwrites manual overrides.
+# Used by: src/lib/contextWindowResolver.ts
+# Default: 86400 (24 hours)
+# CONTEXT_WINDOW_RECONCILE_INTERVAL=86400
+
 # ═══════════════════════════════════════════════════════════════════════════════
 # 20. PROVIDER-SPECIFIC SETTINGS
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -1356,6 +1512,13 @@ APP_LOG_TO_FILE=true
 # CLIPROXYAPI_PORT=5544
 # CLIPROXYAPI_CONFIG_DIR=~/.cli-proxy-api
 
+# ── Mux embedded service ──
+# Override the port where the embedded Mux (coder/mux) agent-orchestration
+# daemon listens. Always bound to 127.0.0.1 — never configurable to 0.0.0.0.
+# Rarely needed — defaults to 8322.
+# Used by: src/lib/services/bootstrap.ts, src/app/api/services/mux/_lib.ts
+# MUX_SERVICE_PORT=8322
+
 # ── Local hostnames (Docker networking) ──
 # Comma-separated additional hostnames treated as "local" for provider routing.
 # Used by: open-sse/config/providerRegistry.ts — allows Docker service names.
@@ -1370,6 +1533,11 @@ APP_LOG_TO_FILE=true
 # Timeout for fast-fail health checks (ms).  Default: 2000
 # PROXY_FAST_FAIL_TIMEOUT_MS=2000
 
+# Time window (hours) for calculating the average latency of candidate proxies
+# in the latency-optimized pool strategy.  Default: 3
+# Used by: src/lib/db/proxies.ts
+# PROXY_LATENCY_WINDOW_HOURS=3
+
 # Health check result cache TTL (ms).  Default: 30000 (30s)
 # PROXY_HEALTH_CACHE_TTL_MS=30000
 
@@ -1378,6 +1546,25 @@ APP_LOG_TO_FILE=true
 # healthy-result cache window under high concurrency.
 # PROXY_HEALTH_UNHEALTHY_CACHE_TTL_MS=2000
 
+# Background proxy health scheduler (src/lib/proxyHealth/scheduler.ts).
+# Periodically probes every registered proxy and (optionally) removes dead ones.
+# Set "false" to disable the scheduler entirely. Default: enabled.
+# PROXY_HEALTH_ENABLED=true
+# Sweep interval in ms (minimum 60000). Default: 600000 (10min).
+# PROXY_HEALTH_INTERVAL_MS=600000
+# Reachability probe target for the scheduler and the auto-test endpoint.
+# Point it at an internal/self-hosted URL to avoid the public default.
+# PROXY_HEALTH_TEST_URL=https://httpbin.org/ip
+# Set "true" to let the scheduler auto-remove proxies after repeated failures.
+# PROXY_AUTO_REMOVE=false
+# Consecutive failures before an auto-remove fires. Default: 3.
+# PROXY_AUTO_REMOVE_AFTER=3
+# Let automated reachability probes (the scheduler + the "Test All" button) WRITE
+# a proxy's status. Default "false": probes are read-only and never deactivate a
+# proxy — only the operator sets active/inactive (a flaky probe must not strand an
+# assigned proxy; #6246). Set "true" to restore the legacy test-and-set behaviour.
+# PROXY_HEALTH_AUTO_DEACTIVATE=false
+
 # Allow OAuth and provider validation flows to bypass a pinned proxy and connect
 # directly when proxy reachability pre-checks fail. Default: false.
 # Also configurable from Dashboard > Settings > Feature Flags.
@@ -1469,10 +1656,19 @@ APP_LOG_TO_FILE=true
 # Used by: open-sse/utils/cursorImages.ts.
 # CURSOR_IMAGE_FETCH_TIMEOUT_MS=15000
 
-# Cursor state DB path override (for cursor version detection).
+# Cursor state DB path override (for IDE cursor version detection).
 # Used by: open-sse/utils/cursorVersionDetector.ts. Default: probed automatically.
 # CURSOR_STATE_DB_PATH=
 
+# Cursor Agent CLI build id for AgentService/Run impersonation (YYYY.MM.DD-<hash>).
+# Used by: open-sse/utils/cursorAgentCliVersion.ts. Default: detect local install, else pin.
+# CURSOR_AGENT_CLI_VERSION=2026.07.08-0c04a8a
+
+# Cursor Agent CLI data directory override (versions live under <dir>/versions/).
+# Used by: open-sse/utils/cursorAgentCliVersion.ts. Default: ~/.local/share/cursor-agent (unix)
+# or %LOCALAPPDATA%\cursor-agent (win32). Official agent CLI also honors this var.
+# CURSOR_DATA_DIR=
+
 # Direct Cursor bearer token used by scripts/ad-hoc/cursor-tap.cjs (developer tooling).
 # CURSOR_TOKEN=
 
@@ -1559,6 +1755,20 @@ APP_LOG_TO_FILE=true
 # Routing-decision log verbosity: 0 silences, higher values log more bypass/route
 # decisions (src/mitm/server.cjs, _internal/bypass.cjs).
 # MITM_VERBOSE=1
+# Strip the leading `sudo` from MITM cert-trust commands (src/mitm/systemCommands.ts) —
+# for root-less / user-namespaced deployments (e.g. rootless Docker/Podman)
+# where the operator trusts the CA manually (e.g. via Node's extra-CA-certs mechanism).
+# OMNIROUTE_NO_SUDO=0
+
+# ── Test/CI-only guards (never needed in production) ──
+# Set automatically by tests/_setup/isolateDataDir.ts and the CI workflows: the
+# test suite must NEVER mutate the OS trust store (a fake test PEM installed via
+# update-ca-certificates broke all system TLS on a persistent runner, 2026-07-05).
+# OMNIROUTE_SKIP_SYSTEM_TRUST=1
+# check-changelog-integrity.mjs (anti CHANGELOG-eat gate): explicit base ref
+# override, and the justified-removal escape hatch for intentional bullet removals.
+# CHANGELOG_BASE_REF=origin/release/v0.0.0
+# ALLOW_CHANGELOG_REMOVALS=1
 
 # ── 1Proxy egress pool ──
 # Used by: src/lib/oneproxySync.ts — fetches proxy nodes from the OmniRoute
@@ -1589,6 +1799,15 @@ APP_LOG_TO_FILE=true
 # FREE_PROXY_IPLOCATE_ENABLED=false
 # FREE_PROXY_IPLOCATE_BASE_URL=https://raw.githubusercontent.com/iplocate/free-proxy-list/main/protocols
 
+# ── Free Proxy Pool (Webshare source) ──
+# Used by: src/lib/freeProxyProviders/webshare.ts
+# Paid, per-account proxy list — requires FREE_PROXY_WEBSHARE_API_KEY to activate,
+# regardless of FREE_PROXY_WEBSHARE_ENABLED.
+# FREE_PROXY_WEBSHARE_ENABLED=true
+# FREE_PROXY_WEBSHARE_API_KEY=
+# FREE_PROXY_WEBSHARE_API_URL=https://proxy.webshare.io/api/v2/proxy/list/
+# FREE_PROXY_WEBSHARE_MAX=500
+
 # ── Vercel Relay ──
 # Used by: src/app/api/settings/proxy/vercel-deploy/route.ts
 # Hides the "Deploy Relay" button when set to false.
@@ -1631,6 +1850,15 @@ APP_LOG_TO_FILE=true
 # SKILLS_SANDBOX_NETWORK_ENABLED=0
 # SKILLS_ALLOWED_SANDBOX_IMAGES=
 
+# Container runtime used by the skill sandbox. Accepted values:
+#   auto     — pick the best installed runtime per host OS (default)
+#   docker   — Docker Engine / Docker Desktop
+#   apple    — Apple Container (macOS native, micro-VM)
+#   wsl      — WSL Container (Windows native via wslc.exe)
+#   orbstack — OrbStack (high-perf Linux VM + docker shim on macOS)
+#   podman   — Podman (rootless, daemonless)
+# SKILLS_SANDBOX_RUNTIME=auto
+
 # ═══════════════════════════════════════════════════════════════════════════════
 # 25. TEST & E2E
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -1676,7 +1904,7 @@ APP_LOG_TO_FILE=true
 # OMNIROUTE_TRANSLATION_API_URL=
 # Bearer token for the translation backend (NEVER commit a real key here).
 # OMNIROUTE_TRANSLATION_API_KEY=
-# Model id, e.g. gpt-4o-mini or cx/gpt-5.4-mini.
+# Model id, e.g. gpt-4o-mini or cx/gpt-5.6-sol.
 # OMNIROUTE_TRANSLATION_MODEL=gpt-4o-mini
 # Per-request timeout in milliseconds (default 60000).
 # OMNIROUTE_TRANSLATION_TIMEOUT_MS=60000
@@ -1731,6 +1959,11 @@ PLAYGROUND_COMPARE_MAX_COLUMNS=4
 # MEMORY_VEC_TOP_K=20                           # default top-K for vector search
 # MEMORY_RRF_K=60                               # RRF k constant (sqlite-vec hybrid recipe)
 # HF_HUB_ENDPOINT=https://huggingface.co        # override Hugging Face Hub base URL for static potion downloads
+# TV6 typed memory decay (OPT-IN, default off — the sweep DELETES decayed memories)
+# MEMORY_TYPED_DECAY_ENABLED=false              # master switch for the destructive sweep (default off)
+# MEMORY_TYPED_DECAY_EPISODIC_DAYS=30           # episodic TTL in days; 0 = episodic immune too
+# MEMORY_TYPED_DECAY_ACCESS_IMMUNITY=3          # access_count >= N → immune; 0 disables access immunity
+# MEMORY_TYPED_DECAY_SWEEP_INTERVAL=0           # periodic sweep interval (seconds); 0 = no periodic sweep
 # AgentBridge + Traffic Inspector (Group A)
 
 # AgentBridge
@@ -1788,6 +2021,10 @@ QUOTA_STORE_DRIVER=sqlite              # sqlite | redis
 # duplicated). Falls back to TS path via X-Bifrost-Fallback header on
 # timeout/failure. See bin/omniroute for the local-redis companion.
 # BIFROST_BASE_URL=
+# Port the supervised Bifrost embedded service binds to (127.0.0.1:<port>), read by
+# src/lib/services/bootstrap.ts when OmniRoute manages the Bifrost sidecar lifecycle.
+# Default: 8080.
+# BIFROST_PORT=8080
 # API key for the Bifrost gateway (sent as Authorization: Bearer ...). If
 # unset, the route expects the request to carry a valid OmniRoute API key;
 # this key is for gateway-side auth only.
@@ -1875,3 +2112,24 @@ QUOTA_STORE_DRIVER=sqlite              # sqlite | redis
 # BIFROST_API_KEY=
 # BIFROST_STREAMING_ENABLED=true
 # BIFROST_TIMEOUT_MS=30000
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Account rotation config (operator-managed; consumed by open-sse/services/rotationConfig.ts)
+# Lets a supervising front-end mirror its rotation rules onto the backend's account-fallback
+# engine. All optional; defaults preserve the historical behavior.
+# ─────────────────────────────────────────────────────────────────────────────
+# OMNIROUTE_ROTATION_ENABLED=true
+# OMNIROUTE_ROTATION_RATE_LIMIT_RESET_SECONDS=0
+# OMNIROUTE_ROTATION_DISABLE_TAG_WITHOUT_RESET=true
+# OMNIROUTE_ROTATE_ON_429=true
+# OMNIROUTE_ROTATE_429_THRESHOLD=1
+# OMNIROUTE_ROTATE_429_WINDOW_SECONDS=120
+# OMNIROUTE_ROTATE_ON_500=true
+# OMNIROUTE_ROTATE_500_THRESHOLD=1
+# OMNIROUTE_ROTATE_500_WINDOW_SECONDS=120
+# OMNIROUTE_ROTATE_ON_502=true
+# OMNIROUTE_ROTATE_502_THRESHOLD=1
+# OMNIROUTE_ROTATE_502_WINDOW_SECONDS=120
+# OMNIROUTE_ROTATE_ON_400=false
+# OMNIROUTE_ROTATE_400_THRESHOLD=1
+# OMNIROUTE_ROTATE_400_WINDOW_SECONDS=120

.env.homolog.example

@@ -0,0 +1,9 @@
+# Homologação E2E real — copie para .env.homolog (NUNCA commitar o real)
+HOMOLOG_BASE_URL=http://192.168.0.15:20128
+# Senha de management do dashboard da VPS (a mesma do /login)
+HOMOLOG_ADMIN_PASSWORD=
+# Deixe vazio: a suíte cria uma API key efêmera via admin e revoga no fim.
+# Só preencha para depurar uma camada isolada com uma key fixa.
+HOMOLOG_API_KEY=
+# Tier crítico (chat real, max_tokens=5). Demais providers: só validação de catálogo.
+HOMOLOG_CRITICAL_PROVIDERS=openai,anthropic,gemini,codex,grok,glm,deepseek,openrouter

.github/dependabot.yml

@@ -24,6 +24,15 @@ updates:
         update-types: ["version-update:semver-major"]
       - dependency-name: "eslint-config-next"
         update-types: ["version-update:semver-major"]
+      # typescript majors are peer-blocked by typescript-eslint, which pins a hard
+      # upper bound (8.64.0 → peerDependencies.typescript ">=4.8.4 <6.1.0"). A TS 7
+      # bump therefore violates the peer and takes down the whole toolchain at once —
+      # #7068 grouped it with 6 harmless bumps and turned Build + Lint + Quality Ratchet
+      # + Unit (6/8, 8/8) + Integration (1/2, 2/2) + dast-smoke red in one shot, blocking
+      # the innocuous updates riding along with it. Un-ignore once typescript-eslint
+      # widens the peer, and migrate TS majors intentionally (own PR, own CI run).
+      - dependency-name: "typescript"
+        update-types: ["version-update:semver-major"]
       # jscpd v5 is a Rust rewrite (native binary, no Node.js programmatic API).
       # scripts/check/check-duplication.mjs is deliberately pinned to jscpd@4 (it
       # parses jscpd-report.json against a frozen baseline). A v5 major would break

.github/workflows/ci.yml

@@ -16,6 +16,10 @@ permissions:
   contents: read
 
 env:
+  # CI must never mutate the runner's OS trust store (2026-07-05: a cert-flow
+  # test installed a fake PEM on a persistent self-hosted runner and broke all
+  # system TLS). Belt-and-suspenders with tests/_setup/isolateDataDir.ts.
+  OMNIROUTE_SKIP_SYSTEM_TRUST: "1"
   CI_NODE_VERSION: "24"
   CI_NODE_24_VERSION: "24"
   CI_NODE_26_VERSION: "26"
@@ -29,17 +33,23 @@ jobs:
       docs: ${{ steps.classify.outputs.docs }}
       i18n: ${{ steps.classify.outputs.i18n }}
       workflow: ${{ steps.classify.outputs.workflow }}
+      testsOnly: ${{ steps.classify.outputs.testsOnly }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         with:
           persist-credentials: false
           fetch-depth: 0
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.CI_NODE_VERSION }}
       - id: classify
         env:
           EVENT_NAME: ${{ github.event_name }}
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
+          # Single source of truth: scripts/quality/classify-pr-changes.mjs
+          # (unit-tested). Push/dispatch always enable every lane.
           if [ "$EVENT_NAME" != "pull_request" ]; then
             {
               echo "code=true"
@@ -50,48 +60,18 @@ jobs:
             exit 0
           fi
 
-          code=false
-          docs=false
-          i18n=false
-          workflow=false
-
           git diff --name-only "$BASE_SHA" "$HEAD_SHA" > changed-files.txt
-
-          while IFS= read -r file; do
-            case "$file" in
-              .github/workflows/*|.zizmor.yml)
-                workflow=true
-                code=true
-                ;;
-              docs/*|*.md)
-                docs=true
-                ;;
-              src/i18n/*|src/i18n/messages/*|scripts/i18n/*|config/i18n.json)
-                i18n=true
-                code=true
-                ;;
-              src/*|open-sse/*|bin/*|electron/*|tests/*|scripts/*|package.json|package-lock.json|tsconfig*.json|next.config.*|vitest*.config.*|playwright.config.*)
-                code=true
-                ;;
-              db/*|config/*)
-                code=true
-                ;;
-              *)
-                code=true
-                ;;
-            esac
-          done < changed-files.txt
-
-          {
-            echo "code=$code"
-            echo "docs=$docs"
-            echo "i18n=$i18n"
-            echo "workflow=$workflow"
-          } >> "$GITHUB_OUTPUT"
+          node scripts/quality/classify-pr-changes.mjs changed-files.txt >> "$GITHUB_OUTPUT"
 
   lint:
     name: Lint
     runs-on: ubuntu-latest
+    needs: changes
+    # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
+    # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
+    # Path filter: pure docs / pure message-catalog PRs skip the code lint bag + typecheck.
+    # Existence reason of this job is code regression; docs/i18n have dedicated jobs.
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
     env:
       # tsx gates below (known-symbols, route-guard-membership) import modules that
       # open SQLite on load; provide DB env so a fresh CI DB initializes cleanly.
@@ -109,7 +89,27 @@ jobs:
       - uses: ./.github/actions/npm-ci-retry
       - run: npm run check:node-runtime
       - run: npm run audit:deps
-      - run: npm run lint
+      - name: Restore ESLint file cache
+        uses: actions/cache@v6
+        with:
+          path: |
+            .eslintcache
+            .eslintcache-complexity
+          key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'eslint.complexity-ratchets.config.mjs', 'config/quality/eslint-suppressions.json', 'package-lock.json') }}
+          restore-keys: |
+            eslint-${{ runner.os }}-
+      # Single ESLint inventory (JSON) — quality-gate reuses the artifact instead of
+      # a second cold full-tree pass for eslintWarnings ratchet counts.
+      - name: ESLint (JSON report)
+        run: npm run lint:json
+      - name: Upload ESLint results
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: eslint-results
+          path: .artifacts/eslint-results.json
+          if-no-files-found: warn
+          retention-days: 7
       - run: npm run check:cycles
       - run: npm run check:route-validation:t06
       - run: npm run check:any-budget:t11
@@ -125,21 +125,33 @@ jobs:
       - run: npm run check:route-guard-membership
       - run: npm run check:test-discovery
       - run: npm run check:tracked-artifacts
+      # WS1.7 (v3.8.49 plan): Dockerfile lint (hadolint, pinned by digest).
+      # failure-threshold=error keeps the 5 pre-existing warnings (DL3008/DL3003/
+      # DL3016 version pinning / WORKDIR) visible without blocking; any ERROR fails.
+      - name: hadolint (Dockerfile)
+        run: docker run --rm -i hadolint/hadolint@sha256:27086352fd5e1907ea2b934eb1023f217c5ae087992eb59fde121dce9c9ff21e hadolint --failure-threshold error - < Dockerfile
       - run: npm run check:lockfile
       - run: npm run check:licenses
       # check:docs-sync is run by the docs-sync-strict job (via check:docs-all) and the
       # husky pre-commit hook; the standalone copy here was redundant (ROI dedup).
       - run: npm run typecheck:core
-      # typecheck:noimplicit:core is a forward-looking gate (noImplicitAny).
-      # Run informationally for now — many pre-existing call sites still need
-      # explicit annotations; track in a dedicated follow-up.
-      - run: npm run typecheck:noimplicit:core
-        continue-on-error: true
+      # #7033: typecheck:core's curated file allowlist does not cover
+      # src/app/(dashboard) TSX (and next.config.mjs sets ignoreBuildErrors:
+      # true, so `next build` never type-checks it either) — orphaned
+      # identifiers there (see #6625/#6909) were invisible to CI. This gate
+      # runs tsc scoped to the dashboard tree against a frozen baseline of
+      # pre-existing errors; only NEW errors fail it.
+      - run: npm run check:dashboard-typecheck
+      # typecheck:noimplicit:core dropped from this job (2026-07 optimize):
+      # it was advisory (continue-on-error) and largely subsumed by the blocking
+      # check:type-coverage ratchet in quality-gate. Local: npm run typecheck:noimplicit:core.
 
   quality-gate:
     name: Quality Ratchet
     runs-on: ubuntu-latest
-    needs: test-coverage
+    # needs lint so eslint-results artifact is available (same inventory as the
+    # blocking lint step). Allow lint failure so other ratchets still run.
+    needs: [changes, test-coverage, lint]
     # Run even when test-coverage was SKIPPED/FAILED (e.g. a single flaky Coverage
     # Shard breaks the shard→coverage→ratchet chain). The DETERMINISTIC ratchets
     # (eslint / complexity / cognitive-complexity / duplication / codeql) do NOT need
@@ -148,7 +160,8 @@ jobs:
     # release PR #4854, where the drift cascade only surfaced post-merge in #5029).
     # The coverage.* metrics degrade gracefully: the download is continue-on-error and
     # the ratchet runs with --allow-missing, so absent coverage is skipped, not failed.
-    if: ${{ !cancelled() }}
+    # Path filter: code-only — pure docs/i18n PRs have nothing for these ratchets to guard.
+    if: ${{ !cancelled() && !contains(github.event.pull_request.labels.*.name, 'hotfix') && (github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true' && (needs.lint.result == 'success' || needs.lint.result == 'failure'))) }}
     # security-events: read lets the CodeQL ratchet read open code-scanning alerts
     # via `gh api .../code-scanning/alerts`. contents: read keeps checkout working.
     permissions:
@@ -163,6 +176,15 @@ jobs:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
       - uses: ./.github/actions/npm-ci-retry
+      - name: Restore ESLint file cache
+        uses: actions/cache@v6
+        with:
+          path: |
+            .eslintcache
+            .eslintcache-complexity
+          key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'eslint.complexity-ratchets.config.mjs', 'config/quality/eslint-suppressions.json', 'package-lock.json') }}
+          restore-keys: |
+            eslint-${{ runner.os }}-
       # Coverage mergeada (coverage-summary.json) p/ o ratchet de cobertura.
       # continue-on-error: o artifact pode não existir se a job test-coverage foi
       # SKIPPED (shard flaky). Nesse caso collect-metrics pula coverage.* (ausente sem
@@ -173,6 +195,13 @@ jobs:
         with:
           name: coverage-report
           path: coverage/
+      # Prefer lint job's ESLint JSON (one inventory, two consumers).
+      - name: Download ESLint results
+        continue-on-error: true
+        uses: actions/download-artifact@v8
+        with:
+          name: eslint-results
+          path: .artifacts/
       - run: npm run quality:collect
       # Catraca: falha se qualquer métrica regredir vs quality-baseline.json (commitado).
       # Hoje: contagem de warnings do ESLint. Fase 4 estende com cobertura (lida do
@@ -194,15 +223,13 @@ jobs:
       # para não pesar no caminho crítico do lint.
       - name: Duplication ratchet
         run: npm run check:duplication
-      - name: Complexity ratchet
-        run: npm run check:complexity
-      # Fase 7 INT: dead-code, cognitive-complexity, type-coverage promovidos de
-      # advisory (quality-extended) para BLOQUEANTES aqui. Os 3 leem seus baseline
-      # de quality-baseline.json e saem 1 em regressão.
+      # Complexity + cognitive: one ESLint walk, two independent baselines (by ruleId).
+      - name: Complexity + cognitive ratchets
+        run: npm run check:complexity-ratchets
+      # Fase 7 INT: dead-code, type-coverage promovidos de advisory (quality-extended)
+      # para BLOQUEANTES aqui. cognitive-complexity is folded into the step above.
       - name: Dead-code ratchet (knip)
         run: npm run check:dead-code
-      - name: Cognitive complexity ratchet (sonarjs)
-        run: npm run check:cognitive-complexity
       - name: Type coverage ratchet
         run: npm run check:type-coverage
       - name: Compression budget ratchet (F2.4 / N4)
@@ -240,6 +267,11 @@ jobs:
   quality-extended:
     name: Quality Gates (Extended)
     runs-on: ubuntu-latest
+    needs: changes
+    # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
+    # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
+    # Path filter: code-only (scanners/ratchets target production surface).
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'hotfix') && (github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true')) }}
     steps:
       # fetch-depth: 0 — the OpenAPI breaking-change gate (oasdiff) reads the base
       # spec via `git show <base_ref>:docs/openapi.yaml`; a shallow clone
@@ -347,6 +379,11 @@ jobs:
   docs-sync-strict:
     name: Docs Sync (Strict)
     runs-on: ubuntu-latest
+    needs: changes
+    # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
+    # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
+    # Run when docs OR code change: API/route code can break doc/OpenAPI contract gates.
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && (needs.changes.outputs.docs == 'true' || needs.changes.outputs.code == 'true')) }}
     steps:
       - uses: actions/checkout@v7
         with:
@@ -366,16 +403,20 @@ jobs:
         run: npm run check:openapi-coverage
       - name: OpenAPI security-tier consistency (advisory)
         run: npm run check:openapi-security-tiers
-      - name: OpenAPI spec paths resolve to real routes (anti-hallucination)
-        run: npm run check:openapi-routes
-      - name: Doc /api refs resolve to real routes (anti-hallucination)
-        run: npm run check:docs-symbols
+      # One FS inventory of src/app/api for both anti-hallucination directions.
+      - name: API docs refs (openapi + prose → routes)
+        run: npm run check:api-docs-refs
       - name: i18n translation drift (warn)
         run: node scripts/i18n/check-translation-drift.mjs --warn
 
   docs-lint:
     name: Docs Lint (prose — advisory)
     runs-on: ubuntu-latest
+    needs: changes
+    # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
+    # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
+    # Prose/markdown only — skip when the PR has no doc surface.
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.docs == 'true') }}
     # Advisory (warning-first): prose/markdown style must not block merges while the
     # existing doc corpus is brought up to style. Promote to blocking once it converges.
     continue-on-error: true
@@ -402,6 +443,11 @@ jobs:
   i18n-ui-coverage:
     name: i18n UI Coverage
     runs-on: ubuntu-latest
+    needs: changes
+    # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
+    # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
+    # UI keys move with dashboard code OR message catalogs.
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && (needs.changes.outputs.i18n == 'true' || needs.changes.outputs.code == 'true')) }}
     steps:
       - uses: actions/checkout@v7
         with:
@@ -413,30 +459,20 @@ jobs:
       - uses: ./.github/actions/npm-ci-retry
       - run: node scripts/i18n/check-ui-keys-coverage.mjs --threshold=65
 
-  i18n-matrix:
-    name: Build language matrix
-    runs-on: ubuntu-latest
-    outputs:
-      langs: ${{ steps.langs.outputs.langs }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - id: langs
-        run: |
-          LANG_DIR="src/i18n/messages"
-          LANGS=$(ls "$LANG_DIR"/*.json | xargs -n1 basename | sed 's/.json$//' | grep -v '^en$' | jq -R . | jq -s . | jq -c .)
-          echo "langs=${LANGS}" >> "$GITHUB_OUTPUT"
-
+  # D4 (plano mestre testes+CI): a matrix de ~40 jobs de <1min por idioma saturava sozinha
+  # a concorrência de jobs da conta (Free = 20 slots, compartilhados entre TODOS os repos)
+  # e pagava spin-up + arredondamento de billing por idioma. Um único job itera os idiomas
+  # (mesmo script), com grupo de log por idioma e artifact único de resultados nomeados por
+  # idioma (a matrix antiga subia 40 artifacts cujo result.txt colidia no merge-multiple).
   i18n:
-    name: i18n Validation
+    name: i18n Validation (all languages)
     runs-on: ubuntu-latest
+    needs: changes
+    # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
+    # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
+    # Message-catalog / i18n-tooling only — pure code without i18n surface skips this lane.
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.i18n == 'true') }}
     continue-on-error: true
-    strategy:
-      fail-fast: false
-      matrix:
-        lang: ${{ fromJson(needs.i18n-matrix.outputs.langs) }}
-    needs: i18n-matrix
     steps:
       - uses: actions/checkout@v7
         with:
@@ -444,27 +480,35 @@ jobs:
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
-
-      - name: Validate ${{ matrix.lang }}
-        env:
-          # Pass the matrix value via env (never interpolate ${{ ... }} straight
-          # into the run: script body) so the shell receives a variable, not
-          # inlined text — zizmor template-injection mitigation. Named MATRIX_LANG
-          # to avoid clobbering the POSIX `LANG` locale variable.
-          MATRIX_LANG: ${{ matrix.lang }}
+      - name: Validate all languages
         run: |
-          python3 scripts/i18n/validate_translation.py quick -l "$MATRIX_LANG" > result.txt
-
-      - name: Upload result
+          set -uo pipefail
+          mkdir -p i18n-results
+          FAIL=0
+          for f in src/i18n/messages/*.json; do
+            lang=$(basename "$f" .json)
+            [ "$lang" = "en" ] && continue
+            echo "::group::i18n $lang"
+            if python3 scripts/i18n/validate_translation.py quick -l "$lang" > "i18n-results/$lang.txt" 2>&1; then
+              echo "OK $lang"
+            else
+              FAIL=1
+              echo "FAIL $lang"
+              cat "i18n-results/$lang.txt"
+            fi
+            echo "::endgroup::"
+          done
+          exit "$FAIL"
+      - name: Upload results
         if: always()
         uses: actions/upload-artifact@v7
         with:
-          name: i18n-${{ matrix.lang }}
-          path: result.txt
+          name: i18n-results
+          path: i18n-results/
 
   pr-test-policy:
     name: PR Test Policy
-    if: ${{ github.event_name == 'pull_request' }}
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -475,7 +519,7 @@ jobs:
         with:
           node-version: ${{ env.CI_NODE_VERSION }}
       - name: Fetch base branch
-        run: git fetch --no-tags origin "${GITHUB_BASE_REF}" --depth=1
+        run: git fetch --no-tags origin "${GITHUB_BASE_REF}"
       - name: Validate source changes include tests
         run: node scripts/check/check-pr-test-policy.mjs --summary-file .artifacts/pr-test-policy.md
       # Anti test-masking: flag net assert removal / new assert.ok(true) in changed tests.
@@ -495,9 +539,17 @@ jobs:
 
   build:
     name: Build
-    runs-on: ubuntu-latest
+    # Dynamic runner: when the release captain flips the USE_VPS_RUNNER repo var to
+    # 'true' (scripts/vps/release-runner-up.sh does it after the self-hosted VM is
+    # online), the heavy jobs run on the dedicated 32-core VPS runners (label
+    # omni-release) instead of queueing on the 20-concurrent-job hosted pool.
+    # Safety: fork PRs NEVER reach the self-hosted runner — the expression falls
+    # back to ubuntu-latest unless the PR head repo is this repository (push /
+    # dispatch events are own-origin by definition). Any failure path (VM down,
+    # var unset/false) also falls back to ubuntu-latest.
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     needs: changes
-    if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.code == 'true' }}
+    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
     steps:
       - uses: actions/checkout@v7
         with:
@@ -508,14 +560,21 @@ jobs:
           cache: npm
       - uses: ./.github/actions/npm-ci-retry
       - run: npm run check:node-runtime
-      - name: Cache Next.js build cache
-        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8
-        with:
-          path: .build/next/cache
-          key: nextjs-${{ runner.os }}-node-${{ env.CI_NODE_VERSION }}-${{ hashFiles('package-lock.json') }}-${{ hashFiles('src/**/*', 'open-sse/**/*', 'db/**/*', 'next.config.mjs', 'tsconfig*.json', 'postcss.config.*', 'tailwind.config.*') }}
-          restore-keys: |
-            nextjs-${{ runner.os }}-node-${{ env.CI_NODE_VERSION }}-${{ hashFiles('package-lock.json') }}-
+      # NOTE: the webpack `.build/next/cache` actions/cache step was removed with the
+      # Turbopack switch below — Turbopack does not read/write the webpack cache dir
+      # (its persistent FS cache is still experimental and intentionally NOT enabled),
+      # so restoring the old ~0.5 GB webpack cache would only waste download time.
+      # Rolling back to webpack = revert this commit (cache step comes back with it).
+      #
+      # Turbopack production build (Next 16, stable): benchmarked 1.9× faster than the
+      # webpack pass (9min0s vs 17min15s on a 32-core box; multi-core Rust vs webpack's
+      # single-threaded compile). Standalone output smoke-validated (server boots,
+      # /api/monitoring/health 200). Downstream jobs (e2e ×9, package-artifact,
+      # electron-package-smoke) consume this artifact, so a green run here validates
+      # the Turbopack artifact end-to-end.
       - run: npm run build
+        env:
+          OMNIROUTE_USE_TURBOPACK: "1"
       - name: Archive Next.js build for downstream jobs
         # Use tar so the archive preserves paths relative to CWD (.build/next/...).
         # upload-artifact path-stripping is ambiguous when exclude patterns are used;
@@ -563,12 +622,26 @@ jobs:
       - name: Assert dist/server.js exists
         run: test -f dist/server.js || (echo "dist/server.js missing — build:cli did not assemble correctly" && exit 1)
       - run: npm run check:pack-artifact
+      # WS1.2 (#7065 class): pack the real tarball, install it into a clean prefix and
+      # BOOT it to a healthy /api/monitoring/health — the gate that structure checks
+      # cannot provide (3 releases shipped boot-crashing tarballs with green lists).
+      - name: Boot-smoke the packed tarball
+        run: npm run check:pack-boot
 
   electron-package-smoke:
-    name: Electron Package Smoke
-    runs-on: ubuntu-latest
-    timeout-minutes: 25
+    name: Electron Package Smoke (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
     needs: build
+    # WS1.5 (v3.8.49 plan): the Electron rebuild/spawn path previously executed for
+    # the FIRST time on the release tag — the v3.8.48 Windows bug (npx.cmd spawned
+    # without shell, CVE-2024-27980 behavior change) could only surface at release.
+    # windows-latest runs prepare:bundle (the ABI rebuild + spawn plan) per release
+    # PR; ubuntu keeps the full pack + headless smoke.
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
     env:
       JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
       CSC_IDENTITY_AUTO_DISCOVERY: "false"
@@ -594,18 +667,37 @@ jobs:
         working-directory: electron
         run: npm install --no-audit --no-fund
       - name: Pack Electron app
+        if: runner.os == 'Linux'
         working-directory: electron
         run: npm run pack
+      # ADVISORY while the new Windows leg matures (repo convention, dast-smoke
+      # precedent): its first-ever real run (2026-07-15, run 29457533565) died in
+      # 0.7s with the error swallowed by pwsh — bash shell captures stderr and
+      # continue-on-error keeps the heavy gate green while we harden it (#7336).
+      - name: Prepare Electron standalone (Windows ABI rebuild + spawn path)
+        if: runner.os == 'Windows'
+        working-directory: electron
+        continue-on-error: true
+        shell: bash
+        run: npm run prepare:bundle 2>&1
       - name: Smoke packaged Electron app
+        if: runner.os == 'Linux'
         env:
           ELECTRON_SMOKE_TIMEOUT_MS: 60000
         run: xvfb-run -a npm run electron:smoke:packaged
 
   test-unit:
     name: Unit Tests (${{ matrix.shard }}/8)
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    needs: build
+    # Same dynamic-runner rule as Build (own-origin only; fallback ubuntu-latest).
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
+    timeout-minutes: 25
+    # needs: changes (not build) — this job never downloads the next-build artifact;
+    # gating it on Build only serialized ~20min of wall-clock for nothing. Jobs that
+    # DO consume the artifact (e2e, package-artifact, electron-package-smoke) keep
+    # needs: build. The `if` mirrors Build's own skip condition so docs-only PRs
+    # still skip the suite.
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
     strategy:
       fail-fast: false
       matrix:
@@ -624,13 +716,39 @@ jobs:
           cache: npm
       - uses: ./.github/actions/npm-ci-retry
       - run: npm run check:node-runtime
-      - run: node --max-old-space-size=4096 --import tsx --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 --test-shard=${{ matrix.shard }}/8 tests/unit/*.test.ts "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui,usage}/**/*.test.ts"
+      # QW-d (plano mestre): fonte única — o MESMO npm script dos runs locais (adiciona o
+      # setupPolyfill que o comando inline omitia; o glob canônico vive só no package.json).
+      # D3 (plano mestre): a coverage é coletada NESTE mesmo run (c8/NODE_V8_COVERAGE propaga
+      # aos filhos através do npm) — elimina a matrix Coverage Shard ×8, que re-executava a
+      # suíte inteira só para medir o gate. Padrão usado pelo CI do próprio nodejs/node.
+      - name: Unit tests (shard ${{ matrix.shard }}/8) with V8 coverage
+        env:
+          TEST_SHARD: ${{ matrix.shard }}/8
+        run: |
+          rm -rf coverage-shard coverage-shard-report
+          npx c8 \
+            --temp-directory=coverage-shard \
+            --reports-dir=coverage-shard-report \
+            --reporter=json \
+            --exclude=tests/** \
+            --exclude=**/*.test.* \
+            npm run test:unit:ci:shard
+      - name: Upload raw shard coverage
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-shard-${{ matrix.shard }}
+          path: coverage-shard/*.json
+          if-no-files-found: error
 
   test-vitest:
     name: Vitest (MCP / autoCombo / UI components)
-    runs-on: ubuntu-latest
+    # Same dynamic-runner rule as Build (own-origin only; fallback ubuntu-latest).
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     timeout-minutes: 15
-    needs: build
+    # needs: changes (not build) — no artifact consumed; see test-unit note.
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
     env:
       JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
       API_KEY_SECRET: ci-test-api-key-secret-long
@@ -646,145 +764,37 @@ jobs:
       - uses: ./.github/actions/npm-ci-retry
       # The second test runner (CLAUDE.md: "Both test runners must pass") — was never
       # wired into CI until the 2026-06-09 quality audit (Fase 6A.2).
-      - run: npm run test:vitest
-      # vitest:ui is RED today (14 fails — UI component drift accumulated while the
-      # suite never ran in CI). Informational until the Fase 6A triage (2026-06-16+)
-      # fixes the components/tests; then drop continue-on-error to make it blocking.
-      - run: npm run test:vitest:ui
+      # WS5.2/5.3 (v3.8.49 plan): JUnit output feeds Trunk Flaky Tests (advisory upload
+      # below). node:test stays OUT of the first wave (fd1-sensitive reporter stream).
+      - run: npm run test:vitest -- --reporter=default --reporter=junit --outputFile.junit=trunk-junit/vitest-mcp.xml
+      # vitest:ui went back to 870/870 green in the v3.8.49 quality plan (WS6.1,
+      # PR #7127 — 69 fails triaged: matchMedia polyfill, node:test→vitest migration,
+      # CompareTab D22 cap). Promoted to BLOCKING per the plan's post-merge step.
+      - run: npm run test:vitest:ui -- --reporter=default --reporter=junit --outputFile.junit=trunk-junit/vitest-ui.xml
+      # Trunk Flaky Tests upload — advisory (never blocks), own-origin only (fork PRs
+      # have no TRUNK_TOKEN). Pinned by SHA (tag v2.1.2).
+      - name: Upload test results to Trunk (advisory)
+        if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
         continue-on-error: true
+        uses: trunk-io/analytics-uploader@385f1ccdf345b4532dc4b6c665dd432b702b8e28 # v2.1.2
+        with:
+          junit-paths: trunk-junit/**/*.xml
+          org-slug: omniroute
+          token: ${{ secrets.TRUNK_TOKEN }}
 
-  node-24-compat:
-    name: Node 24 Compatibility Tests (${{ matrix.shard }}/4)
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    needs: build
-    strategy:
-      fail-fast: false
-      matrix:
-        shard: [1, 2, 3, 4]
-    env:
-      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
-      API_KEY_SECRET: ci-test-api-key-secret-long
-      DISABLE_SQLITE_AUTO_BACKUP: "true"
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v6
-        with:
-          node-version: ${{ env.CI_NODE_24_VERSION }}
-          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
-      - run: npm run check:node-runtime
-      - run: node --max-old-space-size=4096 --import tsx --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 --test-shard=${{ matrix.shard }}/4 tests/unit/*.test.ts "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui,usage}/**/*.test.ts"
-
-  node-26-compat-build:
-    name: Node 26 Compatibility Build
-    runs-on: ubuntu-latest
-    timeout-minutes: 25
-    needs: build
-    env:
-      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
-      API_KEY_SECRET: ci-test-api-key-secret-long
-      DISABLE_SQLITE_AUTO_BACKUP: "true"
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v6
-        with:
-          node-version: ${{ env.CI_NODE_26_VERSION }}
-          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
-      - run: npm run check:node-runtime
-      - name: Cache Next.js build cache
-        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8
-        with:
-          path: .build/next/cache
-          key: nextjs-${{ runner.os }}-node-${{ env.CI_NODE_26_VERSION }}-${{ hashFiles('package-lock.json') }}-${{ hashFiles('src/**/*', 'open-sse/**/*', 'db/**/*', 'next.config.mjs', 'tsconfig*.json', 'postcss.config.*', 'tailwind.config.*') }}
-          restore-keys: |
-            nextjs-${{ runner.os }}-node-${{ env.CI_NODE_26_VERSION }}-${{ hashFiles('package-lock.json') }}-
-      - run: npm run build
-
-  node-26-compat:
-    name: Node 26 Compatibility Tests (${{ matrix.shard }}/4)
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    needs: node-26-compat-build
-    strategy:
-      fail-fast: false
-      matrix:
-        shard: [1, 2, 3, 4]
-    env:
-      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
-      API_KEY_SECRET: ci-test-api-key-secret-long
-      DISABLE_SQLITE_AUTO_BACKUP: "true"
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v6
-        with:
-          node-version: ${{ env.CI_NODE_26_VERSION }}
-          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
-      - run: npm run check:node-runtime
-      - run: node --max-old-space-size=4096 --import tsx --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 --test-shard=${{ matrix.shard }}/4 tests/unit/*.test.ts "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui,usage}/**/*.test.ts"
-
-  test-coverage-shard:
-    name: Coverage Shard (${{ matrix.shard }}/8)
-    runs-on: ubuntu-latest
-    timeout-minutes: 25
-    needs: build
-    strategy:
-      fail-fast: false
-      matrix:
-        shard: [1, 2, 3, 4, 5, 6, 7, 8]
-    env:
-      JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
-      API_KEY_SECRET: ci-test-api-key-secret-long
-      DISABLE_SQLITE_AUTO_BACKUP: "true"
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v6
-        with:
-          node-version: ${{ env.CI_NODE_VERSION }}
-          cache: npm
-      - uses: ./.github/actions/npm-ci-retry
-      - run: npm run check:node-runtime
-      - name: Run c8 over shard ${{ matrix.shard }}/8
-        run: |
-          rm -rf coverage-shard coverage-shard-report
-          # `--temp-directory` (writable via NODE_V8_COVERAGE) is what the merge
-          # job reads with `c8 report --temp-directory ...`. Using `--output-dir`
-          # only produces the final json *report* and leaves the raw v8 files in
-          # `coverage/tmp`, so uploading `coverage-shard/` was empty. Pin the temp
-          # dir so the raw coverage files live there and the artifact upload picks
-          # them up regardless of `--test-force-exit` timing.
-          npx c8 \
-            --temp-directory=coverage-shard \
-            --reports-dir=coverage-shard-report \
-            --reporter=json \
-            --exclude=tests/** \
-            --exclude=**/*.test.* \
-            node --max-old-space-size=4096 --import tsx --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 \
-              --test-shard=${{ matrix.shard }}/8 tests/unit/*.test.ts "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui,usage}/**/*.test.ts"
-      - name: Upload raw shard coverage
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: coverage-shard-${{ matrix.shard }}
-          path: coverage-shard/*.json
-          if-no-files-found: error
-
+  # Node 24/26 compatibility matrices moved to .github/workflows/nightly-compat.yml
+  # (plano mestre testes+CI, Eixo D2 — they cost ~28% of every heavy run to catch a
+  # failure class that rarely originates in a PR; nightly catches it within 24h and
+  # the release gate can still exercise them via workflow_dispatch when needed).
   test-coverage:
     name: Coverage
     runs-on: ubuntu-latest
-    timeout-minutes: 10
-    needs: test-coverage-shard
-    if: ${{ !cancelled() && needs.test-coverage-shard.result == 'success' }}
+    # 10min was sized before #7114 added the lcov reporter (Codecov/Sonar need it);
+    # merging 8 shard JSONs + text+json+lcov now takes ~10-12min — three consecutive
+    # release-tip runs died at exactly 10m as job-timeout "cancelled" (2026-07-15/16).
+    timeout-minutes: 20
+    needs: test-unit
+    if: ${{ !cancelled() && needs.test-unit.result == 'success' && !contains(github.event.pull_request.labels.*.name, 'hotfix') }}
     env:
       JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
       API_KEY_SECRET: ci-test-api-key-secret-long
@@ -832,6 +842,7 @@ jobs:
             --merge-async \
             --reporter=text-summary \
             --reporter=json-summary \
+            --reporter=lcov \
             --exclude=tests/** \
             --exclude=**/*.test.* \
             --check-coverage \
@@ -853,6 +864,18 @@ jobs:
               > coverage/coverage-report.md
           fi
           cat coverage/coverage-report.md >> "$GITHUB_STEP_SUMMARY"
+      # WS5.6 (D7, v3.8.49 plan): patch coverage on the PR diff via Codecov —
+      # informational during calibration (codecov.yml sets informational: true);
+      # promote to blocking only after ~2 weeks without false blocks. The lcov
+      # reporter above also fixes coverage/lcov.info being silently absent
+      # (if-no-files-found: warn) — Sonar consumes the same file.
+      - name: Upload coverage to Codecov (informational)
+        if: always()
+        uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 # v5
+        with:
+          files: coverage/lcov.info
+          token: ${{ secrets.CODECOV_TOKEN }}
+          fail_ci_if_error: false
       - name: Upload coverage artifacts
         if: always()
         uses: actions/upload-artifact@v7
@@ -877,10 +900,14 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0
+      # The upload strips the common `coverage/` prefix, so the artifact root holds
+      # lcov.info directly — download into coverage/ so it lands at coverage/lcov.info,
+      # where sonar.javascript.lcov.reportPaths expects it (path: . left the Sonar
+      # new-code coverage at 0% every scan).
       - uses: actions/download-artifact@v8
         with:
           name: coverage-report
-          path: .
+          path: coverage/
       - name: Explain SonarQube skip
         if: ${{ github.event_name != 'pull_request' || env.SONAR_TOKEN == '' || env.SONAR_HOST_URL == '' }}
         run: |
@@ -889,17 +916,33 @@ jobs:
           else
             echo "SonarQube scan skipped because SONAR_TOKEN or SONAR_HOST_URL is not configured." >> "$GITHUB_STEP_SUMMARY"
           fi
+      - name: Read project version
+        if: ${{ github.event_name == 'pull_request' && env.SONAR_TOKEN != '' && env.SONAR_HOST_URL != '' }}
+        id: pkg
+        run: |
+          VERSION="$(node -p "require('./package.json').version")"
+          # Harden against output injection: only accept a plain semver-ish string.
+          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
+            echo "Invalid package.json version: $VERSION" >&2; exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
       - name: SonarQube Scan
         if: ${{ github.event_name == 'pull_request' && env.SONAR_TOKEN != '' && env.SONAR_HOST_URL != '' }}
         uses: SonarSource/sonarqube-scan-action@v8
         env:
           SONAR_TOKEN: ${{ env.SONAR_TOKEN }}
           SONAR_HOST_URL: ${{ env.SONAR_HOST_URL }}
+        with:
+          # sonar.projectVersion advances the "previous_version" new-code baseline at
+          # each release; without it the baseline never moves (it stays pinned to the
+          # analysis where the version last changed) and legacy issues pile up as
+          # "new code" in the quality gate.
+          args: -Dsonar.projectVersion=${{ steps.pkg.outputs.version }}
 
   coverage-pr-comment:
     name: PR Coverage Comment
     runs-on: ubuntu-latest
-    if: ${{ !cancelled() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false && needs.changes.outputs.code == 'true' }}
+    if: ${{ !cancelled() && github.event_name == 'pull_request' && github.event.pull_request.draft == false && github.event.pull_request.head.repo.fork == false && needs.changes.outputs.code == 'true' }}
     needs:
       - changes
       - pr-test-policy
@@ -983,7 +1026,12 @@ jobs:
     # ~33%. Playwright browser is cached across runs (~1.5min saved per shard).
     # Heavy shard target: ≤20min (was ~40min). Timeout 45min to cover slow runners.
     timeout-minutes: 45
-    needs: build
+    needs: [build, changes]
+    # WS3.1 hotfix fast-lane: the 9-shard E2E matrix is the CI critical path (~25min).
+    # It skips for (a) PRs labeled `hotfix` (entry policy in docs/ops/RELEASE_CHECKLIST.md:
+    # production-broken only, full-suite evidence from the previous green run linked in the
+    # PR) and (b) tests-only diffs outside tests/e2e/ (cannot change the served app).
+    if: ${{ needs.changes.outputs.testsOnly != 'true' && !contains(github.event.pull_request.labels.*.name, 'hotfix') }}
     strategy:
       fail-fast: false
       matrix:
@@ -1004,7 +1052,7 @@ jobs:
       - uses: ./.github/actions/npm-ci-retry
       - run: npm run check:node-runtime
       - name: Cache Playwright browsers
-        uses: actions/cache@v6.0.0
+        uses: actions/cache@v6
         with:
           path: ~/.cache/ms-playwright
           key: playwright-chromium-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
@@ -1018,13 +1066,41 @@ jobs:
       - name: Extract Next.js build artifact
         run: |
           tar -xzf /tmp/e2e-build.tar.gz
-      - run: npx playwright test tests/e2e/*.spec.ts --shard=${{ matrix.shard }}/9
+      # WS4.1: duration-balanced shards (LPT over config/quality/e2e-timings.json).
+      # Measured skew of plain --shard was 14× (24m47s vs 1m47s) — E2E was the CI
+      # critical path. The balancer self-verifies completeness and exits non-zero on
+      # any inconsistency, falling back to plain --shard (never fewer specs).
+      - name: Run E2E tests (duration-balanced shard)
+        env:
+          SHARD: ${{ matrix.shard }}
+          PLAYWRIGHT_JUNIT_OUTPUT_NAME: junit-e2e-results.xml
+        run: |
+          if FILES=$(node scripts/quality/balance-e2e-shards.mjs "$SHARD" 9); then
+            if [ -z "$FILES" ]; then echo "[e2e-balance] shard $SHARD has no files"; exit 0; fi
+            echo "[e2e-balance] shard $SHARD runs:"; echo "$FILES"
+            # shellcheck disable=SC2086 — FILES is our own newline-separated path list
+            npx playwright test $(echo "$FILES" | tr '\n' ' ') --reporter=line,junit
+          else
+            echo "[e2e-balance] balancer unavailable — plain --shard fallback"
+            npx playwright test tests/e2e/*.spec.ts --shard="$SHARD"/9 --reporter=line,junit
+          fi
+      # WS5.2/5.3: Trunk Flaky Tests upload — advisory, own-origin only, SHA-pinned.
+      - name: Upload test results to Trunk (advisory)
+        if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
+        continue-on-error: true
+        uses: trunk-io/analytics-uploader@385f1ccdf345b4532dc4b6c665dd432b702b8e28 # v2.1.2
+        with:
+          junit-paths: junit-e2e-results.xml
+          org-slug: omniroute
+          token: ${{ secrets.TRUNK_TOKEN }}
 
   test-integration:
     name: Integration Tests (${{ matrix.shard }}/2)
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    needs: build
+    # needs: changes (not build) — no artifact consumed; see test-unit note.
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
     strategy:
       fail-fast: false
       matrix:
@@ -1045,12 +1121,15 @@ jobs:
           cache: npm
       - uses: ./.github/actions/npm-ci-retry
       - run: npm run check:node-runtime
-      - run: node --import tsx --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=1 --test-shard=${{ matrix.shard }}/2 tests/integration/*.test.ts
+      # (tsx/esm = QW-b; o alinhamento de ESCOPO do integration com o npm script fica p/ follow-up)
+      - run: node --import tsx/esm --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=1 --test-shard=${{ matrix.shard }}/2 tests/integration/*.test.ts
 
   test-security:
     name: Security Tests
     runs-on: ubuntu-latest
-    needs: build
+    # needs: changes (not build) — no artifact consumed; see test-unit note.
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
     env:
       JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
       API_KEY_SECRET: ci-test-api-key-secret-long
@@ -1082,9 +1161,6 @@ jobs:
       - package-artifact
       - electron-package-smoke
       - test-unit
-      - node-24-compat
-      - node-26-compat-build
-      - node-26-compat
       - test-coverage
       - sonarqube
       - coverage-pr-comment
@@ -1134,15 +1210,12 @@ jobs:
           echo "| Build Matrix | $(status '${{ needs.build.result }}') |" >> "$GITHUB_STEP_SUMMARY"
           echo "| Package Artifact | $(status '${{ needs.package-artifact.result }}') |" >> "$GITHUB_STEP_SUMMARY"
           echo "| Electron Package Smoke | $(status '${{ needs.electron-package-smoke.result }}') |" >> "$GITHUB_STEP_SUMMARY"
-          echo "| Node 26 Compatibility Build | $(status '${{ needs.node-26-compat-build.result }}') |" >> "$GITHUB_STEP_SUMMARY"
 
           echo "" >> "$GITHUB_STEP_SUMMARY"
           echo "## 🧪 Tests" >> "$GITHUB_STEP_SUMMARY"
           echo "| Suite | Status |" >> "$GITHUB_STEP_SUMMARY"
           echo "|-------|--------|" >> "$GITHUB_STEP_SUMMARY"
           echo "| Unit | $(status '${{ needs.test-unit.result }}') |" >> "$GITHUB_STEP_SUMMARY"
-          echo "| Node 24 Compatibility Tests | $(status '${{ needs.node-24-compat.result }}') |" >> "$GITHUB_STEP_SUMMARY"
-          echo "| Node 26 Compatibility Tests | $(status '${{ needs.node-26-compat.result }}') |" >> "$GITHUB_STEP_SUMMARY"
           echo "| Coverage | $(status '${{ needs.test-coverage.result }}') |" >> "$GITHUB_STEP_SUMMARY"
           echo "| PR Coverage Comment | $(status '${{ needs.coverage-pr-comment.result }}') |" >> "$GITHUB_STEP_SUMMARY"
           echo "| E2E | $(status '${{ needs.test-e2e.result }}') |" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/codeql.yml

@@ -22,10 +22,10 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           languages: javascript-typescript
           queries: security-extended
-      - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           category: "/language:javascript-typescript"

.github/workflows/dast-smoke.yml

@@ -10,7 +10,10 @@ jobs:
     # ADVISORY while this new gate matures (repo convention: advisory -> blocking).
     # Flip to blocking (remove continue-on-error) once it's proven stable across a few PRs.
     continue-on-error: true
-    timeout-minutes: 12
+    # Build CLI bundle alone varies 6-11min on GitHub-hosted runners (3 consecutive
+    # timeouts observed on 2026-07-14 with the old 12min cap killing schemathesis
+    # mid-run) — 25min leaves real headroom for the actual DAST steps.
+    timeout-minutes: 25
     env:
       JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
       API_KEY_SECRET: ci-api-key-secret-with-sufficient-length-aaaa

.github/workflows/electron-release.yml

@@ -94,7 +94,7 @@ jobs:
           cache: npm
 
       - name: Cache node_modules
-        uses: actions/cache@v6.0.0
+        uses: actions/cache@v6.1.0
         with:
           path: node_modules
           key: ${{ runner.os }}-node-${{ hashFiles('package-lock.json') }}
@@ -201,6 +201,12 @@ jobs:
               [ -f "$file" ] && cp "$file" "../../release-assets/OmniRoute.exe" && break
             done
           fi
+          # electron-updater manifests (latest.yml / latest-mac.yml / latest-linux.yml)
+          # must be published alongside the installers, or autoUpdater fails with
+          # "Cannot find latest.yml in the latest release artifacts" (#6766).
+          for file in latest*.yml; do
+            [ -f "$file" ] && cp "$file" ../../release-assets/
+          done
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v7
@@ -263,6 +269,7 @@ jobs:
             release-assets/*.AppImage
             release-assets/*.deb
             release-assets/*.blockmap
+            release-assets/*.yml
             release-assets/*.source.tar.gz
             release-assets/*.source.zip
         env:

.github/workflows/nightly-compat.yml

@@ -0,0 +1,126 @@
+name: Nightly Node Compat
+
+# Plano mestre testes+CI (Eixo D2, aprovado 2026-07-04): as matrizes de compatibilidade
+# Node 24/26 custavam ~28% de CADA run do CI pesado (2 execuções completas da suíte por
+# sync da release-PR) para pegar uma classe de quebra que raramente nasce num PR típico.
+# Elas rodam aqui 1×/dia contra o tip da release ativa (mesmo alvo do nightly-release-green)
+# e continuam obrigatórias no gate de release via workflow_dispatch do ci.yml se preciso.
+# fail-fast desligado: numa quebra queremos saber TODAS as versões afetadas de uma vez.
+
+on:
+  schedule:
+    - cron: "47 6 * * *" # 06:47 UTC diário — slot distinto dos demais nightlies
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: "Branch to validate (default: highest release/vX.Y.Z)"
+        required: false
+        type: string
+
+permissions:
+  contents: read
+  issues: write
+
+concurrency:
+  group: nightly-compat
+  cancel-in-progress: true
+
+jobs:
+  resolve-branch:
+    name: Resolve active release branch
+    runs-on: ubuntu-latest
+    outputs:
+      target: ${{ steps.branch.outputs.target }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Resolve active release branch
+        id: branch
+        env:
+          INPUT_BRANCH: ${{ github.event.inputs.branch }}
+        run: |
+          set -euo pipefail
+          if [ -n "${INPUT_BRANCH:-}" ]; then
+            TARGET="$INPUT_BRANCH"
+          else
+            TARGET=$(git for-each-ref --format='%(refname:short)' 'refs/remotes/origin/release/v*' \
+              | sed 's#origin/##' \
+              | sort -t/ -k2 -V \
+              | tail -1)
+          fi
+          case "$TARGET" in
+            release/v[0-9]*.[0-9]*.[0-9]*) ;;
+            *) echo "Refusing non-canonical branch name: $TARGET"; exit 1 ;;
+          esac
+          echo "target=$TARGET" >> "$GITHUB_OUTPUT"
+
+  compat-build-26:
+    name: Node 26 Compatibility Build
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    needs: resolve-branch
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ needs.resolve-branch.outputs.target }}
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "26"
+          cache: npm
+      - uses: ./.github/actions/npm-ci-retry
+      - run: npm run build
+
+  compat-tests:
+    name: Node ${{ matrix.node }} Compat Tests (${{ matrix.shard }}/4)
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    needs: resolve-branch
+    strategy:
+      fail-fast: false
+      matrix:
+        node: [24, 26]
+        shard: [1, 2, 3, 4]
+    env:
+      JWT_SECRET: ci-nightly-secret-with-sufficient-length-for-validation
+      API_KEY_SECRET: ci-nightly-api-key-secret-long
+      DISABLE_SQLITE_AUTO_BACKUP: "true"
+      TEST_SHARD: ${{ matrix.shard }}/4
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ needs.resolve-branch.outputs.target }}
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+      - uses: ./.github/actions/npm-ci-retry
+      - run: npm run check:node-runtime
+      - run: npm run test:unit:ci:shard
+
+  report:
+    name: Open / update tracking issue on failure
+    runs-on: ubuntu-latest
+    if: ${{ !cancelled() && (needs.compat-tests.result == 'failure' || needs.compat-build-26.result == 'failure') }}
+    needs: [resolve-branch, compat-build-26, compat-tests]
+    permissions:
+      issues: write
+    steps:
+      - name: Open or update issue
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TARGET: ${{ needs.resolve-branch.outputs.target }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          TITLE="🌙 nightly-compat: Node 24/26 failures on $TARGET"
+          EXISTING=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open --search "$TITLE in:title" --json number --jq '.[0].number')
+          BODY="Nightly Node-compat run failed on \`$TARGET\`: $RUN_URL — triage which Node version/shard broke (fail-fast off, all versions reported)."
+          if [ -n "$EXISTING" ]; then
+            gh issue comment "$EXISTING" --repo "$GITHUB_REPOSITORY" --body "$BODY"
+          else
+            gh issue create --repo "$GITHUB_REPOSITORY" --title "$TITLE" --body "$BODY"
+          fi

.github/workflows/nightly-mutation.yml

@@ -113,7 +113,7 @@ jobs:
           cache: npm
       - run: npm ci
       - name: Restore Stryker incremental cache
-        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: reports/mutation/stryker-incremental.json
           key: stryker-incremental-${{ matrix.batch.name }}-${{ github.run_id }}

.github/workflows/nightly-release-green.yml

@@ -1,11 +1,18 @@
-name: Nightly Release-Green
+name: Release-Green (continuous)
 
 # Solution D — continuous, NON-BLOCKING drift signal for the active release branch.
 #
 # WHY: the full gate (ci.yml) only runs on the release PR (PR → main), so reds
 # accrue silently on release/** and explode — in layers — at release time. This
-# nightly reproduces the release-equivalent validation on the active release branch
-# HEAD and, when there are HARD failures, opens/updates a single tracking issue.
+# workflow reproduces the release-equivalent validation on the release branch and,
+# when there are HARD failures, opens/updates a single tracking issue.
+#
+# WS5.1 (v3.8.49 quality plan) — two modes:
+#   push to release/v* (code paths) → --quick (fast HARD gates, ~5-8min). Catches the
+#     captain's direct pushes (sync-back — the one ungated write path) AND the merged
+#     COMBINATION right after every PR merge, attributing the offending push range in
+#     the issue. Base-red MTTD drops from ≤24h to ≤~15min after the offending push.
+#   schedule (3×/day) → full --with-build --full-ci (the deep sweep incl. build+suites).
 #
 # It is NOT a required status check and never touches a contributor PR — it only
 # reports. Ratchet drift (eslint warnings / cognitive-complexity / file-size) is
@@ -14,8 +21,23 @@ name: Nightly Release-Green
 # package-artifact) flip the issue open.
 
 on:
+  push:
+    branches: ["release/v*", "main"]
+    paths:
+      - "src/**"
+      - "open-sse/**"
+      - "bin/**"
+      - "electron/**"
+      - "scripts/**"
+      - "tests/**"
+      - "config/**"
+      - "package.json"
+      - "package-lock.json"
+      - "tsconfig*.json"
   schedule:
-    - cron: "23 5 * * *" # 05:23 UTC daily — off-peak, distinct from other nightlies
+    - cron: "23 5 * * *" # full sweep — off-peak, distinct from other nightlies
+    - cron: "23 12 * * *" # full sweep — midday (WS5.1: 3×/day instead of 1×)
+    - cron: "23 18 * * *" # full sweep — evening
   workflow_dispatch:
     inputs:
       branch:
@@ -28,13 +50,25 @@ permissions:
   issues: write
 
 concurrency:
-  group: nightly-release-green
+  # push storms during merge campaigns collapse to the newest commit per branch;
+  # scheduled full sweeps keep their own single lane.
+  group: release-green-${{ github.event_name }}-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  OMNIROUTE_SKIP_SYSTEM_TRUST: "1"
+
 jobs:
   release-green:
     name: Validate active release branch
-    runs-on: ubuntu-latest
+    # On a push, only run for release/* pushes — a push to main is handled by the
+    # main-green job below. Schedule/dispatch always run (they validate the highest release).
+    if: ${{ github.event_name != 'push' || startsWith(github.ref_name, 'release/') }}
+    # Dynamic runner: with USE_VPS_RUNNER=true (release window / on-demand pre-flight)
+    # this runs on the dedicated VPS runner — clean env (no operator OMNIROUTE_API_KEY,
+    # no local noauth CLIs => zero machine-specific false positives) and no contention.
+    # Nightly cron normally finds the var false (VM off) and falls back to hosted.
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && fromJSON('["self-hosted","omni-release"]')) || 'ubuntu-latest' }}
     env:
       JWT_SECRET: ci-nightly-secret-with-sufficient-length-for-validation
       API_KEY_SECRET: ci-nightly-api-key-secret-long
@@ -49,10 +83,15 @@ jobs:
         id: branch
         env:
           INPUT_BRANCH: ${{ github.event.inputs.branch }}
+          EVENT_NAME: ${{ github.event_name }}
+          PUSHED_REF: ${{ github.ref_name }}
         run: |
           set -euo pipefail
           if [ -n "${INPUT_BRANCH:-}" ]; then
             TARGET="$INPUT_BRANCH"
+          elif [ "$EVENT_NAME" = "push" ]; then
+            # validate exactly what was pushed, not the highest branch
+            TARGET="$PUSHED_REF"
           else
             # highest release/vX.Y.Z by semver among remote branches
             TARGET=$(git for-each-ref --format='%(refname:short)' 'refs/remotes/origin/release/v*' \
@@ -86,9 +125,26 @@ jobs:
 
       - name: Release-green validation (full)
         id: validate
+        env:
+          EVENT_NAME: ${{ github.event_name }}
         run: |
           set +e
-          node scripts/quality/validate-release-green.mjs --json --with-build \
+          # --hermetic: scrub live-test trigger vars (self-hosted runner may carry
+          # operator env; hosted ignores the unknown flag before #6300 lands).
+          # push → --quick: fast HARD gates only (~5-8min), per-merge signal.
+          # schedule/dispatch → --with-build --full-ci: ALSO run every static gate from
+          # ci.yml's gate jobs (lint, quality-gate, quality-extended, docs-sync-strict,
+          # pr-test-policy) + build + full suites. PRs into release/** only get the
+          # fast-gates, so these accrue silently and explode in layers on the release PR
+          # (v3.8.46: 11 static base-reds leaked).
+          if [ "$EVENT_NAME" = "push" ]; then
+            MODE="--quick"
+          else
+            MODE="--with-build --full-ci"
+          fi
+          echo "[release-green] mode: $MODE (event: $EVENT_NAME)"
+          # shellcheck disable=SC2086 — MODE is an intentional flag list
+          node scripts/quality/validate-release-green.mjs --json --hermetic $MODE \
             1> release-green.json 2> release-green.log
           echo "exit=$?" >> "$GITHUB_OUTPUT"
           echo "------- report -------"
@@ -100,15 +156,28 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           TARGET: ${{ steps.branch.outputs.target }}
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          EVENT_NAME: ${{ github.event_name }}
+          BEFORE_SHA: ${{ github.event.before }}
+          AFTER_SHA: ${{ github.event.after }}
         run: |
           set -euo pipefail
           TITLE="🔴 Release branch not green: ${TARGET}"
           {
-            echo "The nightly **release-green** validation found HARD failures on \`${TARGET}\`."
+            echo "The **release-green** validation found HARD failures on \`${TARGET}\`."
             echo "These are real defects that would block the release PR — fix them in the"
             echo "originating PR branch (via co-authorship), not by demanding it from contributors."
             echo ""
-            echo "**Run:** ${RUN_URL}"
+            echo "**Run:** ${RUN_URL} (mode: ${EVENT_NAME})"
+            # WS5.1 attribution: on push events the offending change IS this push's range
+            # (one merge per push in the normal queue), so name it — no bisect needed.
+            if [ "$EVENT_NAME" = "push" ] && [ -n "${BEFORE_SHA:-}" ] && \
+               git cat-file -e "$BEFORE_SHA" 2>/dev/null; then
+              echo ""
+              echo "**Offending push range** (\`${BEFORE_SHA:0:9}..${AFTER_SHA:0:9}\`):"
+              echo '```'
+              git log --no-decorate --oneline "${BEFORE_SHA}..${AFTER_SHA}" | head -20
+              echo '```'
+            fi
             echo ""
             echo '```'
             sed -n '/──────── verdict ────────/,$p' release-green.log || tail -40 release-green.log
@@ -128,10 +197,107 @@ jobs:
 
       - name: Upload report artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: release-green-report
           path: |
             release-green.json
             release-green.log
           if-no-files-found: ignore
+
+  # Companion arm for `main`. Under the parallel-cycle model, main only receives merged
+  # work at the release squash — so a gate/infra fix that lands only on release leaves
+  # main red the whole cycle, and repo-wide gates (CodeQL alert count, ratchet baselines)
+  # turn EVERY PR into main red on a check unrelated to its diff. This detects that and
+  # opens a "🔴 main not green" tracking issue. The PREVENTION is the companion-PR reflex
+  # (Hard Rule #21 area / _shared/merge-gates.md §8); this is the automated backstop.
+  main-green:
+    name: Validate main branch
+    # On a push, only run for a push to main — a push to release/* is handled by
+    # release-green above. Schedule/dispatch always run (they also sweep main).
+    if: ${{ github.event_name != 'push' || github.ref_name == 'main' }}
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && fromJSON('["self-hosted","omni-release"]')) || 'ubuntu-latest' }}
+    env:
+      JWT_SECRET: ci-nightly-secret-with-sufficient-length-for-validation
+      API_KEY_SECRET: ci-nightly-api-key-secret-long
+      DISABLE_SQLITE_AUTO_BACKUP: "true"
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: main # literal — no injection surface; scheduled runs default to the repo default branch (a release/v*), so pin main explicitly
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          cache: npm
+
+      - uses: ./.github/actions/npm-ci-retry
+
+      - name: Main-green validation
+        id: validate
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+        run: |
+          set +e
+          # push (a merge into main) → --quick fast HARD gates; schedule/dispatch → full sweep.
+          if [ "$EVENT_NAME" = "push" ]; then
+            MODE="--quick"
+          else
+            MODE="--with-build --full-ci"
+          fi
+          echo "[main-green] mode: $MODE (event: $EVENT_NAME)"
+          # shellcheck disable=SC2086 — MODE is an intentional flag list
+          node scripts/quality/validate-release-green.mjs --json --hermetic $MODE \
+            1> main-green.json 2> main-green.log
+          echo "exit=$?" >> "$GITHUB_OUTPUT"
+          echo "------- report -------"
+          cat main-green.log
+
+      - name: Open / update tracking issue on HARD failure
+        if: steps.validate.outputs.exit != '0'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          EVENT_NAME: ${{ github.event_name }}
+        run: |
+          set -euo pipefail
+          TITLE="🔴 main branch not green"
+          {
+            echo "The **main-green** validation found HARD failures on \`main\`."
+            echo ""
+            echo "Because \`main\` only receives merged work at the release squash, a gate/infra"
+            echo "fix that landed only on the release branch leaves \`main\` broken for the whole"
+            echo "cycle — and repo-wide gates (CodeQL alert count, ratchet baselines) then turn"
+            echo "**every open PR into main** red on a check unrelated to its diff. The fix is a"
+            echo "companion PR \`--base main\` carrying the release-side fix (see"
+            echo "\`_shared/merge-gates.md\` §8), NOT chasing each contributor PR."
+            echo ""
+            echo "**Run:** ${RUN_URL} (mode: ${EVENT_NAME})"
+            echo ""
+            echo '```'
+            sed -n '/──────── verdict ────────/,$p' main-green.log || tail -40 main-green.log
+            echo '```'
+            echo ""
+            echo "_Ratchet drift (eslint warnings / cognitive-complexity / file-size) is expected mid-cycle and did NOT, on its own, open this issue._"
+          } > issue-body.md
+
+          EXISTING=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open \
+            --search "in:title $TITLE" --json number --jq '.[0].number' 2>/dev/null || echo "")
+          if [ -n "$EXISTING" ]; then
+            gh issue comment "$EXISTING" --repo "$GITHUB_REPOSITORY" --body-file issue-body.md
+            echo "Updated existing issue #$EXISTING"
+          else
+            gh issue create --repo "$GITHUB_REPOSITORY" --title "$TITLE" --body-file issue-body.md
+          fi
+
+      - name: Upload report artifact
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: main-green-report
+          path: |
+            main-green.json
+            main-green.log
+          if-no-files-found: ignore

.github/workflows/nightly-resilience.yml

@@ -100,7 +100,7 @@ jobs:
           cache: npm
       - run: npm ci
       - name: Cache Playwright browsers
-        uses: actions/cache@v6.0.0
+        uses: actions/cache@v6.1.0
         with:
           path: ~/.cache/ms-playwright
           key: playwright-chromium-${{ runner.os }}-${{ hashFiles('package-lock.json') }}

.github/workflows/npm-publish.yml

@@ -22,6 +22,14 @@ on:
           - latest
           - next
           - historic
+      publish_mode:
+        description: "staged = npm stage publish (owner approves with 2FA after the staged boot-verify); direct = legacy immediate publish (emergency fallback only)"
+        required: false
+        default: "staged"
+        type: choice
+        options:
+          - staged
+          - direct
   workflow_call:
     inputs:
       version:
@@ -166,8 +174,34 @@ jobs:
           TAG: ${{ github.ref_name }}
         run: gh release upload "$TAG" sbom-npm.cdx.json --clobber
 
-      - name: Publish to npm
+      # WS1.2/WS1.3 (#7065 class): the artifact that is about to be published must
+      # BOOT. build:cli already assembled dist/ above; this packs+installs+boots the
+      # real tarball and fails the publish before anything reaches the registry.
+      - name: Boot-smoke the tarball before ANY publish
         if: steps.resolve.outputs.skip != 'true'
+        run: npm run check:pack-boot
+
+      # WS1.3 (D2, v3.8.49 plan): STAGED publishing by default — `npm stage publish`
+      # parks the exact bytes on the registry WITHOUT making them installable; the
+      # owner then verifies and approves with 2FA (`npm stage approve`), moving the
+      # human gate to AFTER the proof instead of before it. Requires npm >= 11.15
+      # (staged publishing GA 2026-05-22). publish_mode=direct is the emergency
+      # fallback (legacy immediate publish) via workflow_dispatch.
+      - name: Ensure npm supports staged publishing
+        if: steps.resolve.outputs.skip != 'true' && (github.event_name != 'workflow_dispatch' || inputs.publish_mode != 'direct')
+        run: |
+          set -euo pipefail
+          CUR=$(npm --version)
+          if ! node -e "const [a,b]='$(npm --version)'.split('.').map(Number); process.exit(a>11||(a===11&&b>=15)?0:1)"; then
+            # Pinned exact version (supply-chain: never float @latest in the publish
+            # job); bump deliberately when a newer npm is required.
+            echo "npm $CUR < 11.15 — installing pinned npm 11.15.0 for staged publishing"
+            npm install -g --ignore-scripts npm@11.15.0
+          fi
+          npm --version
+
+      - name: Publish to npm (staged — owner approves with 2FA)
+        if: steps.resolve.outputs.skip != 'true' && (github.event_name != 'workflow_dispatch' || inputs.publish_mode != 'direct')
         env:
           VERSION: ${{ steps.resolve.outputs.version }}
           TAG: ${{ steps.resolve.outputs.tag }}
@@ -175,10 +209,32 @@ jobs:
         run: |
           set -euo pipefail
           # Always pass --tag explicitly. Defense in depth: even if VERSION is
-          # accidentally an older release, `npm publish --tag historic` will
-          # NOT promote it to `@latest`.
+          # accidentally an older release, the historic tag will NOT claim `@latest`.
+          npm stage publish --provenance --access public --tag "$TAG"
+          {
+            echo "## 📦 omniroute@$VERSION STAGED (not yet installable)"
+            echo ""
+            echo "The exact bytes are parked on the registry. To release them:"
+            echo '```'
+            echo "npm stage list omniroute            # find the stage id"
+            echo "npm stage approve <id>              # owner 2FA — THE publish"
+            echo '```'
+            echo "To verify the staged bytes first: npm stage download <id> → run"
+            echo "scripts/check/check-pack-boot.mjs against them (see RELEASE_CHECKLIST)."
+            echo "To discard: npm stage reject <id>."
+          } >> "$GITHUB_STEP_SUMMARY"
+          echo "✅ Staged omniroute@$VERSION (dist-tag=$TAG) — awaiting owner 'npm stage approve'"
+
+      - name: Publish to npm (DIRECT — emergency fallback)
+        if: steps.resolve.outputs.skip != 'true' && github.event_name == 'workflow_dispatch' && inputs.publish_mode == 'direct'
+        env:
+          VERSION: ${{ steps.resolve.outputs.version }}
+          TAG: ${{ steps.resolve.outputs.tag }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          set -euo pipefail
           npm publish --provenance --access public --tag "$TAG"
-          echo "✅ Published omniroute@$VERSION (dist-tag=$TAG)"
+          echo "✅ Published omniroute@$VERSION (dist-tag=$TAG) [DIRECT mode]"
 
       - name: Publish to GitHub Packages
         if: steps.resolve.outputs.skip != 'true'

.github/workflows/quality.yml

@@ -14,12 +14,80 @@ permissions:
   contents: read
 
 env:
+  # CI must never mutate the runner's OS trust store (2026-07-05: a cert-flow
+  # test installed a fake PEM on a persistent self-hosted runner and broke all
+  # system TLS). Belt-and-suspenders with tests/_setup/isolateDataDir.ts.
+  OMNIROUTE_SKIP_SYSTEM_TRUST: "1"
   CI_NODE_VERSION: "24"
 
 jobs:
+  # Same classifier as ci.yml (scripts/quality/classify-pr-changes.mjs) so PR→release
+  # path filters share existence reasons: code / docs / i18n / workflow.
+  changes:
+    name: Change Classification
+    runs-on: ubuntu-latest
+    outputs:
+      code: ${{ steps.classify.outputs.code }}
+      docs: ${{ steps.classify.outputs.docs }}
+      i18n: ${{ steps.classify.outputs.i18n }}
+      workflow: ${{ steps.classify.outputs.workflow }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.CI_NODE_VERSION }}
+      - id: classify
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          if [ "$EVENT_NAME" != "pull_request" ]; then
+            {
+              echo "code=true"
+              echo "docs=true"
+              echo "i18n=true"
+              echo "workflow=true"
+            } >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          git diff --name-only "$BASE_SHA" "$HEAD_SHA" > changed-files.txt
+          node scripts/quality/classify-pr-changes.mjs changed-files.txt >> "$GITHUB_OUTPUT"
+
+  # Docs/OpenAPI contract gates only — existence reason is doc accuracy + route refs.
+  # Split out of fast-gates so pure-docs PRs skip typecheck/unit while still validating docs.
+  docs-gates:
+    name: Docs Gates (fast-path)
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && (needs.changes.outputs.docs == 'true' || needs.changes.outputs.code == 'true')) }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.CI_NODE_VERSION }}
+          cache: npm
+      - run: npm ci
+      # One walk of src/app/api for openapi-routes + docs-symbols (both still fail independently).
+      - run: npm run check:api-docs-refs
+      - name: Docs accuracy (fabricated-docs + i18n mirrors, strict)
+        run: npm run check:docs-all
+
   fast-gates:
     name: Fast Quality Gates
-    runs-on: ubuntu-latest
+    needs: changes
+    # Code surface only — pure docs/i18n PRs skip this bag (docs-gates covers docs).
+    if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true') }}
+    # Dynamic runner (same rule as ci.yml): use the self-hosted VPS pool only when the
+    # release captain has USE_VPS_RUNNER=true AND this is not a fork PR (own-origin
+    # branches only — a fork PR must never execute on the LAN runner). Var unset/false
+    # or a fork PR falls back to ubuntu-latest, so this is inert until the flag flips.
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     # tsx gates (known-symbols, route-guard-membership) import modules that open
     # SQLite on load; provide DB env so a fresh CI DB initializes cleanly.
     env:
@@ -36,12 +104,18 @@ jobs:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
       - run: npm ci
+      - name: Restore ESLint file cache
+        uses: actions/cache@v6
+        with:
+          path: |
+            .eslintcache
+            .eslintcache-complexity
+          key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'eslint.complexity-ratchets.config.mjs', 'config/quality/eslint-suppressions.json', 'package-lock.json') }}
+          restore-keys: |
+            eslint-${{ runner.os }}-
       - run: npm run check:provider-consistency
       - run: npm run check:fetch-targets
-      - run: npm run check:openapi-routes
-      - run: npm run check:docs-symbols
-      - name: Docs accuracy (fabricated-docs + i18n mirrors, strict)
-        run: npm run check:docs-all
+      # docs-all / openapi-routes / docs-symbols live in docs-gates (path-filtered).
       - run: npm run check:deps
       - run: npm run check:file-size
       - run: npm run check:error-helper
@@ -52,6 +126,10 @@ jobs:
       - run: npm run check:route-guard-membership
       - run: npm run check:test-discovery
       - run: npm run check:test-runner-api
+      # Guards tap.testFiles drift: a covering unit test absent from stryker.conf.json
+      # tap.testFiles makes its module's mutants survive on a cold nightly-mutation run,
+      # false-failing the blocking mutationScore ratchet. See check-mutation-test-coverage.mjs.
+      - run: npm run check:mutation-test-coverage
       - run: npm run check:any-budget:t11
       # Build-scope guard: fails if worktrees/cruft leak into the tsconfig include
       # scope (would OOM `next build`). Instant. See incident 2026-06-25 / #5031.
@@ -60,25 +138,39 @@ jobs:
       # leaking into the npm tarball (v3.8.36: 6 ops bin/*.sh) per-PR instead of only on
       # the release PR's heavy Package Artifact job.
       - run: npm run check:pack-policy
-      # Complexity + cognitive-complexity ratchets on the fast-path (PR→release) so
-      # cycle drift is rebaselined PER-PR instead of cascading onto the release PR's
-      # Quality Ratchet (v3.8.36: +30 complexity / +15 cognitive surfaced only post-merge).
-      - run: npm run check:complexity
-      - run: npm run check:cognitive-complexity
+      # Complexity + cognitive-complexity: ONE ESLint walk (both baselines still
+      # enforced separately by ruleId). Avoids two cold tree walks on fast-path.
+      - run: npm run check:complexity-ratchets
       - name: Typecheck (core)
         run: npm run typecheck:core
+      # #7033: dashboard-scoped typecheck gate — src/app/(dashboard) TSX is not
+      # covered by typecheck:core's curated allowlist. See check-dashboard-typecheck.mjs.
+      - name: Typecheck (dashboard)
+        run: npm run check:dashboard-typecheck
+      # WS4.2 (v3.8.49 plan): TypeScript 7 native-compiler SHADOW — advisory only.
+      # TS7 went GA 2026-07-08 with 8-12x type-check speedups; its Compiler API only
+      # arrives in 7.1, so typescript-eslint / type-coverage / Stryker stay on 6.x
+      # (the hybrid is the officially documented pattern). Isolated npx on purpose:
+      # installing an alias package could collide node_modules/.bin/tsc with 6.x.
+      # Promote to the blocking gate after ~1 week of parity with the step above.
+      - name: Typecheck (core) — TS7 native shadow (advisory)
+        continue-on-error: true
+        run: |
+          RC=0
+          START=$(date +%s)
+          npx -y -p typescript@7 tsc --pretty false -p tsconfig.typecheck-core.json || RC=$?
+          echo "[ts7-shadow] exit=$RC elapsed=$(( $(date +%s) - START ))s — the 6.x step above stays authoritative"
+          exit $RC
       # TIA: build the impact map at runtime (gitignored, ~21MB) and run only the
-      # unit tests impacted by this PR's changed files. Fail-safe runs the FULL
-      # unit suite on hub/unmapped changes — TIA accelerates, never replaces, the net.
+      # unit tests impacted by this PR's changed files. On hub/unmapped changes the
+      # selector returns __RUN_ALL__ — full-suite authority is the parallel
+      # `fast-unit` 4-shard job (test:unit:ci:shard; was 2-shard, #6781), NOT an
+      # unsharded re-run here. Stacking unsharded test:unit:ci on top of fast-unit
+      # doubled wall time (~16 min extra on ubuntu-latest) without extra coverage.
       #
-      # BLOCKING (flipped 2026-06-17). The pre-existing release unit test-debt that kept
-      # this advisory was cleared: #4030 (16 Zod/registry reds, lossless restore) and
-      # #4063 (the last red — the LiveWS boot test — root-caused as a real event-loop
-      # stall in the WS sidecar, fixed + relocated to the integration suite). A full
-      # ci.yml run on release/v3.8.28 then showed all 8 unit shards green, so PR->release
-      # now blocks on unit-test regressions in the impacted set (typecheck:core already
-      # blocked above). Fail-safe still runs the FULL unit suite on hub/unmapped changes.
-      - name: Impacted unit tests (TIA, fail-safe full; blocking)
+      # BLOCKING for the *impacted subset* (flipped 2026-06-17). Fail-safe full
+      # coverage remains required via `Unit Tests fast-path` (fast-unit).
+      - name: Impacted unit tests (TIA subset; blocking)
         env:
           GITHUB_BASE_REF: ${{ github.base_ref }}
         run: |
@@ -92,15 +184,39 @@ jobs:
           # which must not happen on a blocking gate. DATA_DIR isolation keeps the parallel
           # run race-free regardless of concurrency.
           if echo "$SEL" | grep -q "__RUN_ALL__"; then
-            echo "Fail-safe: running FULL unit suite (CI concurrency)"; npm run test:unit:ci; exit $?
+            echo "Fail-safe: __RUN_ALL__ — deferring FULL unit suite to fast-unit (4-shard)."
+            echo "Not re-running unsharded test:unit:ci here (duplicate of fast-unit coverage)."
+            exit 0
           fi
           echo "Running impacted tests:"; echo "$SEL"
           mapfile -t FILES <<< "$SEL"
-          node --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 "${FILES[@]}"
+          # Loader parity with test:unit:ci:shard (#6787): tests/unit/dashboard/** runs
+          # under `--import tsx` (CJS transform — required for ESM-only deep imports like
+          # @lobehub/icons/es/* reached via lobeProviderIcons.ts); everything else under
+          # `--import tsx/esm`. A single tsx/esm invocation false-reds every dashboard
+          # module-shape test the impact map selects ("Unexpected token 'export'").
+          DASH=(); REST=()
+          for f in "${FILES[@]}"; do
+            case "$f" in
+              tests/unit/dashboard/*) DASH+=("$f") ;;
+              *) REST+=("$f") ;;
+            esac
+          done
+          RC=0
+          if [ ${#REST[@]} -gt 0 ]; then
+            node --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 "${REST[@]}" || RC=$?
+          fi
+          if [ ${#DASH[@]} -gt 0 ]; then
+            node --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 "${DASH[@]}" || RC=$?
+          fi
+          exit $RC
 
   fast-vitest:
     name: Vitest (fast-path)
-    runs-on: ubuntu-latest
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true') }}
+    # Dynamic runner — see fast-gates (own-origin + flag; fork/unset → ubuntu-latest).
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     env:
       JWT_SECRET: ci-lint-secret-with-sufficient-length-for-validation
       API_KEY_SECRET: ci-lint-api-key-secret-long
@@ -114,15 +230,33 @@ jobs:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
       - run: npm ci
-      - run: npm run test:vitest
+      # WS5.2/5.3: JUnit feeds Trunk Flaky Tests — the fast-path runs on EVERY PR,
+      # which is where flaky-detection volume actually comes from (ci.yml's heavy
+      # jobs only run on the release PR). Advisory upload, own-origin only.
+      - run: npm run test:vitest -- --reporter=default --reporter=junit --outputFile.junit=trunk-junit/vitest-fastpath.xml
+      - name: Upload test results to Trunk (advisory)
+        if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
+        continue-on-error: true
+        uses: trunk-io/analytics-uploader@385f1ccdf345b4532dc4b6c665dd432b702b8e28 # v2.1.2
+        with:
+          junit-paths: trunk-junit/**/*.xml
+          org-slug: omniroute
+          token: ${{ secrets.TRUNK_TOKEN }}
 
   fast-unit:
-    name: Unit Tests fast-path (${{ matrix.shard }}/2)
-    runs-on: ubuntu-latest
+    name: Unit Tests fast-path (${{ matrix.shard }}/4)
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true') }}
+    # Dynamic runner — see fast-gates (own-origin + flag; fork/unset → ubuntu-latest).
+    # This is the heaviest fast-path job; 4-way sharding (was 2, #6781) halves the
+    # critical path again (~8.5min → ~4.5min on ubuntu-latest; ~2min on the 8-slot
+    # runner box). Node's native --test-shard=N/total takes any denominator — only
+    # this matrix and the TEST_SHARD env below encode the shard count.
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     strategy:
       fail-fast: false
       matrix:
-        shard: [1, 2]
+        shard: [1, 2, 3, 4]
     env:
       JWT_SECRET: ci-lint-secret-with-sufficient-length-for-validation
       API_KEY_SECRET: ci-lint-api-key-secret-long
@@ -136,9 +270,85 @@ jobs:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
       - run: npm ci
-      - run: >
-          node --max-old-space-size=4096 --import tsx
-          --import ./tests/_setup/isolateDataDir.ts
-          --test --test-force-exit --test-concurrency=4 --test-shard=${{ matrix.shard }}/2
-          tests/unit/*.test.ts
-          "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui}/**/*.test.ts"
+      # QW-d: fonte única — o mesmo npm script do CI pesado/local. Fecha dois drifts do
+      # comando inline antigo: os dirs `memory` e `usage` estavam FORA do glob (testes
+      # silenciosamente não rodavam no fast path) e o setupPolyfill não era importado.
+      - run: npm run test:unit:ci:shard
+        env:
+          TEST_SHARD: ${{ matrix.shard }}/4
+
+  # ── Pacote 4 (plano mestre testes+CI, aprovado 2026-07-04) ─────────────────────────
+  # No-new-warnings por PR via ESLint bulk suppressions nativo (>=9.24). O baseline
+  # config/quality/eslint-suppressions.json congela as violações EXISTENTES por
+  # arquivo+regra; qualquer warning NOVO aparece e o --max-warnings 0 falha o job — o
+  # drift de +41/+88 warnings por ciclo passa a morrer no PR que o introduz, em vez de
+  # ser rebaselinado às cegas na release. Aperto do baseline (na reconciliação da
+  # release): npx eslint . --prune-suppressions --suppressions-location config/quality/eslint-suppressions.json
+  #
+  # Princípio Zero: bloqueante SÓ para branches internas (as campanhas/sessões são a
+  # origem do drift). PR de FORK roda em modo report (continue-on-error → o job fica
+  # verde com anotação; a campanha /green-prs aplica o fix via co-autoria — o
+  # contribuidor NUNCA é bloqueado nem cobrado).
+  lint-guard:
+    name: No new ESLint warnings
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true') }}
+    runs-on: ubuntu-latest
+    continue-on-error: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.CI_NODE_VERSION }}
+          cache: npm
+      - run: npm ci
+      - name: Restore ESLint file cache
+        uses: actions/cache@v6
+        with:
+          path: |
+            .eslintcache
+            .eslintcache-complexity
+          key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'eslint.complexity-ratchets.config.mjs', 'config/quality/eslint-suppressions.json', 'package-lock.json') }}
+          restore-keys: |
+            eslint-${{ runner.os }}-
+      - name: ESLint (baseline congelado — warning novo = vermelho)
+        # lint:json writes the report; --max-warnings 0 keeps no-new-warnings policy.
+        run: npm run lint:json -- --max-warnings 0
+
+  # Merge-integrity: pega no PR os dois vazamentos crônicos de merge que hoje só
+  # explodem na release-PR. (1) CHANGELOG-eat — o auto-resolve do merge come
+  # bullets vizinhos/seções inteiras (incidente #6193, 2026-07-05: 212 linhas /
+  # 130 bullets); o checkout de PR é refs/pull/N/merge, então comparar contra a
+  # base detecta o eat ANTES do merge. (2) SKILL.md gerado stale vs o catálogo de
+  # agent-skills (#6186 mergeou um id de catálogo sem rodar o gerador → 8 reds de
+  # integration invisíveis até a release).
+  #
+  # Princípio Zero: bloqueante SÓ para branches internas; PR de FORK roda em modo
+  # report (continue-on-error) — a campanha corrige via co-autoria, o contribuidor
+  # nunca é bloqueado.
+  merge-integrity:
+    name: Merge integrity (changelog + generated skills)
+    # Always on non-draft PRs — CHANGELOG/skills can break on docs-only merges too.
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) }}
+    runs-on: ubuntu-latest
+    continue-on-error: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true }}
+    env:
+      JWT_SECRET: ci-lint-secret-with-sufficient-length-for-validation
+      API_KEY_SECRET: ci-lint-api-key-secret-long
+      DISABLE_SQLITE_AUTO_BACKUP: "true"
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: ${{ env.CI_NODE_VERSION }}
+          cache: npm
+      - run: npm ci
+      - name: CHANGELOG integrity (nenhum bullet da base pode sumir no merge-result)
+        run: npm run check:changelog-integrity
+      - name: Agent-skills generator sync (SKILL.md gerado ≡ catálogo)
+        run: npm run check:agent-skills-sync

.gitignore

@@ -72,6 +72,7 @@ yarn-error.log*
 # env files (can opt-in for committing if needed)
 .env*
 !.env.example
+!.env.homolog.example
 # Provider API keys (never commit)
 *.api-key
 .nvidia-api-key
@@ -229,3 +230,22 @@ docs/prompts/AGENT-OWNERSHIP-PROTOCOL.md
 docs/prompts/AGENT-OWNERSHIP-PROTOCOL.omniroute-mim.md
 docs/prompts/AGENT-OWNERSHIP-PROTOCOL.omniroute-mid.md
 omniroute.md
+
+# mise configuration
+mise.toml
+_artifacts/
+.claude-flow/
+
+# ESLint file cache (npm run lint --cache / complexity ratchets)
+.eslintcache
+.eslintcache-complexity
+
+
+# CI/local quality artifacts (eslint-results.json, etc.)
+.artifacts/
+
+# Homologation E2E suite (npm run homolog) — real-environment credentials + report output
+.env.homolog
+tests/homolog/.auth/
+tests/homolog/ui/.auth/
+homolog-report/

.gitleaks.toml

@@ -74,3 +74,16 @@
 #       '''tests/unit/''',
 #     ]
 #
+
+[[rules]]
+  # Falsos-positivos comprovados do generic-api-key — zerados em 2026-07-13 (WS6/D3,
+  # plano v3.8.49). Revisar em v3.9.0. Nenhum é credencial: dois são NOMES DE CAMPO
+  # de métricas de latência; o terceiro é o valor PÚBLICO de um beta header da API
+  # da Anthropic (documentado publicamente, não é segredo).
+  id = "generic-api-key"
+  [rules.allowlist]
+    description = "Field names + public Anthropic beta-header value (não são segredos)"
+    regexes = [
+      '''latencyP\d{2}Ms''',
+      '''interleaved-thinking-2025-05-14''',
+    ]

.husky/pre-push

@@ -1,7 +1,9 @@
 #!/usr/bin/env sh
-# .husky/pre-push — fast deterministic gates (<10s total)
-# Intentionally excludes test:unit (slow; covered by CI pre-push remote run).
-# Activated: 2026-06-13 (6A.12 — replaced commented-out test:unit stub)
+# .husky/pre-push — intentionally light.
+# any-budget + tracked-artifacts already run on pre-commit; re-running them on
+# every push only doubles local wall time for the same existence reason (CI still
+# enforces both). Keep this hook as a PATH/npm sanity check + reminder.
+# Intentionally excludes test:unit / typecheck (slow; covered by CI).
 
 if ! command -v npm >/dev/null 2>&1; then
   echo "⚠️  npm not found in PATH — skipping pre-push hooks"
@@ -9,4 +11,5 @@ if ! command -v npm >/dev/null 2>&1; then
   exit 0
 fi
 
-npm run check:any-budget:t11 && npm run check:tracked-artifacts
+# No-op success: real local gates live in pre-commit; CI owns the rest.
+exit 0

.mergify.yml

@@ -0,0 +1,55 @@
+# Mergify merge queue — WS3.4/D5 of the v3.8.49 quality/velocity master plan.
+#
+# WHY: ~85-100 active PR authors/month and 300+ PRs/week peaks, all merged by ONE
+# identity. The manual merge-train validated batches by hand; this queue automates
+# it with batching + automatic batch bisection (a red batch of N costs ~log2(N)
+# revalidations instead of N). Mergify Open Source plan: free, unlimited, public repo.
+#
+# GOVERNANCE (non-negotiable, mirrors CLAUDE.md Hard Rules #21/#22 + the owner's
+# pre-merge ⭐ gate):
+#   • A PR enters the queue ONLY via the `queue` label — applied by the owner (or a
+#     session acting for the owner) AFTER the pre-merge ⭐ report/decision. The label
+#     IS the merge approval; Mergify only executes it.
+#   • During a release-freeze (open issue labeled `release-freeze`), do NOT label PRs
+#     targeting the frozen branch — the freeze is a human-honored coordination signal
+#     the queue cannot see. Retarget to the active release/vX+1 first (Hard Rule #21).
+#   • Never label a PR another session is actively working (Hard Rule #22b).
+#   • Fallback path if Mergify misbehaves or the OSS plan changes: the manual
+#     merge-train runbook (docs/ops/MERGE_TRAIN.md) — remove labels, proceed by hand.
+
+queue_rules:
+  - name: release
+    # Any current or future release branch — the reason GitHub's native queue was
+    # rejected (no wildcard support on personal-account repos).
+    queue_conditions:
+      - base~=^release/v\d+\.\d+\.\d+$
+      - label=queue
+      - -draft
+      - -conflict
+    # "Everything that ran is green, nothing still running, AND the always-on
+    # anchor check succeeded" — robust to the path-filtered fast-gates (docs-only
+    # PRs skip code jobs; matrix shard names vary) while never fail-open: a PR with
+    # zero checks cannot vacuously merge, because `Merge integrity` runs on EVERY
+    # non-draft PR (quality.yml) and must be an affirmative success. Review approval
+    # is intentionally NOT a condition here: the owner-applied `queue` label IS the
+    # approval in this repo's single-maintainer model (see governance header).
+    merge_conditions:
+      - "#check-failure=0"
+      - "#check-pending=0"
+      - "#check-success>=1"
+      - check-success=Merge integrity (changelog + generated skills)
+    # Batching: validate up to 10 queued PRs together (the manual train's sweet spot);
+    # don't hold a lone PR hostage waiting for siblings.
+    batch_size: 10
+    batch_max_wait_time: 5 min
+    # Squash keeps the one-commit-per-PR history the CHANGELOG reconciliation expects.
+    merge_method: squash
+
+pull_request_rules:
+  - name: clean up the queue label after merge
+    conditions:
+      - merged
+    actions:
+      label:
+        remove:
+          - queue

.prettierignore

@@ -1,2 +1,5 @@
 # Long reference tables are manually aligned; formatting the whole file causes noisy diffs.
 docs/reference/ENVIRONMENT.md
+
+# Dense auto-generated free-tier budget rows (one object per line) — prettier multi-line expand blows past file-size cap 800.
+open-sse/config/freeModelCatalog.data.ts

.vscode/settings.json

@@ -48,11 +48,19 @@
       "**/.build",
       "**/dist",
       "**/coverage",
-      "**/.worktrees"
+      "**/.worktrees",
+      "**/.claude/worktrees",
+      "**/electron",
+      "**/_references",
+      "**/_mono_repo",
+      "**/_tasks"
     ]
   },
 
   // Para esconder os diretórios gerados da árvore do Explorer, descomente:
+  // (MANTIDO comentado — o dono precisa ver _references/_mono_repo/_tasks na árvore.
+  //  A performance é resolvida por watcherExclude + search.exclude + tsserver, sem
+  //  precisar escondê-los do Explorer.)
   // "files.exclude": {
   //   "**/.worktrees": true,
   //   "**/coverage": true,

@omniroute/opencode-plugin/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@omniroute/opencode-plugin",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@omniroute/opencode-plugin",
-      "version": "0.1.0",
+      "version": "0.2.0",
       "license": "MIT",
       "dependencies": {
         "zod": "^4.4.3"

@omniroute/opencode-plugin/package.json

@@ -23,7 +23,7 @@
   "scripts": {
     "build": "tsup",
     "clean": "rm -rf dist",
-    "test": "node --import tsx/esm --test tests/scaffold.test.ts tests/auth.test.ts tests/options-schema.test.ts tests/multi-instance.test.ts tests/fetch-interceptor.test.ts tests/provider.test.ts tests/gemini-sanitize.test.ts tests/combos.test.ts tests/config-shim.test.ts tests/features.test.ts tests/usable-combo.test.ts tests/disk-snapshot-perms.test.ts tests/fork-features.test.ts tests/auto-combo-context.test.ts",
+    "test": "node --import tsx/esm --test tests/scaffold.test.ts tests/auth.test.ts tests/options-schema.test.ts tests/multi-instance.test.ts tests/fetch-interceptor.test.ts tests/provider.test.ts tests/gemini-sanitize.test.ts tests/combos.test.ts tests/config-shim.test.ts tests/features.test.ts tests/usable-combo.test.ts tests/disk-snapshot-perms.test.ts tests/fork-features.test.ts tests/auto-combo-context.test.ts tests/provider-id-routing.test.ts",
     "prepublishOnly": "npm run clean && npm run build && npm test"
   },
   "keywords": [

@omniroute/opencode-plugin/src/index.ts

@@ -238,9 +238,26 @@ function trimLeadingDashes(value: string): string {
  */
 export function resolveOmniRoutePluginOptions(
   opts?: OmniRoutePluginOptions
-): Required<Pick<OmniRoutePluginOptions, "providerId" | "displayName" | "modelCacheTtl">> &
-  Pick<OmniRoutePluginOptions, "baseURL" | "features"> {
+): Required<
+  Pick<OmniRoutePluginOptions, "providerId" | "displayName" | "modelCacheTtl">
+> & {
+  /**
+   * #6859: the UNPREFIXED provider id ("omniroute", "omniroute-preprod", …).
+   * `providerId` above is auto-prefixed with "opencode-" ONLY to satisfy OC
+   * 1.17.8+'s native-adapter gate ({openai, anthropic, opencode*}) — that
+   * prefixed value is OC-internal and must be used ONLY for AuthHook.provider
+   * and provider-registration keys (the OC config-hook top-level
+   * `provider.<id>` block). `omnirouteProviderId` MUST be used everywhere an
+   * identifier reaches or represents something OmniRoute's own server parses
+   * (model `id` prefix, `ModelV2.providerID`, combo catalog keys in the
+   * dynamic provider hook) — OmniRoute's `parseModel()` has no alias for
+   * "opencode-<x>", so a prefixed id there is unrecoverable and credential
+   * lookup fails with "No credentials for opencode-<x>".
+   */
+  omnirouteProviderId: string;
+} & Pick<OmniRoutePluginOptions, "baseURL" | "features"> {
   const rawProviderId = opts?.providerId ?? OMNIROUTE_PROVIDER_KEY;
+  const omnirouteProviderId = trimLeadingOpencodePrefix(rawProviderId);
   // OC 1.17.8+ native-adapter gate rejects providerID not in
   // {openai, anthropic, opencode*}. Silently prefix so existing
   // configs (providerId: "omniroute") keep working.
@@ -258,6 +275,7 @@ export function resolveOmniRoutePluginOptions(
       : DEFAULT_MODEL_CACHE_TTL_MS;
   return {
     providerId,
+    omnirouteProviderId,
     displayName,
     modelCacheTtl,
     baseURL: opts?.baseURL,
@@ -265,6 +283,18 @@ export function resolveOmniRoutePluginOptions(
   };
 }
 
+/**
+ * Strip a leading "opencode-" prefix (added only for the OC native-adapter
+ * gate — see `resolveOmniRoutePluginOptions`) so the returned id is safe to
+ * embed in anything OmniRoute's own server parses. A user-supplied
+ * `providerId: "opencode-omniroute"` (already prefixed) resolves to the same
+ * unprefixed "omniroute" as the default, matching `providerId`'s own
+ * idempotent-prefix handling above.
+ */
+function trimLeadingOpencodePrefix(rawProviderId: string): string {
+  return rawProviderId.startsWith("opencode-") ? rawProviderId.slice("opencode-".length) : rawProviderId;
+}
+
 /**
  * Strict parse of raw plugin options (as received from opencode.json or a
  * direct factory call) into the validated `OmniRoutePluginOptions` shape.
@@ -2661,7 +2691,8 @@ export function createOmniRouteProviderHook(
         if (canonicalDedup.has(entry.id)) continue;
         if (usable && !isUsableRawModelId(entry.id, usable, rawEnrichment)) continue;
         const model = mapRawModelToModelV2(entry, {
-          providerId: resolved.providerId,
+          // #6859: server-facing id — NOT the OC-gate-prefixed `resolved.providerId`.
+          providerId: resolved.omnirouteProviderId,
           baseURL,
           apiFormat: resolved.features?.apiFormat,
         });
@@ -2826,7 +2857,8 @@ export function createOmniRouteProviderHook(
           const mapped = mapComboToModelV2(
             combo,
             memberEntries,
-            resolved.providerId,
+            // #6859: server-facing id — NOT the OC-gate-prefixed `resolved.providerId`.
+            resolved.omnirouteProviderId,
             baseURL,
             features.apiFormat
           );
@@ -2845,7 +2877,8 @@ export function createOmniRouteProviderHook(
             }
           }
 
-          const comboKey = buildComboKey(combo, usedComboKeys, resolved.providerId);
+          // #6859: server-facing key — NOT the OC-gate-prefixed `resolved.providerId`.
+          const comboKey = buildComboKey(combo, usedComboKeys, resolved.omnirouteProviderId);
 
           // Collision policy: combos win. Warn ONCE per (cacheKey, comboKey)
           // when overwriting a same-key raw model so the operator can spot
@@ -2947,7 +2980,8 @@ export function createOmniRouteProviderHook(
             },
             status: "active",
             release_date: "",
-            providerID: resolved.providerId,
+            // #6859: server-facing id — NOT the OC-gate-prefixed `resolved.providerId`.
+            providerID: resolved.omnirouteProviderId,
             options: {},
             headers: {},
           };

@omniroute/opencode-plugin/tests/combos.test.ts

@@ -447,14 +447,14 @@ test("models() returns combo entries merged into the map", async () => {
 
   // 3 raw models + 1 combo = 4 entries
   assert.equal(Object.keys(out).length, 4);
-  assert.ok(out["opencode-omniroute/claude-primary"]);
-  assert.ok(out["opencode-omniroute/claude-secondary"]);
-  assert.ok(out["opencode-omniroute/gemini-3-flash"]);
-  assert.ok(out["opencode-omniroute/claude-tier"]);
+  assert.ok(out["omniroute/claude-primary"]);
+  assert.ok(out["omniroute/claude-secondary"]);
+  assert.ok(out["omniroute/gemini-3-flash"]);
+  assert.ok(out["omniroute/claude-tier"]);
 
-  const combo = out["opencode-omniroute/claude-tier"];
+  const combo = out["omniroute/claude-tier"];
   assert.equal(combo.name, "Claude Tier");
-  assert.equal(combo.providerID, "opencode-omniroute");
+  assert.equal(combo.providerID, "omniroute");
   // LCD over claude-primary (200k, reasoning) + claude-secondary (100k, no reasoning)
   assert.equal(combo.limit.context, 100_000);
   assert.equal(combo.capabilities.reasoning, false);
@@ -478,11 +478,11 @@ test("models(): combo with unknown member ids degrades to all-false LCD posture"
     { fetcher: modelsFetcher, combosFetcher }
   );
   const out = await hook.models!({} as never, { auth: apiAuth("sk-z") as never });
-  assert.ok(out["opencode-omniroute/phantom-combo"]);
+  assert.ok(out["omniroute/phantom-combo"]);
   // With zero resolvable members, LCD = all-false (defensive posture).
-  assert.equal(out["opencode-omniroute/phantom-combo"].capabilities.toolcall, false);
-  assert.equal(out["opencode-omniroute/phantom-combo"].capabilities.reasoning, false);
-  assert.equal(out["opencode-omniroute/phantom-combo"].limit.context, 0);
+  assert.equal(out["omniroute/phantom-combo"].capabilities.toolcall, false);
+  assert.equal(out["omniroute/phantom-combo"].capabilities.reasoning, false);
+  assert.equal(out["omniroute/phantom-combo"].limit.context, 0);
 });
 
 test("models(): hidden combos are excluded from the map", async () => {
@@ -505,8 +505,8 @@ test("models(): hidden combos are excluded from the map", async () => {
     { fetcher: modelsFetcher, combosFetcher }
   );
   const out = await hook.models!({} as never, { auth: apiAuth("sk-z") as never });
-  assert.ok(out["opencode-omniroute/visible"]);
-  assert.ok(!out["opencode-omniroute/hidden"], "hidden combo must be omitted");
+  assert.ok(out["omniroute/visible"]);
+  assert.ok(!out["omniroute/hidden"], "hidden combo must be omitted");
 });
 
 test("models(): combo name exactly matches raw model id → raw deleted, raw deleted, no warn", async () => {
@@ -530,8 +530,8 @@ test("models(): combo name exactly matches raw model id → raw deleted, raw del
   });
 
   // Raw model replaced by combo of the same key; combo now lives at the bare slug.
-  assert.ok(out["opencode-omniroute/claude-primary"], "combo surfaces under prefixed key");
-  assert.equal(out["opencode-omniroute/claude-primary"].name, "claude-primary");
+  assert.ok(out["omniroute/claude-primary"], "combo surfaces under prefixed key");
+  assert.equal(out["omniroute/claude-primary"].name, "claude-primary");
 
   // No collision warning fires — dedup makes keys disjoint.
   const collisionWarns = warnings.filter((w) => {
@@ -565,8 +565,8 @@ test("models(): two combos with same slug → second gets disambiguator suffix",
 
   const out = await hook.models!({} as never, { auth: apiAuth("sk-z") as never });
   // First combo gets the bare slug; second gets disambiguated.
-  assert.ok(out["opencode-omniroute/claude"], "first combo at prefixed slug");
-  assert.ok(out["opencode-omniroute/claude-uuid"], "second combo disambiguated by id prefix");
+  assert.ok(out["omniroute/claude"], "first combo at prefixed slug");
+  assert.ok(out["omniroute/claude-uuid"], "second combo disambiguated by id prefix");
 });
 
 test("models(): combos fetch fails → falls back to models-only, warn emitted, no throw", async () => {
@@ -583,8 +583,8 @@ test("models(): combos fetch fails → falls back to models-only, warn emitted,
 
   // Catalog includes the models but NOT any combo entries.
   assert.equal(Object.keys(out).length, 2);
-  assert.ok(out["opencode-omniroute/claude-primary"]);
-  assert.ok(out["opencode-omniroute/claude-secondary"]);
+  assert.ok(out["omniroute/claude-primary"]);
+  assert.ok(out["omniroute/claude-secondary"]);
 
   // Soft-fail warning surfaced.
   const softFail = warnings.find((w) => {
@@ -609,7 +609,7 @@ test("models(): combos cached + reused within TTL (one combo fetch per TTL windo
   const second = await hook.models!({} as never, { auth: apiAuth("sk-z") as never });
   assert.equal(combosFetcher.callCount(), 1, "combos fetched only once within TTL");
   assert.equal(modelsFetcher.callCount(), 1, "models fetched only once within TTL");
-  assert.ok(second["opencode-omniroute/claude-tier"]);
+  assert.ok(second["omniroute/claude-tier"]);
 });
 
 test("models(): combos refetched after TTL expiry (same key as models)", async () => {
@@ -701,7 +701,7 @@ test("models(): nested combo-ref context is the min of nested + raw members", as
     { fetcher: modelsFetcher, combosFetcher }
   );
   const out = await hook.models!({} as never, { auth: apiAuth("sk-z") as never });
-  const masterLight = out["opencode-omniroute/master-light"];
+  const masterLight = out["omniroute/master-light"];
   assert.ok(masterLight, "MASTER-LIGHT entry must exist");
   assert.equal(
     masterLight.limit.context,

@omniroute/opencode-plugin/tests/features.test.ts

@@ -376,7 +376,8 @@ test("provider hook: enrichment fetcher called when features.enrichment !== fals
   );
   const out = await hook.models!({} as never, { auth: apiAuth("sk") as never });
   assert.equal(called, 1, "enrichment fetcher called once");
-  const m = out["opencode-omniroute/claude-sonnet-4-6"];
+  // #6859: dynamic-hook catalog keys use the unprefixed omnirouteProviderId.
+  const m = out["omniroute/claude-sonnet-4-6"];
   assert.equal(m.name, "Claude Sonnet 4.6", "enrichment name overlay applied");
   assert.equal(m.cost.input, 3, "enrichment pricing applied");
   assert.equal(m.cost.output, 15);
@@ -402,7 +403,7 @@ test("provider hook: enrichment fetcher NOT called when features.enrichment:fals
   const out = await hook.models!({} as never, { auth: apiAuth("sk") as never });
   assert.equal(called, 0, "enrichment fetcher NOT called when gated off");
   assert.equal(
-    out["opencode-omniroute/claude-sonnet-4-6"].name,
+    out["omniroute/claude-sonnet-4-6"].name,
     "claude-sonnet-4-6",
     "raw id preserved"
   );
@@ -463,7 +464,7 @@ test("provider hook: compression metadata fetcher called when opted in", async (
   );
   const out = await hook.models!({} as never, { auth: apiAuth("sk") as never });
   assert.equal(called, 1, "compression metadata fetcher called");
-  const combo = out["opencode-omniroute/claude-primary"];
+  const combo = out["omniroute/claude-primary"];
   assert.ok(combo, "combo entry present");
   assert.match(
     combo.name,

@omniroute/opencode-plugin/tests/provider-id-routing.test.ts

@@ -0,0 +1,99 @@
+/**
+ * Regression test for #6859.
+ *
+ * `resolveOmniRoutePluginOptions()` auto-prefixes `providerId` with
+ * `"opencode-"` (commit 75b52e286) so OpenCode 1.17.8+'s native-adapter gate
+ * accepts it as an OC-registered provider id. That prefixed value must stay
+ * OC-internal (AuthHook.provider / provider registration keys) — it must
+ * NEVER leak into the identifiers OmniRoute's own server parses to resolve
+ * credentials (`mapRawModelToModelV2`'s `id`/`providerID`,
+ * `mapComboToModelV2`'s `providerID`, and the dynamic-hook catalog keys).
+ *
+ * OmniRoute's server-side `parseModel()` (open-sse/services/model.ts) splits
+ * a dispatched model string on `/` to recover the provider name and look up
+ * credentials. If the plugin embeds the OC-gate-prefixed id in that string,
+ * the server looks up credentials for a provider named "opencode-omniroute"
+ * (which never exists in `src/shared/constants/providers.ts`) instead of
+ * "omniroute" — producing the exact "No credentials for opencode-omniroute" /
+ * "No active credentials for provider: opencode-omniroute" errors reported
+ * in #6859.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import {
+  createOmniRouteProviderHook,
+  mapRawModelToModelV2,
+  resolveOmniRoutePluginOptions,
+} from "../src/index.js";
+
+/**
+ * Minimal stand-in for OmniRoute's own `parseModel()` (open-sse/services/
+ * model.ts), which splits a dispatched `<providerID>/<modelID>` string on the
+ * FIRST "/" to recover the provider name used for credential lookup. Kept
+ * local (rather than cross-importing the real module) so this package's
+ * self-contained test suite (`cd @omniroute/opencode-plugin && npm test`)
+ * doesn't depend on the root repo's `@/*` path-alias resolution.
+ */
+function splitProviderFromDispatchedModel(modelStr: string): string {
+  const idx = modelStr.indexOf("/");
+  return idx === -1 ? modelStr : modelStr.slice(0, idx);
+}
+
+const apiAuth = (key: string) => ({ type: "api" as const, key });
+
+test("#6859: server-facing model id/providerID must resolve to the unprefixed provider name", () => {
+  const resolved = resolveOmniRoutePluginOptions();
+
+  // The OC-gate-compatible id stays prefixed — it is legitimate for
+  // AuthHook.provider / provider registration.
+  assert.equal(resolved.providerId, "opencode-omniroute");
+
+  // A second, unprefixed id must be exposed for anything that reaches
+  // OmniRoute's own server (model id prefix, ModelV2.providerID, combo keys).
+  assert.equal(
+    resolved.omnirouteProviderId,
+    "omniroute",
+    "resolveOmniRoutePluginOptions() must expose an unprefixed omnirouteProviderId"
+  );
+
+  // A bare raw /v1/models entry (no existing "/" in its id — the common
+  // case for OmniRoute's catalog) mapped with the server-facing id.
+  const model = mapRawModelToModelV2(
+    { id: "claude-opus-4-7" },
+    { providerId: resolved.omnirouteProviderId, baseURL: "http://localhost:20128" }
+  );
+
+  assert.equal(model.providerID, "omniroute");
+  assert.equal(model.id, "omniroute/claude-opus-4-7");
+
+  // OpenCode dispatches back to OmniRoute using `providerID/modelKey`
+  // (matches the issue's own repro: `-m opencode-omniroute/oc/big-pickle`).
+  const dispatchedModelString = `${model.providerID}/claude-opus-4-7`;
+  const parsedProvider = splitProviderFromDispatchedModel(dispatchedModelString);
+
+  assert.equal(
+    parsedProvider,
+    "omniroute",
+    `server-side provider split resolved '${parsedProvider}', expected 'omniroute' — ` +
+      `credentials lookup would fail for an OC-gate-prefixed provider id`
+  );
+});
+
+test("#6859: createOmniRouteProviderHook end-to-end — catalog keys/providerID never carry the OC-gate prefix", async () => {
+  const hook = createOmniRouteProviderHook(
+    { baseURL: "https://or.example.com/v1" },
+    {
+      fetcher: async () => [{ id: "claude-opus-4-7" }],
+      combosFetcher: async () => [],
+    }
+  );
+  const out = await hook.models!({} as never, { auth: apiAuth("sk-test") as never });
+  const model = out["omniroute/claude-opus-4-7"];
+  assert.ok(model, "catalog keyed under the unprefixed provider name");
+  assert.equal(model.providerID, "omniroute");
+  assert.ok(
+    !model.providerID.startsWith("opencode-"),
+    "the OC-gate prefix must never leak into ModelV2.providerID"
+  );
+});

@omniroute/opencode-plugin/tests/provider.test.ts

@@ -101,7 +101,10 @@ test("models: extracts apiKey from ctx.auth (type=api) and calls fetcher with it
   assert.equal(fetcher.callCount(), 1);
   assert.deepEqual(fetcher.callsBy()[0], ["https://or.example.com/v1", "sk-abc"]);
   assert.equal(Object.keys(out).length, 3);
-  assert.ok(out["opencode-omniroute/claude-primary"]);
+  // #6859: dynamic-hook catalog keys use the unprefixed omnirouteProviderId
+  // ("omniroute"), not the OC-gate-prefixed hook.id ("opencode-omniroute") —
+  // that prefix must never leak into anything OmniRoute's server parses.
+  assert.ok(out["omniroute/claude-primary"]);
 });
 
 test("models: returns {} when ctx.auth is null/undefined/wrong-type/empty-key", async () => {
@@ -152,13 +155,17 @@ test("models: maps a sample /v1/models entry to ModelV2 (sanity)", async () => {
     { fetcher, combosFetcher: async () => [] }
   );
   const out = await hook.models!({} as never, { auth: apiAuth("sk-abc") as never });
-  const claude = out["opencode-omniroute/claude-primary"];
+  // #6859: dynamic-hook catalog keys/ids/providerID use the unprefixed
+  // omnirouteProviderId ("omniroute") — the OC-gate prefix ("opencode-")
+  // must stay OC-internal (hook.id / AuthHook.provider) and never leak into
+  // anything OmniRoute's own server parses for credential lookup.
+  const claude = out["omniroute/claude-primary"];
   assert.ok(claude, "claude-primary present");
   // `mapRawModelToModelV2` stamps the provider prefix on the id so OC's
   // static-catalog reader resolves `(providerID, modelID)` from the key.
-  assert.equal(claude.id, "opencode-omniroute/claude-primary");
+  assert.equal(claude.id, "omniroute/claude-primary");
   assert.equal(claude.name, "claude-primary");
-  assert.equal(claude.providerID, "opencode-omniroute");
+  assert.equal(claude.providerID, "omniroute");
   assert.equal(claude.api.id, "openai-compatible");
   assert.equal(claude.api.url, "https://or.example.com/v1");
   assert.equal(claude.api.npm, "@ai-sdk/openai-compatible");

AGENTS.md

@@ -3,14 +3,14 @@
 ## Project
 
 Unified AI proxy/router — route any LLM through one endpoint. Multi-provider support
-with **236 provider entries** (OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Fireworks,
+with **250 provider entries** (OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Fireworks,
 Cohere, NVIDIA, Cerebras, Pollinations, Puter, Cloudflare AI, HuggingFace, DeepInfra,
 SambaNova, Meta Llama API, Moonshot AI, AI21 Labs, Databricks, Snowflake, and many more)
 with **MCP Server** (94 tools), **A2A v0.3 Protocol**, and **Electron desktop app**.
 
-> **Live counts (v3.8.40)**: providers 236 · MCP tools 94 · MCP scopes 30 · A2A skills 6 ·
-> open-sse services 298 · routing strategies 17 · auto-combo scoring factors 12 ·
-> DB modules 94 · DB migrations 106 · base tables 17 · search providers 11 ·
+> **Live counts (v3.8.47)**: providers 250 · MCP tools 94 · MCP scopes 30 · A2A skills 6 ·
+> open-sse services 134 · routing strategies 17 · auto-combo scoring factors 12 ·
+> DB modules 95 · DB migrations 110 · base tables 17 · search providers 11 ·
 > i18n locales 42. **Refresh with `npm run check:docs-all`.**
 
 ## Doc Accuracy Discipline (read before writing any doc)
@@ -178,7 +178,7 @@ Always run `prettier --write` on changed files.
 
 ### Data Layer (`src/lib/db/`)
 
-All persistence uses SQLite through **83 domain-specific modules** in `src/lib/db/`. Top modules:
+All persistence uses SQLite through **95 domain-specific modules** in `src/lib/db/`. Top modules:
 
 - Core: `core.ts`, `migrationRunner.ts`, `encryption.ts`, `stateReset.ts`
 - Providers / catalog: `providers.ts`, `models.ts`, `providerLimits.ts`, `compressionAnalytics.ts`
@@ -188,8 +188,8 @@ All persistence uses SQLite through **83 domain-specific modules** in `src/lib/d
 - Storage: `backup.ts`, `cleanup.ts`, `jsonMigration.ts`, `healthCheck.ts`, `databaseSettings.ts`
 - Extension modules: `evals.ts`, `webhooks.ts`, `reasoningCache.ts`, `readCache.ts`, `tierConfig.ts`, `compressionCombos.ts`, `compressionScheduler.ts`, `batches.ts`, `files.ts`, `syncTokens.ts`, `proxies.ts`, `oneproxy.ts`, `upstreamProxy.ts`, `versionManager.ts`, `cliToolState.ts`, `prompts.ts`, `detailedLogs.ts`, `contextHandoffs.ts`, `compression.ts`, `stats.ts`
 
-Live count: `ls src/lib/db/*.ts | wc -l` (currently 83). Drift detection: `npm run check:docs-counts`.
-Schema migrations live in `db/migrations/` (**97 files** as of v3.8.24) and run via `migrationRunner.ts`.
+Live count: `ls src/lib/db/*.ts | wc -l` (currently 95). Drift detection: `npm run check:docs-counts`.
+Schema migrations live in `db/migrations/` (**110 files** as of v3.8.43) and run via `migrationRunner.ts`.
 `src/lib/localDb.ts` is a **re-export layer only** — never add logic there.
 
 #### DB Internals
@@ -198,7 +198,7 @@ Schema migrations live in `db/migrations/` (**97 files** as of v3.8.24) and run
   journaling. `SCHEMA_SQL` defines **17 base tables** (verify with `grep -c "CREATE TABLE" src/lib/db/core.ts` minus 1 for the bookkeeping `_omniroute_migrations` table). Helpers: `rowToCamel`, `encryptConnectionFields`.
 - **`migrationRunner.ts`**: Applies versioned SQL files from `db/migrations/` inside transactions.
   Tracks applied migrations in `_omniroute_migrations` table.
-- **Migrations**: 97 files (`001_initial_schema.sql` → `099_*.sql`).
+- **Migrations**: 110 files (`001_initial_schema.sql` → `110_*.sql`).
   Each migration is idempotent and runs in a transaction. Live count: `ls src/lib/db/migrations/*.sql | wc -l`.
 - **Domain modules** import `getDbInstance()` from `core.ts` for all CRUD operations.
   Each module owns a specific table/set of tables (e.g., `providers.ts` → `provider_connections`,
@@ -336,7 +336,7 @@ Includes request/response translators with helpers for image handling.
 
 ### Services (`open-sse/services/`)
 
-115 service modules in `open-sse/services/` (top-level only; 184 including sub-dirs like `autoCombo/` and `compression/`). Refresh: `ls open-sse/services/*.ts | wc -l`. Key modules:
+134 service modules in `open-sse/services/` (top-level only; more including sub-dirs like `autoCombo/` and `compression/`). Refresh: `ls open-sse/services/*.ts | wc -l`. Key modules:
 `combo.ts` (routing engine), `usage.ts`, `tokenRefresh.ts`,
 `rateLimitManager.ts`, `accountFallback.ts`, `sessionManager.ts`, `wildcardRouter.ts`,
 `autoCombo/`, `intentClassifier.ts`, `taskAwareRouter.ts`, `thinkingBudget.ts`,
@@ -378,8 +378,8 @@ Modular prompt compression that runs proactively before the existing reactive co
   and iterates through targets in order until one succeeds or all fail.
 - **`resolveComboTargets()`**: Expands a combo configuration into an ordered array of
   `ResolvedComboTarget[]`, each specifying provider + model + account + credentials.
-- **Strategies** (15): priority, weighted, fill-first, round-robin, P2C, random, least-used, reset-aware (v3.8),
-  reset-window, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay. Source: `ROUTING_STRATEGY_VALUES` in `src/shared/constants/routingStrategies.ts`.
+- **Strategies** (17): priority, weighted, fill-first, round-robin, P2C, random, least-used, reset-aware (v3.8),
+  reset-window, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, headroom, fusion. Source: `ROUTING_STRATEGY_VALUES` in `src/shared/constants/routingStrategies.ts`.
 - Each target calls **`handleSingleModel()`** which wraps `handleChatCore()` with
   per-target error handling and circuit breaker checks.
 
@@ -539,7 +539,7 @@ For any non-trivial change, read the matching deep-dive first:
 | Repo navigation                            | [`docs/architecture/REPOSITORY_MAP.md`](docs/architecture/REPOSITORY_MAP.md)                                    |
 | Architecture                               | [`docs/architecture/ARCHITECTURE.md`](docs/architecture/ARCHITECTURE.md)                                        |
 | Engineering reference                      | [`docs/architecture/CODEBASE_DOCUMENTATION.md`](docs/architecture/CODEBASE_DOCUMENTATION.md)                    |
-| Auto-Combo (12-factor, 17 strategies)      | [`docs/routing/AUTO-COMBO.md`](docs/routing/AUTO-COMBO.md)                                                      |
+| Auto-Combo (12-factor, 18 strategies)      | [`docs/routing/AUTO-COMBO.md`](docs/routing/AUTO-COMBO.md)                                                      |
 | Resilience (3 layers)                      | [`docs/architecture/RESILIENCE_GUIDE.md`](docs/architecture/RESILIENCE_GUIDE.md)                                |
 | Skills                                     | [`docs/frameworks/SKILLS.md`](docs/frameworks/SKILLS.md)                                                        |
 | Memory                                     | [`docs/frameworks/MEMORY.md`](docs/frameworks/MEMORY.md)                                                        |

CLAUDE.md

@@ -35,7 +35,7 @@ For full test matrix, see `CONTRIBUTING.md` → "Running Tests". For deep archit
 
 ## Project at a Glance
 
-**OmniRoute** — unified AI proxy/router. One endpoint, 236 LLM providers, auto-fallback.
+**OmniRoute** — unified AI proxy/router. One endpoint, 250 LLM providers, auto-fallback.
 
 | Layer         | Location                | Purpose                                                                                                                                                |
 | ------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
@@ -45,7 +45,7 @@ For full test matrix, see `CONTRIBUTING.md` → "Running Tests". For deep archit
 | Translators   | `open-sse/translator/`  | Format conversion (OpenAI↔Claude↔Gemini)                                                                                                               |
 | Transformer   | `open-sse/transformer/` | Responses API ↔ Chat Completions                                                                                                                       |
 | Services      | `open-sse/services/`    | Combo routing, rate limits, caching, etc                                                                                                               |
-| Database      | `src/lib/db/`           | SQLite domain modules (94 files, 106 migrations)                                                                                                       |
+| Database      | `src/lib/db/`           | SQLite domain modules (95 files, 110 migrations)                                                                                                       |
 | Domain/Policy | `src/domain/`           | Policy engine, cost rules, fallback logic                                                                                                              |
 | MCP Server    | `open-sse/mcp-server/`  | 94 tools (34 base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules), 3 transports (stdio / SSE / Streamable HTTP), 30 scopes |
 | A2A Server    | `src/lib/a2a/`          | JSON-RPC 2.0 agent protocol                                                                                                                            |
@@ -72,7 +72,7 @@ Client → /v1/chat/completions (Next.js route)
 
 API routes follow a consistent pattern: `Route → CORS preflight → Zod body validation → Optional auth (extractApiKey/isValidApiKey) → API key policy enforcement → Handler delegation (open-sse)`. No global Next.js middleware — interception is route-specific.
 
-**Combo routing** (`open-sse/services/combo.ts`): 17 strategies (priority, weighted, fill-first, round-robin, P2C, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion). Each target calls `handleSingleModel()` which wraps `handleChatCore()` with per-target error handling and circuit breaker checks. The `fusion` strategy is the exception: it fans out to a panel of models in parallel, then a judge model synthesizes one final answer (`open-sse/services/fusion.ts`). See `docs/routing/AUTO-COMBO.md` for the 12-factor Auto-Combo scoring + the full strategy table and `docs/architecture/RESILIENCE_GUIDE.md` for the 3 resilience layers.
+**Combo routing** (`open-sse/services/combo.ts`): 18 strategies (priority, weighted, fill-first, round-robin, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline). Each target calls `handleSingleModel()` which wraps `handleChatCore()` with per-target error handling and circuit breaker checks. The `fusion` strategy is the exception: it fans out to a panel of models in parallel, then a judge model synthesizes one final answer (`open-sse/services/fusion.ts`). See `docs/routing/AUTO-COMBO.md` for the 12-factor Auto-Combo scoring + the full strategy table and `docs/architecture/RESILIENCE_GUIDE.md` for the 3 resilience layers.
 
 ---
 
@@ -221,7 +221,7 @@ connection continue serving other models.
 - **2 spaces**, semicolons, double quotes, 100 char width, es5 trailing commas (enforced by lint-staged via Prettier)
 - **Imports**: external → internal (`@/`, `@omniroute/open-sse`) → relative
 - **Naming**: files=camelCase/kebab, components=PascalCase, constants=UPPER_SNAKE
-- **ESLint**: `no-eval`, `no-implied-eval`, `no-new-func` = error everywhere; `no-explicit-any` = warn in `open-sse/` and `tests/`
+- **ESLint**: `no-eval`, `no-implied-eval`, `no-new-func` = error everywhere; `no-explicit-any` = **error** in `open-sse/` and `tests/` (since #6218 — pre-existing violations are frozen in `config/quality/eslint-suppressions.json`, new ones must be fixed; `npm run lint` applies the suppressions and is what CI runs)
 - **TypeScript**: `strict: false`, target ES2022, module esnext, resolution bundler. Prefer explicit types.
 
 ### Database
@@ -332,7 +332,7 @@ For any non-trivial change, read the matching deep-dive first:
 | Repo navigation                               | `docs/architecture/REPOSITORY_MAP.md`                   |
 | Architecture                                  | `docs/architecture/ARCHITECTURE.md`                     |
 | Engineering reference                         | `docs/architecture/CODEBASE_DOCUMENTATION.md`           |
-| Auto-Combo (12-factor scoring, 17 strategies) | `docs/routing/AUTO-COMBO.md`                            |
+| Auto-Combo (12-factor scoring, 18 strategies) | `docs/routing/AUTO-COMBO.md`                            |
 | Resilience (3 mechanisms)                     | `docs/architecture/RESILIENCE_GUIDE.md`                 |
 | Reasoning replay                              | `docs/routing/REASONING_REPLAY.md`                      |
 | Skills framework                              | `docs/frameworks/SKILLS.md`                             |
@@ -428,8 +428,10 @@ git push -u origin feat/your-feature
 
 **Husky hooks**:
 
-- **pre-commit**: lint-staged + `check-docs-sync` + `check:any-budget:t11`
-- **pre-push**: fast deterministic gates (`check:any-budget:t11` + `check:tracked-artifacts`); intentionally excludes `test:unit` (slow — covered by the CI `test-unit` job). Activated 2026-06-13 (Quality Gates Fase 6A.12).
+- **pre-commit**: lint-staged + `check-docs-sync` + `check:any-budget:t11` + `check:tracked-artifacts`
+- **pre-push**: intentionally light (PATH/npm sanity only). `any-budget` + `tracked-artifacts`
+  already run on pre-commit; re-running them on every push was pure double-pay. CI still
+  enforces both. (Was Fase 6A.12 full pre-push gate; folded into pre-commit in #6716.)
 
 ### Worktree isolation (MANDATORY for every development task)
 
@@ -480,7 +482,8 @@ list` shows worktrees you didn't create, leave them alone. End every session wit
 
 ## Environment
 
-- **Runtime**: Node.js ≥22.0.0 <23 || ≥24.0.0 <27, ES Modules
+- **Runtime**: Node.js ≥22.0.0 <23 || ≥24.0.0 <27, ES Modules. This is the **only** runtime for the published `omniroute` CLI, the server, and the test suites (`node:test` + vitest) — `engines.node` is authoritative and end users never need Bun.
+- **Bun (build/dev script runner only)**: Bun `1.3.10` is pinned as an **exact devDependency** (provisioned through the existing `npm ci` via the lockfile's `@oven/bun-*` platform binaries — no `setup-bun`/ad-hoc install). It is used **only** to execute a small, allow-listed set of TypeScript **gate/generator scripts** (replacing `node --import tsx` for startup speed): the CI checks `check:provider-consistency`, `check:compression-budget`, `check:known-symbols`, and the non-CI `gen:provider-reference`, `bench:compression`. **Do NOT** widen Bun to `npm install`, the build (`build:cli*`), `check:pack-artifact`, the published runtime, or the test runners — those stay on Node. Any new Bun-invoking script must be validated byte-identical against its `node --import tsx` output first. After pulling the lockfile change, run `npm install` so `bun` resolves locally (a stale `node_modules` will fail those 5 scripts with `bun: not found`).
 - **TypeScript**: 6.0+, target ES2022, module esnext, resolution bundler
 - **Path aliases**: `@/*` → `src/`, `@omniroute/open-sse` → `open-sse/`, `@omniroute/open-sse/*` → `open-sse/*`
 - **Default port**: 20128 (API + dashboard on same port)
@@ -539,7 +542,10 @@ the stale-enforcement added in Fase 6A.3.
 18. Every bug fix must be validated before shipping: a failing-then-passing unit/integration test (TDD) OR a documented live test on the production VPS (192.168.0.15). A fix without either is not merged. See Testing → "Bug fix / issue triage protocol" for the full decision tree.
 19. Never develop on the shared main checkout. Every development task runs in its own git worktree on its own dedicated branch, and you MUST confirm the base branch with the operator (e.g. via `AskUserQuestion`) before creating the worktree/branch — never assume `main` or the currently checked-out branch. A `git checkout` in the shared checkout silently destroys other sessions' uncommitted work. Tear down only the worktrees/branches you created (by name, never `fix/*`/`feat/*` wildcards), leave other sessions' worktrees untouched, and end on the branch you started on (the active `release/vX.Y.Z`, never `main`). See Git Workflow → "Worktree isolation".
 20. PII redaction/sanitization is **opt-in — never on by default**. OmniRoute proxies for self-hosted/local LLMs where the operator owns the data, so mutating request/response payloads by default would silently corrupt legitimate traffic. The two data-mutating PII feature flags **MUST** keep `defaultValue: "false"` in `src/shared/constants/featureFlagDefinitions.ts`: `PII_REDACTION_ENABLED` (request-side) and `PII_RESPONSE_SANITIZATION` (response + streaming). All three application points — `src/lib/guardrails/piiMasker.ts` (request guardrail), `src/lib/piiSanitizer.ts` (response), `src/lib/streamingPiiTransform.ts` (SSE) — are gated on these flags; with both off the `pii-masker` guardrail still runs but never mutates payloads (data passes through untouched). Flipping either default to `"true"` requires explicit operator approval. The regression guard is `tests/unit/pii-opt-in-default.test.ts` (asserts both definition defaults + behavioral pass-through). Opt-in is per-operator via env or the settings/DB override (`src/lib/db/featureFlags.ts`), never a silent default. See `docs/security/GUARDRAILS.md`.
-21. **Release-freeze — the release branch is frozen to campaign merges while a `/generate-release` is running.** `/generate-release` opens a marker issue labeled `release-freeze` at the start of reconciliation (Phase 0a) and closes it once the release PR squash-merges to `main`. Before merging **any** PR into the active `release/vX.Y.Z` branch, every campaign workflow (`/review-issues`, `/review-prs`, `/implement-features`, `/green-prs`, `/port-upstream-*`) **MUST** check `gh issue list --repo diegosouzapw/OmniRoute --label release-freeze --state open` — if a freeze is active, **HOLD the merge** (leave the PR ready and open; do NOT merge to the release branch), tell the operator, and resume once the freeze lifts. This is a **coordination signal, not a permission lock**: the release captain and the campaign sessions share the `diegosouzapw` identity, so a GitHub branch-protection lock cannot distinguish them — only this honored marker prevents the mid-release commit races that forced full CHANGELOG re-reconciliation in v3.8.40/v3.8.41 (a parallel campaign advanced `release/vX.Y.Z` by 34 commits mid-run). The release captain's own reconciliation/cycle-open pushes are exempt — they *are* the release. Fixes that must land during a freeze (a homologation finding) follow the post-merge read-only rule: land on `main` first via `fix/release-vX.Y.Z-*`.
+21. **Release-freeze — the FROZEN release branch belongs to the release captain; development does NOT stop (parallel-cycle model, 2026-07-04).** `/generate-release` opens a marker issue labeled `release-freeze` at the start of reconciliation (Phase 0a), **immediately cuts the next cycle's branch `release/vX+1` from the frozen tip (Phase 0a.0b — bump + living release PR + re-home of open PRs)**, and closes the freeze once the release PR squash-merges to `main`. Before merging **any** PR, every campaign workflow (`/review-prs`, `/review-group-prs`, `/merge-prs`, `/triage-fix-bugs`, `/implement-fix-bugs`, `/triage-features`, `/implement-features`, `/green-prs`, `/port-upstream-*`) **MUST** check `gh issue list --repo diegosouzapw/OmniRoute --label release-freeze --state open` — if a freeze is active: **NEVER merge into the frozen `release/vX.Y.Z` named in the freeze title**; instead resolve the ACTIVE development branch (the **highest** `release/v*` by semver — normally `release/vX+1`, announced in a freeze-issue comment) and **retarget the PR there** (`gh pr edit <N> --base release/vX+1`, then VERIFY with `gh pr view <N> --json baseRefName` — the edit fails silently) and merge normally. **HOLD only when the highest release/v\* branch IS the frozen one** (the short window before 0a.0b completes, or a pre-parallel-cycle release) — in that case leave the PR ready and open, tell the operator, and resume when the next branch appears or the freeze lifts. The just-shipped fixes reach `release/vX+1` via the Phase 5 sync-back (`scripts/release/sync-next-cycle.mjs`); do not try to sync mid-release. This is a **coordination signal, not a permission lock**: the release captain and the campaign sessions share the `diegosouzapw` identity, so a GitHub branch-protection lock cannot distinguish them — only this honored marker prevents the mid-release commit races that forced full CHANGELOG re-reconciliation in v3.8.40/v3.8.41 (a parallel campaign advanced `release/vX.Y.Z` by 34 commits mid-run). The release captain's own reconciliation/cycle-open pushes are exempt — they _are_ the release. Fixes that must land during a freeze (a homologation finding) follow the post-merge read-only rule: land on `main` first via `fix/release-vX.Y.Z-*`. **⛔ ONLY `/generate-release` may raise a release-freeze, and ONLY at its Phase 0a (start of generating a new version) — lifted at Phase 12c after the squash-merge to `main`.** No campaign, session, or agent may open a `release-freeze` marker at any other time — a freeze is **never** a mid-development coordination tool. If a session ever believes a freeze is genuinely, unavoidably necessary outside the `/generate-release` flow, it **MUST first ask the operator (`diegosouzapw`) in chat, explicitly alert "estou criando um freeze" and get an explicit yes** — never open, extend, or re-open a `release-freeze` autonomously. Conversely, do **not** close/lift an active `/generate-release` freeze to unblock campaign merges: it protects the captain's single clean CI run and auto-lifts at Phase 12c — closing it early re-triggers the exact commit race it prevents. Verify a freeze is legitimate before acting on it: an open `release-freeze` whose title/body references an **OPEN** release PR (`gh pr view <N> --json state`) is the authorized captain freeze — hold, don't touch.
+22. **Cross-session safety — this repo is worked by MANY parallel sessions/agents at once; never step on another's in-flight work.** Two absolute bans, both recurring incidents (this rule exists because they keep happening):
+    - **(a) Never `git stash` / `git stash pop` — ANYWHERE in this repo, including inside an isolated worktree, and including inside any subagent you dispatch.** `git stash` operates on the **shared repository object store**, not the per-worktree working tree — so a stash pushed or popped in one session can silently clobber or resurrect another parallel session's uncommitted changes. This is not hypothetical: 2026-07-02 a `#5923` quotaCache change leaked into the unrelated `#2296` worktree via a global `stash pop`, and the same class reincided through a **subagent**. To compare working changes against a base ref **without** stashing, use `git show <ref>:<path>` or `git diff <ref> -- <path>`; to confirm a typecheck/lint error is pre-existing on the base, inspect the base ref directly (`git show origin/release/vX.Y.Z:<path>`) — never stash your tree away to "get it clean". **Put this ban verbatim in the prompt of every subagent that touches git** (agents don't inherit this file's context — the recurrence was a subagent).
+    - **(b) Never merge, push, rebase, or force-push a PR / branch / worktree that another session is actively working.** An open PR whose head is a live fix worktree in `.claude/worktrees/` you did **not** create (e.g. `fix-5852`/`fix-5923` carrying fresh commits, even when they share your `diegosouzapw` identity), or any branch another session owns, is **off-limits — HOLD**, and let the owning session merge it. **Before** merging or pushing to any PR you did not create _this_ session, run `git worktree list` to check for a matching in-flight worktree and re-check `gh pr view <N> --json state,headRefOid`. Only the owning session merges its own in-flight PR; mid-flight merges race the owner and re-trigger the exact commit/CHANGELOG races Rule #19 and Rule #21 guard against. (Reinforces Rule #19.)
 
 ---
 

CONTRIBUTING.md

@@ -341,7 +341,7 @@ Write unit tests in `tests/unit/` covering at minimum:
 - [ ] Error responses route through `buildErrorBody()` / `sanitizeErrorMessage()` — no raw stack traces in response bodies (see [`docs/security/ERROR_SANITIZATION.md`](./docs/security/ERROR_SANITIZATION.md))
 - [ ] Shell commands (`exec` / `spawn`) pass runtime values via `env`, not via string interpolation
 - [ ] All inputs validated with Zod schemas
-- [ ] CHANGELOG updated (if user-facing change)
+- [ ] Changelog **fragment** added under `changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md` for user-facing changes (see [`changelog.d/README.md`](./changelog.d/README.md)) — do **not** edit `CHANGELOG.md` directly; fragments are aggregated at release time and never conflict between PRs
 - [ ] Documentation updated (if applicable)
 - [ ] No new CodeQL / Secret-Scanning alerts opened, or each one dismissed with technical justification referencing the relevant `docs/security/` doc
 - [ ] Routes that spawn child processes (`/api/mcp/`, `/api/cli-tools/runtime/`) classified as `isLocalOnlyPath()` in `src/server/authz/routeGuard.ts` — see [Hard Rule #15](docs/security/ROUTE_GUARD_TIERS.md)

DESING.md

@@ -1,254 +0,0 @@
-# OmniRoute — Design System & Visual Identity
-
-> **Status:** analysis + standardization plan (no code applied yet — this doc is the spec to approve before implementation).
-> **Date:** 2026-06-16 · **Scope:** unify the OmniRoute dashboard (`src/`) with the marketing site (`_mono_repo/omnirouteSite/`) into **one visual identity** — same graph-paper grid background, same color tokens, standardized components.
-
----
-
-## 1. Purpose
-
-The marketing site (`viral.omniroute.online`, `why.omniroute.online`, `omniroute.online`) and the product dashboard should look like **one product**. The site already borrowed its palette from the dashboard — its `css/tokens.css` even says _"Palette mirrors the OmniRoute dashboard (src/app/globals.css)"_. So the two are already ~80% aligned at the color level. What's missing on the dashboard:
-
-1. The **graph-paper grid wallpaper** the site uses on every page.
-2. A handful of **shared design tokens** the site has but the dashboard lacks (radius scale, brand gradient, `surface-2`, mono font).
-3. **Component-level consistency** — a number of dashboard components bypass the theme tokens with hardcoded hex/rgba.
-
-This document is the analysis and the plan. **Nothing is changed until approved.**
-
----
-
-## 2. Principles
-
-- **Single source of truth = `src/app/globals.css`.** The site mirrors the dashboard, never the other way around. New tokens land in `globals.css` first.
-- **Tokens, never literals.** Components consume semantic tokens (`bg-surface`, `text-primary`, `border-border`), never raw `#hex`.
-- **Subtle, not loud.** The grid is a faint wallpaper that sits behind content — it must never reduce text contrast or fight the UI.
-- **Theme-aware.** Everything works in both `.dark` (default-ish, the product's signature look) and light.
-- **Surgical rollout.** Ship the grid + tokens first (low risk, high visibility), then component cleanups in waves.
-
----
-
-## 3. Current state — what's already aligned vs. what's not
-
-### 3.1 Colors — already unified ✅
-
-Every brand color and surface already matches the site **by value** (only the names differ — dashboard prefixes with `--color-`). Verified in `src/app/globals.css:30-128`:
-
-| Concept                    | Site token (`tokens.css`)                   | Dashboard token (`globals.css`) | Match        |
-| -------------------------- | ------------------------------------------- | ------------------------------- | ------------ |
-| primary                    | `--primary #e54d5e`                         | `--color-primary #e54d5e`       | ✅           |
-| primary-hover              | `--primary-hover #c93d4e`                   | `--color-primary-hover #c93d4e` | ✅           |
-| accent                     | `--accent #6366f1`                          | `--color-accent #6366f1`        | ✅           |
-| accent-2                   | `--accent-2 #8b5cf6`                        | `--color-accent-hover #8b5cf6`  | ✅ (renamed) |
-| accent-3                   | `--accent-3 #a855f7`                        | `--color-accent-light #a855f7`  | ✅ (renamed) |
-| success / warning / error  | `#22c55e / #f59e0b / #ef4444`               | identical                       | ✅           |
-| traffic lights             | `#ff5f56 / #ffbd2e / #27c93f`               | identical                       | ✅           |
-| dark bg / surface / border | `#0b0e14 / #161b22 / rgba(255,255,255,.08)` | identical                       | ✅           |
-| light bg / surface / text  | `#f9f9fb / #fff / #1a1a2e`                  | identical                       | ✅           |
-
-**Conclusion:** there is no color migration to do. The identity is already shared; we are _finishing_ it, not rebuilding it.
-
-### 3.2 Gaps — what the dashboard is missing
-
-| Gap                     | Site has                                                                       | Dashboard                                                  | Action                 |
-| ----------------------- | ------------------------------------------------------------------------------ | ---------------------------------------------------------- | ---------------------- |
-| **Grid wallpaper**      | `body::before` graph-paper, `--grid-line`, `--grid-size 46px`, `--section-alt` | none (flat `--color-bg`)                                   | **Part A**             |
-| **Radius scale**        | `--radius 14px`, `--radius-sm 9px`                                             | none — primitives use ad-hoc `rounded-md/lg/xl` (6/8/12px) | **Part B**             |
-| **Brand gradient**      | `--grad-brand 135deg primary→accent-3`                                         | none — only a one-off `.bg-hero-gradient`                  | **Part B**             |
-| **Nested surface**      | `--surface-2 #1c2230`                                                          | none                                                       | **Part B**             |
-| **Mono font**           | `--font-mono` (ui-monospace stack)                                             | none (code/terminal areas have no token)                   | **Part B**             |
-| **`text-muted` (dark)** | `#8b8b9e`                                                                      | `#a1a1aa` (zinc-400)                                       | reconcile — **Part B** |
-
-### 3.3 Theming mechanics (so we don't break anything)
-
-- **Tailwind v4, CSS-first** (no `tailwind.config.*`). Tokens are defined in `:root`/`.dark` and exposed to utilities via `@theme inline` (`globals.css:130-179`).
-- **Dark via `.dark` class** on `<html>` (`@custom-variant dark` at `globals.css:22`), toggled by a custom Zustand store (`src/store/themeStore.ts`), default theme = `system` (`src/shared/constants/appConfig.ts:11`). The site uses `html[data-theme="light"]` instead — **the mechanisms differ but never meet** (separate origins), so no conflict. We keep the dashboard's `.dark` mechanism.
-- **Runtime primary override** exists (`themeStore.ts:85-97`, presets in `COLOR_THEMES`) — users can swap `--color-primary`. Any new token (gradient, etc.) that references `--color-primary` will inherit those overrides for free. ✅
-
----
-
-## 4. Part A — The graph-paper grid background (headline ask)
-
-### 4.1 What it is
-
-The exact recipe from the site (`_mono_repo/omnirouteSite/css/base.css`): a **fixed, full-viewport pseudo-element** painting two 1px line gradients, sitting at `z-index:-1` behind all content.
-
-```css
-body::before {
-  content: "";
-  position: fixed;
-  inset: 0;
-  z-index: -1;
-  pointer-events: none;
-  background-image:
-    linear-gradient(to right, var(--grid-line) 1px, transparent 1px),
-    linear-gradient(to bottom, var(--grid-line) 1px, transparent 1px);
-  background-size: var(--grid-size) var(--grid-size);
-}
-```
-
-**Why this works even though `body` has an opaque `background-color`:** a `::before` with `z-index:-1` paints _above_ the element's own background but _below_ its in-flow content. So `--color-bg` is the base fill, the grid is layered on top of it, and the app renders above the grid.
-
-### 4.2 Precedent already in the codebase
-
-`src/app/landing/page.tsx:16-26` **already implements this same grid per-page** — but with **red** lines (`#E54D5E`, opacity `0.06`) at **50px**, plus animated orbs. So the pattern is proven in the product; we are promoting it to a **global, theme-aware** wallpaper and (optionally) retiring the duplicate.
-
-### 4.3 Tokens to add (in `globals.css`)
-
-```css
-:root {
-  /* light */
-  --grid-line: rgba(0, 0, 0, 0.045);
-  --grid-size: 46px;
-  --section-alt: rgba(0, 0, 0, 0.022);
-}
-.dark {
-  /* dark */
-  --grid-line: rgba(255, 255, 255, 0.035);
-  --section-alt: rgba(255, 255, 255, 0.018);
-}
-```
-
-### 4.4 The single blocker
-
-The grid is global by construction (it covers the panel, `auth`/`login`, error pages — every route — at once). Exactly **one** element hides it inside the panel:
-
-- `src/shared/components/layouts/DashboardLayout.tsx:62` — the outer wrapper paints an opaque `bg-bg`:
-
-  ```jsx
-  <div className="flex h-dvh min-h-0 w-full overflow-hidden bg-bg">
-  ```
-
-  Everything below it is already transparent — `<main>` (`:93`), the scroll container (`:102`), the `max-w-7xl` inner (`:103`). So **removing `bg-bg` from this one line** lets the body grid show through the entire content area (the body's `--color-bg` remains the base fill underneath the grid).
-
-  ```diff
-  - <div className="flex h-dvh min-h-0 w-full overflow-hidden bg-bg">
-  + <div className="flex h-dvh min-h-0 w-full overflow-hidden">
-  ```
-
-### 4.5 Chrome interaction (sidebar / header)
-
-- `Header` (`src/shared/components/Header.tsx:207`, `bg-bg`) and `Sidebar` (`src/shared/components/Sidebar.tsx:430`, `bg-sidebar`) stay **opaque** → the grid shows in the **content area only**, with solid chrome framing it. This is the recommended, calm default and matches how the site separates chrome from canvas.
-- _Optional vibrancy variant:_ make the header translucent (`bg-bg/80 backdrop-blur`) so the grid runs behind it. A `.bg-vibrancy` helper already exists (`globals.css:370`). **Decision D3 below.**
-
-### 4.6 Login / auth / error pages
-
-These render directly under `<body>` (no panel chrome) and their page wrappers are mostly transparent — the global grid appears behind them automatically. One exception: `src/app/login/page.tsx:124,139` uses opaque `bg-bg` wrappers; soften the same way if we want the grid there too (minor, **D4**).
-
-### 4.7 Landing page
-
-`landing/page.tsx` keeps its richer animated background (orbs + vignette). Options: (a) leave it as-is (its own splash identity), or (b) align its grid to the global tokens (46px, neutral lines) for consistency. **Recommend (a)** — it's a marketing splash, not a panel screen. **Decision D5.**
-
----
-
-## 5. Part B — Token unification
-
-Add to `globals.css` (`:root` + `@theme inline`) so the dashboard gains the site's missing tokens. None of these change existing colors; they add the _missing_ primitives.
-
-```css
-:root {
-  --surface-2: #f5f5fa; /* light: nested panels */
-  --radius: 14px;
-  --radius-sm: 9px;
-  --grad-brand: linear-gradient(135deg, var(--color-primary), var(--color-accent-light));
-  --font-mono: ui-monospace, "JetBrains Mono", "Fira Code", "SF Mono", monospace;
-}
-.dark {
-  --surface-2: #1c2230;
-}
-
-@theme inline {
-  --color-surface-2: var(--surface-2); /* enables bg-surface-2 */
-  --radius-lg: var(--radius); /* enables rounded-lg = 14px */
-  --radius-md: var(--radius-sm); /* enables rounded-md = 9px */
-  --font-mono: var(--font-mono); /* enables font-mono */
-}
-```
-
-| Token                      | Why                                                             | Consumers                                                   |
-| -------------------------- | --------------------------------------------------------------- | ----------------------------------------------------------- |
-| `--radius` / `--radius-sm` | One radius scale (14/9) instead of 6/8/12 ad-hoc                | Button, Card, Modal, Input, Select                          |
-| `--grad-brand`             | Brand gradient for primary CTAs (red→violet), matching the site | Button `primary`, hero/CTA surfaces                         |
-| `--surface-2`              | Nested panels / table headers / inset rows                      | Card.Section, DataTable header, inputs                      |
-| `--font-mono`              | Code blocks, terminal, IDs, endpoints                           | ConsoleLogViewer, code snippets, `localhost:20128/v1` chips |
-| `--text-muted` reconcile   | Pick one value site↔panel                                       | global                                                      |
-
-**Decision D2 (text-muted):** site `#8b8b9e` vs dashboard `#a1a1aa`. Recommend keeping the **dashboard's `#a1a1aa`** (it's the live product, slightly higher contrast) and updating the _site_ to match. Low priority, cosmetic.
-
----
-
-## 6. Part C — Component standardization
-
-The component layer is **custom** (no shadcn/Radix), Tailwind v4, semantic tokens **mostly** adopted (`bg-surface`, `border-white/10`, `ring-primary`) — good adoption (195 files import the shared barrel). The work is removing the **bypasses**. Home: `src/shared/components/`.
-
-Ranked by impact × reach:
-
-| #   | Item                                       | File(s)                                                                                                                                                                                       | Problem → Target                                                                                                                                                                                                                                 |
-| --- | ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| C1  | **Radius alignment**                       | `Button.tsx:14-18`, `Card.tsx:39`, `Modal.tsx`, `Input.tsx`, `Select.tsx`                                                                                                                     | mixed 6/8/12px → repoint to `--radius`/`--radius-sm` (14/9)                                                                                                                                                                                      |
-| C2  | **Button gradient + `accent` variant**     | `Button.tsx:5-12`                                                                                                                                                                             | primary is flat red→red (`from-primary to-primary-hover`); align to `--grad-brand` (red→violet) and add the missing `accent` variant (indigo `#6366f1` is unused by buttons) — **highest visibility, ~195 importers**. **Decision D1.**          |
-| C3  | **Tables**                                 | `DataTable.tsx:122-176`, `logTableStyles.ts`, `globals.css:405-414` (Ant remnants)                                                                                                            | `DataTable` is 100% inline hardcoded rgba + references non-existent vars (`--text-secondary`, `--bg-table-header`); migrate to tokens, retire the 2 divergent table styles. Tables are everywhere (providers/connections/logs) — worst offender. |
-| C4  | **Centralize status colors**               | `flow/edgeStyles.ts:7-12`, `TokenHealthBadge.tsx:14-19`, `DegradationBadge.tsx`, `ProviderCascadeNode.tsx`, `Badge.tsx`, +5 `statusColor` helpers                                             | 6+ copies of the same `#22c55e/#f59e0b/#ef4444` hex; create one `statusColors` module driven off `--color-success/warning/error`. Critical for circuit-breaker / cooldown / lockout badges to read consistently.                                 |
-| C5  | **Card border**                            | `Card.tsx:39`                                                                                                                                                                                 | uses `border-white/5`; brand border is `/8` → align                                                                                                                                                                                              |
-| C6  | **Focus ring reconcile**                   | `globals.css:183` vs component `ring-primary/30`                                                                                                                                              | global `:focus-visible` is indigo (`--color-accent`), components are red (`ring-primary`) — pick one (recommend **accent/indigo** globally, it reads as the "interactive" color)                                                                 |
-| C7  | **Add `Checkbox` + `Textarea` primitives** | currently raw `<input>`/`<textarea>` with inline `accentColor:#6366f1` (e.g. `ColumnToggle.tsx:91`)                                                                                           | create token-driven primitives                                                                                                                                                                                                                   |
-| C8  | **Hardcoded-hex sweep**                    | `ConsoleLogViewer.tsx:240` (`#161b22`/`#30363d`), `ComboLiveStudio.tsx:306` (`#6366f120`), Modal traffic dots `Modal.tsx:149-159`, ~14 chart/component files with literal `#6366f1`/`#a855f7` | replace literals with `bg-surface`/`border-border`/`text-accent` etc.                                                                                                                                                                            |
-| C9  | **`cn()` → clsx + tailwind-merge**         | `src/shared/utils/cn.ts`                                                                                                                                                                      | current `cn` just joins; conflicting classes stack (a `className="rounded-2xl"` override won't replace a primitive's `rounded-lg`). Needed for C1 overrides to behave.                                                                           |
-
-**Already on-brand (token-driven, only need radius):** `Badge`, `Toggle`, `SegmentedControl`, `Input`, `Select`.
-
----
-
-## 7. Rollout plan (phased, each phase shippable + testable)
-
-- **Phase 1 — Grid + tokens (low risk, high visibility).**
-  1. Add grid + identity tokens to `globals.css` (Part A §4.3, Part B §5).
-  2. Add `body::before` grid.
-  3. Remove `bg-bg` from `DashboardLayout.tsx:62`.
-  4. Verify across themes + key screens (dashboard, providers, logs, login, an error page). Confirm contrast unchanged.
-     → _Delivers the headline ask. Reversible in one commit._
-
-- **Phase 2 — Primitives radius + Button (C1, C2, C5, C9).** The visible "feel" pass. `cn()` upgrade first so overrides behave.
-
-- **Phase 3 — Tables + status colors (C3, C4).** The largest consistency win; touch the data-heavy screens.
-
-- **Phase 4 — Cleanup (C6, C7, C8).** Focus ring, new primitives, hardcoded-hex sweep.
-
-Each phase: `npm run lint` + `npm run typecheck:core` + a visual pass. Per repo rule, production-code changes ship with tests where applicable (token/CSS changes are visual — validated by screenshots; component API changes get unit coverage).
-
----
-
-## 8. Open decisions (need your call before/while implementing)
-
-- **D1 — Button primary look.** Keep the current **red→red** gradient, or switch the product's primary buttons to the **red→violet `--grad-brand`** (matches the site CTAs)? _(Affects every primary button.)_ Recommend: **red→violet**, with `--grad-brand`.
-- **D2 — Grid line color.** **Neutral** lines (site style: faint white/black, `rgba(255,255,255,0.035)`) — calm, content-first — **or** the landing's **brand-red** lines? Recommend: **neutral** (matches the site's interior pages; red is louder and can tint readability). Size **46px** (site) to retire the landing's 50px drift.
-- **D3 — Chrome vibrancy.** Sidebar/header stay **solid** (grid in content area only), or go **translucent** so the grid runs behind them? Recommend: **solid** (calmer; less risk).
-- **D4 — Auth/login grid.** Soften `login/page.tsx` wrappers so the grid shows there too? Recommend: **yes** (cheap, more cohesive).
-- **D5 — Landing page.** Leave its animated splash bg as-is, or align it to the global grid? Recommend: **leave as-is**.
-- **D6 — Radius value.** Adopt **14/9** everywhere (bigger, softer, site-matching) — confirm you want this product-wide shift. Recommend: **yes**, it's the single biggest "one identity" signal.
-- **D7 — Scope of first PR.** Ship **Phase 1 only** first (grid + tokens), then iterate? Recommend: **yes** — validate the wallpaper live before the component waves.
-
----
-
-## 9. Out of scope / risks
-
-- **No palette change** — colors already match; we only add missing tokens. Zero risk of recoloring the product.
-- **No theme-engine change** — keep `.dark` + Zustand store; don't migrate to `next-themes` or to the site's `data-theme`.
-- **Radius shift is broad** (D6) — it touches every card/button/input; that's the point, but it's the one change worth eyeballing on busy screens (tables, modals) before merge.
-- **Tables (C3)** carry the most hardcoded styling and the highest regression surface — isolate in its own PR with before/after screenshots.
-- **Worktree isolation (repo hard-rule #19):** implementation runs in a dedicated worktree on a branch cut from the confirmed base (likely `release/v3.8.28`), never on the shared checkout. This doc is the only artifact written to the working tree so far.
-
----
-
-## 10. Reference index
-
-| Area                       | Path                                                                                                                                     |
-| -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
-| Dashboard tokens           | `src/app/globals.css:30-179` (`:root`, `.dark`, `@theme inline`), `body` `:206`                                                          |
-| Theme store                | `src/store/themeStore.ts`, `src/shared/components/ThemeProvider.tsx`, `src/shared/constants/appConfig.ts:9-11`                           |
-| Panel shell (grid blocker) | `src/shared/components/layouts/DashboardLayout.tsx:62`                                                                                   |
-| Chrome                     | `src/shared/components/Header.tsx:207`, `src/shared/components/Sidebar.tsx:430`                                                          |
-| Grid precedent             | `src/app/landing/page.tsx:16-26`                                                                                                         |
-| Primitives                 | `src/shared/components/{Button,Card,Input,Select,Badge,Modal,Toggle,SegmentedControl,Loading,Tooltip,DataTable}.tsx`, barrel `index.tsx` |
-| Status-color sources       | `flow/edgeStyles.ts`, `TokenHealthBadge.tsx`, `DegradationBadge.tsx`, `logTableStyles.ts`                                                |
-| `cn` util                  | `src/shared/utils/cn.ts`                                                                                                                 |
-| Site reference             | `_mono_repo/omnirouteSite/css/tokens.css`, `css/base.css` (grid `body::before`)                                                          |

Dockerfile

@@ -8,8 +8,8 @@ WORKDIR /app
 # that already have a fix published in trixie. CVEs without an upstream fix yet
 # (local-only TOCTOU, etc.) remain until the distro patches them and the image
 # is rebuilt; none are reachable from the proxy's request surface at runtime.
-RUN --mount=type=cache,target=/var/cache/apt,sharing=shared \
-  --mount=type=cache,target=/var/lib/apt/lists,sharing=shared \
+RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=shared \
+  --mount=type=cache,id=apt-lists,target=/var/lib/apt/lists,sharing=shared \
   apt-get update \
   && apt-get upgrade -y \
   && apt-get install -y --no-install-recommends libsecret-1-0 ca-certificates \
@@ -29,8 +29,8 @@ FROM base AS builder
 
 # Build tools for native module compilation
 # apt-get update needed here because base's rm -rf clears the shared cache
-RUN --mount=type=cache,target=/var/cache/apt,sharing=shared \
-  --mount=type=cache,target=/var/lib/apt/lists,sharing=shared \
+RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=shared \
+  --mount=type=cache,id=apt-lists,target=/var/lib/apt/lists,sharing=shared \
   apt-get update \
   && apt-get install -y --no-install-recommends python3 make g++ \
   && rm -rf /var/lib/apt/lists/*
@@ -55,32 +55,51 @@ ENV NPM_CONFIG_LEGACY_PEER_DEPS=true
 # are reproducible.
 RUN test -f package-lock.json \
   || (echo "package-lock.json is required for reproducible Docker builds" >&2 && exit 1)
-RUN --mount=type=cache,target=/root/.npm \
+# `npm rebuild <pkg>` re-runs the package's own install script, so under npm 11 +
+# `--ignore-scripts` on the parent `npm ci` it depends on npm's script-allowlist
+# machinery correctly re-enabling that one package's script. Some self-hosted build
+# environments (e.g. Dokploy) hit a broken/incomplete better-sqlite3 native binding
+# from that indirection. Invoking `node-gyp rebuild` directly inside the package
+# directory bypasses npm's script-running layer entirely and is deterministic
+# regardless of npm version or ignore-scripts allowlist behavior.
+# node-gyp comes from npm's own bundled copy (deterministic, already in the image)
+# instead of `npx --yes`, which would install an arbitrary registry version
+# on-demand and run its lifecycle scripts (Sonar docker:S6505).
+RUN --mount=type=cache,id=npm-cache,target=/root/.npm \
   npm ci --no-audit --no-fund --legacy-peer-deps --ignore-scripts \
-  && npm rebuild better-sqlite3 \
+  && (cd node_modules/better-sqlite3 \
+      && node /usr/local/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js rebuild) \
   && node -e "require('better-sqlite3')(':memory:').close()"
 
-# Build with webpack (stable). Turbopack hit a non-recoverable internal panic on this
-# Next.js version during the v3.8.27 release build — TurbopackInternalError "entered
-# unreachable code: there must be a path to a root" in ImportTracer::get_traces, on both
-# linux/amd64 and linux/arm64. Webpack is the proven engine (build:release / VPS / CI Build
-# all green). Re-enable Turbopack (=1) once the upstream tracer bug is fixed.
+# Build with Turbopack (stable in Next 16, the repo default). The v3.8.27-era
+# TurbopackInternalError panic ("entered unreachable code: there must be a path to a
+# root" in ImportTracer::get_traces) no longer reproduces on Next 16.2.9 — validated
+# 2026-07-05 with clean amd64 (12min14s, image smoke-tested: /api/monitoring/health
+# 200) and arm64 (qemu, exit 0, zero panic strings) builds. Turbopack cut the bare
+# build from 17min to 9min on the same 32-core box. Webpack stays available as the
+# escape hatch: `--build-arg`/-e OMNIROUTE_USE_TURBOPACK=0.
 # See docs/ops/QUALITY_GATE_PLAYBOOK.md Parte 6.
-ENV OMNIROUTE_USE_TURBOPACK=0
+ENV OMNIROUTE_USE_TURBOPACK=1
+
+# Docker containers cannot run the MITM/Agent-Bridge stack (no host DNS/cert
+# access), so keep @/mitm/manager on the graceful stub (#3390). This flag is
+# Docker-only: npm/Electron/VPS builds must bundle the REAL manager (#6344).
+ENV OMNIROUTE_MITM_STUB=1
 
 # Raise the V8 heap ceiling for the build. The webpack production optimization
-# pass (forced above since Turbopack panics) needs more than V8's default ceiling
-# (~2 GB) for a codebase this size; a memory-constrained Docker build otherwise
-# dies with "FATAL ERROR: ... JavaScript heap out of memory" during the builder
-# stage (#4076). NODE_OPTIONS propagates to the spawned `next build` child
-# (build-next-isolated.mjs → resolveNextBuildEnv spreads process.env). Build-only;
-# the runtime heap is set separately on the runner stage (OMNIROUTE_MEMORY_MB).
-# Override for hosts with more/less RAM: `--build-arg OMNIROUTE_BUILD_MEMORY_MB=6144`.
+# pass needs more than V8's default ceiling (~2 GB) for a codebase this size; a
+# memory-constrained Docker build otherwise dies with "FATAL ERROR: ... JavaScript
+# heap out of memory" during the builder stage (#4076). Turbopack's compile is
+# native (Rust) and less V8-heap-bound, but the prerender/export phase still runs
+# on V8, so keep the ceiling. NODE_OPTIONS propagates to the spawned `next build`
+# child (build-next-isolated.mjs → resolveNextBuildEnv spreads process.env).
+# Build-only; the runtime heap is set separately on the runner stage
+# (OMNIROUTE_MEMORY_MB). Override: `--build-arg OMNIROUTE_BUILD_MEMORY_MB=6144`.
 ARG OMNIROUTE_BUILD_MEMORY_MB=4096
 ENV NODE_OPTIONS="--max-old-space-size=${OMNIROUTE_BUILD_MEMORY_MB}"
 
 COPY . ./
-RUN --mount=type=cache,target=/app/.build/next/cache \
+RUN --mount=type=cache,id=next-cache,target=/app/.build/next/cache \
   mkdir -p /app/data && npm run build
 
 # ── Runner base ────────────────────────────────────────────────────────────
@@ -95,6 +114,12 @@ LABEL org.opencontainers.image.title="omniroute" \
 ENV NODE_ENV=production
 ENV PORT=20128
 ENV HOSTNAME=0.0.0.0
+# Runtime heap ceiling. 1024MB is enough for normal traffic but can be tight
+# for large fusion-combo panels (many models fanned out in parallel, each
+# response buffered in full — see open-sse/services/fusion.ts::FUSION_DEFAULTS
+# .maxPanel, issue #1905). Override at `docker run` time with
+# `-e OMNIROUTE_MEMORY_MB=2048` (or higher) if you raise fusionTuning.maxPanel
+# above the default cap.
 ENV OMNIROUTE_MEMORY_MB=1024
 ENV NODE_OPTIONS="--max-old-space-size=${OMNIROUTE_MEMORY_MB}"
 
@@ -176,8 +201,8 @@ COPY --from=builder /app/node_modules/playwright ./node_modules/playwright
 # browsers land under /home/node which persists across image layers and is
 # accessible to the non-root runtime user.
 ENV PLAYWRIGHT_BROWSERS_PATH=/home/node/.cache/ms-playwright
-RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-  --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
+RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=locked \
+  --mount=type=cache,id=apt-lists,target=/var/lib/apt/lists,sharing=locked \
   apt-get update \
   && node node_modules/playwright/cli.js install chromium --with-deps \
   && chown -R node:node /home/node/.cache \
@@ -193,15 +218,15 @@ FROM runner-base AS runner-cli
 USER root
 
 # Install system dependencies required by openclaw (git+ssh references).
-RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-  --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
+RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=locked \
+  --mount=type=cache,id=apt-lists,target=/var/lib/apt/lists,sharing=locked \
   apt-get update \
   && apt-get install -y --no-install-recommends git ca-certificates docker.io docker-compose \
   && rm -rf /var/lib/apt/lists/* \
   && git config --system url."https://github.com/".insteadOf "ssh://git@github.com/"
 
 # Install CLI tools globally. Separate layer from apt for better cache reuse.
-RUN --mount=type=cache,target=/root/.npm \
+RUN --mount=type=cache,id=npm-cache,target=/root/.npm \
   npm install -g --no-audit --no-fund @openai/codex @anthropic-ai/claude-code droid openclaw@latest
 
 USER node

README.md

@@ -6,7 +6,7 @@
 
 # 🚀 OmniRoute — The Free AI Gateway
 
-### Never stop coding. Connect every AI tool to **236 providers** — **50+ free** — through one endpoint.
+### Never stop coding. Connect every AI tool to **250 providers** — **90+ free** — through one endpoint.
 
 **Plug Claude Code, Codex, Cursor, Cline, Copilot & Antigravity into FREE Claude / GPT / Gemini. Auto-fallback.**
 <br/>
@@ -19,11 +19,23 @@
 
 <br/>
 
-[![231 AI Providers](https://img.shields.io/badge/231-AI_Providers-6C5CE7?style=for-the-badge)](#-231-ai-providers--50-free)
-[![50+ Free](https://img.shields.io/badge/50%2B-Free_Tiers-00B894?style=for-the-badge)](#-231-ai-providers--50-free)
+<h3>
+
+⭐ Star the repo if OMNIROUTE helped you save money and make your work easier.
+
+</h3>
+
+[![Stars](https://img.shields.io/github/stars/diegosouzapw/OmniRoute?style=social)](https://github.com/diegosouzapw/OmniRoute)
+<a href="https://trendshift.io/repositories/23589" target="_blank"><img src="https://trendshift.io/api/badge/repositories/23589" alt="diegosouzapw%2FOmniRoute | Trendshift" style="width: 250px; height: 55px;" width="250" height="55"/></a>
+[![Star History Rank](https://api.star-history.com/badge?repo=diegosouzapw/OmniRoute&theme=dark)](https://www.star-history.com/diegosouzapw/omniroute)
+
+</br>
+
+[![250 AI Providers](https://img.shields.io/badge/250-AI_Providers-6C5CE7?style=for-the-badge)](#-250-ai-providers--90-free)
+[![90+ Free](https://img.shields.io/badge/90%2B-Free_Tiers-00B894?style=for-the-badge)](#-250-ai-providers--90-free)
 [![1.6B Free Tokens/mo](https://img.shields.io/badge/1.6B-Free_Tokens%2Fmo-00B894?style=for-the-badge)](docs/reference/FREE_TIERS.md)
 [![Token Savings](https://img.shields.io/badge/up_to_95%25-Token_Savings-E17055?style=for-the-badge)](#%EF%B8%8F-save-1595-tokens--automatically)
-[![17 Strategies](https://img.shields.io/badge/17-Routing_Strategies-0984E3?style=for-the-badge)](#-combos--the-flagship)
+[![18 Strategies](https://img.shields.io/badge/18-Routing_Strategies-0984E3?style=for-the-badge)](#-combos--the-flagship)
 [![$0 to start](https://img.shields.io/badge/%240-To_Start-FDCB6E?style=for-the-badge&logoColor=black)](#-quick-start)
 
 <br/>
@@ -34,79 +46,78 @@
 [![Telegram](https://img.shields.io/badge/Telegram-26A5E4?style=for-the-badge&logo=telegram&logoColor=white)](https://t.me/omnirouteOficial)
 [![WhatsApp Global](https://img.shields.io/badge/WhatsApp_Global-25D366?style=for-the-badge&logo=whatsapp&logoColor=white)](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t)
 [![WhatsApp Brasil](https://img.shields.io/badge/WhatsApp_Brasil-25D366?style=for-the-badge&logo=whatsapp&logoColor=white)](https://chat.whatsapp.com/BTGJXIyjeNIIgExvTMGGhI)
+[![Website](https://img.shields.io/badge/Website-omniroute.online-blue?logo=google-chrome&logoColor=white)](https://omniroute.online)
 
 **Questions, provider tips, roadmap & support → [Discord](https://discord.gg/EkzRkpzKYt) · [Telegram](https://t.me/omnirouteOficial) · WhatsApp [🌍 Global](https://chat.whatsapp.com/JI7cDQ1GyaiDHhVBpLxf8b?mode=gi_t) / [🇧🇷 Brasil](https://chat.whatsapp.com/BTGJXIyjeNIIgExvTMGGhI)**
 
 <br/>
 
-<a href="https://trendshift.io/repositories/23589" target="_blank"><img src="https://trendshift.io/api/badge/repositories/23589" alt="diegosouzapw%2FOmniRoute | Trendshift" style="width: 250px; height: 55px;" width="250" height="55"/></a>
-
-[![npm](https://img.shields.io/npm/v/omniroute?logo=npm&style=flat-square)](https://www.npmjs.com/package/omniroute)
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg?style=flat-square)](LICENSE)
-[![Node](https://img.shields.io/badge/node-%E2%89%A522.0.0-brightgreen?style=flat-square)](package.json)
-[![Stars](https://img.shields.io/github/stars/diegosouzapw/OmniRoute?style=social)](https://github.com/diegosouzapw/OmniRoute)
-
-<div align="center">
+### 🧩 Available
 
 [![npm version](https://img.shields.io/npm/v/omniroute?color=cb3837&logo=npm)](https://www.npmjs.com/package/omniroute)
 ![NPM Monthly](https://img.shields.io/npm/dm/omniroute?label=npm/month&color=cb3837&logo=npm)
 [![Docker Hub](https://img.shields.io/docker/v/diegosouzapw/omniroute?label=Docker%20Hub&logo=docker&color=2496ED)](https://hub.docker.com/r/diegosouzapw/omniroute)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg?style=flat-square)](LICENSE)
 ![Docker Pulls](https://img.shields.io/docker/pulls/diegosouzapw/omniroute?label=docker%20pulls&logo=docker&color=2496ED)
 ![Electron Downloads](https://img.shields.io/github/downloads/diegosouzapw/omniroute/total?style=flat&label=electron%20downloads&logo=electron&color=47848F)
-[![Website](https://img.shields.io/badge/Website-omniroute.online-blue?logo=google-chrome&logoColor=white)](https://omniroute.online)
 
-</div>
-
-<br/>
-
-[**🚀 Quick Start**](#-quick-start) • [**🎯 Combos**](#-combos--the-flagship) • [**🌐 Providers**](#-231-ai-providers--50-free) • [**🔌 CLI & MCP**](#-full-cli--a2a--mcp) • [**🗜️ Compression**](#%EF%B8%8F-save-1595-tokens--automatically) • [**🌍 Website**](https://omniroute.online)
+[**🚀 Quick Start**](#-quick-start) • [**🎯 Combos**](#-combos--the-flagship) • [**🌐 Providers**](#-250-ai-providers--90-free) • [**🔌 CLI & MCP**](#-full-cli--a2a--mcp) • [**🗜️ Compression**](#%EF%B8%8F-save-1595-tokens--automatically) • [**🌍 Website**](https://omniroute.online)
 
 [💥 The Promise](#-the-promise) • [🤔 Why](#-why-omniroute) • [🏆 What Sets Apart](#-what-sets-omniroute-apart) • [🤖 Compatible CLIs](#-compatible-clis--coding-agents) • [🖥️ Where It Runs](#%EF%B8%8F-where-omniroute-runs--anywhere) • [🔒 Private](#-private--local-first) • [🎬 In Action](#-omniroute-in-action) • [📚 Explore More](#-explore-more) • [📧 Support](#-support--community)
 
 </div>
 
 <div align="center">
- <b>🌐 Available in 41+ languages</b>
+ <b>🌐 In 42+ languages</b>
  <table>
   <tr>
-    <td align="center"><a href="README.md">🇺🇸</a></td>
-    <td align="center"><a href="docs/i18n/pt-BR/README.md">🇧🇷</a></td>
-    <td align="center"><a href="docs/i18n/es/README.md">🇪🇸</a></td>
-    <td align="center"><a href="docs/i18n/fr/README.md">🇫🇷</a></td>
-    <td align="center"><a href="docs/i18n/it/README.md">🇮🇹</a></td>
-    <td align="center"><a href="docs/i18n/ru/README.md">🇷🇺</a></td>
-    <td align="center"><a href="docs/i18n/zh-CN/README.md">🇨🇳</a></td>
-    <td align="center"><a href="docs/i18n/zh-TW/README.md">🇹🇼</a></td>
-    <td align="center"><a href="docs/i18n/de/README.md">🇩🇪</a></td>
-    <td align="center"><a href="docs/i18n/ja/README.md">🇯🇵</a></td>
-    <td align="center"><a href="docs/i18n/ko/README.md">🇰🇷</a></td>
-    <td align="center"><a href="docs/i18n/in/README.md">🇮🇳</a></td>
+    <td align="center"><a href="README.md"><img src="docs/assets/flags/us.svg" width="26" alt="English (en)"></a></td>
+    <td align="center"><a href="docs/i18n/pt-BR/README.md"><img src="docs/assets/flags/br.svg" width="26" alt="Português — Brasil (pt-BR)"></a></td>
+    <td align="center"><a href="docs/i18n/pt/README.md"><img src="docs/assets/flags/pt.svg" width="26" alt="Português (pt)"></a></td>
+    <td align="center"><a href="docs/i18n/es/README.md"><img src="docs/assets/flags/es.svg" width="26" alt="Español (es)"></a></td>
+    <td align="center"><a href="docs/i18n/fr/README.md"><img src="docs/assets/flags/fr.svg" width="26" alt="Français (fr)"></a></td>
+    <td align="center"><a href="docs/i18n/it/README.md"><img src="docs/assets/flags/it.svg" width="26" alt="Italiano (it)"></a></td>
+    <td align="center"><a href="docs/i18n/de/README.md"><img src="docs/assets/flags/de.svg" width="26" alt="Deutsch (de)"></a></td>
+    <td align="center"><a href="docs/i18n/nl/README.md"><img src="docs/assets/flags/nl.svg" width="26" alt="Nederlands (nl)"></a></td>
+    <td align="center"><a href="docs/i18n/ru/README.md"><img src="docs/assets/flags/ru.svg" width="26" alt="Русский (ru)"></a></td>
+    <td align="center"><a href="docs/i18n/uk-UA/README.md"><img src="docs/assets/flags/ua.svg" width="26" alt="Українська (uk-UA)"></a></td>
+    <td align="center"><a href="docs/i18n/pl/README.md"><img src="docs/assets/flags/pl.svg" width="26" alt="Polski (pl)"></a></td>
+    <td align="center"><a href="docs/i18n/cs/README.md"><img src="docs/assets/flags/cz.svg" width="26" alt="Čeština (cs)"></a></td>
+    <td align="center"><a href="docs/i18n/sk/README.md"><img src="docs/assets/flags/sk.svg" width="26" alt="Slovenčina (sk)"></a></td>
+    <td align="center"><a href="docs/i18n/ro/README.md"><img src="docs/assets/flags/ro.svg" width="26" alt="Română (ro)"></a></td>
+    <td align="center"><a href="docs/i18n/hu/README.md"><img src="docs/assets/flags/hu.svg" width="26" alt="Magyar (hu)"></a></td>
   </tr>
   <tr>
-    <td align="center"><a href="docs/i18n/th/README.md">🇹🇭</a></td>
-    <td align="center"><a href="docs/i18n/vi/README.md">🇻🇳</a></td>
-    <td align="center"><a href="docs/i18n/id/README.md">🇮🇩</a></td>
-    <td align="center"><a href="docs/i18n/ms/README.md">🇲🇾</a></td>
-    <td align="center"><a href="docs/i18n/phi/README.md">🇵🇭</a></td>
-    <td align="center"><a href="docs/i18n/ar/README.md">🇸🇦</a></td>
-    <td align="center"><a href="docs/i18n/he/README.md">🇮🇱</a></td>
-    <td align="center"><a href="docs/i18n/az/README.md">🇦🇿</a></td>
-    <td align="center"><a href="docs/i18n/uk-UA/README.md">🇺🇦</a></td>
-    <td align="center"><a href="docs/i18n/pl/README.md">🇵🇱</a></td>
-    <td align="center"><a href="docs/i18n/cs/README.md">🇨🇿</a></td>
+    <td align="center"><a href="docs/i18n/bg/README.md"><img src="docs/assets/flags/bg.svg" width="26" alt="Български (bg)"></a></td>
+    <td align="center"><a href="docs/i18n/da/README.md"><img src="docs/assets/flags/dk.svg" width="26" alt="Dansk (da)"></a></td>
+    <td align="center"><a href="docs/i18n/fi/README.md"><img src="docs/assets/flags/fi.svg" width="26" alt="Suomi (fi)"></a></td>
+    <td align="center"><a href="docs/i18n/no/README.md"><img src="docs/assets/flags/no.svg" width="26" alt="Norsk (no)"></a></td>
+    <td align="center"><a href="docs/i18n/sv/README.md"><img src="docs/assets/flags/se.svg" width="26" alt="Svenska (sv)"></a></td>
+    <td align="center"><a href="docs/i18n/zh-CN/README.md"><img src="docs/assets/flags/cn.svg" width="26" alt="中文 — 简体 (zh-CN)"></a></td>
+    <td align="center"><a href="docs/i18n/zh-TW/README.md"><img src="docs/assets/flags/tw.svg" width="26" alt="中文 — 繁體 (zh-TW)"></a></td>
+    <td align="center"><a href="docs/i18n/ja/README.md"><img src="docs/assets/flags/jp.svg" width="26" alt="日本語 (ja)"></a></td>
+    <td align="center"><a href="docs/i18n/ko/README.md"><img src="docs/assets/flags/kr.svg" width="26" alt="한국어 (ko)"></a></td>
+    <td align="center"><a href="docs/i18n/th/README.md"><img src="docs/assets/flags/th.svg" width="26" alt="ไทย (th)"></a></td>
+    <td align="center"><a href="docs/i18n/vi/README.md"><img src="docs/assets/flags/vn.svg" width="26" alt="Tiếng Việt (vi)"></a></td>
+    <td align="center"><a href="docs/i18n/id/README.md"><img src="docs/assets/flags/id.svg" width="26" alt="Bahasa Indonesia (id)"></a></td>
+    <td align="center"><a href="docs/i18n/ms/README.md"><img src="docs/assets/flags/my.svg" width="26" alt="Bahasa Melayu (ms)"></a></td>
+    <td align="center"><a href="docs/i18n/phi/README.md"><img src="docs/assets/flags/ph.svg" width="26" alt="Filipino (phi)"></a></td>
   </tr>
   <tr>
-    <td align="center"><a href="docs/i18n/nl/README.md">🇳🇱</a></td>
-    <td align="center"><a href="docs/i18n/bg/README.md">🇧🇬</a></td>
-    <td align="center"><a href="docs/i18n/da/README.md">🇩🇰</a></td>
-    <td align="center"><a href="docs/i18n/fi/README.md">🇫🇮</a></td>
-    <td align="center"><a href="docs/i18n/no/README.md">🇳🇴</a></td>
-    <td align="center"><a href="docs/i18n/sv/README.md">🇸🇪</a></td>
-    <td align="center"><a href="docs/i18n/hu/README.md">🇭🇺</a></td>
-    <td align="center"><a href="docs/i18n/ro/README.md">🇷🇴</a></td>
-    <td align="center"><a href="docs/i18n/sk/README.md">🇸🇰</a></td>
-    <td align="center"><a href="docs/i18n/pt/README.md">🇵🇹</a></td>
-    <td align="center"></td>
+    <td align="center"><a href="docs/i18n/in/README.md"><img src="docs/assets/flags/in.svg" width="26" alt="हिन्दी (in)"></a></td>
+    <td align="center"><a href="docs/i18n/hi/README.md"><img src="docs/assets/flags/in.svg" width="26" alt="हिन्दी (hi)"></a></td>
+    <td align="center"><a href="docs/i18n/gu/README.md"><img src="docs/assets/flags/in.svg" width="26" alt="ગુજરાતી (gu)"></a></td>
+    <td align="center"><a href="docs/i18n/mr/README.md"><img src="docs/assets/flags/in.svg" width="26" alt="मराठी (mr)"></a></td>
+    <td align="center"><a href="docs/i18n/ta/README.md"><img src="docs/assets/flags/in.svg" width="26" alt="தமிழ் (ta)"></a></td>
+    <td align="center"><a href="docs/i18n/te/README.md"><img src="docs/assets/flags/in.svg" width="26" alt="తెలుగు (te)"></a></td>
+    <td align="center"><a href="docs/i18n/bn/README.md"><img src="docs/assets/flags/bd.svg" width="26" alt="বাংলা (bn)"></a></td>
+    <td align="center"><a href="docs/i18n/ur/README.md"><img src="docs/assets/flags/pk.svg" width="26" alt="اردو (ur)"></a></td>
+    <td align="center"><a href="docs/i18n/fa/README.md"><img src="docs/assets/flags/ir.svg" width="26" alt="فارسی (fa)"></a></td>
+    <td align="center"><a href="docs/i18n/ar/README.md"><img src="docs/assets/flags/sa.svg" width="26" alt="العربية (ar)"></a></td>
+    <td align="center"><a href="docs/i18n/he/README.md"><img src="docs/assets/flags/il.svg" width="26" alt="עברית (he)"></a></td>
+    <td align="center"><a href="docs/i18n/tr/README.md"><img src="docs/assets/flags/tr.svg" width="26" alt="Türkçe (tr)"></a></td>
+    <td align="center"><a href="docs/i18n/az/README.md"><img src="docs/assets/flags/az.svg" width="26" alt="Azərbaycan (az)"></a></td>
+    <td align="center"><a href="docs/i18n/sw/README.md"><img src="docs/assets/flags/tz.svg" width="26" alt="Kiswahili (sw)"></a></td>
   </tr>
 </table>
 </div>
@@ -138,18 +149,18 @@
 
 </div>
 
-> One endpoint. **236 providers.** Never stop building — and let OmniRoute pick the cheapest one that works.
+> One endpoint. **250 providers.** Never stop building — and let OmniRoute pick the cheapest one that works.
 
 <table>
   <tr>
-    <td width="33%" valign="top"><b>🚫 Never hit limits</b><br/><sub>Auto-fallback across 236 providers in milliseconds. Quota out? Next provider takes over — zero downtime.</sub></td>
+    <td width="33%" valign="top"><b>🚫 Never hit limits</b><br/><sub>Auto-fallback across 250 providers in milliseconds. Quota out? Next provider takes over — zero downtime.</sub></td>
     <td width="33%" valign="top"><b>💸 Save up to 95% tokens</b><br/><sub>RTK + Caveman stacked compression cuts 15–95% of eligible tokens (~89% avg on tool-heavy sessions).</sub></td>
-    <td width="33%" valign="top"><b>🆓 $0 to start</b><br/><sub>50+ providers with a free tier, 11 free <i>forever</i> (Kiro, Qoder, Pollinations, LongCat…). No card needed.</sub></td>
+    <td width="33%" valign="top"><b>🆓 $0 to start</b><br/><sub>90+ providers with a free tier, 11 free <i>forever</i> (Kiro, Qoder, Pollinations, LongCat…). No card needed.</sub></td>
   </tr>
   <tr>
-    <td width="33%" valign="top"><b>🔌 Every tool works</b><br/><sub>16+ coding agents — Claude Code, Codex, Cursor, Cline, Copilot, Antigravity — through one config.</sub></td>
+    <td width="33%" valign="top"><b>🔌 Every tool works</b><br/><sub>24+ coding agents — Claude Code, Codex, Cursor, Cline, Copilot, Antigravity — through one config.</sub></td>
     <td width="33%" valign="top"><b>🧩 One endpoint</b><br/><sub>OpenAI ↔ Claude ↔ Gemini ↔ Responses API translation. Point any tool at <code>/v1</code> and it just works.</sub></td>
-    <td width="33%" valign="top"><b>🛡️ Production-grade</b><br/><sub>Circuit breakers, TLS stealth, MCP (87 tools), A2A, memory, guardrails, evals. 14,965 tests.</sub></td>
+    <td width="33%" valign="top"><b>🛡️ Production-grade</b><br/><sub>Circuit breakers, TLS stealth, MCP (94 tools), A2A, memory, guardrails, evals. 21,000+ tests.</sub></td>
   </tr>
 </table>
 
@@ -183,7 +194,7 @@
                           ▼
 ┌──────────────────────────────────────────────────────────┐
 │                  OmniRoute — Smart Router                  │
-│  RTK + Caveman compression · 17 routing strategies         │
+│  RTK + Caveman compression · 18 routing strategies         │
 │  Circuit breakers · TLS stealth · MCP · A2A · Guardrails   │
 └─────────────────────────┬──────────────────────────────────┘
         ┌─────────────┬────┴────────┬─────────────┐
@@ -221,20 +232,56 @@ No combo to create. Set your model to `auto` (or a variant) and OmniRoute builds
 
 ##
 
-### 🔀 Or build your own — 17 routing strategies
+### 🔀 Or build your own — 18 routing strategies
 
-| Goal                                    | Strategy / combo                                   |
-| --------------------------------------- | -------------------------------------------------- |
-| 🥇 Drain my subscription before paying  | `priority` / `fill-first`                          |
-| ⚖️ Spread load across accounts          | `round-robin` · `weighted` · `p2c` · `least-used`  |
-| 💸 Always cheapest viable model         | `cost-optimized` · `auto/cheap`                    |
-| 🧠 Hand off long context between models | `context-relay` · `context-optimized`              |
-| 🎲 Randomized / privacy routing         | `random` · `strict-random`                         |
-| 🧬 Fan out to a panel + judge synthesis | `fusion`                                           |
-| 📊 Route by remaining quota headroom    | `reset-window` · `headroom`                        |
-| 🤖 Just make it smart                   | `auto` (9-factor scoring) · `lkgp` · `reset-aware` |
+All **18** strategies — mix & match per combo step:
 
-<sub>The Auto-Combo engine scores every candidate on **9 factors** (health, quota, cost, latency, success rate, freshness…) — see [`docs/routing/AUTO-COMBO.md`](docs/routing/AUTO-COMBO.md).</sub>
+| #   | Strategy            | What it does                                                     |
+| --- | ------------------- | ---------------------------------------------------------------- |
+| 1   | `priority`          | First-target ordered list — drain each before the next 🥇        |
+| 2   | `fill-first`        | Fill each target's quota fully before moving on                  |
+| 3   | `weighted`          | Weighted random by per-target weight                             |
+| 4   | `round-robin`       | Cycle through targets in order                                   |
+| 5   | `p2c`               | Power-of-two-choices random load balancing                       |
+| 6   | `least-used`        | Pick the target with the lowest current load                     |
+| 7   | `random`            | Uniform random pick (deduplicated)                               |
+| 8   | `strict-random`     | Random without de-duplicating repeats 🎲                         |
+| 9   | `cost-optimized`    | Minimize $ per request from live catalog pricing 💸              |
+| 10  | `headroom`          | Pick the target with the most remaining quota                    |
+| 11  | `reset-window`      | Prefer the target whose quota window resets soonest              |
+| 12  | `reset-aware`       | Rank by quota reset time — short windows first 📊                |
+| 13  | `context-relay`     | Hand off context across targets for long conversations 🧠        |
+| 14  | `context-optimized` | Pick the best fit for the current context size                   |
+| 15  | `lkgp`              | Last-Known-Good Path — sticky to the last successful target      |
+| 16  | `auto`              | 12-factor live scoring across every connection 🤖                |
+| 17  | `fusion`            | Fan out to a panel of models + a judge synthesizes one answer 🧬 |
+| 18  | `pipeline`          | Chain steps — each target's output feeds the next one 🔗         |
+
+<sub>The Auto-Combo engine scores every candidate on **12 factors** (health, quota, cost, latency, success rate, freshness…) — see [`docs/routing/AUTO-COMBO.md`](docs/routing/AUTO-COMBO.md).</sub>
+
+##
+
+### ⚖️ Quota-Share — split one subscription across a team ✨ NEW
+
+> Running several keys against the **same upstream account** (one Codex Pro plan, one Kimi key, one GLM Coding seat)? A burst on one key can burn the whole 5-hour / hourly quota and lock everyone else out. **Quota-Share** distributes a provider's time-based quota **fairly** across the keys in a pool — and it's _work-conserving_, so an idle member's slice is lent out instead of wasted.
+
+| Knob                     | What it controls                                                                |
+| ------------------------ | ------------------------------------------------------------------------------- |
+| ⚖️ **Allocation weight** | each key's slice of the pool — e.g. `50 / 30 / 20`                              |
+| 📐 **Dimensions**        | track `%` · requests · tokens · `$`, per **5h / 7d / per-model** window         |
+| 🚦 **Policy**            | `hard` (block over share) · `soft` (deprioritize) · `burst` (use idle headroom) |
+| 🧱 **Cap**               | absolute ceiling per key, independent of mode                                   |
+
+```
+Pool "team-codex"   ·   1 Codex Pro account   ·   3 keys   ·   5-hour window
+  ├─ alice    weight 50  ██████████░░░░░░░░░░   ≤ 50% of the shared 5h quota
+  ├─ bob      weight 30  ██████░░░░░░░░░░░░░░   ≤ 30%
+  └─ ci-bot   weight 20  ████░░░░░░░░░░░░░░░░   ≤ 20%
+Generous mode (<50% pool used) → idle shares are lent out
+Strict mode  (≥50% pool used)  → each key held to its fair share
+```
+
+<sub>Enforced in the hot path **before** the request leaves OmniRoute, with per-(key, model) caps + session stickiness for prompt-cache integrity (now with a per-combo / global disable toggle). 📖 [Quota Sharing Engine](docs/routing/QUOTA_SHARE.md)</sub>
 
 ##
 
@@ -267,15 +314,15 @@ Result: 4 layers of fallback = zero downtime
 
 | Feature                                | OmniRoute                                                           | Other routers |
 | -------------------------------------- | ------------------------------------------------------------------- | ------------- |
-| 🌐 Providers                           | **231**                                                             | 20–100        |
-| 🆓 Free providers                      | **50+ (11 free forever)**                                           | 1–5           |
-| 🔀 Routing strategies                  | **17** (priority, weighted, cost-optimized, context-relay, fusion…) | 1–3           |
+| 🌐 Providers                           | **250**                                                             | 20–100        |
+| 🆓 Free providers                      | **90+ (11 free forever)**                                           | 1–5           |
+| 🔀 Routing strategies                  | **18** (priority, weighted, cost-optimized, context-relay, fusion…) | 1–3           |
 | 🗜️ Token compression                   | **RTK + Caveman stacked (15–95%)**                                  | None / 20–40% |
-| 🧰 Built-in MCP server                 | **87 tools, 3 transports, 30 scopes**                               | Rare          |
+| 🧰 Built-in MCP server                 | **94 tools, 3 transports, 30 scopes**                               | Rare          |
 | 🤝 A2A agent protocol                  | **6 skills, JSON-RPC 2.0**                                          | None          |
 | 🧠 Memory (FTS5 + vector)              | **Yes**                                                             | Rare          |
 | 🛡️ Guardrails (PII, injection, vision) | **Yes**                                                             | Rare          |
-| ☁️ Cloud agents                        | **Codex, Devin, Jules**                                             | None          |
+| ☁️ Cloud agents                        | **Codex, Cursor, Devin, Jules**                                     | None          |
 | 🥷 TLS fingerprint stealth             | **JA3/JA4 via wreq-js**                                             | None          |
 | 🖥️ Multi-platform                      | **Web · Desktop · Termux · PWA**                                    | Web only      |
 | 🌍 i18n                                | **42 locales**                                                      | 0–4           |
@@ -290,19 +337,23 @@ Result: 4 layers of fallback = zero downtime
 
 </div>
 
-> Recent highlights from **v3.8.20 → v3.8.41**. Full history in [`CHANGELOG.md`](CHANGELOG.md).
+> Recent highlights from **v3.8.20 → v3.8.47**. Full history in [`CHANGELOG.md`](CHANGELOG.md).
 
-- **⚖️ Quota-Share routing** — a dedicated combo strategy that spreads load across accounts by _available quota_: Deficit-Round-Robin scheduling, per-connection `max_concurrent` with cooldown-wait queueing, multi-window usage buckets (5h / 7d / per-model), per-(key,model) caps, session stickiness for prompt-cache integrity, and proactive saturation from upstream token-usage headers. → [Resilience Guide](docs/architecture/RESILIENCE_GUIDE.md)
+- **🗜️ Compression hardening** — a default-on **inflation guard** (discard the stacked result and send the verbatim original whenever compression would _grow_ the prompt), completed **Caveman rule packs** for German / French / Japanese (dedup + ultra) plus a new **Chinese (文言 / wényán) input pack** with zh-vs-ja auto-detection, and **RTK filters for Gradle & .NET (`dotnet`)** build output. → [Compression](docs/compression/COMPRESSION_ENGINES.md)
+- **💸 Honest flat-rate cost** — subscription / coding-plan providers (ChatGPT Web, grok-web, the Minimax / Kimi / GLM / Alibaba Coding plans, Xiaomi MiMo…) now read **$0** in cost analytics instead of an inflated per-token estimate, while budget / quota / routing keep estimating unchanged. → [API Reference](docs/reference/API_REFERENCE.md)
+- **⚖️ Quota-Share routing** — a dedicated combo strategy that spreads load across accounts by _available quota_: Deficit-Round-Robin scheduling, per-connection `max_concurrent` with cooldown-wait queueing, multi-window usage buckets (5h / 7d / per-model), per-(key, model) caps, session stickiness for prompt-cache integrity (now with a per-combo / global disable toggle), and proactive saturation from upstream token-usage headers. → [Resilience Guide](docs/architecture/RESILIENCE_GUIDE.md)
 - **🤖 One-command CLI/agent setup** — a dedicated `setup-*` command configures each coding tool to route through OmniRoute (Claude Code, Codex, Cline, Continue, Cursor, Roo Code, Kilo Code, Crush, Goose, Qwen Code, Aider, OpenCode); `omniroute launch` / `omniroute launch-codex` are zero-config launchers. → [CLI Integrations](docs/guides/CLI-INTEGRATIONS.md)
 - **🛰️ Remote mode** — drive a remote OmniRoute from any machine with scoped access tokens (`omniroute connect` / `omniroute contexts` / `omniroute tokens`), plus an `omniroute login antigravity` helper that runs Google "native/desktop" OAuth on your own machine and pastes a credential blob into a remote/VPS install (where the loopback redirect is unreachable). → [Remote Mode](docs/guides/REMOTE-MODE.md)
-- **🧭 Smarter auto-routing** — OpenRouter-style `auto/<category>:<tier>` combos (e.g. `auto/coding:fast`, `auto/reasoning:pro`), a **Fusion** strategy (fan out to a panel of models in parallel, then synthesize via a judge), **task-aware routing** (best-fit connection per task type), per-request `X-Route-Model` override, live Arena-ELO + models.dev model intelligence, per-step account allowlists, provider-wildcard combo steps, nested combo-ref execution, sticky weighted selection, and `web_search`-aware routing. → [Auto-Combo](docs/routing/AUTO-COMBO.md)
-- **🗜️ Pluggable compression** — an async pipeline of **9 composable engines** with Compression Studios, an LLMLingua-2 ONNX engine and a heuristic/SLM two-tier **Ultra**, RTK, delegated Anthropic Context Editing, **Output Styles** (output-axis steering: terse-prose / less-code / terse-CJK), an **adaptive context-budget dial** (escalate only as far as needed to fit the context window), per-request `x-omniroute-compression` control, an opt-in offline eval harness, one-click **Headroom** proxy lifecycle management from the dashboard (Docker sidecar supported), a synthetic **compression playground** (Play lanes + A/B Compare with USD-capped fidelity verdicts), an opt-in **per-step fidelity gate** that rejects a lossy engine before it degrades the prompt, a **best-of-N candidate encoder** (GCF vs TOON — keep whichever is shorter, with an A/B bytes/token table in the studio), **CCR ranged/grep/stats retrieval** (pull an exact byte/line slice or summary of a stored block instead of re-expanding it), and a unified panel with named profiles + an active-profile selector. → [Compression](docs/compression/COMPRESSION_ENGINES.md)
+- **🧭 Smarter auto-routing** — OpenRouter-style `auto/<category>:<tier>` combos (e.g. `auto/coding:fast`, `auto/reasoning:pro`), a **Fusion** strategy (fan out to a panel of models in parallel, then synthesize via a judge), **task-aware routing** (best-fit connection per task type), per-request `X-Route-Model` override, live Arena-ELO + models.dev model intelligence, per-step account allowlists, provider-wildcard combo steps, nested combo-ref execution, sticky weighted selection, `web_search`-aware routing (now with **per-model web-search/web-fetch interception rules**), native **xAI Grok `/v1/responses`** routing, and **per-request Auto-Combo controls** (`X-OmniRoute-Mode` mode-preset override + `X-OmniRoute-Budget` hard USD cost ceiling, scoped to a single request). Embeddings-only and rerank-only models (JinaAI, OpenRouter custom, reranker models…) no longer disappear from the combo builder's model picker. → [Auto-Combo](docs/routing/AUTO-COMBO.md)
+- **🗜️ Pluggable compression** — an async pipeline of **10 composable engines** with Compression Studios, an LLMLingua-2 ONNX engine and a heuristic/SLM two-tier **Ultra**, RTK, delegated Anthropic Context Editing, **Output Styles** (output-axis steering: terse-prose / less-code / terse-CJK), an **adaptive context-budget dial** (escalate only as far as needed to fit the context window), per-request `x-omniroute-compression` control, an opt-in offline eval harness, one-click **Headroom** proxy lifecycle management from the dashboard (Docker sidecar supported), a synthetic **compression playground** (Play lanes + A/B Compare with USD-capped fidelity verdicts), an opt-in **per-step fidelity gate** that rejects a lossy engine before it degrades the prompt, a **best-of-N candidate encoder** (GCF vs TOON — keep whichever is shorter, with an A/B bytes/token table in the studio), the vendored **GCF codec updated to spec v3.2** (nested flattening — deeply-nested payloads go from ~3% to ~32% compression vs JSON), a new **omniglyph** engine (context-as-image, ~10× fewer tokens on the converted block), **CCR ranged/grep/stats retrieval** (pull an exact byte/line slice or summary of a stored block instead of re-expanding it), a unified panel with named profiles + an active-profile selector, an opt-in **per-engine pipeline circuit-breaker**, an opt-in **LLM-tier engine** (a model pass for higher-ratio semantic compression), a **read-lifecycle engine** that collapses superseded file reads, **usage-observed prefix freeze**, a graduated **CCR retrieval-feedback ramp**, a `preserveSystemPrompt` mode enum, and a **drag-reorder pipeline editor** in the studio. → [Compression](docs/compression/COMPRESSION_ENGINES.md)
 - **🕵️ Transparent MITM decrypt (TPROXY)** — capture & translate traffic from CLIs that ignore proxy env vars, with a per-SNI certificate authority and a trust-store installer. → [MITM/TPROXY](docs/security/MITM-TPROXY-DECRYPT.md)
 - **💸 Cost telemetry everywhere** — `X-OmniRoute-*` cost/usage headers on every endpoint (including media), a non-token cost engine, a cache-HIT `X-OmniRoute-Cost-Saved` header, and per-key USD spend quotas. → [API Reference](docs/reference/API_REFERENCE.md)
-- **🧠 Memory you control** — opt-in int8 vector quantization (Qdrant + sqlite-vec), memory off by default, and a per-request `x-omniroute-no-memory` header. → [Memory](docs/frameworks/MEMORY.md)
+- **🧠 Memory you control** — opt-in int8 vector quantization (Qdrant + sqlite-vec), opt-in **typed memory decay** (aged low-value memories fade on a per-type schedule), memory off by default, and a per-request `x-omniroute-no-memory` header. → [Memory](docs/frameworks/MEMORY.md)
 - **🛡️ Security** — a prompt-injection guard across every LLM route (backed by a red-team suite), plus a free DuckDuckGo last-resort web search. → [Guardrails](docs/security/GUARDRAILS.md)
-- **🤝 More providers & agents** — Cursor Cloud Agent (a 4th cloud agent), CodeBuddy CN (`copilot.tencent.com`), a Google Flow video-generation provider, new gateways **DGrid** and **Pioneer AI** (Fastino Labs), inbound **xAI Grok** translators plus **Grok Build (xAI)** with an OAuth import-token flow, GPT-4 / GPT-4o-mini on the GitHub Copilot provider, multi-model **Factory Droid**, **ZenMux Free** (session-cookie free tier), **Alibaba DashScope** text-to-video (`wan2.7-t2v`), a refreshed 236-provider catalog (OrcaRouter, Wafer AI, OpenAdapter, dit.ai, TokenRouter, …), Vertex AI media generation (speech / transcription / music / video), and one-click account import from CLIProxyAPI (`~/.cli-proxy-api/`). → [Providers](docs/reference/PROVIDER_REFERENCE.md)
-- **⚡ Local performance & infra** — a one-click local Redis launcher (`omniroute redis up`, plus a dashboard Redis panel), one-click **Cloudflare Workers** and **Deno Deploy** relay deployers wired into the proxy pool, and an optional Bifrost Go sidecar that offloads the hottest relay path (`BIFROST_BASE_URL`, with automatic fallback to the TypeScript path on timeout) — now with a relay-backend selector (`OMNIROUTE_RELAY_BACKEND=ts|bifrost|auto`) so the `/v1/relay` endpoint stays the stable surface while choosing the fastest backend internally. → [Environment](docs/reference/ENVIRONMENT.md)
+- **🖼️ New endpoints** — `/v1/ocr` (Mistral OCR) and `/v1/audio/translations` (Whisper-style audio translation) round out the media API surface. → [API Reference](docs/reference/API_REFERENCE.md)
+- **🌍 Deployment & ops** — reverse-proxy `basePath` deployment (`OMNIROUTE_BASE_PATH`, e.g. serving OmniRoute under `/omniroute/`), browser-language auto-detect on first visit, per-API-key device/connection tracking (IP+UA fingerprint, masked, in-memory only), root-less MITM cert trust for user-namespaced containers (`OMNIROUTE_NO_SUDO`), server-side configured-only / available-only filters on the Free Provider Rankings page, and **Traditional Chinese (zh-TW)** localization for the frontend + CLI. → [Environment](docs/reference/ENVIRONMENT.md)
+- **🤝 More providers & agents** — Cursor Cloud Agent (a 4th cloud agent), CodeBuddy CN (`copilot.tencent.com`), a Google Flow video-generation provider, new gateways **DGrid** and **Pioneer AI** (Fastino Labs), inbound **xAI Grok** translators plus **Grok Build (xAI)** with an OAuth import-token flow, GPT-4 / GPT-4o-mini on the GitHub Copilot provider, multi-model **Factory Droid**, **ZenMux Free** (session-cookie free tier), **Alibaba DashScope** text-to-video (`wan2.7-t2v`), a refreshed 250-provider catalog (OrcaRouter, Wafer AI, OpenAdapter, dit.ai, TokenRouter, …), Vertex AI media generation (speech/transcription/music/video), a first-class **Ollama** local-provider card, the **SenseNova** free Token Plan (chat + text-to-image), one-click account import from CLIProxyAPI (`~/.cli-proxy-api/`), **Claude Sonnet 5** wired end-to-end, a new provider wave (**Kenari**, **SumoPod**, **X5Lab**, **Charm Hyper**, **Nube.sh**, **b.ai**, **Qiniu**, **ModelScope**, **Augment/Auggie CLI**, **ClinePass**, NVIDIA NIM image generation), Codex account import from a raw ChatGPT access token, the **Requesty** gateway (BYOK, ~200 free req/day), **Yuanbao (web)** as a cookie-session provider (DeepSeek V3/R1 + Hunyuan), the **Zed** hosted LLM aggregator (OAuth), **Claude 5 Sonnet** on the Claude Web provider, Kiro **adaptive-thinking reasoning** surfaced as `reasoning_content`, **bulk API-key add for Cloudflare Workers AI**, and **OpenVecta** (AI inference gateway). → [Providers](docs/reference/PROVIDER_REFERENCE.md)
+- **⚡ Local performance & infra** — a one-click local Redis launcher (`omniroute redis up`, plus a dashboard Redis panel), one-click **Cloudflare Workers** and **Deno Deploy** relay deployers wired into the proxy pool, a relay-backend selector (`OMNIROUTE_RELAY_BACKEND=ts|bifrost|auto`) so `/v1/relay` stays the stable surface while choosing the fastest backend internally, **Bifrost** (Go AI-gateway) and **Mux** (agent-orchestration daemon) promoted to first-class embedded/supervised services alongside 9Router/CLIProxyAPI, **Webshare** added as a paid fourth source in the free-proxy provider framework, and **shorthand proxy formats + protocol header mode** for bulk proxy import. → [Embedded Services](docs/frameworks/EMBEDDED-SERVICES.md)
 
 <br/>
 
@@ -336,7 +387,7 @@ Result: 4 layers of fallback = zero downtime
 <b>＋ also works with</b> · Cline · Antigravity · Windsurf · AMP · Hermes · Qwen CLI · Roo · Continue · <b>any OpenAI-compatible tool</b>
 </div>
 
-<sub>📖 Per-tool setup for all 16+ tools → [`docs/reference/CLI-TOOLS.md`](docs/reference/CLI-TOOLS.md) · 🧩 OpenCode plugin → [`@omniroute/opencode-provider`](https://www.npmjs.com/package/@omniroute/opencode-provider)</sub>
+<sub>📖 Per-tool setup for all 24+ tools → [`docs/reference/CLI-TOOLS.md`](docs/reference/CLI-TOOLS.md) · 🧩 OpenCode plugin → [`@omniroute/opencode-provider`](https://www.npmjs.com/package/@omniroute/opencode-provider)</sub>
 
 </div>
 
@@ -344,27 +395,60 @@ Result: 4 layers of fallback = zero downtime
 
 <div align="center">
 
-# 🌐 231 AI Providers — 50+ Free
+# 🌐 250 AI Providers — 90+ Free
 
 </div>
 
-> The most complete catalog of any open-source router: **236 providers**, **50+ with a free tier**, **11 free forever**.
+> The most complete catalog of any open-source router: **250 providers**, **90+ with a free tier**, **11 free forever**.
 
 <div align="center">
 
+### 🏢 Every major lab — through one endpoint
+
+<table>
+  <tr>
+    <td align="center" width="92"><picture><source media="(prefers-color-scheme:dark)" srcset="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-png@1.91.0/dark/openai.png"/><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/openai.svg" width="40" alt="OpenAI"/></picture><br/><sub>OpenAI</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/claude-color.svg" width="40" alt="Anthropic"/><br/><sub>Anthropic</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/gemini-color.svg" width="40" alt="Gemini"/><br/><sub>Gemini</sub></td>
+    <td align="center" width="92"><picture><source media="(prefers-color-scheme:dark)" srcset="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-png@1.91.0/dark/grok.png"/><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/grok.svg" width="40" alt="xAI Grok"/></picture><br/><sub>xAI Grok</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/deepseek-color.svg" width="40" alt="DeepSeek"/><br/><sub>DeepSeek</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/mistral-color.svg" width="40" alt="Mistral"/><br/><sub>Mistral</sub></td>
+  </tr>
+  <tr>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/qwen-color.svg" width="40" alt="Qwen"/><br/><sub>Qwen</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/meta-color.svg" width="40" alt="Meta Llama"/><br/><sub>Meta Llama</sub></td>
+    <td align="center" width="92"><picture><source media="(prefers-color-scheme:dark)" srcset="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-png@1.91.0/dark/groq.png"/><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/groq.svg" width="40" alt="Groq"/></picture><br/><sub>Groq</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/nvidia-color.svg" width="40" alt="NVIDIA"/><br/><sub>NVIDIA</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/minimax-color.svg" width="40" alt="MiniMax"/><br/><sub>MiniMax</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/cohere-color.svg" width="40" alt="Cohere"/><br/><sub>Cohere</sub></td>
+  </tr>
+  <tr>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/perplexity-color.svg" width="40" alt="Perplexity"/><br/><sub>Perplexity</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/huggingface-color.svg" width="40" alt="Hugging Face"/><br/><sub>HuggingFace</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/together-color.svg" width="40" alt="Together"/><br/><sub>Together</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/fireworks-color.svg" width="40" alt="Fireworks"/><br/><sub>Fireworks</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/cloudflare-color.svg" width="40" alt="Cloudflare"/><br/><sub>Cloudflare</sub></td>
+    <td align="center" width="92"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/baidu-color.svg" width="40" alt="Baidu"/><br/><sub>Baidu</sub></td>
+  </tr>
+</table>
+
+<sub>…and 220+ more — every icon resolves live from the dashboard's provider catalog. 📖 [Provider Reference](docs/reference/PROVIDER_REFERENCE.md)</sub>
+
+<br/>
+
 ### 🆓 Free Forever — $0, no card
 
 <table>
   <tr>
-    <td align="center" width="150"><img src="https://img.shields.io/badge/AgentRouter-FF6600?style=flat-square" alt="AgentRouter"/><br/><sub>GPT-5, Claude, Gemini<br/>$100 free credits</sub></td>
-    <td align="center" width="150"><img src="https://img.shields.io/badge/Qoder_AI-6366F1?style=flat-square" alt="Qoder AI"/><br/><sub>Kimi-K2, DeepSeek-R1<br/>Unlimited FREE</sub></td>
-    <td align="center" width="150"><img src="https://img.shields.io/badge/Pollinations-10B981?style=flat-square" alt="Pollinations"/><br/><sub>GPT-5, Claude, Llama 4<br/>No key needed</sub></td>
-    <td align="center" width="150"><img src="https://img.shields.io/badge/LongCat-FF7A00?style=flat-square" alt="LongCat"/><br/><sub>LongCat-2.0<br/>10M tokens one-time (KYC) 🔑</sub></td>
+    <td align="center" width="150"><img src="./public/providers/agentrouter.png" width="44" alt="AgentRouter"/><br/><b>AgentRouter</b><br/><sub>GPT-5, Claude, Gemini<br/>$100 free credits</sub></td>
+    <td align="center" width="150"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/qoder-color.svg" width="44" alt="Qoder AI"/><br/><b>Qoder AI</b><br/><sub>Kimi-K2, DeepSeek-R1<br/>Unlimited FREE</sub></td>
+    <td align="center" width="150"><picture><source media="(prefers-color-scheme:dark)" srcset="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-png@1.91.0/dark/pollinations.png"/><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/pollinations.svg" width="44" alt="Pollinations"/></picture><br/><b>Pollinations</b><br/><sub>GPT-5, Claude, Llama 4<br/>No key needed</sub></td>
+    <td align="center" width="150"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/longcat-color.svg" width="44" alt="LongCat"/><br/><b>LongCat</b><br/><sub>LongCat-2.0<br/>10M tokens one-time (KYC) 🔑</sub></td>
   </tr>
   <tr>
-    <td align="center" width="150"><img src="https://img.shields.io/badge/Cloudflare_AI-F38020?style=flat-square&logo=cloudflare&logoColor=white" alt="Cloudflare AI"/><br/><sub>50+ models<br/>10K neurons/day</sub></td>
-    <td align="center" width="150"><img src="https://img.shields.io/badge/NVIDIA_NIM-76B900?style=flat-square&logo=nvidia&logoColor=white" alt="NVIDIA NIM"/><br/><sub>129 models<br/>~40 RPM free</sub></td>
-    <td align="center" width="150"><img src="https://img.shields.io/badge/Cerebras-F15A29?style=flat-square" alt="Cerebras"/><br/><sub>Qwen3 235B<br/>1M tokens/day</sub></td>
+    <td align="center" width="150"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/cloudflare-color.svg" width="44" alt="Cloudflare AI"/><br/><b>Cloudflare AI</b><br/><sub>50+ models<br/>10K neurons/day</sub></td>
+    <td align="center" width="150"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/nvidia-color.svg" width="44" alt="NVIDIA NIM"/><br/><b>NVIDIA NIM</b><br/><sub>129 models<br/>~40 RPM free</sub></td>
+    <td align="center" width="150"><img src="https://cdn.jsdelivr.net/npm/@lobehub/icons-static-svg@1.91.0/icons/cerebras-color.svg" width="44" alt="Cerebras"/><br/><b>Cerebras</b><br/><sub>Qwen3 235B<br/>1M tokens/day</sub></td>
   </tr>
 </table>
 
@@ -420,7 +504,7 @@ Result: 4 layers of fallback = zero downtime
 
 </div>
 
-> OmniRoute isn't just a server — it's a **full command-line cockpit** with **60+ commands**, plus open agent protocols so an AI agent can drive OmniRoute **by itself**.
+> OmniRoute isn't just a server — it's a **full command-line cockpit** with **80+ commands**, plus open agent protocols so an AI agent can drive OmniRoute **by itself**.
 
 ### ⌨️ A real CLI (not just `start`)
 
@@ -460,7 +544,7 @@ Expose OmniRoute over **MCP** or **A2A** and any capable agent gets the keys to
 | Protocol           | Endpoint                                        | Use it for                                             |
 | ------------------ | ----------------------------------------------- | ------------------------------------------------------ |
 | 🧰 **MCP (stdio)** | `omniroute --mcp`                               | Plug into Claude Desktop, Cursor, any MCP client       |
-| 🌊 **MCP (HTTP)**  | `http://localhost:20128/api/mcp/stream`         | Remote MCP — **87 tools**, 30 scopes, full audit trail |
+| 🌊 **MCP (HTTP)**  | `http://localhost:20128/api/mcp/stream`         | Remote MCP — **94 tools**, 30 scopes, full audit trail |
 | 📡 **MCP (SSE)**   | `http://localhost:20128/api/mcp/sse`            | Streaming MCP transport                                |
 | 🤝 **A2A**         | `http://localhost:20128/.well-known/agent.json` | Agent-to-agent, **JSON-RPC 2.0** + SSE, 6 skills       |
 
@@ -479,9 +563,9 @@ claude mcp add-server omniroute --type http --url http://localhost:20128/api/mcp
 
 </div>
 
-> **Why use many token when few token do trick?** Every request passes through OmniRoute's compression pipeline **transparently** — no client changes. It's now a **stack of 9 composable engines** that run in order and mix & match per routing combo — building on ideas from [RTK](https://github.com/rtk-ai/rtk), [Caveman](https://github.com/JuliusBrussee/caveman) (⭐ 51K+), [LLMLingua-2](https://github.com/microsoft/LLMLingua), and [Troglodita](https://github.com/leninejunior/troglodita) (PT-BR).
+> **Why use many tokens when few tokens do the trick?** Every request passes through OmniRoute's compression pipeline **transparently** — no client changes. It's now a **stack of 10 composable engines** that run in order and mix & match per routing combo — building on ideas from [RTK](https://github.com/rtk-ai/rtk), [Caveman](https://github.com/JuliusBrussee/caveman) (⭐ 78K+), [LLMLingua-2](https://github.com/microsoft/LLMLingua), and [Troglodita](https://github.com/leninejunior/troglodita) (PT-BR).
 
-### 🧱 The 9-engine stack
+### 🧱 The 10-engine stack
 
 Engines run in pipeline order; each is independently toggleable and configurable per combo:
 
@@ -490,12 +574,13 @@ Engines run in pipeline order; each is independently toggleable and configurable
 | 1   | **Session-Dedup** | Drops content repeated across turns (content-addressed, cross-turn) |
 | 2   | **CCR**           | Archives large blocks behind retrieve markers, fetched on demand    |
 | 3   | **RTK**           | Smart tool-result filtering, dedup & truncation (command-aware)     |
-| 4   | **Headroom**      | Lossless tabular compaction of homogeneous JSON arrays (~30%+)      |
-| 5   | **Caveman**       | Rule-based prose compression (~65–75% on output)                    |
-| 6   | **LLMLingua-2**   | ML semantic pruning via MobileBERT ONNX — code-safe, async          |
-| 7   | **Lite**          | Whitespace + image-URL trimming (latency-light baseline)            |
-| 8   | **Aggressive**    | Summarization + progressive aging of old turns                      |
-| 9   | **Ultra**         | Heuristic token pruning with an optional small-model (SLM) tier     |
+| 4   | **Headroom**      | Lossless tabular compaction of homogeneous JSON arrays, flat or nested (~30%), via a vendored **GCF** codec (spec v3.2) |
+| 5   | **Relevance**     | Extractive sentence scoring against the last user query             |
+| 6   | **Caveman**       | Rule-based prose compression (~65–75% on output)                    |
+| 7   | **LLMLingua-2**   | ML semantic pruning via MobileBERT ONNX — code-safe, async          |
+| 8   | **Lite**          | Whitespace + image-URL trimming (latency-light baseline)            |
+| 9   | **Aggressive**    | Summarization + progressive aging of old turns                      |
+| 10  | **Ultra**         | Heuristic token pruning with an optional small-model (SLM) tier     |
 
 Code blocks, URLs and structured data are **always preserved** byte-perfect. **One-click presets** combine the engines:
 
@@ -529,7 +614,7 @@ Code blocks, URLs and structured data are **always preserved** byte-perfect. **O
 ### 📖 How it works — pipeline, architecture & savings math
 
 ```
-Client (10,000 tok) ──▶ OmniRoute Compression (9 engines) ──▶ Provider (~1,080 tok, up to 95% saved)
+Client (10,000 tok) ──▶ OmniRoute Compression (10 engines) ──▶ Provider (~1,080 tok, up to 95% saved)
 ```
 
 Default stacked combo runs `RTK → Caveman`. When both act on the same tool/context payload, savings compound:
@@ -544,7 +629,7 @@ Code blocks, URLs, JSON and structured data are **always protected** by the pres
 
 ### 🎚️ Beyond the engines — output styles, the adaptive dial & per-request control
 
-The 9 engines above shrink what goes **in**. Three more layers shape **how**, **when**, and what comes **out**:
+The 10 engines above shrink what goes **in**. Three more layers shape **how**, **when**, and what comes **out**:
 
 - **🪄 Output Styles** _(output-axis steering)_ — inject deterministic, cache-safe response-shaping instructions; combinable, each at `lite` / `full` / `ultra` intensity. Adding a style is a one-line registry entry:
   - **Terse prose** — drop filler / articles / hedging; keep technical substance exact.
@@ -628,7 +713,7 @@ PORT=20128 npm run dev
 **📦 pnpm**
 
 ```bash
-pnpm install -g omniroute && pnpm approve-builds -g && omniroute
+pnpm add -g omniroute@latest --allow-build=better-sqlite3 --allow-build=@swc/core && omniroute
 ```
 
 **🐧 Arch Linux (AUR)**
@@ -666,6 +751,24 @@ podman compose --profile base up -d
 
 📖 [Podman Guide](contrib/podman/README.md) — Quadlet setup, podman-compose, Quadlet.
 
+**⚡ Faster / leaner install (skip the native build)**
+
+The native SQLite engine (`better-sqlite3`) is an **optional** dependency, so a global
+install never blocks on compiling from source: it uses a prebuilt binary when one matches
+your platform/Node, and otherwise falls back transparently to a pure-JS engine
+(`node:sqlite` on Node 22+, else the bundled `sql.js` WASM) — no build tools required.
+
+To skip the post-install native warm-up entirely (CI, headless, or slow machines):
+
+```bash
+OMNIROUTE_SKIP_POSTINSTALL=1 npm install -g omniroute   # CI=1 also skips it
+```
+
+For the fastest installs prefer **pnpm** (content-addressed store + hard links — see above).
+For a dashboard-free, headless runtime use the Docker `base` profile (above) or the
+[Termux guide](docs/guides/TERMUX_GUIDE.md). The CLI and the web dashboard are served by the
+same process on one port, so there is no separate CLI-only package today.
+
 <br/>
 
 <div align="center">
@@ -720,16 +823,16 @@ podman compose --profile base up -d
 
 **The $0 Free Stack — combine into one unbreakable combo:**
 
-| Provider          | Prefix      | Free models                                     | Quota             |
-| ----------------- | ----------- | ----------------------------------------------- | ----------------- |
-| **Kiro**          | `kr/`       | Claude Sonnet 4.5, Haiku 4.5, Opus 4.6          | 50 credits/mo     |
-| **Qoder**         | `if/`       | kimi-k2-thinking, qwen3-coder-plus, deepseek-r1 | ♾️ Unlimited      |
-| **Qwen**          | `qw/`       | qwen3-coder-plus/flash/next                     | ♾️ Unlimited      |
-| **Pollinations**  | `pol/`      | GPT-5, Claude, Gemini, DeepSeek, Llama 4        | No key needed     |
+| Provider          | Prefix      | Free models                                     | Quota              |
+| ----------------- | ----------- | ----------------------------------------------- | ------------------ |
+| **Kiro**          | `kr/`       | Claude Sonnet 4.5, Haiku 4.5, Opus 4.6          | 50 credits/mo      |
+| **Qoder**         | `if/`       | kimi-k2-thinking, qwen3-coder-plus, deepseek-r1 | ♾️ Unlimited       |
+| **Qwen**          | `qw/`       | qwen3-coder-plus/flash/next                     | ♾️ Unlimited       |
+| **Pollinations**  | `pol/`      | GPT-5, Claude, Gemini, DeepSeek, Llama 4        | No key needed      |
 | **LongCat**       | `lc/`       | LongCat-2.0                                     | 10M one-time (KYC) |
-| **Cloudflare AI** | `cf/`       | 50+ models                                      | 10K neurons/day   |
-| **NVIDIA NIM**    | `nvidia/`   | 129 models                                      | ~40 RPM           |
-| **Cerebras**      | `cerebras/` | Qwen3 235B, GPT-OSS 120B                        | 1M tok/day        |
+| **Cloudflare AI** | `cf/`       | 50+ models                                      | 10K neurons/day    |
+| **NVIDIA NIM**    | `nvidia/`   | 129 models                                      | ~40 RPM            |
+| **Cerebras**      | `cerebras/` | Qwen3 235B, GPT-OSS 120B                        | 1M tok/day         |
 
 > 💡 The dashboard "cost" is a **savings tracker**, not a bill — OmniRoute never charges you. A "$290 total cost" using free models means **$290 saved**.
 
@@ -778,9 +881,9 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
 
 <br/>
 
-**Routing:** 15 strategies · task-aware smart routing · thinking budget controls · wildcard routing · system prompt injection.
+**Routing:** 18 strategies · task-aware smart routing · thinking budget controls · wildcard routing · system prompt injection.
 **Compatibility:** OpenAI ↔ Claude ↔ Gemini ↔ Responses API · auto OAuth refresh (PKCE, 8 providers) · multi-account round-robin · Batch + Files API · live OpenAPI 3.0.
-**Protocols:** MCP (87 tools, 3 transports, 30 scopes) · A2A (JSON-RPC 2.0, SSE, 6 skills) · ACP · cloud agents (Codex, Devin, Jules).
+**Protocols:** MCP (94 tools, 3 transports, 30 scopes) · A2A (JSON-RPC 2.0, SSE, 6 skills) · ACP · cloud agents (Codex, Cursor, Devin, Jules).
 **Plugins:** custom plugin marketplace (system-configured registry URL with SSRF-guarded fetch) · install / enable / disable · Notion + Obsidian knowledge-base integrations (WebDAV file server, vault search, note CRUD).
 **Embedded services:** one-click install & lifecycle management of local sidecar services (CLIProxy, NineRouter).
 **Quality & Ops:** built-in **Evals** (golden-set: exact/contains/regex/custom) · guardrails (PII, injection, vision) · health dashboard · p50/p95/p99 telemetry · webhooks · compliance audit.
@@ -804,7 +907,7 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
 **Will I be charged by OmniRoute?** No — it's free, open-source software on your machine. You only pay paid providers directly. OmniRoute has no billing system.
 **Are FREE providers really unlimited?** Mostly — Qoder, Pollinations, LongCat, and Cloudflare are free with no per-account credit cap. Kiro is free too but capped at ~50 credits/month per account. Stack multiple free providers in a combo and auto-fallback keeps you serving for $0.
 **Will compression hurt quality?** No — it only compresses the **input**; code, URLs, JSON are always protected.
-**Does it work where AI is blocked?** Yes — 3-level proxy + 1proxy marketplace reach all 236 providers.
+**Does it work where AI is blocked?** Yes — 3-level proxy + 1proxy marketplace reach all 250 providers.
 
 📖 [User Guide](docs/guides/USER_GUIDE.md) · [API Reference](docs/reference/API_REFERENCE.md) · [Environment Config](docs/reference/ENVIRONMENT.md)
 
@@ -874,7 +977,7 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
 - **Protocols**: MCP (stdio/HTTP) + A2A v0.3 (JSON-RPC 2.0 + SSE)
 - **Streaming**: Server-Sent Events (SSE) + WebSocket bridge (`/v1/ws`)
 - **Auth**: OAuth 2.0 (PKCE) + JWT + API Keys + MCP Scoped Authorization
-- **Testing**: Node.js test runner + Vitest (**14,965 test cases** across 517 files — unit, integration, E2E, security, ecosystem)
+- **Testing**: Node.js test runner + Vitest (**21,000+ test cases** across 2,586 files — unit, integration, E2E, security, ecosystem)
 - **Platforms**: Desktop (Electron), Android (Termux), PWA (any browser)
 - **CI/CD**: GitHub Actions (auto npm publish + Docker Hub on release)
 - **Website**: [omniroute.online](https://omniroute.online)
@@ -892,66 +995,56 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
 
 ### 📘 Getting Started
 
-| Document                                                       | Description                                                                      |
-| -------------------------------------------------------------- | -------------------------------------------------------------------------------- |
-| [User Guide](docs/guides/USER_GUIDE.md)                        | Providers, combos, CLI integration, deployment                                   |
-| [Setup Guide](docs/guides/SETUP_GUIDE.md)                      | Full install methods, CLI tool configs, protocol setup, timeout tuning           |
-| [CLI Tools Guide](docs/reference/CLI-TOOLS.md)                 | Per-tool setup for Claude Code, Codex, Cursor, Cline, OpenClaw, Kilo, Copilot    |
-| [Remote Mode](docs/guides/REMOTE-MODE.md)                      | Drive a remote OmniRoute (VPS) from your laptop CLI via scoped access tokens     |
-| [Claude Code Config](docs/guides/CLAUDE-CODE-CONFIGURATION.md) | Point Claude Code at OmniRoute (local/remote) with `launch` + per-model profiles |
-| [Quick Start](README.md#-quick-start)                          | 3-step install → connect → configure                                             |
+- **[User Guide](docs/guides/USER_GUIDE.md)** — Providers, combos, CLI integration, deployment
+- **[Setup Guide](docs/guides/SETUP_GUIDE.md)** — Full install methods, CLI tool configs, protocol setup, timeout tuning
+- **[CLI Tools Guide](docs/reference/CLI-TOOLS.md)** — Per-tool setup for Claude Code, Codex, Cursor, Cline, OpenClaw, Kilo, Copilot
+- **[Remote Mode](docs/guides/REMOTE-MODE.md)** — Drive a remote OmniRoute (VPS) from your laptop CLI via scoped access tokens
+- **[Claude Code Config](docs/guides/CLAUDE-CODE-CONFIGURATION.md)** — Point Claude Code at OmniRoute (local/remote) with `launch` + per-model profiles
+- **[Quick Start](README.md#-quick-start)** — 3-step install → connect → configure
 
 ### 🔧 Operations & Deployment
 
-| Document                                                 | Description                                                    |
-| -------------------------------------------------------- | -------------------------------------------------------------- |
-| [Docker Guide](docs/guides/DOCKER_GUIDE.md)              | Docker run, Compose profiles, Caddy HTTPS, tunnels, image tags |
-| [Podman Guide](contrib/podman/README.md)                 | Quadlet systemd integration, podman-compose, SELinux           |
-| [VM Deployment](docs/ops/VM_DEPLOYMENT_GUIDE.md)         | Complete guide: VM + nginx + Cloudflare setup                  |
-| [Fly.io Deployment](docs/ops/FLY_IO_DEPLOYMENT_GUIDE.md) | Deploy to Fly.io with persistent storage                       |
-| [Termux Guide](docs/guides/TERMUX_GUIDE.md)              | Run OmniRoute on Android via Termux                            |
-| [PWA Guide](docs/guides/PWA_GUIDE.md)                    | Progressive Web App install, caching, architecture             |
-| [Uninstall Guide](docs/guides/UNINSTALL.md)              | Clean removal for all install methods                          |
-| [Environment Config](docs/reference/ENVIRONMENT.md)      | Complete `.env` variables and references                       |
+- **[Docker Guide](docs/guides/DOCKER_GUIDE.md)** — Docker run, Compose profiles, Caddy HTTPS, tunnels, image tags
+- **[Podman Guide](contrib/podman/README.md)** — Quadlet systemd integration, podman-compose, SELinux
+- **[VM Deployment](docs/ops/VM_DEPLOYMENT_GUIDE.md)** — Complete guide: VM + nginx + Cloudflare setup
+- **[Fly.io Deployment](docs/ops/FLY_IO_DEPLOYMENT_GUIDE.md)** — Deploy to Fly.io with persistent storage
+- **[Termux Guide](docs/guides/TERMUX_GUIDE.md)** — Run OmniRoute on Android via Termux
+- **[PWA Guide](docs/guides/PWA_GUIDE.md)** — Progressive Web App install, caching, architecture
+- **[Uninstall Guide](docs/guides/UNINSTALL.md)** — Clean removal for all install methods
+- **[Environment Config](docs/reference/ENVIRONMENT.md)** — Complete `.env` variables and references
 
 ### 🧠 Features & Architecture
 
-| Document                                                                     | Description                                                                   |
-| ---------------------------------------------------------------------------- | ----------------------------------------------------------------------------- |
-| [Architecture](docs/architecture/ARCHITECTURE.md)                            | System architecture, data flow, and internals                                 |
-| [Compression Guide](docs/compression/COMPRESSION_GUIDE.md)                   | 7-option pipeline: off / lite / standard / aggressive / ultra / RTK / stacked |
-| [RTK Compression](docs/compression/RTK_COMPRESSION.md)                       | Command-output compression, filters, trust, verify, raw-output recovery       |
-| [Compression Engines](docs/compression/COMPRESSION_ENGINES.md)               | Caveman, RTK, stacked pipelines, dashboard/API/MCP surfaces                   |
-| [Compression Rules Format](docs/compression/COMPRESSION_RULES_FORMAT.md)     | JSON rule-pack schemas for Caveman and RTK filters                            |
-| [Compression Language Packs](docs/compression/COMPRESSION_LANGUAGE_PACKS.md) | Language detection and Caveman rule-pack authoring                            |
-| [Resilience Guide](docs/architecture/RESILIENCE_GUIDE.md)                    | Circuit breakers, cooldowns, queue, anti-thundering herd, TLS spoofing        |
-| [Auto-Combo Engine](docs/routing/AUTO-COMBO.md)                              | 9-factor scoring, mode packs, self-healing                                    |
-| [Proxy Guide](docs/ops/PROXY_GUIDE.md)                                       | 3-level proxy system, 1proxy marketplace, registry CRUD                       |
-| [Free Tiers](docs/reference/FREE_TIERS.md)                                   | 25+ free API providers consolidated directory                                 |
-| [Features Gallery](docs/guides/FEATURES.md)                                  | Visual dashboard tour with screenshots                                        |
-| [Codebase Documentation](docs/architecture/CODEBASE_DOCUMENTATION.md)        | Beginner-friendly codebase walkthrough                                        |
+- **[Architecture](docs/architecture/ARCHITECTURE.md)** — System architecture, data flow, and internals
+- **[Compression Guide](docs/compression/COMPRESSION_GUIDE.md)** — 7-option pipeline: off / lite / standard / aggressive / ultra / RTK / stacked
+- **[RTK Compression](docs/compression/RTK_COMPRESSION.md)** — Command-output compression, filters, trust, verify, raw-output recovery
+- **[Compression Engines](docs/compression/COMPRESSION_ENGINES.md)** — Caveman, RTK, stacked pipelines, dashboard/API/MCP surfaces
+- **[Compression Rules Format](docs/compression/COMPRESSION_RULES_FORMAT.md)** — JSON rule-pack schemas for Caveman and RTK filters
+- **[Compression Language Packs](docs/compression/COMPRESSION_LANGUAGE_PACKS.md)** — Language detection and Caveman rule-pack authoring
+- **[Resilience Guide](docs/architecture/RESILIENCE_GUIDE.md)** — Circuit breakers, cooldowns, queue, anti-thundering herd, TLS spoofing
+- **[Auto-Combo Engine](docs/routing/AUTO-COMBO.md)** — 12-factor scoring, mode packs, self-healing
+- **[Proxy Guide](docs/ops/PROXY_GUIDE.md)** — 3-level proxy system, 1proxy marketplace, registry CRUD
+- **[Free Tiers](docs/reference/FREE_TIERS.md)** — 25+ free API providers consolidated directory
+- **[Features Gallery](docs/guides/FEATURES.md)** — Visual dashboard tour with screenshots
+- **[Codebase Documentation](docs/architecture/CODEBASE_DOCUMENTATION.md)** — Beginner-friendly codebase walkthrough
 
 ### 🤖 Protocols & APIs
 
-| Document                                          | Description                                         |
-| ------------------------------------------------- | --------------------------------------------------- |
-| [API Reference](docs/reference/API_REFERENCE.md)  | All endpoints with examples                         |
-| [OpenAPI Spec](docs/openapi.yaml)                 | OpenAPI 3.0 specification                           |
-| [MCP Server](open-sse/mcp-server/README.md)       | 87 MCP tools, IDE configs, Python/TS/Go clients     |
-| [MCP Server Guide](docs/frameworks/MCP-SERVER.md) | MCP installation, transports, and tool reference    |
-| [A2A Server](src/lib/a2a/README.md)               | JSON-RPC 2.0 protocol, skills, streaming, task mgmt |
-| [A2A Server Guide](docs/frameworks/A2A-SERVER.md) | A2A agent card, tasks, skills, and streaming        |
+- **[API Reference](docs/reference/API_REFERENCE.md)** — All endpoints with examples
+- **[OpenAPI Spec](docs/openapi.yaml)** — OpenAPI 3.0 specification
+- **[MCP Server](open-sse/mcp-server/README.md)** — 95 MCP tools, IDE configs, Python/TS/Go clients
+- **[MCP Server Guide](docs/frameworks/MCP-SERVER.md)** — MCP installation, transports, and tool reference
+- **[A2A Server](src/lib/a2a/README.md)** — JSON-RPC 2.0 protocol, skills, streaming, task mgmt
+- **[A2A Server Guide](docs/frameworks/A2A-SERVER.md)** — A2A agent card, tasks, skills, and streaming
 
 ### 📋 Project & Quality
 
-| Document                                           | Description                                     |
-| -------------------------------------------------- | ----------------------------------------------- |
-| [Contributing](CONTRIBUTING.md)                    | Development setup and guidelines                |
-| [Changelog](CHANGELOG.md)                          | Full per-version release history                |
-| [Security Policy](SECURITY.md)                     | Vulnerability reporting and security practices  |
-| [i18n Guide](docs/guides/I18N.md)                  | 40+ language support, translation workflow, RTL |
-| [Release Checklist](docs/ops/RELEASE_CHECKLIST.md) | Pre-release validation steps                    |
-| [Coverage Plan](docs/ops/COVERAGE_PLAN.md)         | Test coverage strategy and 14,965 test suite    |
+- **[Contributing](CONTRIBUTING.md)** — Development setup and guidelines
+- **[Changelog](CHANGELOG.md)** — Full per-version release history
+- **[Security Policy](SECURITY.md)** — Vulnerability reporting and security practices
+- **[i18n Guide](docs/guides/I18N.md)** — 40+ language support, translation workflow, RTL
+- **[Release Checklist](docs/ops/RELEASE_CHECKLIST.md)** — Pre-release validation steps
+- **[Coverage Plan](docs/ops/COVERAGE_PLAN.md)** — Test coverage strategy and 21,000+ test suite
 
 <br/>
 
@@ -965,23 +1058,23 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
   <tr>
     <td align="center" width="160">
       <a href="https://github.com/oyi77">
-        <img src="https://github.com/oyi77.png" width="80" style="border-radius:50%" alt="oyi77"/><br/>
+        <img src="https://github.com/oyi77.png" width="40" style="border-radius:50%" alt="oyi77"/><br/>
         <b>oyi77</b>
       </a><br/>
-      <sub>🥇 190 commits • +72K lines</sub><br/>
+      <sub>🥇 189 commits • +155K lines</sub><br/>
       <sub>Analytics engine, SQL aggregations,<br/>proxy marketplace, test coverage</sub>
     </td>
     <td align="center" width="160">
       <a href="https://github.com/christopher-s">
-        <img src="https://github.com/christopher-s.png" width="80" style="border-radius:50%" alt="Chris Staley"/><br/>
+        <img src="https://github.com/christopher-s.png" width="40" style="border-radius:50%" alt="Chris Staley"/><br/>
         <b>Chris Staley</b>
       </a><br/>
-      <sub>🥈 72 commits • +5.7K lines</sub><br/>
+      <sub>🥈 70 commits • +5.7K lines</sub><br/>
       <sub>SSE stream hardening, Responses API,<br/>Gemini pagination, test regression fixes</sub>
     </td>
     <td align="center" width="160">
       <a href="https://github.com/zenobit">
-        <img src="https://github.com/zenobit.png" width="80" style="border-radius:50%" alt="zenobit"/><br/>
+        <img src="https://github.com/zenobit.png" width="40" style="border-radius:50%" alt="zenobit"/><br/>
         <b>zenobit</b>
       </a><br/>
       <sub>🥉 62 commits • +24K lines</sub><br/>
@@ -989,20 +1082,28 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
     </td>
     <td align="center" width="160">
       <a href="https://github.com/rdself">
-        <img src="https://github.com/rdself.png" width="80" style="border-radius:50%" alt="R.D. & Randi"/><br/>
+        <img src="https://github.com/rdself.png" width="40" style="border-radius:50%" alt="R.D. & Randi"/><br/>
         <b>R.D. & Randi</b>
       </a><br/>
-      <sub>🏅 107 commits • +28K lines</sub><br/>
+      <sub>🏅 108 commits • +30K lines</sub><br/>
       <sub>Endpoints page, tunnel integrations,<br/>Docker workflows, A2A status, compression UI</sub>
     </td>
     <td align="center" width="160">
       <a href="https://github.com/benzntech">
-        <img src="https://github.com/benzntech.png" width="80" style="border-radius:50%" alt="benzntech"/><br/>
+        <img src="https://github.com/benzntech.png" width="40" style="border-radius:50%" alt="benzntech"/><br/>
         <b>benzntech</b>
       </a><br/>
-      <sub>🏅 20 commits • +7.5K lines</sub><br/>
+      <sub>🏅 22 commits • +7.5K lines</sub><br/>
       <sub>Electron desktop app, auto-updater,<br/>release build workflows, cross-platform CI</sub>
     </td>
+    <td align="center" width="160">
+      <a href="https://github.com/herjarsa">
+        <img src="https://github.com/herjarsa.png" width="40" style="border-radius:50%" alt="herjarsa"/><br/>
+        <b>herjarsa</b>
+      </a><br/>
+      <sub>🏅 21 commits • +6K lines</sub><br/>
+      <sub>Zero-latency combos, vision-bridge auto-routing,<br/>catalog context-length, resilience 429 hints</sub>
+    </td>
   </tr>
 </table>
 
@@ -1016,11 +1117,11 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
 
 <div align="center">
 
-## 👥 Contributors
+## 👥 280+ Contributors
 
 </div>
 
-[![Contributors](https://contrib.rocks/image?repo=diegosouzapw/OmniRoute&max=100&columns=20&anon=1)](https://github.com/diegosouzapw/OmniRoute/graphs/contributors)
+[![Contributors](https://contrib.rocks/image?repo=diegosouzapw/OmniRoute&max=200&columns=20&anon=1)](https://github.com/diegosouzapw/OmniRoute/graphs/contributors)
 
 ### How to Contribute
 
@@ -1045,14 +1146,13 @@ gh release create v3.8.2 --title "v3.8.2" --generate-notes
 
 ## 📊 Stars
 
-<a href="https://www.star-history.com/?repos=diegosouzapw%2Fomniroute&type=date&legend=top-left">
+<a href="https://www.star-history.com/?repos=diegosouzapw%2FOmniRoute&type=date&legend=top-left">
  <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=diegosouzapw/omniroute&type=date&theme=dark&legend=top-left" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=diegosouzapw/omniroute&type=date&legend=top-left" />
-   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=diegosouzapw/omniroute&type=date&legend=top-left" />
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=diegosouzapw/OmniRoute&type=date&theme=dark&legend=top-left&sealed_token=XP_ycEjv7s31p1edvhsMOXry51OWYsUjDRWjflSG7jQKRpO9hPGg7i_EHvwhI6QtrARTMH-YGjJhi8sumRYflEJD0DPlH_MMHjizhBYCX8fbHFrHEiNvVA" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=diegosouzapw/OmniRoute&type=date&legend=top-left&sealed_token=XP_ycEjv7s31p1edvhsMOXry51OWYsUjDRWjflSG7jQKRpO9hPGg7i_EHvwhI6QtrARTMH-YGjJhi8sumRYflEJD0DPlH_MMHjizhBYCX8fbHFrHEiNvVA" />
+   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=diegosouzapw/OmniRoute&type=date&legend=top-left&sealed_token=XP_ycEjv7s31p1edvhsMOXry51OWYsUjDRWjflSG7jQKRpO9hPGg7i_EHvwhI6QtrARTMH-YGjJhi8sumRYflEJD0DPlH_MMHjizhBYCX8fbHFrHEiNvVA" />
  </picture>
 </a>
-</div>
 
 <br/>
 
@@ -1085,36 +1185,36 @@ OmniRoute stands on the shoulders of giants. It started as a fork of **[9router]
 
 | Project                                                                         |    ⭐ | How it inspired OmniRoute                                                                                                             |
 | ------------------------------------------------------------------------------- | ----: | ------------------------------------------------------------------------------------------------------------------------------------- |
-| **[9router](https://github.com/decolua/9router)** · decolua                     | 17.9k | The original project this fork is built on — extended here with multi-modal APIs and a full TypeScript rewrite.                       |
-| **[CLIProxyAPI](https://github.com/router-for-me/CLIProxyAPI)** · router-for-me | 37.8k | The Go implementation that inspired this JavaScript / TypeScript port.                                                                |
-| **[LiteLLM](https://github.com/BerriAI/litellm)** · BerriAI                     | 50.8k | The AI gateway whose public pricing dataset feeds our cost-tracking sync and whose provider-normalization model informed our routing. |
+| **[9router](https://github.com/decolua/9router)** · decolua                     | 19.0k | The original project this fork is built on — extended here with multi-modal APIs and a full TypeScript rewrite.                       |
+| **[CLIProxyAPI](https://github.com/router-for-me/CLIProxyAPI)** · router-for-me | 38.8k | The Go implementation that inspired this JavaScript / TypeScript port.                                                                |
+| **[LiteLLM](https://github.com/BerriAI/litellm)** · BerriAI                     | 52.1k | The AI gateway whose public pricing dataset feeds our cost-tracking sync and whose provider-normalization model informed our routing. |
 
 ### 🗜️ Context & token compression — engines
 
-| Project                                                                      |    ⭐ | How it inspired OmniRoute                                                                                                                                                                                |
-| ---------------------------------------------------------------------------- | ----: | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **[Caveman](https://github.com/JuliusBrussee/caveman)** · JuliusBrussee      | 74.5k | The viral "why use many token when few token do trick" project — its caveman-speak philosophy powers our standard compression mode and 30+ filler/condensation rules.                                    |
-| **[RTK – Rust Token Killer](https://github.com/rtk-ai/rtk)** · rtk-ai        | 63.6k | High-performance command-output compression — inspired our RTK engine, JSON filter DSL, raw-output recovery and the stacked RTK → Caveman pipeline.                                                      |
-| **[headroom](https://github.com/chopratejas/headroom)** · chopratejas        | 33.6k | Reversible context-compression (SmartCrusher) — inspired our `headroom` engine and the `ccr` retrieve-marker pattern.                                                                                    |
-| **[LLMLingua](https://github.com/microsoft/LLMLingua)** · Microsoft          |  6.3k | Prompt-compression research (LLMLingua / LLMLingua-2) — inspired our async, code-safe, fail-open `llmlingua` engine.                                                                                     |
-| **[llmlingua-2-js](https://github.com/atjsh/llmlingua-2-js)** · atjsh        |    27 | The JS/ONNX port (MobileBERT / XLM-RoBERTa) used as the worker-thread backend for our LLMLingua engine.                                                                                                  |
-| **[Troglodita](https://github.com/leninejunior/troglodita)** · Lenine Júnior |    15 | PT-BR token compression — powers our pt-BR language pack: pleonasm reduction and filler removal tuned for Brazilian-Portuguese grammar.                                                                  |
-| **[ponytail](https://github.com/DietrichGebert/ponytail)** · DietrichGebert  | 51.4k | The viral "lazy senior dev" YAGNI-coder skill — inspired our **less-code** Output Style: smallest-working-change steering that cuts _generated_ code (the output-axis sibling to Caveman's terse prose). |
+| Project                                                                       |    ⭐ | How it inspired OmniRoute                                                                                                                                                                                |
+| ----------------------------------------------------------------------------- | ----: | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **[Caveman](https://github.com/JuliusBrussee/caveman)** · JuliusBrussee       | 78.2k | The viral "why use many token when few token do trick" project — its caveman-speak philosophy powers our standard compression mode and 30+ filler/condensation rules.                                    |
+| **[RTK – Rust Token Killer](https://github.com/rtk-ai/rtk)** · rtk-ai         | 67.3k | High-performance command-output compression — inspired our RTK engine, JSON filter DSL, raw-output recovery and the stacked RTK → Caveman pipeline.                                                      |
+| **[headroom](https://github.com/headroomlabs-ai/headroom)** · headroomlabs-ai | 54.5k | Reversible context-compression (SmartCrusher) — inspired our `headroom` engine and the `ccr` retrieve-marker pattern.                                                                                    |
+| **[LLMLingua](https://github.com/microsoft/LLMLingua)** · Microsoft           |  6.4k | Prompt-compression research (LLMLingua / LLMLingua-2) — inspired our async, code-safe, fail-open `llmlingua` engine.                                                                                     |
+| **[llmlingua-2-js](https://github.com/atjsh/llmlingua-2-js)** · atjsh         |    28 | The JS/ONNX port (MobileBERT / XLM-RoBERTa) used as the worker-thread backend for our LLMLingua engine.                                                                                                  |
+| **[Troglodita](https://github.com/leninejunior/troglodita)** · Lenine Júnior  |    16 | PT-BR token compression — powers our pt-BR language pack: pleonasm reduction and filler removal tuned for Brazilian-Portuguese grammar.                                                                  |
+| **[ponytail](https://github.com/DietrichGebert/ponytail)** · DietrichGebert   | 68.8k | The viral "lazy senior dev" YAGNI-coder skill — inspired our **less-code** Output Style: smallest-working-change steering that cuts _generated_ code (the output-axis sibling to Caveman's terse prose). |
 
 ### 🧩 Compact formats, token research & code-aware tooling
 
 | Project                                                                                        |    ⭐ | How it inspired OmniRoute                                                                                                                                                                                      |
 | ---------------------------------------------------------------------------------------------- | ----: | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **[TOON](https://github.com/toon-format/toon)** · toon-format                                  | 24.6k | Token-Oriented Object Notation — its columnar, header-plus-rows model shaped our tabular compaction stage.                                                                                                     |
-| **[GCF – Graph Compact Format](https://github.com/blackwell-systems/gcf)** · Blackwell Systems |    11 | Schema-aware "JSON for LLMs" notation — co-inspired our lossless homogeneous-array compaction with `[N rows]` markers.                                                                                         |
-| **[token-optimizer-mcp](https://github.com/ooples/token-optimizer-mcp)** · ooples              |   409 | Brotli/SQLite cache + per-session context-delta — inspired our `session-dedup` engine.                                                                                                                         |
-| **[token-savior](https://github.com/Mibayy/token-savior)** · Mibayy                            |   993 | Bash-output compaction + MCP profiles — inspired our compression bail-out discipline and MCP tool-manifest reduction.                                                                                          |
-| **[token-saver](https://github.com/ppgranger/token-saver)** · ppgranger                        |   103 | Content-aware, per-file-type output compression with failure-aware bail-out — validated our per-type dispatch and minimum-gain skip.                                                                           |
-| **[token-optimizer](https://github.com/alexgreensh/token-optimizer)** · alexgreensh            |  1.4k | "Find the ghost tokens" — its offload + recoverable-handle pattern informed our CCR offload thinking.                                                                                                          |
-| **[TokenMizer](https://github.com/Shweta-Mishra-ai/tokenmizer)** · Shweta-Mishra-ai            |     1 | A session-graph + cross-turn line-dedup blueprint that informed our session-dedup design.                                                                                                                      |
+| **[TOON](https://github.com/toon-format/toon)** · toon-format                                  | 24.7k | Token-Oriented Object Notation — its columnar, header-plus-rows model shaped our tabular compaction stage.                                                                                                     |
+| **[GCF – Graph Compact Format](https://github.com/blackwell-systems/gcf)** · Blackwell Systems |    14 | First inspired our tabular compaction stage; now its zero-dependency, lossless generic-profile encoder is **vendored directly** as the Headroom codec (MIT, SPDX-marked), current with GCF spec v3.2. |
+| **[token-optimizer-mcp](https://github.com/ooples/token-optimizer-mcp)** · ooples              |   421 | Brotli/SQLite cache + per-session context-delta — inspired our `session-dedup` engine.                                                                                                                         |
+| **[token-savior](https://github.com/Mibayy/token-savior)** · Mibayy                            |  1.0k | Bash-output compaction + MCP profiles — inspired our compression bail-out discipline and MCP tool-manifest reduction.                                                                                          |
+| **[token-saver](https://github.com/ppgranger/token-saver)** · ppgranger                        |   110 | Content-aware, per-file-type output compression with failure-aware bail-out — validated our per-type dispatch and minimum-gain skip.                                                                           |
+| **[token-optimizer](https://github.com/alexgreensh/token-optimizer)** · alexgreensh            |  1.5k | "Find the ghost tokens" — its offload + recoverable-handle pattern informed our CCR offload thinking.                                                                                                          |
+| **[TokenMizer](https://github.com/Shweta-Mishra-ai/tokenmizer)** · Shweta-Mishra-ai            |     2 | A session-graph + cross-turn line-dedup blueprint that informed our session-dedup design.                                                                                                                      |
 | **[OmniCompress](https://github.com/jessefreitas/OmniCompress)** · jessefreitas                |     2 | Rust columnar-JSON + content-addressed retrieve + cross-message dedup — validated our `headroom`/`ccr`/`session-dedup` engine design and the cache-stable "compressed form is position-independent" invariant. |
-| **[mcp-compressor](https://github.com/atlassian-labs/mcp-compressor)** · Atlassian Labs        |    80 | MCP tool-schema/description compression — informed our MCP tool-manifest cardinality reduction.                                                                                                                |
-| **[RepoMapper](https://github.com/pdavis68/RepoMapper)** · pdavis68                            |   182 | Aider-style repo-map ranking — informed our repo-map / retrieval-ranking exploration.                                                                                                                          |
+| **[mcp-compressor](https://github.com/atlassian-labs/mcp-compressor)** · Atlassian Labs        |    89 | MCP tool-schema/description compression — informed our MCP tool-manifest cardinality reduction.                                                                                                                |
+| **[RepoMapper](https://github.com/pdavis68/RepoMapper)** · pdavis68                            |   181 | Aider-style repo-map ranking — informed our repo-map / retrieval-ranking exploration.                                                                                                                          |
 | **[quiet-shell-mcp](https://github.com/mrsimpson/quiet-shell-mcp)** · mrsimpson                |     4 | Declarative shell-output reduction over MCP — validated our declarative bash-output compaction.                                                                                                                |
 | **[ts-morph](https://github.com/dsherret/ts-morph)** · David Sherret                           |  6.1k | TypeScript Compiler API toolkit — inspired our parser-based comment removal that preserves string, template and regex literals.                                                                                |
 
@@ -1122,27 +1222,27 @@ OmniRoute stands on the shoulders of giants. It started as a fork of **[9router]
 
 | Project                                                            |    ⭐ | How it inspired OmniRoute                                                                                           |
 | ------------------------------------------------------------------ | ----: | ------------------------------------------------------------------------------------------------------------------- |
-| **[Mem0](https://github.com/mem0ai/mem0)** · mem0ai                | 58.9k | Universal memory layer — its proxy-as-write/read-boundary model shaped our memory architecture.                     |
-| **[Letta (MemGPT)](https://github.com/letta-ai/letta)** · letta-ai | 23.4k | Stateful agents with tiered memory — inspired our Context Control & Recovery (CCR) tiered model.                    |
+| **[Mem0](https://github.com/mem0ai/mem0)** · mem0ai                | 59.8k | Universal memory layer — its proxy-as-write/read-boundary model shaped our memory architecture.                     |
+| **[Letta (MemGPT)](https://github.com/letta-ai/letta)** · letta-ai | 23.6k | Stateful agents with tiered memory — inspired our Context Control & Recovery (CCR) tiered model.                    |
 | **[WFGY](https://github.com/onestardao/WFGY)** · onestardao        |  1.8k | The ProblemMap taxonomy of 16 recurring RAG/LLM failure modes — the shared vocabulary in our troubleshooting guide. |
 
 ### 🛰️ Traffic inspection, MITM & transparent proxy
 
 | Project                                                                           |   ⭐ | How it inspired OmniRoute                                                                                                                                                        |
 | --------------------------------------------------------------------------------- | ---: | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **[llm-interceptor](https://github.com/chouzz/llm-interceptor)** · chouzz         |   46 | MITM interception/analysis of coding-assistant ↔ LLM traffic — our Traffic Inspector ports its SSE merge, conversation normalization, host passthrough and secret masking (MIT). |
-| **[ProxyBridge](https://github.com/InterceptSuite/ProxyBridge)** · InterceptSuite | 5.1k | Transparent per-process proxy routing — inspired our crash-safe MITM teardown, socket idle-timeouts, `/proc` process attribution and TPROXY capture.                             |
+| **[llm-interceptor](https://github.com/chouzz/llm-interceptor)** · chouzz         |   48 | MITM interception/analysis of coding-assistant ↔ LLM traffic — our Traffic Inspector ports its SSE merge, conversation normalization, host passthrough and secret masking (MIT). |
+| **[ProxyBridge](https://github.com/InterceptSuite/ProxyBridge)** · InterceptSuite | 5.3k | Transparent per-process proxy routing — inspired our crash-safe MITM teardown, socket idle-timeouts, `/proc` process attribution and TPROXY capture.                             |
 
 ### 📚 Model data, observability & UI
 
 | Project                                                                    |    ⭐ | How it inspired OmniRoute                                                                                                  |
 | -------------------------------------------------------------------------- | ----: | -------------------------------------------------------------------------------------------------------------------------- |
-| **[models.dev](https://github.com/anomalyco/models.dev)** · SST / OpenCode |  5.1k | Open database of AI model specs, pricing and capabilities — synced natively into our model catalog.                        |
-| **[React Flow / xyflow](https://github.com/xyflow/xyflow)** · xyflow       | 37.1k | The node-based graph library powering our real-time Compression Studio and Combo/Routing Studio.                           |
-| **[LangGraph](https://github.com/langchain-ai/langgraph)** · LangChain     | 35.1k | LangGraph Studio's live workflow-graph visualization inspired our Studios' real-time cascade view.                         |
-| **[Langfuse](https://github.com/langfuse/langfuse)** · Langfuse            | 29.3k | Its trace → span → generation observability model shaped our Compression Studio waterfall.                                 |
+| **[models.dev](https://github.com/anomalyco/models.dev)** · SST / OpenCode |  5.6k | Open database of AI model specs, pricing and capabilities — synced natively into our model catalog.                        |
+| **[React Flow / xyflow](https://github.com/xyflow/xyflow)** · xyflow       | 37.4k | The node-based graph library powering our real-time Compression Studio and Combo/Routing Studio.                           |
+| **[LangGraph](https://github.com/langchain-ai/langgraph)** · LangChain     | 36.1k | LangGraph Studio's live workflow-graph visualization inspired our Studios' real-time cascade view.                         |
+| **[Langfuse](https://github.com/langfuse/langfuse)** · Langfuse            | 30.1k | Its trace → span → generation observability model shaped our Compression Studio waterfall.                                 |
 | **[Kiali](https://github.com/kiali/kiali)** · Kiali                        |  3.6k | Istio service-mesh observability — inspired our circuit-breaker badges and error-edge visuals in the Routing/Combo Studio. |
-| **[lobe-icons](https://github.com/lobehub/lobe-icons)** · LobeHub          |  2.1k | AI/LLM brand logos that render the provider icons across our dashboard.                                                    |
+| **[lobe-icons](https://github.com/lobehub/lobe-icons)** · LobeHub          |  2.2k | AI/LLM brand logos that render the provider icons across our dashboard.                                                    |
 
 ### 🛡️ Security
 
@@ -1150,6 +1250,12 @@ OmniRoute stands on the shoulders of giants. It started as a fork of **[9router]
 | ------------------------------------------------------------------------------------------- | --: | ------------------------------------------------------------------------------------------------------------------------------------------------ |
 | **[awesome-secure-defaults](https://github.com/tldrsec/awesome-secure-defaults)** · tldrsec | 708 | A curated list of secure-by-default libraries that guides our security choices (Helmet.js, DOMPurify, ssrf-req-filter, safe-regex, Google Tink). |
 
+### 🧭 Complementary tools
+
+| Project                                                                       | How it composes with OmniRoute                                                                                                                                                                             |
+| ----------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **[CodeWebChat](https://github.com/robertpiosik/CodeWebChat)** · robertpiosik | Editor-side companion — VS Code + browser extension that autofills 15+ chatbot web UIs with editor context. Owns the free-web-UI rail alongside OmniRoute's API rail; can point its API mode at OmniRoute. |
+
 ## ❤️ Support
 
 OmniRoute is free and open source, built and maintained in the open. If it saves you time or money, consider supporting development:
@@ -1168,7 +1274,7 @@ MIT License - see [LICENSE](LICENSE) for details.
 
 **[⬆ Back to top](#-omniroute)** · Built with ❤️ for the open-source AI community.
 
-<sub>OmniRoute v3.8.24 · Node ≥22.0.0 · MIT License · <a href="https://omniroute.online">omniroute.online</a></sub>
+<sub>OmniRoute v3.8.43 · Node ≥22.0.0 · MIT License · <a href="https://omniroute.online">omniroute.online</a></sub>
 
 </div>
 <!-- GitHub Discussions enabled for community Q&A -->

bin/cli/commands/completion.mjs

@@ -15,7 +15,11 @@ function readCache() {
   try {
     const raw = JSON.parse(readFileSync(cachePath(), "utf8"));
     if (raw && typeof raw.ts === "number" && Date.now() - raw.ts < CACHE_TTL_MS) return raw;
-  } catch {}
+  } catch (err) {
+    if (process.env.OMNIROUTE_DEBUG_COMPLETION) {
+      console.error("[omniroute completion] readCache failed:", err?.message ?? err);
+    }
+  }
   return null;
 }
 
@@ -41,12 +45,20 @@ async function refreshCache(opts = {}) {
       const j = await mr.value.json();
       models = (Array.isArray(j) ? j : j.data || []).map((m) => m.id).filter(Boolean);
     }
-  } catch {}
+  } catch (err) {
+    if (process.env.OMNIROUTE_DEBUG_COMPLETION) {
+      console.error("[omniroute completion] refreshCache failed:", err?.message ?? err);
+    }
+  }
   const data = { combos, providers, models, ts: Date.now() };
   try {
     mkdirSync(dirname(cachePath()), { recursive: true });
     writeFileSync(cachePath(), JSON.stringify(data));
-  } catch {}
+  } catch (err) {
+    if (process.env.OMNIROUTE_DEBUG_COMPLETION) {
+      console.error("[omniroute completion] writeCache failed:", err?.message ?? err);
+    }
+  }
   return data;
 }
 

bin/cli/commands/compression.mjs

@@ -24,7 +24,7 @@ async function restCompressionStatus() {
   const combosBody = combosRes.ok ? await combosRes.json() : { combos: [] };
   const analytics = analyticsRes && analyticsRes.ok ? await analyticsRes.json() : null;
   return {
-    engine: settings.engine ?? null,
+    strategy: settings.defaultMode || "standard",
     settings,
     combos: combosBody.combos ?? combosBody,
     analytics,
@@ -33,7 +33,10 @@ async function restCompressionStatus() {
 
 async function restCompressionConfigure(config) {
   const body = { ...config };
-  if (body.engine) body.engine = normalizeEngine(body.engine);
+  if (body.strategy) {
+    body.defaultMode = body.strategy === "caveman" ? "standard" : normalizeEngine(body.strategy);
+    delete body.strategy;
+  }
   const res = await apiFetch("/api/settings/compression", { method: "PUT", body });
   if (!res.ok) {
     process.stderr.write(`Error: ${res.status}\n`);
@@ -43,9 +46,10 @@ async function restCompressionConfigure(config) {
 }
 
 async function restSetEngine(name) {
+  const normalized = normalizeEngine(name);
   const res = await apiFetch("/api/settings/compression", {
     method: "PUT",
-    body: { engine: normalizeEngine(name) },
+    body: { defaultMode: normalized === "caveman" ? "standard" : normalized },
   });
   if (!res.ok) {
     process.stderr.write(`Error: ${res.status}\n`);
@@ -103,7 +107,11 @@ export async function runCompressionStatus(opts, cmd) {
 
 export async function runCompressionConfigure(opts, cmd) {
   const config = {};
-  if (opts.engine) config.engine = opts.engine;
+  // #6571 — both the MCP tool schema (compressionConfigureInput) and
+  // handleCompressionConfigure expect `strategy`, not `engine`; a non-strict
+  // MCP schema silently strips an unrecognized `engine` key on the primary
+  // (MCP-mounted) path, so this must be `strategy` on both paths.
+  if (opts.engine) config.strategy = normalizeEngine(opts.engine);
   if (opts.cavemanAggressiveness !== undefined)
     config.caveman = { aggressiveness: opts.cavemanAggressiveness };
   if (opts.rtkBudget !== undefined) config.rtk = { tokenBudget: opts.rtkBudget };
@@ -163,7 +171,7 @@ export function registerCompression(program) {
   engine.command("set <name>").action(runCompressionEngineSet);
   engine.command("get").action(async (opts, cmd) => {
     const data = await mcpCall("omniroute_compression_status", {}, restCompressionStatus);
-    process.stdout.write(`${data.engine ?? "(default)"}\n`);
+    process.stdout.write(`${data.strategy ?? "(default)"}\n`);
   });
 
   const combos = cmp.command("combos").description(t("compression.combos.description"));

bin/cli/commands/doctor.mjs

@@ -3,7 +3,7 @@ import net from "node:net";
 import os from "node:os";
 import path from "node:path";
 import { createDecipheriv, scryptSync } from "node:crypto";
-import { pathToFileURL } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { resolveDataDir, resolveStoragePath } from "../data-dir.mjs";
 import { printHeading } from "../io.mjs";
 import { t } from "../i18n.mjs";
@@ -380,24 +380,67 @@ function resolveLivenessUrl(options = {}) {
   return `http://${formatHostForUrl(host || "127.0.0.1")}:${dashboardPort}/api/health/degradation`;
 }
 
+async function probeUrl(url) {
+  try {
+    const response = await fetchWithTimeout(url);
+    return { ok: response.ok, status: response.status };
+  } catch {
+    return { ok: false, status: 0 };
+  }
+}
+
 async function checkServerLiveness(options = {}) {
   const url = resolveLivenessUrl(options);
 
-  try {
-    const response = await fetchWithTimeout(url);
-    if (!response.ok) {
-      return warn("Server liveness", `Server responded with HTTP ${response.status}`, { url });
-    }
-    return ok("Server liveness", "Server health endpoint is reachable", { url });
-  } catch {
-    return warn("Server liveness", "Server health endpoint is not reachable", { url });
+  // First attempt: configured health endpoint (may require auth token).
+  const primary = await probeUrl(url);
+  if (primary.ok) {
+    return ok("Server liveness", "Server health endpoint is reachable", { url, status: primary.status });
   }
+
+  // #6162: /api/health and /api/health/degradation require a management token.
+  // When unauthenticated, fall back to probing a publicly served static asset
+  // (favicon.ico) to confirm the Next.js server is alive and reachable.
+  // Derive the fallback URL from the primary URL (preserving protocol/host/port)
+  // so custom liveness URL configurations are honored. Fall back to defaults
+  // only if the primary URL can't be parsed.
+  let fallbackUrl;
+  try {
+    const parsed = new URL(url);
+    parsed.pathname = "/favicon.ico";
+    parsed.search = "";
+    parsed.hash = "";
+    fallbackUrl = parsed.toString();
+  } catch {
+    const port = parsePort(process.env.PORT || "20128", 20128);
+    const dashboardPort = parsePort(process.env.DASHBOARD_PORT || String(port), port);
+    const host = String(options.livenessHost || process.env.OMNIROUTE_DOCTOR_HOST || "127.0.0.1")
+      .trim()
+      .replace(/^https?:\/\//, "")
+      .replace(/\/.*$/, "");
+    fallbackUrl = `http://${formatHostForUrl(host || "127.0.0.1")}:${dashboardPort}/favicon.ico`;
+  }
+  const fallback = await probeUrl(fallbackUrl);
+
+  if (fallback.ok) {
+    return ok(
+      "Server liveness",
+      `Server reachable (health endpoint returned ${primary.status}, likely requires MANAGEMENT_TOKEN)`,
+      { primaryUrl: url, primaryStatus: primary.status, fallbackUrl, fallbackStatus: fallback.status }
+    );
+  }
+
+  return warn(
+    "Server liveness",
+    `Server health endpoint returned HTTP ${primary.status || "no-response"} and fallback probe failed`,
+    { primaryUrl: url, primaryStatus: primary.status, fallbackUrl, fallbackStatus: fallback.status }
+  );
 }
 
 export async function collectDoctorChecks(context = {}, options = {}) {
   const rootDir =
     context.rootDir ||
-    path.resolve(path.dirname(new URL(import.meta.url).pathname), "..", "..", "..");
+    path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
   const dataDir = resolveDataDir();
   const dbPath = resolveStoragePath(dataDir);
 

bin/cli/commands/health.mjs

@@ -48,7 +48,11 @@ export async function runHealthCommand(opts = {}) {
   }
 
   try {
-    const res = await apiFetch("/api/health", { retry: false, timeout: 5000, acceptNotOk: true });
+    const res = await apiFetch("/api/monitoring/health", {
+      retry: false,
+      timeout: 5000,
+      acceptNotOk: true,
+    });
     if (!res.ok) {
       console.error(t("common.error", { message: `HTTP ${res.status}` }));
       return 1;
@@ -66,29 +70,22 @@ export async function runHealthCommand(opts = {}) {
     if (health.uptime) console.log(t("health.uptime", { uptime: health.uptime }));
     if (health.version) console.log(`  Version: ${health.version}`);
 
-    if (health.requests !== undefined) {
-      console.log(t("health.requests", { count: health.requests }));
+    if (health.activeConnections !== undefined) {
+      console.log(t("health.requests", { count: health.activeConnections }));
     }
 
-    if (health.breakers && opts.verbose) {
+    if (health.circuitBreakers && opts.verbose) {
       console.log("\n  \x1b[1mCircuit Breakers\x1b[0m");
-      for (const [name, status] of Object.entries(health.breakers)) {
-        const state =
-          status.state === "closed" ? "\x1b[32m● closed\x1b[0m" : "\x1b[33m○ open\x1b[0m";
-        console.log(`    ${name.padEnd(20)} ${state}`);
-      }
+      const { open = 0, halfOpen = 0, closed = 0 } = health.circuitBreakers;
+      console.log(`    \x1b[32m● closed\x1b[0m     ${closed}`);
+      console.log(`    \x1b[33m○ half-open\x1b[0m  ${halfOpen}`);
+      console.log(`    \x1b[31m○ open\x1b[0m       ${open}`);
     }
 
-    if (health.cache && opts.verbose) {
-      console.log("\n  \x1b[1mCache\x1b[0m");
-      console.log(`    Semantic hits:   ${health.cache.semanticHits || 0}`);
-      console.log(`    Signature hits:  ${health.cache.signatureHits || 0}`);
-    }
-
-    if (opts.verbose && health.memory) {
+    if (opts.verbose && health.memoryUsage) {
       console.log("\n  \x1b[1mMemory\x1b[0m");
-      console.log(`    RSS:        ${health.memory.rss || "N/A"}`);
-      console.log(`    Heap used:  ${health.memory.heapUsed || "N/A"}`);
+      console.log(`    RSS:        ${health.memoryUsage.rss || "N/A"}`);
+      console.log(`    Heap used:  ${health.memoryUsage.heapUsed || "N/A"}`);
     }
 
     return 0;
@@ -100,13 +97,17 @@ export async function runHealthCommand(opts = {}) {
 
 export async function runHealthComponentsCommand(opts = {}) {
   try {
-    const res = await apiFetch("/api/health", { retry: false, timeout: 5000, acceptNotOk: true });
+    const res = await apiFetch("/api/monitoring/health", {
+      retry: false,
+      timeout: 5000,
+      acceptNotOk: true,
+    });
     if (!res.ok) {
       console.error(`HTTP ${res.status}`);
       return 1;
     }
     const health = await res.json();
-    const components = health.components || health.breakers || {};
+    const components = health.components || health.circuitBreakers || {};
     for (const [name, info] of Object.entries(components)) {
       const status =
         typeof info === "object" ? info.state || info.status || "unknown" : String(info);

bin/cli/commands/launch-codex.mjs

@@ -19,6 +19,16 @@ const STRIPPED_CODEX_ENV_KEYS = [
 /** Placeholder so codex's `env_key` is always satisfied when the backend is open. */
 const NO_AUTH_SENTINEL = "omniroute-no-auth";
 
+// On Windows the `codex` binary is an npm `.cmd` shim that `spawn` cannot resolve
+// without a shell (bare "codex" → ENOENT). Mirror the qodercli Windows fix (#6263):
+// spawn `codex.cmd` through a shell on win32, and the bare binary elsewhere.
+export function resolveCodexSpawn(platform) {
+  if (platform === "win32") {
+    return { command: "codex.cmd", shell: true };
+  }
+  return { command: "codex", shell: undefined };
+}
+
 function stripTrailingSlash(value) {
   let s = String(value);
   let end = s.length;
@@ -126,10 +136,10 @@ export async function runLaunchCodexCommand(opts = {}, codexArgs = []) {
 
   if (!(await healthCheck(baseUrl))) {
     console.error(
-      (t("launch.notRunning") || "OmniRoute is not reachable at {port}. Start it with 'omniroute serve'.").replace(
-        "{port}",
-        baseUrl
-      )
+      (
+        t("launch.notRunning") ||
+        "OmniRoute is not reachable at {port}. Start it with 'omniroute serve'."
+      ).replace("{port}", baseUrl)
     );
     return 1;
   }
@@ -142,7 +152,12 @@ export async function runLaunchCodexCommand(opts = {}, codexArgs = []) {
   const env = buildCodexEnv(process.env, authToken);
 
   return await new Promise((resolve) => {
-    const child = spawn("codex", extraArgs, { env, stdio: "inherit" });
+    const { command: codexLaunch, shell: shellValue } = resolveCodexSpawn(process.platform);
+    const child = spawn(codexLaunch, extraArgs, {
+      env,
+      stdio: "inherit",
+      shell: shellValue,
+    });
     child.on("error", (err) => {
       if (err?.code === "ENOENT") {
         console.error(
@@ -165,10 +180,16 @@ export function registerLaunchCodex(program) {
       t("launchCodex.description") || "Launch Codex CLI pointed at OmniRoute (local or remote VPS)"
     )
     .option("--port <port>", "Local OmniRoute port (ignored when --remote is set)", "20128")
-    .option("--remote <url>", "Remote OmniRoute base URL, e.g. http://192.168.0.15:20128 (overrides --port + context)")
+    .option(
+      "--remote <url>",
+      "Remote OmniRoute base URL, e.g. http://192.168.0.15:20128 (overrides --port + context)"
+    )
     .option("--profile <name>", "Codex profile to activate (passed as --profile <name>)")
     .option("-p, --p <name>", "Alias for --profile")
-    .option("--api-key <key>", "OmniRoute API key (overrides OMNIROUTE_API_KEY env var for this invocation)")
+    .option(
+      "--api-key <key>",
+      "OmniRoute API key (overrides OMNIROUTE_API_KEY env var for this invocation)"
+    )
     .allowUnknownOption(true)
     .allowExcessArguments(true)
     .argument("[codexArgs...]", "arguments passed through to the codex binary")

bin/cli/commands/serve.mjs

@@ -1,8 +1,8 @@
 import { spawn } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
-import { platform, totalmem } from "node:os";
+import { platform, totalmem, hostname as osHostname } from "node:os";
 import { t } from "../i18n.mjs";
 import { writePidFile, cleanupPidFile, waitForServer } from "../utils/pid.mjs";
 import { ServerSupervisor, detectMitmCrash } from "../runtime/processSupervisor.mjs";
@@ -16,6 +16,7 @@ import {
 import { resolveTlsOptions } from "../../../scripts/dev/tls-options.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
+const _pkg = JSON.parse(readFileSync(join(__dirname, "..", "..", "..", "package.json"), "utf8"));
 
 // URL scheme for the "OmniRoute is running" banner — flipped to https when
 // opt-in TLS (#5242) is active. Process-scoped: one `serve` run = one scheme.
@@ -48,11 +49,13 @@ export function registerServe(program) {
     .option("--no-tray", t("serve.no_tray") || "Disable system tray icon")
     .option(
       "--tls-cert <path>",
-      t("serve.tls_cert") || "Path to a TLS certificate (PEM) to serve HTTPS (also OMNIROUTE_TLS_CERT)"
+      t("serve.tls_cert") ||
+        "Path to a TLS certificate (PEM) to serve HTTPS (also OMNIROUTE_TLS_CERT)"
     )
     .option(
       "--tls-key <path>",
-      t("serve.tls_key") || "Path to the TLS private key (PEM) to serve HTTPS (also OMNIROUTE_TLS_KEY)"
+      t("serve.tls_key") ||
+        "Path to the TLS private key (PEM) to serve HTTPS (also OMNIROUTE_TLS_KEY)"
     )
     .action(async (opts) => {
       await runServe(opts);
@@ -60,6 +63,8 @@ export function registerServe(program) {
 }
 
 export async function runServe(opts = {}) {
+  const startedAt = performance.now();
+
   const { isNativeBinaryCompatible } =
     await import("../../../scripts/build/native-binary-compat.mjs");
   const { getNodeRuntimeSupport, getNodeRuntimeWarning } =
@@ -78,6 +83,7 @@ export async function runServe(opts = {}) {
   | |__| | | | | | | | | | | | \\ \\ (_) | |_| | ||  __/
    \\____/|_| |_| |_|_| |_|_|_|  \\_\\___/ \\__,_|\\__\\___|
 \x1b[0m`);
+  console.log(`\x1b[2m  v${_pkg.version}\x1b[0m\n`);
 
   const nodeSupport = getNodeRuntimeSupport();
   if (!nodeSupport.nodeCompatible) {
@@ -164,7 +170,16 @@ export async function runServe(opts = {}) {
     PORT: String(dashboardPort),
     DASHBOARD_PORT: String(dashboardPort),
     API_PORT: String(apiPort),
-    HOSTNAME: process.env.HOSTNAME || "0.0.0.0",
+    // #6194: POSIX shells (bash/zsh) auto-set HOSTNAME to the machine name — the
+    // .env loader (first-wins) can never override it. Ignore HOSTNAME when it
+    // matches the OS-reported hostname (the auto-set signature). OMNIROUTE_SERVER_HOST
+    // takes precedence; legacy HOSTNAME values that don't match os.hostname() are
+    // still honoured for backward compatibility (e.g. Windows CMD/PowerShell users
+    // who set HOSTNAME in .env where it is NOT auto-set).
+    HOSTNAME:
+      process.env.OMNIROUTE_SERVER_HOST ||
+      (process.env.HOSTNAME !== osHostname() ? process.env.HOSTNAME : undefined) ||
+      "0.0.0.0",
     NODE_ENV: "production",
     // #5238: preserve a user-set NODE_OPTIONS (incl. their own
     // `--max-old-space-size=…`) instead of clobbering it with the calibrated
@@ -187,7 +202,15 @@ export async function runServe(opts = {}) {
   }
 
   if (opts.noRecovery) {
-    return runWithoutRecovery(serverJs, env, memoryLimit, dashboardPort, apiPort, noOpen);
+    return runWithoutRecovery(
+      serverJs,
+      env,
+      memoryLimit,
+      dashboardPort,
+      apiPort,
+      noOpen,
+      startedAt
+    );
   }
 
   return runWithSupervisor(
@@ -199,6 +222,7 @@ export async function runServe(opts = {}) {
     noOpen,
     opts.log === true,
     opts.maxRestarts ?? 2,
+    startedAt,
     useTray
   );
 }
@@ -219,7 +243,7 @@ function runDaemon(serverJs, env, memoryLimit, dashboardPort, apiPort) {
   console.log(`  \x1b[1mAPI Base:\x1b[0m   ${urlScheme}://localhost:${apiPort}/v1`);
 }
 
-function runWithoutRecovery(serverJs, env, memoryLimit, dashboardPort, apiPort, noOpen) {
+function runWithoutRecovery(serverJs, env, memoryLimit, dashboardPort, apiPort, noOpen, startedAt) {
   // #5238: skip the explicit CLI --max-old-space-size when the user pinned the
   // heap via NODE_OPTIONS (a CLI arg would shadow/override their value).
   const server = spawn("node", [...buildNodeHeapArgs(process.env, memoryLimit), serverJs], {
@@ -240,7 +264,7 @@ function runWithoutRecovery(serverJs, env, memoryLimit, dashboardPort, apiPort,
       (text.includes("Ready") || text.includes("started") || text.includes("listening"))
     ) {
       started = true;
-      onReady(dashboardPort, apiPort, noOpen);
+      onReady(dashboardPort, apiPort, noOpen, startedAt);
     }
   });
 
@@ -274,7 +298,7 @@ function runWithoutRecovery(serverJs, env, memoryLimit, dashboardPort, apiPort,
   setTimeout(() => {
     if (!started) {
       started = true;
-      onReady(dashboardPort, apiPort, noOpen);
+      onReady(dashboardPort, apiPort, noOpen, startedAt);
     }
   }, 15000);
 }
@@ -288,6 +312,7 @@ async function runWithSupervisor(
   noOpen,
   showLog,
   maxRestarts,
+  startedAt,
   useTray = false
 ) {
   if (showLog) process.env.OMNIROUTE_SHOW_LOG = "1";
@@ -325,12 +350,36 @@ async function runWithSupervisor(
     waitForServer(dashboardPort, 60000).then(async (up) => {
       if (up) {
         if (useTray) await maybeStartTray(dashboardPort, apiPort, supervisor);
-        onReady(dashboardPort, apiPort, noOpen);
+        onReady(dashboardPort, apiPort, noOpen, startedAt);
+      } else {
+        reportReadinessTimeout(dashboardPort, supervisor);
       }
     });
   }
 }
 
+// #6321: waitForServer resolving `false` used to fall through silently — the CLI
+// printed the banner + "⏳ Starting server..." and then produced ZERO further
+// output forever, even though the child process may well have crashed or be
+// stuck (issue reports show the server sometimes actually comes up later, or is
+// reachable directly while the CLI still looks hung). Surface a clear diagnostic
+// plus whatever stdout/stderr the child buffered instead of going silent.
+export function reportReadinessTimeout(dashboardPort, supervisor) {
+  console.error(
+    `\n\x1b[33m⚠ Server did not respond within 60s.\x1b[0m It may still be starting, or may` +
+      ` have failed silently.`
+  );
+  console.error(`  Try:  curl -I http://localhost:${dashboardPort}/api/monitoring/health`);
+  console.error(`  Or:   rerun with \x1b[36m--log\x1b[0m to see live server output.\n`);
+
+  const recentLog = supervisor?.getRecentLog?.() ?? [];
+  if (recentLog.length) {
+    console.error("--- Recent server output ---");
+    recentLog.forEach((l) => console.error(l));
+    console.error("--- End recent output ---\n");
+  }
+}
+
 let _killTray = null;
 function killTrayIfActive() {
   if (_killTray) {
@@ -366,18 +415,20 @@ async function maybeStartTray(port, apiPort, supervisor) {
   } catch (err) {
     // tray is optional — do not fail the server, but surface why it failed so
     // "--tray shows nothing" is diagnosable instead of silent (#4605).
-    process.stderr.write(
-      `[omniroute][tray] failed to start: ${err?.message ?? String(err)}\n`
-    );
+    process.stderr.write(`[omniroute][tray] failed to start: ${err?.message ?? String(err)}\n`);
   }
 }
 
-async function onReady(dashboardPort, apiPort, noOpen) {
+async function onReady(dashboardPort, apiPort, noOpen, startedAt) {
   const dashboardUrl = `${urlScheme}://localhost:${dashboardPort}`;
   const apiUrl = `${urlScheme}://localhost:${apiPort}`;
+  const elapsed =
+    typeof startedAt === "number" && Number.isFinite(startedAt)
+      ? ((performance.now() - startedAt) / 1000).toFixed(1)
+      : "0.0";
 
   console.log(`
-  \x1b[32m✔ OmniRoute is running!\x1b[0m
+  \x1b[32m✔ OmniRoute is running!\x1b[0m \x1b[2m(started in ${elapsed}s)\x1b[0m
 
   \x1b[1m  Dashboard:\x1b[0m  ${dashboardUrl}
   \x1b[1m  API Base:\x1b[0m   ${apiUrl}/v1

bin/cli/commands/setup-claude.mjs

@@ -20,7 +20,11 @@ import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import os from "node:os";
 import { printHeading, printInfo, printSuccess, printError } from "../io.mjs";
-import { categoriseModel } from "./setup-codex.mjs";
+import {
+  categoriseModel,
+  isCodexCompatibleTextModel,
+  profileNameFromModelId,
+} from "./setup-codex.mjs";
 
 /** Map a Codex-style effort to a Claude Code settings.json effortLevel. */
 function effortLevelFor(cfg) {
@@ -29,6 +33,17 @@ function effortLevelFor(cfg) {
   return cfg.effort || undefined;
 }
 
+/**
+ * Generic profile for a live-catalog model that `categoriseModel()` doesn't
+ * recognize (e.g. any provider added after the hardcoded glm/kimi/mimo/…
+ * pattern list was written). Mirrors setup-codex.mjs's fallbackCodexProfile()
+ * so setup-claude never silently produces zero profiles for a fresh catalog.
+ */
+export function fallbackClaudeProfile(modelId, model) {
+  if (!isCodexCompatibleTextModel(model)) return null;
+  return { name: profileNameFromModelId(modelId) };
+}
+
 /** Build the settings.json content for one Claude Code profile. */
 export function buildProfileSettings(modelId, baseUrl, cfg) {
   const env = {
@@ -50,18 +65,84 @@ export function buildProfileSettings(modelId, baseUrl, cfg) {
   return JSON.stringify(settings, null, 2) + "\n";
 }
 
+/**
+ * Generate Claude Code profile files for a live model catalog. Shared by the
+ * `setup-claude` CLI command and the post-model-sync auto-sync so both stay
+ * behaviorally identical. Writes `<claudeHome>/profiles/<name>/settings.json`
+ * (directory-per-profile); never touches the active/default Claude config.
+ * @param {Array} models
+ * @param {{claudeHome?:string, baseUrl:string, dryRun?:boolean, only?:string, log?:(line:string)=>void}} opts
+ * @returns {Promise<{written:number, skipped:number, profiles:Array<{name:string, model:string, filePath:string}>}>}
+ */
+export async function syncClaudeProfilesFromModels(models, opts = {}) {
+  const claudeHome = opts.claudeHome || join(os.homedir(), ".claude");
+  const profilesRoot = join(claudeHome, "profiles");
+  const baseUrl = opts.baseUrl;
+  const dryRun = Boolean(opts.dryRun);
+  // Injectable dry-run printer (#5959): under the node:test runner, a child
+  // process writing multi-byte UTF-8 (the "──" box-drawing heading) to stdout
+  // corrupts the runner's V8-serialized event stream ~50% of the time
+  // ("Unable to deserialize cloned data due to invalid or unsupported
+  // version"). Tests inject a collector; the CLI default stays console.log.
+  const log = opts.log ?? console.log;
+  const onlyFilter = opts.only ? opts.only.split(",").map((s) => s.trim()) : null;
+
+  if (!dryRun && !existsSync(profilesRoot)) {
+    mkdirSync(profilesRoot, { recursive: true });
+  }
+
+  let written = 0;
+  let skipped = 0;
+  const profiles = [];
+
+  for (const m of models) {
+    const id = typeof m === "string" ? m : (m.id ?? "");
+    if (!id) {
+      skipped++;
+      continue;
+    }
+    if (onlyFilter && !onlyFilter.some((f) => id.includes(f))) {
+      skipped++;
+      continue;
+    }
+
+    const cfg = categoriseModel(id) ?? fallbackClaudeProfile(id, m);
+    if (!cfg) {
+      skipped++;
+      continue;
+    }
+
+    const dir = join(profilesRoot, cfg.name);
+    const filePath = join(dir, "settings.json");
+    const content = buildProfileSettings(id, baseUrl, cfg);
+
+    if (dryRun) {
+      log(`\n── [dry-run] ${filePath} ──`);
+      log(content);
+    } else {
+      mkdirSync(dir, { recursive: true });
+      writeFileSync(filePath, content, "utf8");
+    }
+    profiles.push({ name: cfg.name, model: id, filePath });
+    written++;
+  }
+
+  return { written, skipped, profiles };
+}
+
 /**
  * @param {{remote?:string, port?:string, apiKey?:string, claudeHome?:string, dryRun?:boolean, only?:string}} opts
  * @returns {Promise<number>}
  */
 export async function runSetupClaudeCommand(opts = {}) {
   const port = Number(opts.port ?? process.env.PORT ?? 20128) || 20128;
-  const baseUrl = (opts.remote ?? `http://localhost:${port}`).replace(/\/+$/, "").replace(/\/v1$/, "");
+  const baseUrl = (opts.remote ?? `http://localhost:${port}`)
+    .replace(/\/+$/, "")
+    .replace(/\/v1$/, "");
   const apiKey = opts.apiKey ?? opts["api-key"] ?? process.env.OMNIROUTE_API_KEY ?? "";
   const claudeHome = opts.claudeHome ?? opts["claude-home"] ?? join(os.homedir(), ".claude");
   const profilesRoot = join(claudeHome, "profiles");
   const dryRun = Boolean(opts.dryRun ?? opts["dry-run"]);
-  const onlyFilter = opts.only ? opts.only.split(",").map((s) => s.trim()) : null;
 
   printHeading("OmniRoute → Claude Code profile generator");
   printInfo(`Connecting to ${baseUrl} …`);
@@ -89,42 +170,25 @@ export async function runSetupClaudeCommand(opts = {}) {
 
   printInfo(`Received ${models.length} models from ${baseUrl}`);
 
-  if (!dryRun && !existsSync(profilesRoot)) {
-    mkdirSync(profilesRoot, { recursive: true });
-  }
+  const { written, skipped, profiles } = await syncClaudeProfilesFromModels(models, {
+    claudeHome,
+    baseUrl,
+    dryRun,
+    only: opts.only,
+  });
 
-  let written = 0;
-  for (const m of models) {
-    const id = typeof m === "string" ? m : m.id ?? "";
-    if (!id) continue;
-    if (onlyFilter && !onlyFilter.some((f) => id.includes(f))) continue;
-
-    const cfg = categoriseModel(id);
-    if (!cfg) continue;
-
-    const dir = join(profilesRoot, cfg.name);
-    const filePath = join(dir, "settings.json");
-    const content = buildProfileSettings(id, baseUrl, cfg);
-
-    if (dryRun) {
-      console.log(`\n── [dry-run] ${filePath} ──`);
-      console.log(content);
-    } else {
-      mkdirSync(dir, { recursive: true });
-      writeFileSync(filePath, content, "utf8");
-      printSuccess(`  ✓ profiles/${cfg.name}/settings.json  (${id})`);
-    }
-    written++;
-  }
-
-  const skipped = models.length - written;
   if (!dryRun) {
+    for (const profile of profiles) {
+      printSuccess(`  ✓ profiles/${profile.name}/settings.json  (${profile.model})`);
+    }
     console.log("");
     printSuccess(`${written} Claude Code profiles written to ${profilesRoot}`);
     if (skipped > 0) printInfo(`${skipped} models skipped (no matching profile pattern)`);
     console.log("\nTo use a profile:");
     console.log("  omniroute launch --profile <name>     # e.g. omniroute launch --profile glm52");
-    console.log("  # or: CLAUDE_CONFIG_DIR=~/.claude/profiles/<name> claude  (export ANTHROPIC_AUTH_TOKEN first)");
+    console.log(
+      "  # or: CLAUDE_CONFIG_DIR=~/.claude/profiles/<name> claude  (export ANTHROPIC_AUTH_TOKEN first)"
+    );
   } else {
     console.log(`\n[dry-run] ${written} profiles would be written (${skipped} skipped)`);
   }
@@ -143,7 +207,10 @@ export function registerSetupClaude(program) {
     .option("--remote <url>", "Remote OmniRoute URL, e.g. http://192.168.0.15:20128")
     .option("--api-key <key>", "OmniRoute API key (defaults to OMNIROUTE_API_KEY env var)")
     .option("--claude-home <dir>", "Claude home dir (default: ~/.claude)")
-    .option("--only <patterns>", "Comma-separated substrings — only matching model IDs (e.g. glm,kimi)")
+    .option(
+      "--only <patterns>",
+      "Comma-separated substrings — only matching model IDs (e.g. glm,kimi)"
+    )
     .option("--dry-run", "Print what would be written without touching the filesystem")
     .action(async (opts) => {
       const exitCode = await runSetupClaudeCommand(opts);

bin/cli/commands/setup-codex.mjs

@@ -39,29 +39,83 @@ export function categoriseModel(modelId) {
     { re: /kmc\/kimi-k2\.6/, name: "kimi-k26", ctx: 131072, compact: 112000, toolLimit: 32768 },
     { re: /glm\/glm-5\.2-max/, name: "glm52max", ctx: 131072, compact: 112000, toolLimit: 32768 },
     { re: /glm\/glm-5\.2$/, name: "glm52", ctx: 131072, compact: 112000, toolLimit: 32768 },
-    { re: /opencode-go\/mimo-v2\.5-pro/, name: "mimo-pro", ctx: 131072, compact: 112000, toolLimit: 32768 },
-    { re: /opencode-go\/qwen3\.7-plus/, name: "qwen37plus", ctx: 32768, compact: 28000, toolLimit: 16384 },
+    {
+      re: /opencode-go\/mimo-v2\.5-pro/,
+      name: "mimo-pro",
+      ctx: 131072,
+      compact: 112000,
+      toolLimit: 32768,
+    },
+    {
+      re: /opencode-go\/qwen3\.7-plus/,
+      name: "qwen37plus",
+      ctx: 32768,
+      compact: 28000,
+      toolLimit: 16384,
+    },
   ];
 
   // ── Good models (high effort) ─────────────────────────────────────────────
   const goodPatterns = [
-    { re: /ollamacloud\/deepseek-v4-pro/, name: "deepseek-pro", ctx: 131072, compact: 112000, toolLimit: 32768 },
-    { re: /opencode-go\/mimo-v2\.5$/, name: "mimo", ctx: 131072, compact: 112000, toolLimit: 32768 },
+    {
+      re: /ollamacloud\/deepseek-v4-pro/,
+      name: "deepseek-pro",
+      ctx: 131072,
+      compact: 112000,
+      toolLimit: 32768,
+    },
+    {
+      re: /opencode-go\/mimo-v2\.5$/,
+      name: "mimo",
+      ctx: 131072,
+      compact: 112000,
+      toolLimit: 32768,
+    },
   ];
 
   // ── Simple models (no effort) ─────────────────────────────────────────────
   const simplePatterns = [
     { re: /ollamacloud\/gemma4:31b/, name: "gemma4", ctx: 32768, compact: 28000, toolLimit: 16384 },
-    { re: /ollamacloud\/nemotron-3-super/, name: "nemotron", ctx: 32768, compact: 28000, toolLimit: 16384 },
-    { re: /ollamacloud\/gpt-oss:20b/, name: "gptoss", ctx: 32768, compact: 28000, toolLimit: 16384 },
+    {
+      re: /ollamacloud\/nemotron-3-super/,
+      name: "nemotron",
+      ctx: 32768,
+      compact: 28000,
+      toolLimit: 16384,
+    },
+    {
+      re: /ollamacloud\/gpt-oss:20b/,
+      name: "gptoss",
+      ctx: 32768,
+      compact: 28000,
+      toolLimit: 16384,
+    },
   ];
 
   // ── Fast models (low effort) ──────────────────────────────────────────────
   const fastPatterns = [
-    { re: /ollamacloud\/deepseek-v4-flash/, name: "deepseek-flash", ctx: 65536, compact: 56000, toolLimit: 16384 },
-    { re: /ollamacloud\/gemini-3-flash/, name: "gemini-flash", ctx: 1000000, compact: 850000, toolLimit: 32768 },
+    {
+      re: /ollamacloud\/deepseek-v4-flash/,
+      name: "deepseek-flash",
+      ctx: 65536,
+      compact: 56000,
+      toolLimit: 16384,
+    },
+    {
+      re: /ollamacloud\/gemini-3-flash/,
+      name: "gemini-flash",
+      ctx: 1000000,
+      compact: 850000,
+      toolLimit: 32768,
+    },
     { re: /glm\/glm-5-turbo/, name: "glm5turbo", ctx: 131072, compact: 112000, toolLimit: 16384 },
-    { re: /glm\/glm-4\.7-flash/, name: "glm47flash", ctx: 131072, compact: 112000, toolLimit: 16384 },
+    {
+      re: /glm\/glm-4\.7-flash/,
+      name: "glm47flash",
+      ctx: 131072,
+      compact: 112000,
+      toolLimit: 16384,
+    },
   ];
 
   for (const p of thinkingPatterns) {
@@ -80,6 +134,92 @@ export function categoriseModel(modelId) {
   return null;
 }
 
+function firstPositiveNumber(...values) {
+  for (const value of values) {
+    if (typeof value === "number" && Number.isFinite(value) && value > 0) {
+      return value;
+    }
+  }
+  return null;
+}
+
+function shortHash(value) {
+  let hash = 5381;
+  for (let i = 0; i < value.length; i++) {
+    hash = ((hash << 5) + hash) ^ value.charCodeAt(i);
+  }
+  return (hash >>> 0).toString(36);
+}
+
+export function profileNameFromModelId(modelId) {
+  const normalized = String(modelId)
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+  const base = normalized || "model";
+  if (base.length <= 96) return base;
+  return `${base.slice(0, 84).replace(/-+$/g, "")}-${shortHash(base)}`;
+}
+
+function hasAnyValue(values, patterns) {
+  return values.some((value) => patterns.some((pattern) => pattern.test(value)));
+}
+
+export function isCodexCompatibleTextModel(model) {
+  if (typeof model === "string") return true;
+
+  const id = String(model?.id ?? "").toLowerCase();
+  const type = String(model?.type ?? "").toLowerCase();
+  const outputModalities = Array.isArray(model?.output_modalities)
+    ? model.output_modalities.map((value) => String(value).toLowerCase())
+    : [];
+
+  if (type && !["chat", "text", "language", "llm", "model"].includes(type)) {
+    return false;
+  }
+
+  const unsupportedPatterns = [
+    /(^|[/_-])(image|img|video|veo|seedance|audio|speech|voice|tts|stt|whisper)([/_-]|$)/,
+    /(^|[/_-])(embedding|embeddings|embed|rerank|moderation|transcription)([/_-]|$)/,
+  ];
+  if (hasAnyValue([id, type], unsupportedPatterns)) return false;
+
+  const nonTextModalities = [/^(image|video|audio)$/];
+  if (hasAnyValue(outputModalities, nonTextModalities)) return false;
+
+  if (outputModalities.length > 0 && !outputModalities.includes("text")) {
+    return false;
+  }
+
+  return true;
+}
+
+export function fallbackCodexProfile(modelId, model) {
+  if (!isCodexCompatibleTextModel(model)) return null;
+
+  const ctx =
+    typeof model === "string"
+      ? 128000
+      : (firstPositiveNumber(
+          model.context_length,
+          model.max_context_window_tokens,
+          model.max_input_tokens
+        ) ?? 128000);
+  const maxOutput =
+    typeof model === "string"
+      ? null
+      : firstPositiveNumber(model.max_output_tokens, model.output_token_limit);
+  const toolLimit = Math.min(Math.max(maxOutput ?? 16384, 8192), 32768);
+
+  return {
+    name: profileNameFromModelId(modelId),
+    ctx,
+    compact: Math.floor(ctx * 0.85),
+    summary: false,
+    toolLimit,
+  };
+}
+
 /** Build the TOML content for a single profile. */
 function buildProfileToml(modelId, cfg) {
   const lines = [
@@ -105,6 +245,52 @@ function buildProfileToml(modelId, cfg) {
   return lines.join("\n") + "\n";
 }
 
+export async function syncCodexProfilesFromModels(models, opts = {}) {
+  const codexHome = opts.codexHome || join(os.homedir(), ".codex");
+  const dryRun = Boolean(opts.dryRun);
+  const onlyFilter = opts.only ? opts.only.split(",").map((s) => s.trim()) : null;
+
+  if (!dryRun && !existsSync(codexHome)) {
+    mkdirSync(codexHome, { recursive: true });
+  }
+
+  let written = 0;
+  let skipped = 0;
+  const profiles = [];
+
+  for (const m of models) {
+    const id = typeof m === "string" ? m : (m.id ?? "");
+    if (!id) {
+      skipped++;
+      continue;
+    }
+    if (onlyFilter && !onlyFilter.some((f) => id.includes(f))) {
+      skipped++;
+      continue;
+    }
+
+    const cfg = categoriseModel(id) ?? fallbackCodexProfile(id, m);
+    if (!cfg) {
+      skipped++;
+      continue;
+    }
+
+    const filePath = join(codexHome, `${cfg.name}.config.toml`);
+    const content = buildProfileToml(id, cfg);
+
+    if (dryRun) {
+      console.log(`\n── [dry-run] ${filePath} ──`);
+      console.log(content);
+    } else {
+      writeFileSync(filePath, content, "utf8");
+    }
+    profiles.push({ name: cfg.name, model: id, filePath });
+    written++;
+  }
+
+  return { written, skipped, profiles };
+}
+
 // ── Command ───────────────────────────────────────────────────────────────────
 
 /**
@@ -146,39 +332,17 @@ export async function runSetupCodexCommand(opts = {}) {
 
   printInfo(`Received ${models.length} models from ${baseUrl}`);
 
-  // ── Ensure codex home exists ──────────────────────────────────────────────
-  if (!dryRun && !existsSync(codexHome)) {
-    mkdirSync(codexHome, { recursive: true });
-  }
-
   // ── Generate profiles ─────────────────────────────────────────────────────
-  let written = 0;
-  let skipped = 0;
-
-  for (const m of models) {
-    const id = typeof m === "string" ? m : (m.id ?? "");
-    if (!id) continue;
-    if (onlyFilter && !onlyFilter.some((f) => id.includes(f))) continue;
-
-    const cfg = categoriseModel(id);
-    if (!cfg) continue;
-
-    const filePath = join(codexHome, `${cfg.name}.config.toml`);
-    const content = buildProfileToml(id, cfg);
-
-    if (dryRun) {
-      console.log(`\n── [dry-run] ${filePath} ──`);
-      console.log(content);
-    } else {
-      writeFileSync(filePath, content, "utf8");
-      printSuccess(`  ✓ ${cfg.name}.config.toml  (${id})`);
-    }
-    written++;
-  }
-
-  skipped = models.length - written;
+  const { written, skipped, profiles } = await syncCodexProfilesFromModels(models, {
+    codexHome,
+    dryRun,
+    only: opts.only,
+  });
 
   if (!dryRun) {
+    for (const profile of profiles) {
+      printSuccess(`  ✓ ${profile.name}.config.toml  (${profile.model})`);
+    }
     console.log("");
     printSuccess(`${written} profiles written to ${codexHome}`);
     if (skipped > 0) {
@@ -210,10 +374,7 @@ export function registerSetupCodex(program) {
       "--api-key <key>",
       "OmniRoute API key for the remote instance (defaults to OMNIROUTE_API_KEY env var)"
     )
-    .option(
-      "--codex-home <dir>",
-      "Directory where profile files are written (default: ~/.codex)"
-    )
+    .option("--codex-home <dir>", "Directory where profile files are written (default: ~/.codex)")
     .option(
       "--only <patterns>",
       "Comma-separated substrings — only generate profiles for matching model IDs (e.g. glm,kimi)"

bin/cli/output.mjs

@@ -37,6 +37,7 @@ function inferSchema(sample) {
 function formatCell(v, col) {
   if (v == null) return "";
   if (col.formatter) return col.formatter(v);
+  if (typeof v === "object") return JSON.stringify(v);
   return String(v);
 }
 

bin/cli/runtime/nativeDeps.mjs

@@ -52,6 +52,31 @@ export function hasModule(name) {
   return existsSync(join(runtimeModules(), name, "package.json"));
 }
 
+/**
+ * Probe whether a native addon (.node) file can actually be dlopen'd by the Node runtime that
+ * is going to load it. Runs in a throwaway subprocess so a real ABI mismatch (which can segfault
+ * the process instead of throwing) never takes down the caller — only the probe subprocess.
+ */
+function probeNativeBinaryLoadable(binary) {
+  try {
+    const res = spawnSync(
+      process.execPath,
+      [
+        "-e",
+        "try { require(process.argv[1]); process.exit(0); } catch (e) { process.exit(1); }",
+        binary,
+      ],
+      { timeout: 10_000, stdio: "ignore" }
+    );
+    // status === 0 means require() (and therefore dlopen) succeeded. Anything else — a thrown
+    // ERR_DLOPEN_FAILED/NODE_MODULE_VERSION mismatch (status 1) or a crash (status null with a
+    // signal, e.g. SIGSEGV) — means the binary is not safe to load.
+    return res.status === 0;
+  } catch {
+    return false;
+  }
+}
+
 export function isBetterSqliteBinaryValid() {
   const binary = join(
     runtimeModules(),
@@ -68,10 +93,18 @@ export function isBetterSqliteBinaryValid() {
     closeSync(fd);
     const magic = buf.toString("hex");
     const os = platform();
-    if (os === "linux") return magic.startsWith("7f454c46"); // ELF
-    if (os === "darwin") return magic.startsWith("cffaedfe") || magic.startsWith("cefaedfe"); // Mach-O
-    if (os === "win32") return magic.startsWith("4d5a"); // PE/MZ
-    return true;
+    let formatOk;
+    if (os === "linux") formatOk = magic.startsWith("7f454c46"); // ELF
+    else if (os === "darwin")
+      formatOk = magic.startsWith("cffaedfe") || magic.startsWith("cefaedfe"); // Mach-O
+    else if (os === "win32") formatOk = magic.startsWith("4d5a"); // PE/MZ
+    else formatOk = true;
+    if (!formatOk) return false;
+    // File-format magic bytes alone do not guarantee the binary was built for the Node ABI
+    // (NODE_MODULE_VERSION) that will load it — a stale/foreign-ABI binary passes the header
+    // check and then crashes (segfault) on load instead of triggering a rebuild. Actually
+    // attempt to load it, isolated in a subprocess.
+    return probeNativeBinaryLoadable(binary);
   } catch {
     return false;
   }

bin/cli/runtime/processSupervisor.mjs

@@ -35,22 +35,32 @@ export class ServerSupervisor {
     // heap via NODE_OPTIONS (a CLI arg would shadow/override their value). The
     // calibrated heap is already carried by env.NODE_OPTIONS either way.
     const heapArgs = buildNodeHeapArgs(process.env, this.memoryLimit);
+    // #6321: stdout used to be discarded (`"ignore"`) whenever `--log`/OMNIROUTE_SHOW_LOG
+    // wasn't set (the default) — any debug/pino output written to stdout vanished
+    // silently, so a boot that never becomes ready looked like a dead hang with zero
+    // output even at APP_LOG_LEVEL=debug. Pipe stdout too and buffer it alongside
+    // stderr so a readiness timeout can surface what the child actually printed.
     this.child = spawn("node", [...heapArgs, this.serverPath], {
       cwd: dirname(this.serverPath),
       env: this.env,
-      stdio: showLog ? "inherit" : ["ignore", "ignore", "pipe"],
+      stdio: showLog ? "inherit" : ["ignore", "pipe", "pipe"],
     });
 
     writePidFile("server", this.child.pid);
 
+    const bufferOutput = (data) => {
+      const lines = data.toString().split("\n").filter(Boolean);
+      this.crashLog.push(...lines);
+      if (this.crashLog.length > CRASH_LOG_LINES) {
+        this.crashLog = this.crashLog.slice(-CRASH_LOG_LINES);
+      }
+    };
+
+    if (this.child.stdout) {
+      this.child.stdout.on("data", bufferOutput);
+    }
     if (this.child.stderr) {
-      this.child.stderr.on("data", (data) => {
-        const lines = data.toString().split("\n").filter(Boolean);
-        this.crashLog.push(...lines);
-        if (this.crashLog.length > CRASH_LOG_LINES) {
-          this.crashLog = this.crashLog.slice(-CRASH_LOG_LINES);
-        }
-      });
+      this.child.stderr.on("data", bufferOutput);
     }
 
     this.child.on("error", (err) => this.handleExit(-1, err));
@@ -107,6 +117,12 @@ export class ServerSupervisor {
     }, delay);
   }
 
+  // #6321: exposes the buffered stdout+stderr lines so a caller (e.g. a readiness
+  // timeout) can print what the child actually said instead of silence.
+  getRecentLog() {
+    return [...this.crashLog];
+  }
+
   dumpCrashLog() {
     console.error("\n--- Server crash log ---");
     this.crashLog.forEach((l) => console.error(l));

bin/cli/utils/pid.mjs

@@ -65,34 +65,52 @@ export function sleep(ms) {
 // cold start due to filesystem watchers, antivirus, etc.) get a working
 // "server ready" signal instead of a phantom timeout while the server is
 // still booting. TCP fallback marks the server as ready when the port
-// has been listening for >= 3s consecutively but /api/monitoring/health
-// has not yet been mounted — common during dev cold start.
+// has been listening for >= 3s consecutively AND the health route is
+// actively rejecting/resetting connections fast (route not mounted yet,
+// but the HTTP server is clearly alive and responsive) — never for a
+// socket that merely accepts TCP and then hangs without ever completing
+// a single request (#6800: that's a still-booting/CPU-bound process, not
+// a "route not mounted" gap, and must NOT be reported as ready).
 export async function waitForServer(port, timeout = 60000) {
   const start = Date.now();
   let tcpListeningSince = null;
   while (Date.now() - start < timeout) {
-    try {
-      const res = await fetch(`http://localhost:${port}/api/monitoring/health`, {
-        signal: AbortSignal.timeout(2000),
-      });
-      if (res.ok) return true;
-      // Server responded but health endpoint is not ready yet — keep
-      // polling, but the fact that we got a response means TCP is open.
+    const outcome = await pollHealthOnce(port);
+    if (outcome === "ready") return true;
+    if (outcome === "fast-reject") {
       if (tcpListeningSince === null) tcpListeningSince = Date.now();
-    } catch {
-      const listening = await isPortListening(port).catch(() => false);
-      if (listening) {
-        if (tcpListeningSince === null) tcpListeningSince = Date.now();
-        if (Date.now() - tcpListeningSince >= 3000) return true;
-      } else {
-        tcpListeningSince = null;
-      }
+      if (Date.now() - tcpListeningSince >= 3000) return true;
+    } else {
+      // "hanging" (request timed out with no response at all) or
+      // "not-listening" — neither counts toward the grace window.
+      tcpListeningSince = null;
     }
     await sleep(500);
   }
   return false;
 }
 
+// Polls /api/monitoring/health once and classifies the outcome:
+// - "ready": got a 2xx HTTP response.
+// - "fast-reject": got a non-2xx HTTP response, or the connection was
+//   actively refused/reset (not a timeout) — the HTTP server is alive and
+//   answering quickly, just not routing this endpoint yet (#2460).
+// - "hanging": the request timed out waiting for any response — the
+//   process accepted the TCP connection but never answered (#6800).
+// - "not-listening": nothing is accepting connections on the port at all.
+async function pollHealthOnce(port) {
+  try {
+    const res = await fetch(`http://localhost:${port}/api/monitoring/health`, {
+      signal: AbortSignal.timeout(2000),
+    });
+    return res.ok ? "ready" : "fast-reject";
+  } catch (err) {
+    if (err?.name === "TimeoutError") return "hanging";
+    const listening = await isPortListening(port).catch(() => false);
+    return listening ? "fast-reject" : "not-listening";
+  }
+}
+
 async function isPortListening(port) {
   const net = await import("node:net");
   return new Promise((resolve) => {

bin/omniroute.mjs

@@ -6,6 +6,7 @@
  * Special bypasses (handled before Commander):
  *   --mcp                     Start MCP server over stdio
  *   reset-encrypted-columns   Recovery tool for broken encrypted credentials
+ *   reset-password            Reset the admin/management password
  *
  * All other commands are routed through Commander (bin/cli/program.mjs).
  */
@@ -210,6 +211,15 @@ if (process.argv.includes("reset-encrypted-columns")) {
   process.exit(exitCode ?? 0);
 }
 
+if (process.argv.includes("reset-password")) {
+  // bin/reset-password.mjs self-executes its `main()` on import and calls
+  // process.exit() on completion/error. Await a never-resolving promise so
+  // control never falls through to Commander (which would then reject
+  // `reset-password` as an unknown command). See #6261.
+  await import(pathToFileURL(join(ROOT, "bin", "reset-password.mjs")).href);
+  await new Promise(() => {});
+}
+
 try {
   const { createProgram } = await import(
     pathToFileURL(join(ROOT, "bin", "cli", "program.mjs")).href

bin/reset-password.mjs

@@ -5,10 +5,15 @@
  *
  * Usage:
  *   node bin/reset-password.mjs
- *   npx omniroute reset-password
+ *   omniroute reset-password
+ *
+ * Non-interactive / scripted usage (piped stdin, e.g. CI or Docker):
+ *   printf 'NewPass123\nNewPass123\n' | omniroute reset-password
+ *   printf 'NewPass123' | omniroute reset-password --password-stdin
  *
  * Resets the admin password for OmniRoute.
- * Prompts for a new password and updates the database directly.
+ * Prompts for a new password (interactive TTY) or reads it from stdin
+ * (non-TTY) and updates the database directly.
  *
  * @module bin/reset-password
  */
@@ -21,19 +26,61 @@ import { readManagementPasswordState, resetManagementPassword } from "./cli/sqli
 const DATA_DIR = resolveDataDir();
 const DB_PATH = resolveStoragePath(DATA_DIR);
 
-const rl = createInterface({
-  input: process.stdin,
-  output: process.stdout,
-});
+const MIN_PASSWORD_LENGTH = 8;
 
-function ask(question) {
-  return new Promise((resolve) => rl.question(question, resolve));
+/** Read the entire stdin stream as a UTF-8 string (used for non-TTY input). */
+function readAllStdin() {
+  return new Promise((resolve) => {
+    let data = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => {
+      data += chunk;
+    });
+    process.stdin.on("end", () => resolve(data));
+    process.stdin.on("error", () => resolve(data));
+    // Resuming is implied by attaching a 'data' listener, but be explicit so a
+    // paused stream (some spawn setups) still flows to EOF.
+    process.stdin.resume();
+  });
 }
 
-function exitWithError(message) {
-  console.error(message);
-  rl.close();
-  process.exit(1);
+/**
+ * Obtain the new password (and its confirmation).
+ *
+ * - `--password-stdin`: the ENTIRE stdin is the password, no confirmation.
+ * - non-TTY stdin (piped): read all of stdin once; first line is the password,
+ *   second line — when present — is the confirmation, else the first line is
+ *   reused (a single-line pipe means "no separate confirmation").
+ * - interactive TTY: two sequential prompts (unchanged behavior).
+ *
+ * The non-TTY path exists because two sequential `rl.question` promises never
+ * settle under a piped EOF — the second read blocks forever, so the reset was
+ * silently never applied (#6258).
+ */
+async function collectPassword() {
+  if (process.argv.includes("--password-stdin")) {
+    const raw = await readAllStdin();
+    const password = raw.replace(/[\r\n]+$/, "");
+    return { password, confirm: password };
+  }
+
+  if (!process.stdin.isTTY) {
+    const raw = await readAllStdin();
+    const lines = raw.split(/\r?\n/);
+    const password = lines[0] ?? "";
+    const confirm = lines[1] ? lines[1] : password;
+    return { password, confirm };
+  }
+
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const ask = (question) => new Promise((resolve) => rl.question(question, resolve));
+    const password = await ask("Enter new password (min 8 chars): ");
+    const confirm = await ask("Confirm new password: ");
+    return { password, confirm };
+  } finally {
+    rl.close();
+  }
 }
 
 console.log("\n🔑 OmniRoute — Password Reset\n");
@@ -54,27 +101,34 @@ async function main() {
     console.log("ℹ️  No password is currently set.");
   }
 
-  const password = await ask("Enter new password (min 8 chars): ");
+  const { password, confirm } = await collectPassword();
 
-  if (!password || password.length < 8) {
-    exitWithError("\n❌ Password must be at least 8 characters.\n");
+  if (!password || password.length < MIN_PASSWORD_LENGTH) {
+    console.error(`\n❌ Password must be at least ${MIN_PASSWORD_LENGTH} characters.\n`);
+    process.exit(1);
   }
 
-  const confirm = await ask("Confirm new password: ");
-
   if (password !== confirm) {
-    exitWithError("\n❌ Passwords do not match.\n");
+    console.error("\n❌ Passwords do not match.\n");
+    process.exit(1);
   }
 
   await resetManagementPassword(password, DB_PATH);
-  rl.close();
 
   console.log("\n✅ Password reset successfully!");
   console.log("   Restart OmniRoute for changes to take effect.\n");
 }
 
-main().catch((err) => {
-  console.error(`\n❌ Error: ${err.message}\n`);
-  rl.close();
-  process.exit(1);
-});
+main()
+  .then(() => {
+    // Explicit exit(0) so a caller that imports this module (bin/omniroute.mjs
+    // routes `omniroute reset-password` here) terminates cleanly instead of
+    // hanging / exiting with code 13 on an unsettled wrapper await. On POSIX,
+    // console.log to a pipe is synchronous, so the success line is already
+    // flushed by the time we exit.
+    process.exit(0);
+  })
+  .catch((err) => {
+    console.error(`\n❌ Error: ${err.message}\n`);
+    process.exit(1);
+  });

changelog.d/README.md

@@ -0,0 +1,42 @@
+# changelog.d/ — changelog fragments
+
+**A PR never edits `CHANGELOG.md` directly during the cycle.** Instead it adds ONE new
+file here — its changelog entry as a *fragment*. Two PRs never touch the same file, so
+changelog merge conflicts (the "CHANGELOG-eat" cascade that forced a re-sync push + full
+CI re-run after every sibling merge) are structurally impossible.
+
+## Convention
+
+| Directory      | Aggregates under        |
+| -------------- | ----------------------- |
+| `features/`    | `### ✨ New Features`   |
+| `fixes/`       | `### 🐛 Bug Fixes`      |
+| `maintenance/` | `### 📝 Maintenance`    |
+
+- **Filename**: `<PR-number>-<short-slug>.md` (e.g. `fixes/6700-dockerfile-better-sqlite3.md`).
+  The PR number prefix keeps aggregation order deterministic.
+- **Content**: the exact bullet line(s) that should land in `CHANGELOG.md`, starting with
+  `- `. Multi-line (continuation) bullets are fine. Keep the repo's credit format:
+  `(#PR — thanks @user)`.
+- One fragment per PR (rarely more, e.g. a PR that both fixes and adds).
+
+## Example
+
+`changelog.d/fixes/6496-cloudflare-relay-worker-syntax.md`:
+
+```markdown
+- **fix(providers):** Cloudflare relay Worker deploys use Service Worker syntax with `body_part` metadata ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)) — thanks @SeaXen
+```
+
+## Aggregation
+
+The release captain (or `/generate-release`) folds all fragments into `CHANGELOG.md` and
+deletes them:
+
+```bash
+node scripts/release/aggregate-changelog.mjs            # write + delete fragments
+node scripts/release/aggregate-changelog.mjs --dry-run  # preview only
+```
+
+Fragment well-formedness is enforced by `npm run check:changelog-integrity` (the same
+gate that guards against CHANGELOG-eat for legacy direct edits).

changelog.d/features/6072-ws-server-inprocess-autostart.md

@@ -0,0 +1 @@
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).

changelog.d/features/6556-omniglyph-engine.md

@@ -0,0 +1 @@
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).

changelog.d/features/6611-native-container-runtimes.md

@@ -0,0 +1 @@
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).

changelog.d/features/6708-gemma4-thinkingconfig-guard.md

@@ -0,0 +1 @@
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)

changelog.d/features/6709-xai-responses-endpoint.md

@@ -0,0 +1 @@
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)

changelog.d/features/6727-model-capability-override-ui.md

@@ -0,0 +1 @@
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).

changelog.d/features/6763-operator-configurable-account-rotation.md

@@ -0,0 +1 @@
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).

changelog.d/features/6774-cursor-grok-4-5-effort-fast.md

@@ -0,0 +1 @@
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).

changelog.d/features/6776-discover-live-codex-models.md

@@ -0,0 +1 @@
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).

changelog.d/features/6779-cursor-opus48-fable5-sonnet5.md

@@ -0,0 +1 @@
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).

changelog.d/features/6783-changelog-fragments.md

@@ -0,0 +1 @@
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.

changelog.d/features/6798-latency-optimized-proxy-rotation.md

@@ -0,0 +1 @@
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).

changelog.d/features/6804-fusion-judge-own-knowledge.md

@@ -0,0 +1 @@
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).

changelog.d/features/6811-playground-model-picker-search.md

@@ -0,0 +1 @@
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.

changelog.d/features/6818-antigravity-weekly-quota.md

@@ -0,0 +1 @@
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).

changelog.d/features/6820-codex-effort-model-echo.md

@@ -0,0 +1 @@
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.

changelog.d/features/6823-zai-web-cookie-provider.md

@@ -0,0 +1 @@
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)

changelog.d/features/6838-headroom-gcf-v3.2-nested-flattening.md

@@ -0,0 +1 @@
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).

changelog.d/features/6862-gpt-5-6-providers.md

@@ -0,0 +1,2 @@
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun

changelog.d/features/homolog-e2e-suite.md

@@ -0,0 +1 @@
+- **Homologation suite**: new `npm run homolog` runs the full release-homologation battery against the deployed VPS — health/version parity, API + real SSE streaming with an ephemeral API key (created and revoked by the run), minimal-cost real-provider smoke (promptfoo generated from the live catalog), and a Playwright sweep that loads every dashboard route and exercises the API-key UI flow — emitting a unified CTRF report that backs the release STOP #2 checklist

changelog.d/fixes/1037-vercel-relay-sso-protection-check.md

@@ -0,0 +1 @@
+- **fix(api):** Vercel Relay deploy now checks the Deployment Protection (SSO) PATCH response and surfaces `ssoProtectionWarning` when Vercel rejects it, instead of silently activating a relay that later returns an undiagnosed `403 Access denied`. (thanks @ricatix)

changelog.d/fixes/1382-streaming-empty-content-block.md

@@ -0,0 +1 @@
+- **fix(combo):** streaming Claude responses whose content block opens (`content_block_start`) and closes with no usable text/tool_use — a shape some upstreams return for tool-heavy requests on HTTP 200 — are now detected by `validateResponseQuality`'s SSE peek and trigger combo failover instead of being forwarded to the client as a silent empty completion (thanks @heishen6).

changelog.d/fixes/1556-openai-regex-lookaround.md

@@ -0,0 +1 @@
+- **fix(codex):** strip regex `pattern` lookaround (lookahead/lookbehind) from tool JSON Schemas on the Codex/OpenAI native passthrough path — previously only the translated-request path coerced tool schemas, so a `pattern` like `^(?=.*@).+$` reached OpenAI unmodified and was rejected with `regex lookaround is not supported`. (thanks @evinjohnn) (#7100)

changelog.d/fixes/1809-mitm-stop-dns-before-kill.md

@@ -0,0 +1 @@
+- **fix(cli):** `stopMitm()` now removes /etc/hosts DNS-spoof entries before killing the MITM server process, closing the window where a client's DNS still resolved a target host to `127.0.0.1` while nothing was listening there — the cause of `connect ECONNREFUSED 127.0.0.1:443` right after stopping the MITM proxy (thanks @dionisius95).

changelog.d/fixes/1811-composer-space-sep.md

@@ -0,0 +1 @@
+- **fix(sse):** Cursor Composer/Auto tool calls that separate the arg name and value with a space instead of a newline (e.g. `path /Users/.../test`) no longer produce empty-valued, malformed argument keys, fixing silent no-op Write/tool calls. (thanks @way-art)

changelog.d/fixes/1904-custom-model-vision-toggle.md

@@ -0,0 +1 @@
+- **fix(dashboard):** the "Custom Models" add/edit form now has a "Vision capable" toggle so a custom OpenAI-compatible model can be manually flagged as vision-capable when the provider's discovery metadata doesn't report an image input modality (thanks @nguyenphi37)

changelog.d/fixes/1905-fusion-panel-oom.md

@@ -0,0 +1 @@
+- **fix(combos):** fusion combos now reject an oversized panel (>40 models by default, tunable via `fusionTuning.maxPanel`) with a clean 400 before fanning out, instead of buffering dozens of concurrent full responses in memory and OOM-crashing the whole container. (thanks @fontvu)

changelog.d/fixes/2032-openai-compatible-check-404-warning.md

@@ -0,0 +1 @@
+- **fix(providers):** the OpenAI-compatible "Check" validation flow now surfaces a warning when the chat-completions probe returns `404` (e.g. `model_not_found`) instead of silently passing as `Valid` — a bogus/non-standard model id (Featherless/OpenRouter-style `vendor/model` typos) previously went undetected at Check time and only surfaced once a real request tripped the per-model lockout. (thanks @advane204f)

changelog.d/fixes/2413-preserve-agent-headers.md

@@ -0,0 +1 @@
+- **fix(executors):** forward agent-supplied `X-Session-ID`/`X-Title` metadata headers to upstream providers — previously dropped for every client outside the `x-opencode-*` allowlist. (thanks @chitholian) (#7104)

changelog.d/fixes/2461-antigravity-streaming-403-raw-bytes.md

@@ -0,0 +1 @@
+- **fix(sse):** Antigravity streaming requests that hit a non-ok upstream response (e.g. a 403) no longer pipe the raw upstream bytes straight through to the client — a binary/non-UTF8 error body (observed as gzip-magic-byte garbage) is now routed through the same sanitized `buildAntigravityUpstreamError()` path the non-streaming branch already used, instead of corrupting the client-visible error message. Regression guard: `tests/unit/antigravity-streaming-error-body-sanitized-2461.test.ts` — thanks @Duongkhanhtool

changelog.d/fixes/2493-better-sqlite3-abi-validation.md

@@ -0,0 +1 @@
+- **fix(cli):** the runtime self-heal now verifies a cached `better-sqlite3` native binary actually loads for the running Node before trusting it — the old check only inspected the file's magic bytes (ELF/Mach-O/PE header), so a binary built for a different Node ABI passed validation and segfaulted the process on first use instead of triggering a rebuild. (thanks @mrprohack) (#7105)

changelog.d/fixes/5716-proxy-pool-relayauth-dropped.md

@@ -0,0 +1 @@
+- fix(providers): preserve relayAuth for vercel/deno/cloudflare relay proxies referenced by-id from the no-auth-provider Proxy Pool dropdown (#5716)

changelog.d/fixes/6142-6142-devin-unified-api.md

@@ -0,0 +1 @@
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)

changelog.d/fixes/6272-6272-mimo-proxy.md

@@ -0,0 +1 @@
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)

changelog.d/fixes/6276-toolcall-args-logs.md

@@ -0,0 +1 @@
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)

changelog.d/fixes/6280-lmarena-arena-modernize.md

@@ -0,0 +1 @@
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun

changelog.d/fixes/6308-web-model-discovery.md

@@ -0,0 +1 @@
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).

changelog.d/fixes/6323-log-detail-stale-reopen.md

@@ -0,0 +1 @@
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).

changelog.d/fixes/6330-sensenova-token-plan.md

@@ -0,0 +1 @@
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).

changelog.d/fixes/6343-6343-v0web-creds.md

@@ -0,0 +1 @@
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)

changelog.d/fixes/6377-6377-agentrouter-key.md

@@ -0,0 +1 @@
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)

changelog.d/fixes/6401-6401-usage-migrations.md

@@ -0,0 +1 @@
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)

changelog.d/fixes/6409-6409-build-ram.md

@@ -0,0 +1 @@
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)

changelog.d/fixes/6479-6479-compression-pipeline.md

@@ -0,0 +1 @@
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)

changelog.d/fixes/6524-6524-reasoning-buffer-clamp.md

@@ -0,0 +1 @@
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)

changelog.d/fixes/6538-tier-flow-svg-public.md

@@ -0,0 +1 @@
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).

changelog.d/fixes/6557-6557-disabled-provider.md

@@ -0,0 +1 @@
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).