John Costa 875a84e301 fix(docker): copy the app with node ownership instead of a second chown layer (#14010) ...

The runner-base stage COPY'd the standalone build as root and then ran
`RUN chown -R node:node /app`. On overlayfs a chown rewrites every file it
touches into the new layer, so the published image carried the ~2 GB
standalone tree twice (docker history of diegosouzapw/omniroute:latest:
`COPY /app/.build/next/standalone ./` 2.03 GB followed by
`RUN chown -R node:node /app` 2.04 GB).

Set `--chown=node:node` on the three COPYs that populate /app, drop the
recursive chown, and hand /app and /app/data to node non-recursively next to
the `mkdir -p /app/data` so the data dir stays writable without a volume.

Measured by rebuilding the runner-base COPY/chown sequence against the
published /app tree (root-owned source, same base image, linux/arm64):

  before: 4.38 GB of layers (COPY 2.04 GB + chown -R 2.04 GB), inspect Size 1220846106
  after:  2.34 GB of layers (COPY --chown 2.04 GB),          inspect Size  655117142

The fixed image runs as uid 1000, /app and /app/data are node-owned and
writable, the server boots and healthcheck.mjs exits 0. hadolint output is
unchanged. tests/unit/dockerfile-copy-chown-13990.test.ts guards the
mechanism.

Fixes #13990

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

2026-09-18 11:35:05 -03:00

..

.gitkeep

Release v3.8.47 (#6569)

2026-07-13 09:12:40 -03:00

0000-files-batches-ownership-null-owner-anonymous-list.md

fix(api): enforce API-key ownership on files and batches — null-owner records and anonymous listing (#13749)

2026-09-15 13:25:13 -03:00

0000-i18n-review-all-locales.md

fix(i18n): review the 64 non-pt-BR dashboard catalogs for translation quality (#14078)

2026-09-18 07:09:03 -03:00

0000-jwt-bootstrap-chain-real-peer-loopback.md

fix(auth): close the JWT_SECRET bootstrap chain — real-peer loopback, obsidian always-protected, DATA_DIR vault refusal (#13791)

2026-09-15 16:58:24 -03:00

0000-pinned-401-combo-fallback.md

fix(combo): fall through on pinned 401 responses (#12818)

2026-09-18 11:29:23 -03:00

9908-antigravity-image-quota-account-rotation.md

fix(antigravity): rotate image accounts on explicit quota exhaustion (#9908)

2026-09-16 19:59:43 -03:00

11742-public-error-boundaries-hardening.md

security(runtime): harden TLS provenance, lifecycle, and public error boundaries (#11742)

2026-09-17 15:35:35 -03:00

12252-cohere-monthly-quota-text.md

fix(sse): classify "N API calls / month" 429 text as quota_exhausted (#12252)

2026-09-18 11:28:03 -03:00

12334-claude-per-model-lockout.md

fix(combo): scope Claude model failures to the model, not the account (#12340)

2026-09-18 11:28:20 -03:00

12370-responses-function-call-name.md

fix(api): restore function_call name on non-streaming /v1/responses (#12370) (#13824)

2026-09-16 06:08:58 -03:00

12453-conversation-turn-nodes-retention.md

fix(db): give conversation_turn_nodes its own 1-day retention (#13344)

2026-09-16 08:23:17 -03:00

12491-codex-wreq-standalone-runtime.md

fix(sse): dynamic-specifier require for wreq-js in Codex WS transport (#12491) (#13756)

2026-09-16 06:17:57 -03:00

12497-command-code-muse-spark-budget-floor.md

fix(command-code): floor tiny muse-spark output budgets so hidden reasoning cannot consume the whole budget (#12497)

2026-09-18 11:28:36 -03:00

12563-windows-npm-cmd-shim.md

fix(cli): detect npm-global Claude .cmd shims under Program Files on Windows (#12565)

2026-09-18 11:28:52 -03:00

12585-codex-strip-temperature.md

fix(sse): strip Codex temperature on native Responses passthrough (#12585)

2026-09-17 16:27:19 -03:00

12643-messages-entry-guard.md

fix(chat): reject null/non-object entries in messages[] (#12643) (#13755)

2026-09-17 13:16:02 -03:00

12668-anthropic-native-handoff-system.md

fix(sse): prevent Anthropic 400s for Claude-native handoffs (#12668)

2026-09-17 16:26:25 -03:00

12686-reasoning-rule-declared-efforts.md

fix(resilience): honor declared effort vocabulary in reasoning rule gate (#12686)

2026-09-17 16:24:58 -03:00

12692-xai-legacy-function-call.md

fix(providers): xAI translators drop legacy function_call and zero total_tokens (#12692, #12700) (#13753)

2026-09-16 06:18:37 -03:00

12700-xai-usage-total.md

fix(providers): xAI translators drop legacy function_call and zero total_tokens (#12692, #12700) (#13753)

2026-09-16 06:18:37 -03:00

12704-modal-base-url-field.md

fix(dashboard): expose the Modal Base URL field in the connection modals (#12704) (#12736)

2026-09-18 11:29:08 -03:00

12723-cursor-kimi-tool-call-narration.md

fix(cursor): recover Kimi tool calls emitted as history narration (#12723)

2026-09-16 15:34:54 -03:00

12730-vendor-route-effort-values.md

fix(providers): parse per-vendor-route reasoning.effort_values in discovery (#12730)

2026-09-17 16:24:39 -03:00

12732-catalog-auto-target-metadata-memo.md

fix(ci): clear five uncovered base-reds on release/v3.8.51 — auto-combo catalog event-loop pin, unweighted quota-share, resilience key set, pack-gate stamp, synced-catalog env doc (#13678)

2026-09-15 09:00:51 -03:00

12732-quota-share-unweighted-drr.md

fix(ci): clear five uncovered base-reds on release/v3.8.51 — auto-combo catalog event-loop pin, unweighted quota-share, resilience key set, pack-gate stamp, synced-catalog env doc (#13678)

2026-09-15 09:00:51 -03:00

12737-codex-websocket-premature-close.md

fix(codex): fail the stream when the websocket closes before a terminal event (#12737)

2026-09-17 18:37:51 -03:00

12830-cleanup-no-blocking-vacuum.md

fix(db): reclaim freed pages incrementally instead of a blocking VACUUM in the cleanup scheduler (#12821) (#12830)

2026-09-17 18:38:26 -03:00

12861-direct-fetch-timeout-unhandled-rejection.md

fix(resilience): extend process crash guard to combo hedge cancels and upstream fetch failures (#13636) (#14064)

2026-09-18 10:21:32 -03:00

12863-gemini-to-claude-cached-input-tokens.md

fix(translator): stop double-counting cached tokens in Gemini to Claude usage (#12863)

2026-09-18 11:29:38 -03:00

12864-anthropic-request-not-allowed-not-a-ban.md

fix(sse): Anthropic OAuth 403 "Request not allowed" is a per-request refusal — cooldown with backoff instead of an instant ban (#12859) (#12864)

2026-09-17 16:26:08 -03:00

12897-vllm-max-model-len.md

fix(providers): read the vLLM context window from max_model_len (#12897)

2026-09-17 18:37:34 -03:00

12898-combo-hidden-update-schema.md

fix(combos): accept isHidden in updateComboSchema (#12898)

2026-09-17 16:25:16 -03:00

12903-vision-bridge-nested-images-prefix-credential.md

fix(vision-bridge): nested tool_result images + provider-prefix credential check (#12903)

2026-09-17 02:30:54 -03:00

12904-inject-global-system-prompt-post-translation.md

fix(sse): inject global system prompt once, post-translation, across all target shapes (#12904)

2026-09-17 02:30:35 -03:00

12905-directive-preamble-strip-analysis-preserve.md

fix(thinking): parse/scrub DSML tool-call markers and recognize adaptive thinking (#12905)

2026-09-17 12:56:30 -03:00

12905-nonstream-thinking-intent-parity.md

fix(thinking): parse/scrub DSML tool-call markers and recognize adaptive thinking (#12905)

2026-09-17 12:56:30 -03:00

12905-reasoning-gate-thinking-leak.md

fix(thinking): parse/scrub DSML tool-call markers and recognize adaptive thinking (#12905)

2026-09-17 12:56:30 -03:00

12905-system-preamble-opt-in-and-flush.md

fix(thinking): parse/scrub DSML tool-call markers and recognize adaptive thinking (#12905)

2026-09-17 12:56:30 -03:00

12906-direct-timeout-reasoning-aware.md

fix(sse): retry empty_response 502 + reasoning-aware direct response-start timeout (#12906)

2026-09-17 02:30:15 -03:00

12906-empty-response-502-retry.md

fix(sse): retry empty_response 502 + reasoning-aware direct response-start timeout (#12906)

2026-09-17 02:30:15 -03:00

12909-tool-call-history-preserve.md

fix(compat): preserve GPT and Claude Code tool-call history (#12909)

2026-09-17 02:29:39 -03:00

12910-semantic-cache-exact-id-finalize.md

fix(usage): finalize semantic cache hits by exact request id (#12910)

2026-09-17 02:29:19 -03:00

12911-codex-ws-lease-fail-fast.md

fix(codex): fail fast and release per-account Responses WS leases (#12911)

2026-09-17 10:56:01 -03:00

12913-stream-active-timeout.md

fix(sse): bound active streams without terminal events (#12913)

2026-09-17 10:44:48 -03:00

12927-magnific-key-validation-false-negative.md

fix(providers): correct Magnific key validation probe path (#12927) (#13754)

2026-09-16 06:18:22 -03:00

12949-auggie-quota-200-no-failover.md

fix(routing): fail over when Auggie's quota-exhausted text exits clean (#12949) (#13751)

2026-09-17 10:46:52 -03:00

12956-weighted-combo-cooling-down-503.md

fix(combo): answer 503 + Retry-After, not 404, when a weighted pool is only cooling down (#12956)

2026-09-17 16:25:49 -03:00

12957-model-lockout-5xx-exact-scope.md

fix(resilience): lock the exact model, not the quota family, on 5xx model-lockout failures (#12957)

2026-09-17 16:25:32 -03:00

12958-gitlab-duo-403-entitlement-fallback.md

fix(oauth): fall back to public Code Suggestions on any GitLab Duo direct_access 403 (#12958) (#13758)

2026-09-16 06:17:42 -03:00

12968-anthropic-shim-tiny-probe-empty.md

fix(sse): widen max_tokens/tool_use exemption to lone empty text blocks (#12968) (#13771)

2026-09-16 06:16:49 -03:00

12989-thinking-binding-controls-beta-forward.md

fix(claude): forward client-negotiated thinking-binding-controls and thinking-display-updates betas (#12989)

2026-09-18 11:29:54 -03:00

12995-combos-i18n-formatting-error.md

fix(i18n): stop swallowed FORMATTING_ERROR from showing raw keys/garbled text (#12995)

2026-09-16 13:37:07 -03:00

12996-responses-streaming-namespace-followup.md

fix(api): restore MCP namespace identity on follow-up Responses turns (#12996) (#13769)

2026-09-17 10:46:34 -03:00

12999-batch-and-file-cleanup.md

fix(db): auto-clean terminal batch checkpoints and expired file content (#12999)

2026-09-16 15:45:34 -03:00

13000-combo-context-limit-cold-start.md

fix(providers): backfill combo context limit from snapshot after cold start (#13000) (#13759)

2026-09-16 06:17:27 -03:00

13012-cli-mcp-restart-and-enable.md

fix(cli): add POST /api/mcp/restart and mcp enable/disable subcommands (#13012) (#13770)

2026-09-16 06:17:04 -03:00

13022-desktop-exe-malformed-skill-tool-schemas.md

fix(skills): repair nested malformed schemas in injected skill tools (#13022) (#13772)

2026-09-16 06:16:34 -03:00

13046-oauth-polltoken-nonjson-body.md

fix(oauth): read pollToken body once on non-JSON upstream responses (kimi-coding, github) (#13046)

2026-09-18 11:30:09 -03:00

13071-providers-put-lazy-chatgpt-web-codex-import.md

fix(providers): lazily load chatgpt-web-codex admin helpers in PUT /api/providers/[id] (#13071)

2026-09-16 13:37:39 -03:00

13078-local-provider-embedding-override.md

fix(providers): honor operator-set endpoint overrides for local models (#13078)

2026-09-16 13:36:52 -03:00

13089-combo-live-roundrobin-missing-events.md

fix(routing): publish dashboard events from the round-robin combo loop (#13089) (#13776)

2026-09-16 06:16:02 -03:00

13122-responses-custom-tool-choice.md

fix(sse): accept Responses API custom tool_choice (#13122) (#13775)

2026-09-16 06:16:18 -03:00

13131-remove-chipotle-provider.md

fix(providers): remove the chipotle/pepper provider (#13131) (#13913)

2026-09-17 13:22:09 -03:00

13149-health-poll-skip-integrity.md

fix(db): skip integrity scans during health polling (#13149)

2026-09-17 18:52:43 -03:00

13153-early-eof-sibling-failover.md

fix(sse): fail over to sibling connection on stream early EOF (#13153)

2026-09-15 16:49:06 -03:00

13173-fable-mid-conversation-system.md

fix(sse): preserve Fable mid-conversation cache prefixes (#13173)

2026-09-17 16:24:04 -03:00

13201-eval-errored-case-scored-passed.md

fix(evals): fail a case whose model call errored instead of scoring it passed (#13201)

2026-09-18 11:30:35 -03:00

13217-combo-dead-keys.md

fix(combos): stop dropping live keys and persisting dead ones (#13217)

2026-09-15 10:59:34 -03:00

13218-wal-busy-counter.md

fix(db): persist WAL busy counter across restarts (#13218)

2026-09-15 13:21:52 -03:00

13220-vertex-claude-prompt-caching.md

fix(vertex): preserve Claude prompt caching and usage metadata (#13220)

2026-09-18 11:30:45 -03:00

13232-zai-web-missing-browser-executable.md

fix(sse): classify missing Chromium as a Z.ai host/config cooldown (#13232) (#13777)

2026-09-16 06:15:47 -03:00

13279-combo-test-admission.md

fix(combos): abort combo test probes when the client disconnects (#13279)

2026-09-15 11:24:35 -03:00

13280-bounded-routing-caches.md

fix(quota): bound routing caches with shared boundedMap factory (#13280)

2026-09-15 13:08:21 -03:00

13281-error-type-contract.md

fix(call-logs): versioned error_type vocabulary with unknown fail-open (#13281)

2026-09-15 11:26:38 -03:00

13290-shared-temp-data-dir-teardown.md

test: close the database before removing temp DATA_DIR (#13290) (#13292)

2026-09-17 02:31:53 -03:00

13293-alibaba-workspace-endpoints.md

fix(providers): honor Alibaba workspace embedding and rerank endpoints (#13293)

2026-09-18 11:30:53 -03:00

13295-redaction-truncates-after-path.md

fix(backend): stop redaction truncating the message after a path (#13295)

2026-09-18 11:31:02 -03:00

13299-token-plan-live-catalog.md

fix(providers): fetch live Qwen and Alibaba Token Plan catalogs (#13299)

2026-09-16 16:50:42 -03:00

13306-windows-libuv-abort-sqljs-exit.md

fix(db): defer process.exit(0) by a macrotask on graceful shutdown (#13306) (#13778)

2026-09-16 06:15:31 -03:00

13314-supervisor-surfaces-fatal-startup-diagnostic.md

fix(cli): surface fatal [STARTUP] boot diagnostics without --log (#13314) (#13779)

2026-09-16 06:15:15 -03:00

13320-semaphore-cooldown-keeps-limit.md

fix(sse): keep a round-robin target's concurrency limit through a cooldown (#13320)

2026-09-16 21:01:48 -03:00

13321-rate-limit-reset-rfc3339.md

fix(resilience): parse RFC 3339 and fractional-second rate-limit resets (#13321)

2026-09-16 21:02:04 -03:00

13322-cli-negated-flags.md

fix(cli): read commander's negated --no-* flags as opts.<name> === false (#13322)

2026-09-16 21:02:19 -03:00

13323-private-provider-urls-db-off.md

fix(providers): let a dashboard OFF for private provider URLs beat the env opt-in (#13323)

2026-09-16 21:02:35 -03:00

13327-cli-restart-honors-port.md

fix(cli): let restart honor PORT like serve and dashboard (#13327)

2026-09-16 21:02:51 -03:00

13328-warmup-cb-redis-key-prefix.md

fix(redis): namespace warmup circuit-breaker keys with REDIS_KEY_PREFIX (#13328)

2026-09-16 21:09:38 -03:00

13329-rate-limiter-backup-flag.md

fix(api): stop DISABLE_SQLITE_AUTO_BACKUP from turning off Redis rate limiting (#13329)

2026-09-16 21:03:09 -03:00

13333-tool-choice-none-claude.md

fix(translator): keep tool_choice "none" instead of turning it into "auto" (#13333)

2026-09-16 21:03:25 -03:00

13334-gemini-tool-result-without-id.md

fix(translator): pair id-less Gemini tool results with their call (#13334)

2026-09-16 21:03:40 -03:00

13335-claude-tool-result-image-gemini.md

fix(translator): send a Claude tool_result image to Gemini as inlineData (#13335)

2026-09-16 21:03:57 -03:00

13338-combo-identical-error-circuit-breaker.md

fix(combo): stop retrying an unrecoverable request-shape error across the whole fallback chain (#13338)

2026-09-16 13:39:29 -03:00

13355-strip-internal-omniroute-markers.md

fix(dispatch): strip every _omniroute* internal marker before upstream send (#13355)

2026-09-16 15:32:58 -03:00

13364-zed-hosted-haiku-thinking-inflation.md

fix(providers): stop zed-hosted claude-haiku-4-5 thinking from inflating max_tokens (#13364) (#13780)

2026-09-16 06:15:00 -03:00

13380-gemini-web-system-and-tool-prompt.md

fix(providers): gemini-web no longer drops system instructions or the tool contract (#13380) (#13784)

2026-09-16 06:14:31 -03:00

13381-gemini-web-model-selection.md

fix(providers): select and verify the requested gemini-web model/mode before answering (#13381) (#13919)

2026-09-17 13:06:37 -03:00

13389-catalog-cache-backoff-reset.md

fix(db): stop backoff-reset from busting the model catalog cache (#13389) (#13783)

2026-09-16 06:14:46 -03:00

13426-opencode-plugin-stale-cache-age.md

fix(opencode-plugin): report disk-cache age in the stale-fallback warning (#13426)

2026-09-16 22:56:38 -03:00

13428-logs-export-streaming.md

fix(api): stream /api/logs/export with row cap to prevent V8 heap OOM (#13123) (#13428)

2026-09-17 12:32:43 -03:00

13429-lite-redundant-remove-tool-call-id.md

fix(compression): keep tool messages through lite redundant-remove (#13429) (#13787)

2026-09-16 06:13:44 -03:00

13431-responses-post-keepalive-error-type.md

fix(sse): frame post-keepalive /v1/responses stream errors with a type field (#13431) (#13785)

2026-09-16 06:14:14 -03:00

13432-incremental-auto-vacuum-drift.md

fix(db): reconcile INCREMENTAL auto_vacuum drift via the vacuum scheduler (#13432) (#13786)

2026-09-16 06:13:59 -03:00

13434-authoritative-provider-listing.md

fix(models): reconcile provider dashboards with active live catalogs (#13434)

2026-09-16 16:56:28 -03:00

13436-client-bundle-server-only-guard.md

fix(build): stop the client bundle from reaching server-only modules, and make the guard find them (#13436)

2026-09-15 12:52:41 -03:00

13438-cold-catalog-retry.md

fix(models): return 503 with Retry-After when a cold catalog build exceeds its time bound (#13438)

2026-09-15 11:21:58 -03:00

13439-protected-priority-502.md

fix(combo): return 502 for non-quota protected-priority stops (#13439)

2026-09-15 15:46:57 -03:00

13440-daily-reset-tz.md

fix(resilience): honor user daily-reset clock for non-TPD quota cooldowns (#13440)

2026-09-15 15:02:55 -03:00

13441-error-type-write-guard.md

fix(call-logs): zod write-point guard for error_type (#13441)

2026-09-15 12:20:19 -03:00

13452-provider-node-baseurl-ignored.md

fix(sse): stop unhydrated compatible connections routing to the real OpenAI/Anthropic API (#13452) (#13798)

2026-09-16 06:12:28 -03:00

13461-fake-success-200-classifier.md

fix(sse): classify a 2xx body as a disguised upstream failure (#13461) (#13910)

2026-09-17 10:45:25 -03:00

13470-background-oauth-refresh-proxy-guard.md

fix(sse): fail closed on background token-refresh for dead proxy pools (#13470) (#13793)

2026-09-16 06:12:59 -03:00

13471-opencode-muse-spark-1-3-responses.md

fix(providers): route Muse Spark 1.3 to the Responses API on OpenCode Zen, OpenCode and OpenCode Go (#13471)

2026-09-15 11:08:16 -03:00

13472-responses-cache-creation-tokens.md

fix(sse): forward cache-creation tokens through the responses usage hop (#13472) (#13790)

2026-09-16 06:13:29 -03:00

13484-opencode-responses-first-byte-stall.md

fix(opencode): rotate once when a Responses stream stalls before its first byte (#13484)

2026-09-15 20:10:57 -03:00

13488-pii-sanitizer-splices-openrouter-metadata.md

fix(sse): stop PII sanitizer splicing OpenRouter metadata into content (#13488) (#13792)

2026-09-16 06:13:14 -03:00

13498-opencode-user-blocked-rotation.md

fix(sse): fail over opencode request on refused-route 403 (#13498)

2026-09-15 20:39:39 -03:00

13535-windows-tray-icon-contrast.md

fix(cli): redraw Windows tray icon with dark outline + ship icon.ico (#13535) (#13797)

2026-09-16 06:12:43 -03:00

13538-tray-crash-diagnostics.md

fix(cli): persist supervisor give-up crash diagnostics to disk (#13538) (#13908)

2026-09-17 10:46:00 -03:00

13544-audio-transcription-call-log.md

fix(api): record audio transcription/translation/speech requests in call_logs (#13544) (#13803)

2026-09-16 06:11:13 -03:00

13552-claude-tool-schema-root-unions.md

fix(translator): flatten root-level anyOf/oneOf/allOf in Claude tool schemas (#13561)

2026-09-18 11:31:43 -03:00

13556-reasoning-rule-propagation.md

fix(routing): preserve reasoning overrides across transports and fallbacks (#13556)

2026-09-16 17:01:51 -03:00

13558-minimax-m3-reasoning-leak.md

fix(providers): MiniMax-M3 reasoning leaks into delta.content instead of reasoning_content (#13558) (#13799)

2026-09-16 06:12:12 -03:00

13562-hide-auto-nothink-settings-schema.md

fix(api): persist hideAutoCombos/hideNoThinkVariants in settings schema (#13562) (#13800)

2026-09-16 06:11:56 -03:00

13566-codex-settings-apikey.md

fix(cli): Codex long-session turn-pin fallback + codex-settings key resolution (#13564 #13563) (#13566)

2026-09-18 11:31:52 -03:00

13566-codex-turnpin-fallback.md

fix(cli): Codex long-session turn-pin fallback + codex-settings key resolution (#13564 #13563) (#13566)

2026-09-18 11:31:52 -03:00

13573-gemini-leading-functioncall-turn.md

fix(gemini): never send a functionCall-opening turn with no preceding user turn (#13573)

2026-09-16 13:38:56 -03:00

13577-proxy-status-preserved-on-write.md

fix(proxies): keep the stored status when a write does not send one (#13577)

2026-09-15 11:05:01 -03:00

13582-partial-update-keeps-omitted-fields.md

fix(api): keep omitted fields on partial updates (#13582)

2026-09-15 10:04:14 -03:00

13591-antigravity-opaque-400-error-surfaced.md

fix(providers): surface real Antigravity upstream error detail (#13591) (#13801)

2026-09-16 06:11:41 -03:00

13597-calllogs-worker-error-detail.md

fix(usage): thread real error/exit-code through callLogs worker failOpen (#13597) (#13802)

2026-09-16 06:11:27 -03:00

13599-deepseek-bai-reasoning-content-echo.md

fix(providers): echo reasoning_content for bai DeepSeek thinking-mode follow-ups (#13599) (#13807)

2026-09-16 06:10:13 -03:00

13602-i18n-duplicated-flag-description-key.md

fix(i18n): drop the duplicated flag description key and the duplicated ERROR_TYPE_CONTRACT import left by the batch merges (#13816)

2026-09-15 21:35:03 -03:00

13605-socks-userinfo-decode-guard.md

fix(proxy): keep proxy credentials holding a literal percent (#13605)

2026-09-15 12:59:27 -03:00

13606-token-limit-request-scoped.md

fix(connection-cooldown): skip cooldown for locally rejected token-budget 429s (#13606)

2026-09-15 11:18:10 -03:00

13607-disk-snapshot-atomic-write.md

fix(opencode-plugin-v2): write catalog snapshot atomically via temp file and rename (#13607)

2026-09-15 11:15:24 -03:00

13608-blocked-resets-streak.md

fix(proxy-health): refused probe responses reset the consecutive-failure streak (#13608)

2026-09-15 20:01:25 -03:00

13609-mistral-401-ambiguous-auth.md

fix(providers): stop parking Mistral connections on a bare 401 with no clear auth failure (#13609)

2026-09-15 21:19:47 -03:00

13612-validate-pool-preserve-status.md

fix(proxies): preserve inactive and dead statuses during pool validation (#13612)

2026-09-15 10:11:44 -03:00

13613-management-token-env.md

fix(opencode): read management token from environment with startup fallback warning (#13613)

2026-09-15 11:12:03 -03:00

13614-routing-error-guard.md

fix(routing): await stale provider-pin clears and gate swallowed errors plus fire-and-forget async (#13614)

2026-09-15 15:52:33 -03:00

13615-opencode-transient-retry-delay.md

fix(sse): pause failover dispatch after repeated transient upstream failures (#13615)

2026-09-15 20:58:12 -03:00

13617-devin-cli-key-validation-fallback.md

fix(devin): fall back to CLI probe when the HTTP API rejects a CLI-format key (#13617)

2026-09-16 15:15:16 -03:00

13620-combo-reasoning-only-sse-burst.md

fix(sse): recognize bare delta.reasoning in combo streaming quality-gate peek (#13620) (#13806)

2026-09-16 06:10:28 -03:00

13622-openrouter-batch-variants.md

fix(models): keep OpenRouter :batch variants out of chat routing (#13622)

2026-09-18 11:32:01 -03:00

13627-cursor-kv-after-text-mcp-toolcall.md

fix(cursor): kv_after_text must not settle away a trailing exec_mcp tool call (#13627)

2026-09-16 13:39:14 -03:00

13628-grok46-default-effort.md

fix(providers): restore grok-4.6/4.5 default reasoning effort (#13628)

2026-09-16 08:15:21 -03:00

13633-stream-recovery-toolcall-order.md

fix(stream-recovery): order-aware in-flight tool-call detection behind off-by-default flag (#13633)

2026-09-15 16:10:52 -03:00

13635-release-v3.8.51-basereds.md

fix(ci): clear the release/v3.8.51 base-reds on the PR fast path (#13635)

2026-09-15 08:51:45 -03:00

13636-pack-artifact-policy-abort-guard-test.md

fix(tests): list dist/httpClientAbortGuard.mjs in the pack-artifact policy assertion (#13872)

2026-09-16 10:10:32 -03:00

13641-search-ghost.md

fix(call-logs): hide search rows without a live provider (#13641)

2026-09-15 12:48:06 -03:00

13645-free-badge-auth.md

fix(dashboard): require provider free-tier for the Free badge (#13645)

2026-09-15 13:57:39 -03:00

13646-socks-flag-reader.md

fix(api): use shared SOCKS5 flag reader in settings routes (#13646)

2026-09-15 14:10:45 -03:00

13650-recovery-trace-logging.md

fix(stream-recovery): log recovery traces with continuation attempt (#13650)

2026-09-15 16:19:10 -03:00

13652-kiro-tooldocs-repeat-every-turn.md

fix(sse): stop re-prepending Kiro tool docs onto every subsequent turn (#13652) (#13808)

2026-09-16 06:09:58 -03:00

13657-rate-limited-429-single-retry-drain.md

fix(sse): stop retry wave on rate-limited 429 and drain 429 once (#13657)

2026-09-15 22:01:56 -03:00

13671-dst-gap.md

fix(sse): bound daily quota cooldowns around daylight-saving transitions (#13671)

2026-09-15 15:07:42 -03:00

13672-retry-after-provenance.md

fix(sse): omit synthetic Retry-After and mark retry provenance on drain path (#13672)

2026-09-15 15:25:43 -03:00

13679-cdp-proxy-auth-network-isolation.md

fix(security): isolate CDP proxy network + auth gate (#13679 PR F) (#13811)

2026-09-16 06:09:44 -03:00

13679-cli-token-random-salt.md

fix(security): generate a random per-install CLI token salt (#13679) (#13909)

2026-09-17 10:45:43 -03:00

13679-cloudsync-hmac-fail-open.md

fix(security): reject unverifiable X-Cloud-Sig in cloud-sync HMAC check (#13679 PR A) (#13804)

2026-09-16 06:10:58 -03:00

13679-container-posture-cors.md

fix(security): container/Fly REQUIRE_API_KEY posture + free-tier usage leak (#13679) (#13911)

2026-09-17 10:45:07 -03:00

13679-deploy-manifest-literal-secrets.md

fix(security): remove literal secrets from podman manifest, block CHANGEME remote login (#13679) (#13812)

2026-09-16 06:09:29 -03:00

13679-selfloop-bearer-random.md

fix(security): random per-process self-loop admission bearer (#13679) (#13813)

2026-09-16 06:09:15 -03:00

13680-13681-batches-sweep-cap-shared-file.md

fix(db): cap per-request batch sweep and guard shared files (#13680, #13681) (#13805)

2026-09-16 06:10:43 -03:00

13685-endpoint-alias-policy-fail-open.md

fix(security): enforce allowedEndpoints on the alias rewrites (#13685) (#13741)

2026-09-18 11:32:37 -03:00

13686-estimated-usage-guard.md

fix(usage): skip billing for estimated token usage, bill real output only on partial estimates (#13686)

2026-09-15 16:22:51 -03:00

13689-openrouter-free-tier-1000-day.md

fix(providers): sync OpenRouter :free 1000/day tier from /credits lifetime purchases (#13689)

2026-09-18 11:32:10 -03:00

13717-db-health-resource-bounds.md

fix(db): bound health scans and isolate native diagnostics (#13717)

2026-09-16 12:59:45 -03:00

13720-suffix-effort-propagation.md

fix(chat): preserve suffix reasoning intent across model attempts (#13720)

2026-09-17 18:52:59 -03:00

13734-catalog-provider-node-apitype-endpoints.md

fix(memory): list provider-node models in the Embedding and Rerank selectors (#13740)

2026-09-18 11:32:26 -03:00

13740-memory-selectors-list-node-models.md

fix(memory): list provider-node models in the Embedding and Rerank selectors (#13740)

2026-09-18 11:32:26 -03:00

13760-nested-prompt-cache-cost.md

fix(usage): preserve nested prompt cache reads before cost calculation (#13760)

2026-09-18 11:32:56 -03:00

13782-i18n-retranslate-english-leaves.md

fix(i18n): retranslate the verbatim-English leaves in all 65 catalogs; ratio gate now blocking (#13782)

2026-09-15 23:19:43 -03:00

13828-zylo-key-validation.md

fix(providers): validate Zylo keys against the chat route, not its open catalog (#13877)

2026-09-16 13:35:33 -03:00

13832-credential-allowlist-diagnostic.md

fix(sse): say when an API key's allowlist is what hid every connection (#13879)

2026-09-16 13:35:49 -03:00

13847-combo-multimodal-capability.md

Fix/combo multimodal capability 13847 (#13863)

2026-09-18 11:34:21 -03:00

13859-mcp-sdk-externalize.md

fix(build): externalize @modelcontextprotocol/sdk to heal MCP initialize 500 on standalone builds (#13859)

2026-09-17 17:06:41 -03:00

13885-pt-br-review.md

fix(i18n): pt-BR review pass over the retranslated leaves (172 corrections) + review-locale script (#13885)

2026-09-16 12:19:40 -03:00

13892-cli-catalogs-all-locales.md

fix(cli): translate the CLI for every locale (38 catalogs were nearly empty) (#13892)

2026-09-16 12:27:59 -03:00

13940-docs-mirrors-resync.md

fix(docs): re-sync the 65 documentation mirror sets; section-level docs pipeline; drift gate blocking (#13940)

2026-09-17 02:55:31 -03:00

13974-i18n-base-markers.md

fix(i18n): translate the 3,719 __MISSING__ markers eight base PRs added on 2026-09-16 (#13974)

2026-09-17 09:09:02 -03:00

14001-openrouter-models-base-url-override.md

fix(providers): honor the base URL override in OpenRouter model discovery (#14001)

2026-09-18 11:34:47 -03:00

14009-perplexity-web-preserve-spaces.md

fix(perplexity-web): keep runs of spaces when cleaning non-streaming answers (#14009)

2026-09-18 11:34:56 -03:00

14010-docker-single-app-layer.md

fix(docker): copy the app with node ownership instead of a second chown layer (#14010)

2026-09-18 11:35:05 -03:00

adobe-firefly-no-browser-spawn-in-tests.md

fix(adobe-firefly): do not spawn Chrome for CDP warm under test runners (#13289)

2026-09-17 02:32:10 -03:00

agnes-cn-thinking-effort-tiers.md

feat(providers): add Agnes AI (China) as agnes-cn on api.agnes-ai.cn (#13399)

2026-09-16 08:01:39 -03:00

agnes-thinking-effort-tiers.md

fix(providers): declare Agnes official thinking effort tiers (#13655) (#14063)

2026-09-18 10:21:17 -03:00

antigravity-unreported-quota-fraction-unknown.md

fix(antigravity): keep unreported quota fraction unknown (#7138)

2026-09-16 19:59:58 -03:00

api-key-blocked-models-schema.md

fix(api): accept blockedModels in the key permissions schema (#13666)

2026-09-17 16:26:42 -03:00

basereds-apikey-provider-count-241.md

fix(tests): bump the APIKEY_PROVIDERS tripwire to 241 (Agnes AI China) (#13905)

2026-09-16 13:48:13 -03:00

basereds-forgotten-sibling-report-bounds.md

fix(ci): bound the forgotten-sibling report so an advisory step stops failing the job (#13889)

2026-09-16 11:45:40 -03:00

claude-oauth-sticky-refresh.md

fix(oauth): soft-fail Claude refresh so CredentialHealth is not sticky-dead (#13185)

2026-09-16 23:10:24 -03:00

cline-refresh-token-classification.md

fix(oauth): classify an embedded invalid_grant in a refresh error body (#13466)

2026-09-17 16:27:01 -03:00

codex-manual-loopback-action.md

fix(oauth): expose manual Codex callback entry (#9944)

2026-09-16 19:59:25 -03:00

codex-reasoning-object-whitelist.md

fix(codex): whitelist reasoning object keys before the wire (#13643) (#14065)

2026-09-18 10:21:44 -03:00

combo-retry-precontent-streaming-failure.md

fix(combo): retry pre-content streaming failures (#13630)

2026-09-17 02:31:36 -03:00

ghsa-34rg-image-url-ssrf-public-only.md

fix(security): pin the public-only guard on client-supplied image URLs (#13748)

2026-09-15 13:24:50 -03:00

ghsa-35fw-jx89-local-only-gates.md

fix(authz): gate the cli-tools status and skills execution routes to LOCAL_ONLY (#13745)

2026-09-15 13:25:35 -03:00

ghsa-r4q7-credential-catalog-groq-xai-sk.md

fix(security): add Groq, xAI and OpenAI-compatible key shapes to the credential catalog (#13744)

2026-09-15 13:24:30 -03:00

mcp-audit-sqlite-fallback.md

fix(mcp): fall back when better-sqlite3 export is not callable (#13903)

2026-09-17 18:47:25 -03:00

model-test-skip-returns-status.md

fix(api): give the #13376 model-test skip a real httpStatus (#13730)

2026-09-15 08:50:58 -03:00

output-styles-top-level-system.md

fix(compression): place output-style instruction in top-level system, not messages[0] (#13383)

2026-09-18 11:31:27 -03:00

release-acceptance-shadow.md

ci(acceptance): emit a shadow release-acceptance report next to release-green (#13701) (#14066)

2026-09-18 10:21:59 -03:00

resource-pressure-cgroup-psi.md

fix(sse): prefer cgroup PSI for chat admission (#12562)

2026-09-18 11:28:45 -03:00

sec-adm-zip-0.6.1-symlink-follow.md

chore(deps): bump the adm-zip override to ^0.6.1 (#13737)

2026-09-15 13:24:09 -03:00

stryker-tapfiles-drift-release-line.md

fix(ci): clear the tap.testFiles drift that reds the mutation gate on every PR (#13814)

2026-09-18 11:33:22 -03:00

tinycms-dom-shim-next-location.md

fix(providers): keep TinyCMS DOM stub safe for Next.js SSR (#13957)

2026-09-18 11:34:39 -03:00

utilization-account-chart-display.md

fix(analytics): resolve account email/name in Utilization chart and fix tooltip stacking context (#13029)

2026-09-18 11:30:01 -03:00

vertex-docs-script-end-tag.md

fix(providers): strip Vertex doc script blocks whose end tag carries junk (#13936)

2026-09-16 23:57:14 -03:00

vertex-express-xai-models.md

fix(vertex): discover and route partner models correctly (#12471)

2026-09-16 16:37:41 -03:00

wal-truncate-sigbus.md

fix(db): never TRUNCATE-checkpoint a live WAL (SIGBUS under traffic) (#14005)

2026-09-18 10:21:03 -03:00