mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-02 21:32:10 +03:00
c8a9bad000
* fix(combo): fall back on Responses SSE failures * fix(combo): cancel rejected upstream streams * chore(release): script the 0a.0b PR re-home with a verified read-back (#7312) The parallel-cycle model hands the frozen release/vX to the captain and cuts release/vX+1 for everyone else. Phase 0a.0b step 3 then re-homes every open PR onto the new cycle — today as a hand-run loop of gh pr edit --base. Three things make that loop unreliable at exactly the moment it matters: 1. gh pr edit --base FAILS SILENTLY (v3.8.42). It exits 0 and leaves the base untouched, so every edit needs a gh pr view --json baseRefName read-back. A human mid-release skips that. 2. gh pr list caps at 30 results by default. A loop written without --limit re-homes the first 30 of 148 and reports success. 3. Volume: the v3.8.49 freeze had 148 open PRs — roughly 450 API calls across edit, verify and comment. The script does the read-back on every PR, uses --limit 300, is idempotent (a PR already on the next base is skipped, so a resumed release re-runs safely), refuses to start when the next branch does not exist yet, and exits non-zero listing any PR whose retarget did not take. It also prints the reminder that it cannot solve the other half: PRs opened AFTER it runs. Those need the repo default_branch pointed at the live cycle — contributors open PRs against the default branch, and while that stays on main they never target a release branch at all (6 such PRs on 2026-07-15). classify() is pure and unit-tested: retarget open and draft PRs on the frozen branch; never touch main (the release PR's own lane), an older shipped release, or a PR already re-homed. Refs #7307 * fix(build): packed tarball boot crash — server-ws timeout import escaped the package (#7065 class) (#7308) * fix(build): server-ws timeout helper as shipped sibling — ../../src import crashed every packed boot (#7065 class) * test(build): align pack-artifact-policy fixture with the new dist/main-server-timeouts.mjs required path * fix(skills): register cli-skill-collector in the agent-skills catalog (Integration 2/2 base-red) (#7310) * fix(skills): register cli-skill-collector in the agent-skills catalog (#6294 shipped the dir only) * chore(skills): regenerate cli-skill-collector SKILL.md via the generator, preserving the #6294 authored workflow in the custom block * fix(skills): derive coverage totals from the id lists + align remaining count assertions (45 catalog / 21 cli) * fix(skills): SkillCoverage totals are number, not stale literals * chore(ci): make the Electron Windows leg advisory with bash stderr capture (first-run failure diagnosis) (#7340) * fix(ci): Coverage job timeout 10->20min (lcov reporter pushed it past the old cap) (#7342) * test(ci): make #6634 selfref guard hermetic — read file from disk, no git ref (#7327) check-test-masking-selfref-6634.test.ts did git I/O inside a unit test (`git show origin/main:<file>`), the single most common red across today's babysit sweep — GitHub-hosted runners use shallow/single-ref checkouts with no origin/main, so the show fails with "fatal: invalid object name". The prior hotfix (2e42b8efc, #7174) wrapped it in try/catch + on-demand fetch + t.skip() on failure, but t.skip() itself trips the PR Test Policy weakened-assert gate (confirmed today on #7300), and origin/main was the wrong ref anyway — PRs target release/v3.8.49, not main. Ported the hermetic version proven on PR #7300 (@growab): read the real current source of check-test-masking.test.ts from disk instead of diffing against a git ref, and use an empty-string base (baseTaut/baseExtTaut = 0) instead of the pre-#6404 git snapshot — this maximizes headTaut - baseTaut, the strictest input for the exclusion under test, so the guard is exercised at least as hard as before. No git ref, no skip, no CI-shape dependency. Verified both directions locally: - SELF_TEST_FIXTURE_RE neutralized in check-test-masking.mjs -> test FAILS (10 new bare tautologies + 28 new extended tautologies reported) - restored -> test PASSES, and the full check-test-masking.test.ts suite (55 tests) stays green, confirming the #6634 self-referential-fixture regression this guard exists for is still covered. Co-authored-by: growab <nekron@icloud.com> * chore(quality): tighten the coverage ratchet to the CI's real numbers (#7326) The Quality Ratchet has been red on main, and not for a regression — the report says 'OK (57 métricas, 11 melhoraram)'. It fails the --require-tighten step: ✗ coverage.branches: melhorou de 73 para 78.1 (delta 5.1000 > slack 5) — rode 'npm run quality:ratchet -- --update' e commite o baseline apertado The gate was asking for this in plain text. The baseline's own note names the same trigger: 'Apertar via quality:ratchet -- --update a partir do 1o run de coverage mergeada do CI que popule essas chaves.' Values are the CI's, not a local run. The baseline warns that a local test:coverage measures ~68% against the CI's ~76.5% — tightening to local numbers would write the wrong floor. So this reproduces the CI's exact inputs: eslint-results + coverage-report artifacts downloaded from the merged-coverage run on main (29387411665), re-rooted from the runner's paths to the local cwd so extractModuleCoverage can match CRITICAL_MODULE_PATHS, then quality:collect + quality:ratchet --update. Collected output matches the CI's report line for line (branches 78.1, statements/lines 80.8, functions 86.44, chatCore 72.98, combo 85.42, accountFallback 96.78, auth 92.55). Verified: no baseline key added or removed (56 before, 56 after) — only the 12 coverage values moved. The 57-vs-56 metric count between the CI's run and a local one is --allow-missing skipping the metrics only CI collects (mutation scores, CodeQL, bundle size). Worth recording why the improvement appeared now: it is real, but it surfaced because Coverage had been SKIPPED whenever unit shards went red — so the ratchet was passing trivially over ABSENT data. Fixing the shards on #7300 made coverage run and the ratchet finally had something to compare. * fix(stream): reconcile encrypted Codex reasoning visibility without mutating upstream item (#7304) * fix(stream): reconcile encrypted Codex reasoning visibility without mutating upstream item Resolves the collision between two open PRs on ensureVisibleResponsesReasoningSummary: #7095 (xz-dev) found that chat clients see nothing when Codex exposes reasoning only as encrypted_content, and added a visible placeholder — but did so by mutating item.summary in place. #7176 (JxnLexn) found that same mutation corrupts the forwarded response item, discarding the encrypted_content shape Codex needs for follow-up requests, and removed the mutation — but that also silently dropped the placeholder, so chat clients went back to seeing nothing. The mutation existed only so a later line could read the summary text back off the same item. getVisibleResponsesReasoningSummaryText() computes that text without touching the item, so: - synthetic response.reasoning_summary_text.delta / .part.done events still carry the placeholder for chat clients (#7095's goal), and - the forwarded response.output_item.done payload keeps its original encrypted_content intact with no fabricated summary field (#7176's goal). Applied at both call sites #7095 identified: the native Responses passthrough in stream.ts/passthroughTailProcessor.ts, and the Responses-to-Chat-Completions translator in openai-responses.ts. Closes #7095, closes #7176. Co-authored-by: Xiangzhe <xiangzhedev@gmail.com> Co-authored-by: Jan Leon <Jan.gaschler@gmail.com> * test(stream): guard the encrypted-reasoning mutation via the completed backfill path The output_item.done line is echoed verbatim on the wire, so a re-introduced item.summary mutation does NOT surface in that event — verified by re-injecting the mutation, which left the existing assertion green. The mutation does surface in the response.completed snapshot, where the captured reasoning item is re-serialized when upstream sends an empty output (store: false). Adds that case, which fails as expected when the mutation is re-introduced, making the #7176 half of the reconciliation an enforced regression guard rather than an incidental property of the current code path. Co-authored-by: Xiangzhe <xiangzhedev@gmail.com> Co-authored-by: Jan Leon <Jan.gaschler@gmail.com> --------- Co-authored-by: Xiangzhe <xiangzhedev@gmail.com> Co-authored-by: Jan Leon <Jan.gaschler@gmail.com> * chore(ci): stop dependabot proposing typescript majors — peer-blocked by typescript-eslint (#7306) typescript-eslint pins a hard upper bound on its typescript peer (8.64.0 → ">=4.8.4 <6.1.0"). A major TS bump violates it, so the failure is not one check — it is the whole toolchain at once. #7068 is the demonstration: dependabot grouped typescript ^6→^7 with six harmless dev bumps (@types/node, eslint, fast-check, knip, prettier, typescript-eslint) and turned Build, Lint, Quality Ratchet, Unit (6/8, 8/8), Integration (1/2, 2/2) and dast-smoke red in a single PR. The six innocuous updates were blocked by the one that could never pass. Ignoring the major lets the rest of the group flow on its own. TS majors are a toolchain migration and deserve their own PR and their own CI run — not a weekly automated attempt that cannot succeed until typescript-eslint widens the peer. Refs #7068 * test(dashboard): dedicated regression guard for #6815 density guarantee (#7291) * test(dashboard): dedicated regression guard for #6815 density guarantee Coverage for the #6815 multi-column density guarantee was only ever asserted incidentally, by two other guards (#7072, #3520) that pinned the literal sm:grid-cols-2 token. That coupling evaporated the coverage when PR #7027 migrated the component to a container-driven auto-fit template and the literal token was removed from both files. Adds a dedicated guard that simulates, from the shipped className, how many columns the per-group card grid renders at a wide container width -- supporting both the breakpoint-ladder and auto-fit mechanisms this component has shipped with -- and asserts >1 column, without asserting any specific Tailwind token. * chore(changelog): fragment for #7291 density guard * test(ci): mock route bridge surfaces error message, not raw stack (#7354) The E2E mock HTTP server's 500 catch sent error.stack straight to the response body, which CodeQL flags as js/stack-trace-exposure (medium). It's test-only localhost code, but the repo-wide CodeQL ratchet counts open alerts across all branches — so this one alert (baseline 0 → 1) turned the Quality Ratchet red on EVERY open PR into both main and release, masking whatever each PR actually changed. Surface error.message instead: clears the alert, keeps a useful signal for a failing mock route, and doesn't log to stderr (node:test native runner corrupts its report stream on console output). The test only asserts status 200, so the 500 body is not checked. Introduced by the #7304 integration test added this cycle. * ci(release-green): add a main-green arm to detect when main goes red (#7355) The release-green workflow already reproduces the release-equivalent gate on release/** and opens a tracking issue on HARD failures — but main had no such watch. Under the parallel-cycle model main only receives merged work at the release squash, so a gate/infra fix that landed only on the release branch leaves main red the whole cycle, and repo-wide gates (CodeQL alert count, ratchet baselines) turn EVERY PR into main red on a check unrelated to its diff. v3.8.49 hit this 3× in one night. Adds a dedicated main-green job (push to main + the same 3 crons + dispatch) that checks out main literally (no resolver, no injection surface), runs the same validate-release-green.mjs, and opens/updates a '🔴 main branch not green' issue pointing at the companion-PR fix. Gates the existing release-green job with an if: so a push to main doesn't re-validate release and vice-versa; schedule/dispatch sweep both. Detection backstop for the prevention rule in _shared/merge-gates.md §8. * fix(sse): sanitize non-ok Antigravity streaming error body (port from 9router#2461) (#7106) Root cause: the STREAMING branch of AntigravityExecutor.executeOnce() had no !response.ok check at all — it unconditionally wrapped the upstream response body in a pass-through TransformStream, unlike the sibling non-streaming branch which already built a sanitized error via buildAntigravityUpstreamError. When Google's 403 error body was binary/non-UTF8 (observed: gzip-magic-byte payloads), those raw bytes were forwarded verbatim, corrupting the client-visible error message ('[ERROR] [403]: <control-byte garbage>'). Fix: add the same !response.ok guard to the streaming branch, routing through buildAntigravityUpstreamError()/buildErrorBody() (hard rule #12) instead of piping unknown bytes through as if they were an SSE stream. Reported-by: Duongkhanhtool (https://github.com/decolua/9router/issues/2461) * fix(6954,6953): preserve system role + strip empty-signature thinking blocks (#6982) * fix(6954,6953): preserve system role + strip empty-signature thinking blocks #6954 — System turns misattributed as assistant (claude-to-openai.ts:352) The ternary `msg.role === 'user' || msg.role === 'tool' ? 'user' : 'assistant'` mapped any non-user/non-tool role (including 'system') to 'assistant'. Mid-conversation system turns (Claude format) lost their role on translation to OpenAI format, causing them to be treated as assistant output. Fix: add explicit 'system' branch to the ternary. #6953 — Empty-signature thinking blocks poison Anthropic leg (openai-to-claude.ts) Non-Anthropic providers (codex/gpt-5.x) synthesize thinking blocks with signature:''\. On replay, the old code fabricated a DEFAULT_THINKING_CLAUDE_SIGNATURE to fill the empty signature — but Anthropic rejects foreign signatures with HTTP 400, permanently degrading combo/blend routes to codex-only. Fix: strip thinking blocks with empty/missing signatures and redacted_thinking blocks with empty/missing data entirely. They carry no replayable value. Tests: 8 new tests (4 per bug), all passing. Existing #5312 and #5945 regression tests still pass — no interference. * fix(6953): strip only signature:"" thinking blocks, preserve undefined signature CI caught a regression: translator-helper-branches test had a Claude-format thinking block without signature field (undefined) that was being stripped by the original fix. The fix was too aggressive — it stripped both signature:"" (non-Anthropic synthesized) and signature: undefined (legitimate Claude-format). Correct behavior: - signature === "" (empty string): strip — hallmark of codex/gpt-5.x block - signature === undefined: preserve with DEFAULT_THINKING_CLAUDE_SIGNATURE fallback - redacted_thinking data === "": strip - redacted_thinking data === undefined: preserve with fallback Added regression test for undefined-signature preservation. --------- Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> * fix(6980): classify Cloudflare AI neuron exhaustion as quota_exhausted (#6983) Cloudflare Workers AI free tier (10k Neurons/day, account-wide) returns 429 with body 'you have used up your daily free allocation of 10,000 neurons' which matched no QUOTA_PATTERNS keyword — falling through to rate_limit (~60s cooldown) instead of quota_exhausted. Two layers: 1. Provider-specific rule for 'cloudflare-ai' in providerRuleRegistry (scope: connection — budget is account-wide, not per-model) 2. Defense-in-depth: /daily free allocation/i in classify429 QUOTA_PATTERNS Tests: 11/11 pass (provider rule + classify429 paths covered). Closes #6980 Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> * fix(models): preserve chat-capable image model rows (#7004) Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> * fix(sse): register ollama-cloud in USAGE_FETCHER_PROVIDERS (#7026) (#7041) Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> * fix(quality): read cognitiveComplexity= machine line in validate-release-green (#7009) (#7042) Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> * fix(relay): bound Bifrost stream lifetime (#7093) Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> * fix(sse): recognize xiaomi-tokenplan mimo as a thinking-mode model (#7098) * fix(sse): recognize xiaomi-tokenplan mimo as a thinking-mode model (port from 9router#1321) The reasoning_content injector already handles DeepSeek/Kimi/K2/MiniMax thinking-mode upstreams, echoing a placeholder reasoning_content on assistant turns that lack one. Its THINKING_MODEL_PATTERNS list omitted the xiaomi-tokenplan mimo family, so requests through xiaomi-tokenplan/mimo-v2.5-pro still hit upstream's 400 'reasoning_content in the thinking mode must be passed back to the API', making the model unusable in multi-turn conversations (e.g. Codex CLI). Add a /\bmimo\b/i pattern so mimo models get the same treatment. Reported-by: z.wl (@xxue-z) (https://github.com/decolua/9router/issues/1321) * docs(changelog): add fragment for #7098 mimo thinking-model fix * fix(codex): strip regex lookaround from tool schema patterns (#7100) * fix(codex): strip regex lookaround from tool schema patterns (port from 9router#1556) Codex/OpenAI's Responses API rejects JSON Schema pattern fields using regex lookaround (e.g. ^(?=.*@).+$) with a 400 'regex lookaround is not supported' error. The existing numeric-field sanitizer (coerceSchemaNumericFields) was only wired into the translated-request path (openai-to-claude.ts), not the native codex/openai passthrough path (normalizeCodexTools in open-sse/executors/codex/tools.ts), so lookahead/lookbehind patterns reached upstream unmodified and broke tool calls for clients that emit them (e.g. IDE agent harnesses validating an email field). Reported-by: evin (@evinjohnn) (https://github.com/decolua/9router/issues/1556) * chore(changelog): move #1556 entry to changelog.d fragment Consistency with the repo's canonical changelog.d/fixes/ workflow (avoids merge-storm re-conflicts from editing CHANGELOG.md directly). * refactor(codex): table-drive the regex-strip recursion to keep the complexity ratchet at baseline The #1556 lookaround strip walked every sub-schema field with its own copy-pasted if-block (properties / patternProperties / definitions / $defs, then prefixItems / anyOf / oneOf / allOf), pushing stripUnsupportedRegexPatterns past the cyclomatic threshold and check:complexity to 2057 > baseline 2056. Collapse the eight near-identical blocks into two loops over the field-name constants, with the object-map recursion factored into a helper. Same fields, same traversal order, same behavior — complexity is back at baseline 2056 and the #1556 regression tests still pass. * fix(compression): Headroom SmartCrusher skips developer-role messages (port from 9router#2132) (#7102) Root cause: SmartCrusher's system-message guard only excluded role === "system", but Codex CLI (open-sse/executors/codex.ts) sends its instructions/tool-schema turn with role "developer" (the Responses-API equivalent of system used by newer models). Every other system-exclusion guard in this codebase also covers developer (roleNormalizer.ts, contextManager.ts, claudeUpstreamMessages.ts, etc.) except this one, so Headroom happily tabular-compacted JSON arrays embedded in the developer turn (e.g. an update_plan tool schema example), corrupting the instructions the model needs to call the plan tool and breaking Codex CLI plan mode. Fix: extend the guard in crushMessages()/collectCompactableArrays() (smartcrusher.ts) to skip role === "developer" alongside role === "system". Reported-by: SingCJ (https://github.com/decolua/9router/issues/2132) * fix(providers): surface a warning on 404 model_not_found in OpenAI-compatible Check (port from 9router#2032) (#7103) Root cause: validateOpenAICompatibleProvider's chat-completions probe fallback treated ANY 4xx other than 401/403/429/400 as a silent 'credentials valid' pass with no warning, so a bogus/non-standard model id (e.g. Featherless/OpenRouter vendor/model typos) went undetected at Check time. The first real request then hit the upstream 404 model_not_found and the per-model lockout, holding the model unavailable for the configured reset window with no prior indication anything was wrong. User-visible effect: 'Check' now returns valid:true with an explicit warning (including the upstream error message when parseable) whenever the chat probe answers 404, so a bad model id is caught before it reaches production traffic and the lockout. Reported-by: advane204f (https://github.com/decolua/9router/issues/2032) * fix(executors): forward X-Session-ID/X-Title agent metadata headers (#7104) * fix(executors): forward X-Session-ID/X-Title agent metadata headers (port from 9router#2413) Custom agent clients (e.g. non-OpenCode providers) commonly send X-Session-ID and X-Title headers for upstream request tracking/attribution, but forwardOpencodeClientHeaders() only forwarded x-opencode-* keys plus User-Agent, silently dropping these for every client. Extends the existing case-insensitive allowlist forwarding path with x-session-id/x-title. Reported-by: Atikur Rahman Chitholian (@chitholian) (https://github.com/decolua/9router/issues/2413) * chore(changelog): move #2413 entry to changelog.d fragment Consistency with the repo's canonical changelog.d/fixes/ workflow (avoids merge-storm re-conflicts from editing CHANGELOG.md directly). * fix(cli): verify better-sqlite3 native binary is actually loadable (#7105) * fix(cli): verify better-sqlite3 native binary is actually loadable (port from 9router#2493) isBetterSqliteBinaryValid() only checked the .node file's magic bytes (ELF/Mach-O/PE header), never whether the binary was built for the ABI (NODE_MODULE_VERSION) of the Node runtime that loads it. A stale or foreign-ABI binary passed the check and then segfaulted the process on the first database call instead of triggering a rebuild via npmInstallRuntime(). The fix adds a real load probe (require() in a throwaway subprocess) after the magic-byte check, so an incompatible binary is now correctly reported as invalid and the runtime self-heal reinstalls it. Reported-by: Manikandan (@mrprohack) (https://github.com/decolua/9router/issues/2493) * chore(changelog): move #2493 entry to changelog.d fragment Consistency with the repo's canonical changelog.d/fixes/ workflow (avoids merge-storm re-conflicts from editing CHANGELOG.md directly). * fix(sse): handle space-separated arg name/value in Composer tool calls (port from 9router#1811) (#7116) parseInnerCall only split arg segments on a newline between the arg name and its value. Cursor's live Composer/Auto output has been observed using a single space instead, so those segments were treated as one long (space-containing) arg name with an empty value, silently no-opping Write/tool calls for Composer/Auto models. Fall back to splitting on the first whitespace boundary when no newline is present in the segment. Reported-by: way-art (https://github.com/decolua/9router/issues/1811) * fix(cli): remove MITM DNS spoof entries before killing server process (#7117) * fix(cli): remove MITM DNS spoof entries before killing server process (port from 9router#1809) stopMitm() killed the spawned MITM server process first and only removed the /etc/hosts DNS-spoof entries afterward. During that window any client whose DNS still resolved a target host to 127.0.0.1 but whose MITM listener was already dead got connect ECONNREFUSED 127.0.0.1:443 — exactly the community-confirmed workaround (stop DNS before stopping the server) proves. Swap the two steps so DNS is always cleared first, mirroring the ordering already used by repairMitm() and handleExitCleanup(). Reported-by: dionisius95 (https://github.com/decolua/9router/issues/1809) * refactor(mitm): extract repair planning out of manager to respect the file-size cap The #1809 DNS-before-kill ordering fix pushed src/mitm/manager.ts to 813 lines, over the 800-line cap check:file-size enforces for non-frozen files. Move the pure repair-planning pieces (collectManagedHosts, the RepairPlan shape and its filesystem/cert/DNS sweep) into a sibling src/mitm/repair.ts. The in-memory session bookkeeping repairMitm() owns — cached sudo password, orphaned flag, PID file — deliberately stays in manager.ts, so the seam is "plan the repair" vs "own the session". manager.ts is now 731 lines; behavior is unchanged. The DNS-first ordering fix and its regression guard (tests/unit/mitm-stop-dns-before-kill-1809.ts) are untouched and still pass. * fix(mitm): split stopMitm() DNS/kill steps to fix complexity ratchet regression stopMitm()'s new DNS-before-kill ordering (#1809) pushed its cyclomatic complexity to 18 (max 15), regressing the complexity ratchet from 2056 to 2057. Extract the DNS-removal step and the process-kill step (in-memory + PID-file fallback) into two private helpers, mirroring the existing performRepairSteps() extraction pattern in repair.ts. Behavior unchanged; complexity back at 2056 (cognitive-complexity drops to 889, one under baseline). * fix(api): check Vercel SSO-protection PATCH response on relay deploy (#7119) * fix(api): check Vercel SSO-protection PATCH response on relay deploy (port from 9router#1037) The Vercel relay deploy route disabled Deployment Protection (SSO) by firing a PATCH request with .catch(() => {}) and never checking res.ok. When Vercel rejects or no-ops the PATCH (plan doesn't allow disabling protection, an under-scoped token, etc.), the relay was still saved and activated as a healthy proxy pool, and later requests routed through it failed with an undiagnosed 403 Access denied from Vercel's own deployment protection — indistinguishable from an upstream-provider rejection (e.g. Codex/ChatGPT edge-IP blocking). Extract disableSsoProtection() to check the PATCH response and surface an ssoProtectionWarning in the deploy response when it fails, so the failure source can be diagnosed instead of silently masked. Reported-by: Rico Aditya (@ricatix) (https://github.com/decolua/9router/issues/1037) * refactor(api): extract vercel-deploy POST helpers to keep the cognitive-complexity ratchet at baseline The SSO-protection check added to POST pushed its cognitive complexity from 15 to 21, regressing the cognitive-complexity ratchet (891 > baseline 890). Extract two pure helpers with identical behavior: - buildDeployErrorResponse(): the sanitized non-ok Vercel deploy response - resolveSsoProtectionWarning(): the SSO PATCH check + warning string POST now reads as a flat sequence of guards. No behavior change. * fix(combos): reject oversized fusion panels before fan-out (port from 9router#1905) (#7120) A fusion combo fans every panel model out in parallel and buffers each model's full response text in memory simultaneously. With the runtime heap capped by Dockerfile's OMNIROUTE_MEMORY_MB (default 1024MB), a large panel (reported: ~73 models via an 'auto' combo with strategy: fusion) with sizable concurrent responses can exceed the heap ceiling and OOM-crash the whole container instead of failing one request. handleFusionChat now rejects panels above a configurable hard cap (FUSION_DEFAULTS.maxPanel = 40, overridable per-combo via fusionTuning.maxPanel) with a clean 400 before fan-out begins. Reported-by: Phong Vu (@fontvu) (https://github.com/decolua/9router/issues/1905) * fix(combo): detect empty content_block in streaming SSE peek (#7121) * fix(combo): detect empty content_block in streaming SSE peek (port from 9router#1382) The bounded SSE peek in validateResponseQuality() treated ANY content_block_start/delta/stop event as proof of real output and stopped buffering immediately, without checking whether the block actually carried text/tool_use content. Some upstreams (reported: DeepSeek, GLM via claude→openai translation) can open and close a text content_block with empty text and no tool_use on tool-heavy requests — the gateway logged success and forwarded a client-visible empty completion, and combo routing never failed over to the next model. Track real content separately from 'a content_block_* event was seen': a tool_use/redacted_thinking block start is self-evidently real signal, a text/thinking block start is not (real content only confirmed via a subsequent delta carrying non-empty text/thinking, or an input_json_delta streaming tool arguments). A completed lifecycle (message_start + message_delta/stop) that never produced real content now fails validateResponseQuality(), matching the existing content_filter empty-stream detection path (#3685). Reported-by: heishen6 (https://github.com/decolua/9router/issues/1382) * refactor(combo): extract SSE lifecycle applier to keep the complexity ratchets at baseline The #1382 empty-content_block peek added a branchy switch inline in parseAccumulatedSse, pushing check:complexity to 2057 > baseline 2056. Move the switch to a module-level applySseLifecycleEvent() and hold the four lifecycle booleans in a single SseLifecycleFlags object threaded through it, so the closure no longer copies flags in and out per event. The per-event predicates (content_block_start / content_block_delta / message_delta) are split into small guard helpers, which keeps the applier flat — cognitive complexity punishes nesting, and an earlier switch-only extraction traded the cyclomatic ratchet for a cognitive regression at 891 > 890. Logic is unchanged; both ratchets are now green (complexity 2055, cognitive-complexity 890) and the #1382 regression tests still pass. * fix(auto): use p95 fallback in speed factors (#7128) Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> * Use OpenAI chunks for early chat keepalives (#7136) * Use OpenAI chunks for early chat keepalives * Update keepalive assertion to match chat completion chunk format --------- Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> * [needs-vps] fix(dashboard): add vision-capability toggle for custom OpenAI-compatible models (#7124) * fix(dashboard): add vision-capability toggle for custom OpenAI-compatible models (port from 9router#1904) detectVisionInput()/getCustomVisionCapabilityFields() already honoured an explicit supportsVision flag on a custom-model record, but there was no way to set it: the POST/PUT /api/provider-models Zod schema and updateCustomModel()/addCustomModel() silently dropped the field, and the 'Custom Models' add/edit UI had no checkbox at all. Self-hosted/local backends that don't self-report an image input modality (OpenRouter-style architecture.input_modalities) therefore had no way to be flagged vision-capable, so the vision tag never appeared and image inputs were rejected. Reported-by: nguyenphi37 (https://github.com/decolua/9router/issues/1904) * refactor(dashboard): extract providerCredentialText from providerPageHelpers to respect the file-size gate providerPageHelpers.ts is a frozen god-file (cap 1053, split(\n).length metric) and this PR's own +3 lines (the #1904 supportsVision field) pushed it to 1054, failing check:file-size. Extract the cohesive providerText utility + the 4 web-session-credential label/hint/title helpers into a new leaf module (providerCredentialText.ts), re-exported from providerPageHelpers.ts for backward compatibility so all existing import sites keep working unchanged. File now sits at 946 lines, well under the frozen cap. * refactor(db): extract tri-state override helper to keep the complexity ratchet at baseline The #1904 supportsVision override added a second copy of the "absent keeps / null clears / else coerce" block already used by preserveOpenAIDeveloperRole, pushing updateCustomModel to 84 lines and check:complexity to 2057 > 2056. The file-size failure was masking this one: the gate exits on its first red, so complexity never ran until providerPageHelpers was back under its cap. Fold both blocks into applyTriStateBooleanOverride(). Behavior is unchanged — updateCustomModel is back under max-lines-per-function and the global count returns to the 2056 baseline (cognitive-complexity stays at 890). * [needs-vps] fix(dashboard): align onboarding tier content (#7125) * fix(dashboard): align onboarding welcome feature cards vertically * fix(dashboard): align onboarding tier content * chore: scope onboarding PR to UI fix * i18n(pt-BR): add onboarding.tier.flowCaption + afterSetup keys The two new tier keys added to en.json were missing from pt-BR.json, tripping the i18n-pt-br no-drift test (#6695). Add their pt-BR translations. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> * fix(ci): fetch full base history in pr-test-policy (shallow graft broke merge-base) (#7501) With --depth=1 the base ref is grafted, so 'git diff base...HEAD' resolves a wrong merge-base for PR branches that recently merged the release branch. The three-dot diff then attributes ALREADY-MERGED sibling PRs' changes to the PR under test, producing false high-signal reds (deleted test files / weakened asserts that exist in no ref reachable from the PR). Observed live on #7329: the job blamed it for tests/unit/ui/provider-plan-config.test.tsx (deleted by an unrelated merged PR) and for #7106's antigravity files. Local reproduction with full history returns PASS for the same head. The job's checkout is already fetch-depth: 0, so the full base fetch only updates the ref — negligible cost. * [needs-vps] fix(electron): materialize Turbopack hashed-module symlinks during packaging (#6724, #6594) (#6794) * fix(electron): materialize Turbopack hashed-module symlinks during packaging Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); keeps only the author's changes. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(electron): actually enable materializeSymlinks on the electron standalone path The option existed in assembleStandalone but no production callsite passed it, so packaged builds still shipped absolute symlinks into the build machine's worktree for Turbopack hashed externals (better-sqlite3-<hash>, sqlite-vec-<hash>) — verified by dpkg -c on a freshly built .deb. One-line enablement on the electron prepare path, which is exactly the surface #6724/#6594 report. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: huohua-dev <258873123+huohua-dev@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(grok): strip reasoningEffort for grok cli models (#6938) Co-authored-by: minisforum <no@mail.com> Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> * chore(quality): rebaseline zizmor 169->175 (cycle workflow drift) +6 from v3.8.48/v3.8.49 workflow changes (npm-publish WS1.3 #7092, electron-release, nightly-compat, nightly-release-green, CI restructures incl. #7501). Breakdown vs v3.8.47: +3 unpinned-uses (@vN convention), +2 cache-poisoning (own release-workflow artifact upload/cache -- operator-controlled, not fork-PR exploitable), +1 excessive-permissions (nightly-compat issues perm). No new template-injection/artipacked/dangerous-triggers. Measured zizmor 1.25.2 = 175 onda3a0be69. Unblocks Quality Gates (Extended) for #7329. * fix(codex): Test probe uses a ChatGPT-account-supported model (#7521) (#7524) The connection Test button always reported success for a Codex connection backed by a ChatGPT account: the probe sent `gpt-5.3-codex`, a codex-only model the ChatGPT-account backend rejects outright with a 400 — the same status the probe treats as 'auth accepted, body invalid'. A bad token and a good token both came back 400, so Test could never fail on a bad token. Probe with `gpt-5.5` (confirmed served for ChatGPT-account sessions via live VPS test 2026-07-16) instead; `input: []` still yields the intended 400 for a good token, 401/403 for a bad one. Live verification (VPS): gpt-5.3-codex, gpt-5.6-sol and the gpt-5*-codex ids all return 'not supported when using Codex with a ChatGPT account'; gpt-5.5 and gpt-5.6-terra answer normally on the same account. Closes #7521 * fix(codex): validate refresh_token on import before persisting (#7522) (#7525) POST /api/oauth/codex/import accepted a payload with an already-invalidated refresh_token and persisted it as an 'active' connection that could never work — the failure surfaced confusingly only on first real use, long after the import looked successful. Validate each record's refresh_token against OpenAI's OAuth endpoint before persisting, reusing refreshCodexToken() (free exchange, no quota). On an unrecoverable refresh error the record is rejected with a clear re-auth message; a valid token imports as before, with any rotated tokens applied. Bulk import still processes each record independently — one dead token no longer blocks the valid ones. Reproduced live 2026-07-16: a 2026-07-10 auth.json imported clean but its refresh_token returned 401 refresh_token_invalidated. TDD: 3 tests RED against the old route, 5/5 GREEN with the fix. Closes #7522 * fix(codex): non-stream chat 502 'Response body is already used' (single-reader peek) (#7526) Every non-streaming Codex chat request for a ChatGPT-account connection failed instantly with [502]: Response body is already used (reset after 1m). The streaming/playground path was unaffected. Root cause: peekCodexSseTransientError (open-sse/executors/codex.ts) peeked the SSE prefix with response.body.getReader(), then called reader.releaseLock() and response.body.getReader() a SECOND time on the same already-disturbed body to build the replacement stream. Re-acquiring a reader on a disturbed body throws on undici ('Response body is already used'); chatCore's generic upstream-error handling then stamped the TypeError with a default 60s cooldown, masking a pure code defect as a rate limit (and tripping the codex circuit breaker). Fix: keep the single reader already held; never touch response.body again. TDD: a getReader spy that throws on the 2nd acquire reproduces the exact hazard — 1 test RED against the release code, 2/2 GREEN with the fix; the replacement body stays byte-identical to the upstream SSE. No regression across the codex unit suite. Reproduced live on the VPS 2026-07-16. * fix(oauth): surface tunnel hint when Codex OAuth runs on a remote host (#7523) (#7527) The PKCE callback server binds the SERVER's loopback (localhost:PORT). When the operator drives the OAuth flow from a different machine (OmniRoute on a remote host/VPS), the provider redirects the browser to the operator's OWN localhost:PORT — the confirmation screen hangs forever with no explanation. start-callback-server now inspects the request Host: on a non-loopback host it returns { remoteHost, tunnelCommand, message } so the UI can show the 'ssh -L PORT:127.0.0.1:PORT' instruction (or steer to the paste/import flow) instead of a silent hang. Loopback access is unaffected. The Host header is spoofable, so this drives only a UI hint — never an auth decision. Logic extracted to remoteOAuthHint.ts (keeps the god-route under its size budget and makes it unit-testable). TDD: 4 tests covering loopback (no hint), null host (fail-open), and remote host (correct tunnel command for both the fixed 1455 and OS-assigned ports). Closes #7523 * fix(compression): lazy-load typescript in RTK codeStripper so prod-lean deploys don't break (#7096) (#7164) Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> * fix(combo): fall back on Responses SSE failures * fix(combo): cancel rejected upstream streams --------- Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> Co-authored-by: growab <nekron@icloud.com> Co-authored-by: Xiangzhe <xiangzhedev@gmail.com> Co-authored-by: Jan Leon <Jan.gaschler@gmail.com> Co-authored-by: Rafael Dias Zendron <rafael.zendron22@gmail.com> Co-authored-by: Xiangzhe <32761048+xz-dev@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: Ronaldo Davi <ronaldodavi@gmail.com> Co-authored-by: KooshaPari <42529354+KooshaPari@users.noreply.github.com> Co-authored-by: Wibias <37517432+Wibias@users.noreply.github.com> Co-authored-by: huohua-dev <celentanohertor@gmail.com> Co-authored-by: huohua-dev <258873123+huohua-dev@users.noreply.github.com> Co-authored-by: CitrusIce <31264099+CitrusIce@users.noreply.github.com> Co-authored-by: minisforum <no@mail.com>