Files
OmniRoute/src/shared/providers/webSessionCredentials.ts
Diego Rodrigues de Sa e Souza de60b4b171 Release v3.8.23
* chore(release): open v3.8.23 development cycle

* fix(anthropic): strip top_p when temperature is set to avoid 400 (#3691)

Integrated into release/v3.8.23

* fix(vertex): support Vertex AI Express-mode API keys (#3690)

Integrated into release/v3.8.23

* fix(stream): error on empty Claude SSE instead of synthetic success (#3689)

Integrated into release/v3.8.23

* fix(oauth): stop token-refresh invalidation loop + harden proxy resolution (#3692)

Integrated into release/v3.8.23

* docs: add FUNDING.yml and Support section to README (#3698)

Integrated into release/v3.8.23

* feat: gemini - handle known ratelimits (#3686)

Integrated into release/v3.8.23

* fix: stream combo fails over on empty content-filtered response (#3685) (#3702)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(antigravity): preserve gemini-3.1-pro high/low budget tiers (#3696) (#3703)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(auto-combo): add auto-updating model intelligence scoring (#3660)

Integrated into release/v3.8.23

* fix(gemini): context-mode fallback for signatureless tool calls (#3688) (#3704)

* chore(quality-gate): reconcile file-size baseline (27 files + providerLimits.ts) (#3705)

* feat(vertex): dynamic model discovery via Generative Language models API (#3712)

Integrated into release/v3.8.23. Vertex dynamic model discovery — surfaces image models (imagen-*, gemini-*-image), embeddings and audio from the live Generative Language catalog, with cached→static fallback and the shared parseGeminiModelsList helper. Validated: parser test 5/5, typecheck:core clean.

* fix(combo): gate reasoning token buffer (#3700)

Integrated into release/v3.8.23. Makes the #3588 reasoning token buffer safe and configurable: only inflates max_tokens when the model has a known, non-default output cap and the buffered value fits inside it; otherwise preserves/clamps the client limit. Adds the reasoningTokenBufferEnabled kill switch (default ON). Validated: combo-routing-engine 81/81, combo-config 25/25, combo-quality-validator-reasoning 12/12, phase1f 10/10, typecheck:core clean.

* refactor(#3501): god-component Phase 1g-1j — client 4062→3408 LOC (-654) (#3717)

Phase 1g-1j of #3501: client 4062→3408 LOC. Pure extraction (ProviderPlaygroundPanel, useCommandCodeAuth, useExternalLinkFlow+ExternalLinkModal, useAuthFileHandlers) + loadConnProxies ReferenceError fix + phase1f test path fix.

Co-authored-by: oyi77 <14921983+oyi77@users.noreply.github.com>

* refactor(#3501): god-component Phase 1k-1m — client 3408→2553 LOC (-855) (#3721)

Phase 1k-1m of #3501: client 3408→2553 LOC. Pure extraction (useModelImportHandlers+ImportProgressModal, useModelVisibilityHandlers, ProviderModelsSection).

Co-authored-by: oyi77 <14921983+oyi77@users.noreply.github.com>

* docs(changelog): restore #3590 bullet lost on the v3.8.20 release branch

The fix itself reached main pre-tag via cherry-pick #3591, but its changelog
bullet (commit e33fdd4ab) only ever existed on release/v3.8.20 after the
squash-merge. Restored under [3.8.20] per the 2026-06-12 release-branch
leftover audit (_tasks/release-audit/release-leftovers-audit-2026-06-12.md).

* fix(kiro): resolve quota for IAM Identity Center accounts missing a profileArn (#3722)

Integrated into release/v3.8.23

* refactor(#3501): god-component Phase 1n-1s — client 2553→1376 LOC (-1177) (#3725)

Phase 1n-1s of #3501: client 2553→1376 LOC. Pure extraction (ConnectionsListPanel, ConnectionsHeaderToolbar, ZedImportCard, BatchTestResultsModal, AdaptaTutorialModal, useApiKeySave + helpers).

Co-authored-by: oyi77 <14921983+oyi77@users.noreply.github.com>

* feat(model-lockout): settings UI, backend integration, error classification, and success-decay recovery (#3629)

Integrated into release/v3.8.23

* refactor(#3501): god-component Phase 1t — client 1376→781 LOC (≤800 TARGET REACHED ) (#3727)

Phase 1t of #3501: client 1376→781 LOC (≤800 reached). Original god-component 12,882→781 (−94%).

Co-authored-by: oyi77 <14921983+oyi77@users.noreply.github.com>

* fix: bundle @omniroute/opencode-plugin inside omniroute + add 'setup opencode' CLI command (#3726)

Integrated into release/v3.8.23

* feat(vertex): self-tracked USD spend since account added (#3724)

Integrated into release/v3.8.23

* fix(qwen-web): migrate to v2 chat API with full cookie-jar replay (#3288) (#3723)

Integrated into release/v3.8.23

* fix(sse): make safeLogEvents async — 'await' in a sync function broke every chatHelpers import

#3692 added a lazy 'await import(proxyEgress)' for egress-IP visibility inside
safeLogEvents, which is a sync function — an ES syntax error. It went unnoticed
because typecheck:core does not cover src/sse and no test in the merge gates
loaded chatHelpers via tsx; any consumer that did (chat-context-relay and
chat-route-coverage suites, integration harnesses) failed at module load with
'await can only be used inside an async function'.

safeLogEvents is fire-and-forget logging with an outer try/catch, so making it
async (and 'void'-ing the single chat.ts call site) preserves behavior exactly.

Validation: tests/unit/chat-context-relay.test.ts + chat-route-coverage.test.ts
went from failing-at-load to green (+14 tests destravados).

* fix(sse): remove cross-provider credential leak in emergency fallback + combo/proxy audit fixes (#3699)

Integrated into release/v3.8.23

* fix(executors): inject MiMoCode anti-abuse marker so free endpoint stops 403ing (#3728)

Integrated into release/v3.8.23

* fix(dashboard): repair "Test all models" — toast crash, status icons, auto-hide (#3729)

Integrated into release/v3.8.23

* chore(deps): bump actions/upload-artifact from 4 to 7 (#3735)

Integrated into release/v3.8.23 — aligns upload-artifact to v7 (already used across ci.yml).

* chore(deps): bump actions/cache from 4 to 5 (#3734)

Integrated into release/v3.8.23 — actions/cache v4→v5.

* chore(deps): bump actions/download-artifact from 4 to 8 (#3733)

Integrated into release/v3.8.23 — download-artifact v4→v8.

* feat(fallback): add OMNIROUTE_EMERGENCY_FALLBACK env switch (#3741)

Adds an OMNIROUTE_EMERGENCY_FALLBACK env switch to disable the emergency budget-exhaustion fallback (reroute to free nvidia/gpt-oss-120b). Default unchanged (enabled). Closes #3739, related #2879.

Integrated into release/v3.8.23.

* i18n: comprehensive zh-CN translation improvements (#3736)

Aligns zh-CN to en (hundreds of entries), translates batch-action labels + settings sidebar menu, adds categoryConfig/endpointTokenSaver keys, resolves __MISSING__ stubs. Sidebar/SidebarTab hardcoded strings replaced with t(). en.json purely additive (8 new sidebar.* keys, 0 removed); cli-i18n gate green.

Integrated into release/v3.8.23.

* chore(release): v3.8.23 — 2026-06-12

- CHANGELOG: complete v3.8.23 section (28 bullets, 27 commits)
- fix(webdav): resolve promise on writeStream finish, not req end — eliminates
  intermittent 500 on PUT update (writeStream may not have flushed at rename time)
- test(autoCombo): stub DB calls from PR #3660 in tieredRotation.test.ts to prevent
  5s timeout in vitest (getModelIntelligenceBySource DB init path)
- chore(env-sync): add XDG_DATA_HOME + OMNIROUTE_OPENCODE_PLUGIN_DIR to IGNORE_FROM_CODE
  allowlist (introduced by PR #3726 setup-open-code.mjs, not OmniRoute config vars)
- chore(cli): regenerated bin/cli/api-commands/*.mjs (7 new, 27 updated)

* fix(model-family): fallback lookup also tries bare model name with dots

getNextFamilyFallback normalized dots-to-hyphens ("gemini-3.1-pro-high" →
"gemini-3-1-pro-high") but MODEL_FAMILIES keys use the literal dot form. The
lookup always missed, returning null for any model whose dots are part of the
name rather than a version separator.

Fallback: try MODEL_FAMILIES[lookupKey] ?? MODEL_FAMILIES[bareModel] so both
naming conventions are covered. Fixes T30 test (pre-existing since v3.8.22).

* feat: expose API key cost drilldown + quota % used (#3742)

Adds all-time USD cost per API key in the API Key Manager, a per-key deep-link into the Cost Explorer (filtered + grouped by model), URL-param hydration of range/groupBy/apiKeyIds, and a '% used' quota display. Review adjustments: extracted URL-param parsers to a tested module (Rule #18), i18n'd the new strings (en + zh-CN), dropped the redundant webdav-handler entry already on release.

Integrated into release/v3.8.23.

* feat: add provider display modes — All / Configured / Compact (#3743)

Replaces the Providers page configured-only toggle with All/Configured/Compact display modes (Compact = flat deduped grid, no-auth last). Persists the preference and migrates the legacy localStorage key. Rebased onto release/v3.8.23.

Integrated into release/v3.8.23.

* fix(cache): scope semantic-cache signature to API key (#3740)

Adds the api_key_id dimension to generateSignature's SHA-256 hash so two callers with different API keys never receive each other's cached responses. Threads apiKeyId through checkSemanticCache + both write sites; migration 098 clears pre-existing key-less entries; unauthenticated requests stay isolated from keyed ones. 3 TDD tests.

Integrated into release/v3.8.23.

* fix(responses): apply OpenAI Responses API stream=false spec default (#3708)

resolveStreamFlag now applies the stream=false-when-omitted default for sourceFormat=openai-responses (same as the existing claude path), so spec-compliant /v1/responses upstreams that return JSON no longer fall through to the wildcard-Accept heuristic and trigger STREAM_EARLY_EOF / 502. Codex CLI (stream:true) and explicit text/event-stream clients unaffected.

Integrated into release/v3.8.23.

* chore(release): reconcile CI gates for v3.8.23

- file-size baseline: re-freeze 8 files grown by PRs #3742/#3743/#3740
  (cost drilldown, provider display modes, cache key isolation)
- ARCHITECTURE.md: update executor count 55→60 (check:docs-counts drift)
- .env.example: add OMNIROUTE_EMERGENCY_FALLBACK (#3741, env-doc-sync)
- CHANGELOG: add formatted bullets for #3742, #3743, #3708, #3740,
  model-family-fallback fix; remove duplicate raw ### Fixed section

* test: restore assert count to satisfy check:test-masking gate

Three test files had net assertion removals after behavior-changing PRs:
- chatcore-translation-paths: emergency fallback moved to routing layer
  (#3699) — add body error assertion + model-name guard
- executor-vertex-extended: non-JSON is now Express API key (#3690) —
  add projects/-path guard to the express-key URL test
- stream-utils: empty streams now emit error (#3685) — add code/message/
  status/completePayload guards to both passthrough and translate variants

All new assertions are meaningful (code enum value, 5xx range, non-empty
message, onComplete must-not-fire contract).

* fix(ci): move rtl-logical-classes test to ui/ so vitest:ui runner collects it

---------

Co-authored-by: Felipe Almeman <4226997+zhiru@users.noreply.github.com>
Co-authored-by: NOXX - Commiter <artur1992123@mail.ru>
Co-authored-by: Nick Sullivan <142708+TechNickAI@users.noreply.github.com>
Co-authored-by: Markus Hartung <mail@hartmark.se>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: PizzaV <103120356+pizzav-xyz@users.noreply.github.com>
Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: oyi77 <14921983+oyi77@users.noreply.github.com>
Co-authored-by: Chewji <126886556+Chewji9875@users.noreply.github.com>
Co-authored-by: Hernan Javier Ardila Sanchez <hjasgr@gmail.com>
Co-authored-by: Felipe Sartori <felipesartori.ti@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Zois Pagoulatos <zpagoulatos@hotmail.com>
Co-authored-by: sdfsdfw2 <167810361+sdfsdfw2@users.noreply.github.com>
Co-authored-by: Witroch4 <witalo_rocha@hotmail.com>
2026-06-12 23:49:22 -03:00

242 lines
8.0 KiB
TypeScript

import { WEB_COOKIE_PROVIDERS } from "@/shared/constants/providers";
export type WebSessionCredentialRequirement =
| {
kind: "cookie" | "token";
credentialName: string;
placeholder: string;
acceptsFullCookieHeader: boolean;
storageKeys: readonly string[];
}
| {
kind: "none";
credentialName: "";
placeholder: "";
acceptsFullCookieHeader: false;
storageKeys: readonly [];
};
export const WEB_SESSION_CREDENTIAL_REQUIREMENTS = {
"chatgpt-web": {
kind: "cookie",
credentialName: "__Secure-next-auth.session-token",
placeholder: "__Secure-next-auth.session-token=...",
acceptsFullCookieHeader: true,
storageKeys: ["cookie", "sessionToken", "session-token", "__Secure-next-auth.session-token"],
},
"grok-web": {
kind: "cookie",
credentialName: "sso + sso-rw",
placeholder: "sso=...; sso-rw=...",
acceptsFullCookieHeader: true,
storageKeys: ["cookie", "sso", "sso-rw"],
},
"gemini-web": {
kind: "cookie",
credentialName: "__Secure-1PSID (optional: __Secure-1PSIDTS)",
placeholder: "__Secure-1PSID=...; __Secure-1PSIDTS=...",
acceptsFullCookieHeader: true,
storageKeys: ["cookie", "__Secure-1PSID", "__Secure-1PSIDTS"],
},
"gemini-business": {
kind: "cookie",
credentialName: "__Secure-1PSID (optional: __Secure-1PSIDTS)",
placeholder: "__Secure-1PSID=...; __Secure-1PSIDTS=... (from business.gemini.google)",
acceptsFullCookieHeader: true,
storageKeys: ["cookie", "__Secure-1PSID", "__Secure-1PSIDTS"],
},
"perplexity-web": {
kind: "cookie",
credentialName: "__Secure-next-auth.session-token",
placeholder: "__Secure-next-auth.session-token=...",
acceptsFullCookieHeader: true,
storageKeys: ["cookie", "sessionToken", "session-token", "__Secure-next-auth.session-token"],
},
"blackbox-web": {
kind: "cookie",
credentialName: "__Secure-authjs.session-token",
placeholder: "__Secure-authjs.session-token=...; other=value",
acceptsFullCookieHeader: true,
storageKeys: ["cookie", "sessionToken", "__Secure-authjs.session-token"],
},
"muse-spark-web": {
kind: "cookie",
credentialName: "abra_sess",
placeholder: "abra_sess=...; other=value",
acceptsFullCookieHeader: true,
storageKeys: ["cookie", "abra_sess"],
},
"claude-web": {
kind: "cookie",
credentialName: "sessionKey",
placeholder: "sessionKey=... or full Cookie header from claude.ai",
acceptsFullCookieHeader: true,
storageKeys: ["cookie", "sessionKey"],
},
"deepseek-web": {
kind: "token",
credentialName: "userToken",
placeholder: "userToken=... or paste raw userToken",
acceptsFullCookieHeader: false,
storageKeys: ["token", "userToken"],
},
"copilot-web": {
kind: "token",
credentialName: "access_token",
placeholder: "access_token=... or a DevTools HAR export",
acceptsFullCookieHeader: false,
storageKeys: ["token", "access_token", "accessToken"],
},
"t3-web": {
kind: "cookie",
credentialName: "convex-session-id + Cookie header",
placeholder: "convex-session-id=abc123...; Cookie: ...",
acceptsFullCookieHeader: true,
storageKeys: ["cookie", "convex-session-id", "convexSessionId"],
},
"adapta-web": {
kind: "cookie",
credentialName: "__client",
placeholder: "__client=... or full Cookie header from agent.adapta.one",
acceptsFullCookieHeader: true,
storageKeys: ["cookie", "__client"],
},
"inner-ai": {
kind: "cookie",
credentialName: "token + email",
placeholder: "token_value user@example.com",
acceptsFullCookieHeader: false,
storageKeys: ["token", "cookie", "email"],
},
huggingchat: {
kind: "cookie",
credentialName: "hf-chat",
placeholder: "hf-chat=... or full Cookie header from huggingface.co",
acceptsFullCookieHeader: true,
storageKeys: ["cookie", "hf-chat"],
},
phind: {
kind: "cookie",
credentialName: "phind_session",
placeholder: "phind_session=... or full Cookie header from phind.com",
acceptsFullCookieHeader: true,
storageKeys: ["cookie", "phind_session"],
},
"poe-web": {
kind: "cookie",
credentialName: "p-b",
placeholder: "p-b=... or full Cookie header from poe.com",
acceptsFullCookieHeader: true,
storageKeys: ["cookie", "p-b"],
},
"venice-web": {
kind: "cookie",
credentialName: "session",
placeholder: "session=... or full Cookie header from venice.ai",
acceptsFullCookieHeader: true,
storageKeys: ["cookie", "session"],
},
"v0-vercel-web": {
kind: "cookie",
credentialName: "__vercel_session",
placeholder: "__vercel_session=... or full Cookie header from v0.dev",
acceptsFullCookieHeader: true,
storageKeys: ["cookie", "__vercel_session"],
},
"kimi-web": {
kind: "cookie",
credentialName: "session",
placeholder: "session=... or full Cookie header from kimi.moonshot.cn",
acceptsFullCookieHeader: true,
storageKeys: ["cookie", "session"],
},
"doubao-web": {
kind: "cookie",
credentialName: "session",
placeholder: "session=... or full Cookie header from doubao.com",
acceptsFullCookieHeader: true,
storageKeys: ["cookie", "session"],
},
"qwen-web": {
kind: "cookie",
credentialName: "full Cookie header (must include cna, ssxmod_itna, token)",
placeholder: "cna=...; token=...; ssxmod_itna=...; ssxmod_itna2=... (full Cookie header from chat.qwen.ai)",
acceptsFullCookieHeader: true,
storageKeys: ["cookie", "token", "ssxmod_itna", "ssxmod_itna2", "cna", "tongyi_sso_ticket"],
},
"duckduckgo-web": {
kind: "cookie",
credentialName: "duckai",
placeholder: "duckai=... or full Cookie header from duckduckgo.com",
acceptsFullCookieHeader: true,
storageKeys: ["cookie", "duckai"],
},
"t3-chat-web": {
kind: "token",
credentialName: "token",
placeholder: "Paste your T3 Chat token from t3.chat (Local Storage → token)",
acceptsFullCookieHeader: false,
storageKeys: ["token"],
},
"chatglm-web": {
kind: "cookie",
credentialName: "chatglm_session",
placeholder: "chatglm_session=... or full Cookie header from chatglm.cn",
acceptsFullCookieHeader: true,
storageKeys: ["cookie", "chatglm_session"],
},
"xiaomimimo-web": {
kind: "cookie",
credentialName: "session",
placeholder: "session=... or full Cookie header from aistudio.xiaomimimo.com",
acceptsFullCookieHeader: true,
storageKeys: ["cookie", "session"],
},
"manus-web": {
kind: "cookie",
credentialName: "manus_session",
placeholder: "manus_session=... or full Cookie header from manus.im",
acceptsFullCookieHeader: true,
storageKeys: ["cookie", "manus_session"],
},
lmarena: {
kind: "cookie",
credentialName: "session",
placeholder: "session=... or full Cookie header from lmarena.ai",
acceptsFullCookieHeader: true,
storageKeys: ["cookie", "session"],
},
} satisfies Record<keyof typeof WEB_COOKIE_PROVIDERS, WebSessionCredentialRequirement>;
export function getWebSessionCredentialRequirement(
providerId: unknown
): WebSessionCredentialRequirement | null {
if (typeof providerId !== "string") return null;
return (
WEB_SESSION_CREDENTIAL_REQUIREMENTS[
providerId as keyof typeof WEB_SESSION_CREDENTIAL_REQUIREMENTS
] ?? null
);
}
export function requiresWebSessionCredential(providerId: unknown): boolean {
const requirement = getWebSessionCredentialRequirement(providerId);
return !!requirement && requirement.kind !== "none";
}
function hasNonEmptyString(value: unknown): value is string {
return typeof value === "string" && value.trim().length > 0;
}
export function hasUsableWebSessionCredential(
providerId: unknown,
providerSpecificData: unknown
): boolean {
const requirement = getWebSessionCredentialRequirement(providerId);
if (!requirement || requirement.kind === "none") return false;
if (!providerSpecificData || typeof providerSpecificData !== "object") return false;
const data = providerSpecificData as Record<string, unknown>;
return requirement.storageKeys.some((key) => hasNonEmptyString(data[key]));
}