Base hygiene — gates de CI pré-existentes (glm typecheck, migrations count, merge-integrity, sanitizer de paths)

AGENTS.md

@@ -56,7 +56,7 @@ Repository map and Reference Documentation sections below.
 | Translators   | `open-sse/translator/`  | Format conversion (OpenAI↔Claude↔Gemini)                                                                                                                                  |
 | Transformer   | `open-sse/transformer/` | Responses API ↔ Chat Completions                                                                                                                                          |
 | Services      | `open-sse/services/`    | Combo routing, rate limits, caching, etc                                                                                                                                  |
-| Database      | `src/lib/db/`           | SQLite domain modules (169 migrations)                                                                                                                                    |
+| Database      | `src/lib/db/`           | SQLite domain modules (170 migrations)                                                                                                                                    |
 | Domain/Policy | `src/domain/`           | Policy engine, cost rules, fallback logic                                                                                                                                 |
 | MCP Server    | `open-sse/mcp-server/`  | 110 tools (45 canonical + memory/skill/GitHub/pool/gamification/plugin/Notion/Obsidian/local-corpus/RTK modules), 3 transports (stdio / SSE / Streamable HTTP), 33 scopes |
 | A2A Server    | `src/lib/a2a/`          | JSON-RPC 2.0 agent protocol                                                                                                                                               |

README.md

@@ -1244,7 +1244,7 @@ Métricas canônicas em 2026-08-24: **1.029 vídeos únicos** · **11.132.922 vi
   <tr><td nowrap><b>Runtime</b></td><td>Node.js 22.x / 24.x LTS — <code>&gt;=22.22.2 &lt;23 || &gt;=24.0.0 &lt;27</code></td></tr>
   <tr><td nowrap><b>Language</b></td><td>TypeScript 6.0 — <b>100% TypeScript</b> across <code>src/</code> and <code>open-sse/</code> (zero <code>any</code> in core since v2.0)</td></tr>
   <tr><td nowrap><b>Framework</b></td><td>Next.js 16 + React 19 + Tailwind CSS 4</td></tr>
-  <tr><td nowrap><b>Database</b></td><td>better-sqlite3 (SQLite, WAL journaling) + LowDB (JSON legacy) — 122 domain modules, 169 migrations</td></tr>
+  <tr><td nowrap><b>Database</b></td><td>better-sqlite3 (SQLite, WAL journaling) + LowDB (JSON legacy) — 122 domain modules, 170 migrations</td></tr>
   <tr><td nowrap><b>Memory</b></td><td>SQLite FTS5 full-text + int8-quantized vector embeddings, typed decay</td></tr>
   <tr><td nowrap><b>Schemas</b></td><td>Zod 4 — MCP tool I/O validation + API contracts</td></tr>
   <tr><td nowrap><b>Protocols</b></td><td>MCP (stdio / HTTP / SSE) + A2A v0.3 (JSON-RPC 2.0 + SSE)</td></tr>

changelog.d/fixes/reset-aware-model-family.md

@@ -1 +1 @@
-Keep Antigravity Gemini usable when the same connection's Claude weekly quota is empty; generic quota cache stays per-connection for every other provider.
+- Keep Antigravity Gemini usable when the same connection's Claude weekly quota is empty; generic quota cache stays per-connection for every other provider.

llm.txt

@@ -14,7 +14,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 169 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 170 migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -124,7 +124,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 169 versioned SQL migration files
+│   │   │   └── migrations/       # 170 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -389,7 +389,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 122 `src/lib/db/` modules with 169 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 122 `src/lib/db/` modules with 170 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -433,7 +433,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (122 domain-specific files, 169 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (122 domain-specific files, 170 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 

open-sse/executors/glm.ts

@@ -223,8 +223,9 @@ export function translateSseResponse(
   suppressThinkClose: boolean = false
 ): Response {
   if (!response.body) return response;
-  // GLM is a high-throughput provider — use a larger stream buffer (64KB) to
-  // keep provider → client pacing ahead of the model's token emission rate.
+  // GLM is a high-throughput provider. (A previous extra positional arg here — an intended 64KB
+  // buffer hint — was silently ignored: createSSETransformStreamWithLogger takes 15 params and
+  // never consumed it, so passing it only tripped TS2554. Removed; behavior is unchanged.)
   const transform = createSSETransformStreamWithLogger(
     FORMATS.CLAUDE,
     FORMATS.OPENAI,
@@ -240,8 +241,7 @@ export function translateSseResponse(
     false,
     suppressThinkClose,
     undefined,
-    undefined,
-    65536
+    undefined
   );
   const headers = cloneHeaders(response.headers);
   headers.set("content-type", "text/event-stream");

open-sse/utils/errorPathRedaction.ts

@@ -343,6 +343,17 @@ function findTokenEnd(value: string, start: number): number {
   return end;
 }
 
+// A resolved `.ext:line:col` (or `.ext:line`) endpoint is an unambiguous
+// terminal stack location: a filesystem path never legitimately continues past
+// the numeric coordinate suffix. Detect it by walking back over the trailing
+// `:<digits>` immediately preceding the resolved extension end.
+function extensionEndHasLineColumnSuffix(value: string, extensionEnd: number): boolean {
+  let index = extensionEnd;
+  if (index <= 0 || !isAsciiDigit(value.charCodeAt(index - 1))) return false;
+  while (index > 0 && isAsciiDigit(value.charCodeAt(index - 1))) index--;
+  return index > 0 && value.charCodeAt(index - 1) === 0x3a;
+}
+
 function findExtensionEndInToken(value: string, start: number, end: number): number {
   let lastExtensionEnd = -1;
   for (let index = start; index < end; index++) {
@@ -461,11 +472,17 @@ function findUnquotedPathEnd(
   let firstTrimmedTokenEnd = -1;
   let lastPathTokenEnd = -1;
   let resolvedExtensionEnd = -1;
+  let resolvedCoordinateEnd = -1;
   let hasFilesystemEvidence = false;
   let hasUnresolvedFragments = false;
 
   const resolveEndpoint = (): number => {
     if (hasUnresolvedFragments) {
+      // A coordinate-terminated stack location (`file.ts:42:9`) is a definite
+      // endpoint: prefer it over failing closed so trailing prose such as
+      // "Authorization: Bearer <secret>" is not swallowed into <path> and can
+      // still be redacted independently by the sensitive-text pass.
+      if (resolvedCoordinateEnd >= 0) return resolvedCoordinateEnd;
       return failClosedAmbiguity || hasFilesystemEvidence ? value.length : -1;
     }
     if (resolvedExtensionEnd >= 0) return resolvedExtensionEnd;
@@ -514,10 +531,16 @@ function findUnquotedPathEnd(
       if (extensionEnd < 0 && containsExtensionEvidence) {
         resolvedExtensionEnd = trimmedTokenEnd;
       }
+      if (extensionEnd >= 0 && extensionEndHasLineColumnSuffix(value, extensionEnd)) {
+        resolvedCoordinateEnd = extensionEnd;
+      }
     } else if (extensionEnd >= 0) {
       resolvedExtensionEnd = extensionEnd;
       hasFilesystemEvidence = true;
       hasUnresolvedFragments = false;
+      if (extensionEndHasLineColumnSuffix(value, extensionEnd)) {
+        resolvedCoordinateEnd = extensionEnd;
+      }
     } else if (containsExtensionEvidence) {
       resolvedExtensionEnd = trimmedTokenEnd;
       hasFilesystemEvidence = true;

skills/cli-tunnel/SKILL.md

@@ -37,12 +37,12 @@ omniroute tunnel
 omniroute tunnel list
 ```
 
-### `tunnel create [type]`
+### `tunnel create`
 
 **Example:**
 
 ```bash
-omniroute tunnel create [type]
+omniroute tunnel create
 ```
 
 ### `tunnel stop <type>`